{
"platform": "linux-auditd",
"note": "Seed knowledge base. Detection references are representative of publicly available Sigma logic (SigmaHQ) and should be validated against your deployed ruleset. Telemetry assumes a Linux host with auditd and/or an EDR emitting process/network/file syscall events.",
"entries": [
{
"id": "whoami",
"match": { "program": "whoami" },
"description": "System owner / current user discovery",
"techniques": [{ "id": "T1033", "name": "System Owner/User Discovery" }],
"telemetry": ["execve() of /usr/bin/whoami — auditd type=EXECVE/SYSCALL", "process creation event with parent shell"],
"detections": [{ "source": "Sigma", "rule": "Local system reconnaissance utility execution (proc_creation_lnx)", "confidence": "medium" }],
"noise": 45
},
{
"id": "id",
"match": { "program": "id" },
"description": "User and group identity discovery",
"techniques": [{ "id": "T1033", "name": "System Owner/User Discovery" }],
"telemetry": ["execve() of /usr/bin/id", "process creation event"],
"detections": [{ "source": "Sigma", "rule": "Local system reconnaissance utility execution (proc_creation_lnx)", "confidence": "medium" }],
"noise": 45
},
{
"id": "hostname",
"match": { "program": "hostname" },
"description": "Host name discovery",
"techniques": [{ "id": "T1082", "name": "System Information Discovery" }],
"telemetry": ["execve() of /usr/bin/hostname"],
"detections": [{ "source": "Sigma", "rule": "System information discovery utility (proc_creation_lnx)", "confidence": "low" }],
"noise": 30
},
{
"id": "uname",
"match": { "program": "uname" },
"description": "Kernel / OS version discovery",
"techniques": [{ "id": "T1082", "name": "System Information Discovery" }],
"telemetry": ["execve() of /usr/bin/uname"],
"detections": [{ "source": "Sigma", "rule": "System information discovery utility (proc_creation_lnx)", "confidence": "low" }],
"noise": 30
},
{
"id": "os-release",
"match": { "line": { "contains": "/etc/os-release" } },
"description": "OS distribution/version fingerprinting via release files",
"techniques": [{ "id": "T1082", "name": "System Information Discovery" }],
"telemetry": ["openat()/read() of /etc/os-release — auditd file watch (if configured)"],
"detections": [{ "source": "Sigma", "rule": "Read of OS release/version files (file_event_lnx)", "confidence": "low" }],
"noise": 30
},
{
"id": "passwd-read",
"match": { "program": "cat", "args": { "contains": "/etc/passwd" } },
"description": "Enumeration of local accounts via /etc/passwd",
"techniques": [
{ "id": "T1087.001", "name": "Account Discovery: Local Account" },
{ "id": "T1003.008", "name": "OS Credential Dumping: /etc/passwd and /etc/shadow" }
],
"telemetry": ["openat() of /etc/passwd — auditd file watch", "execve() of cat/less/head/grep against sensitive path"],
"detections": [{ "source": "Sigma", "rule": "Read of /etc/passwd by interactive utility (file_event_lnx / proc_creation_lnx)", "confidence": "medium" }],
"noise": 55
},
{
"id": "shadow-read",
"match": { "line": { "contains": "/etc/shadow" } },
"description": "Access to /etc/shadow — password hash exposure",
"techniques": [{ "id": "T1003.008", "name": "OS Credential Dumping: /etc/passwd and /etc/shadow" }],
"telemetry": ["openat() of /etc/shadow — high-signal auditd file watch", "read by process not running as auth stack"],
"detections": [{ "source": "Sigma", "rule": "Access to /etc/shadow outside auth context (file_event_lnx)", "confidence": "high" }],
"noise": 85
},
{
"id": "ps",
"match": { "program": "ps" },
"description": "Running process discovery",
"techniques": [{ "id": "T1057", "name": "Process Discovery" }],
"telemetry": ["execve() of /usr/bin/ps", "reads under /proc/*/stat,cmdline"],
"detections": [{ "source": "Sigma", "rule": "Process discovery utility execution (proc_creation_lnx)", "confidence": "low" }],
"noise": 35
},
{
"id": "netstat",
"match": { "program": "netstat" },
"description": "Network connection discovery",
"techniques": [{ "id": "T1049", "name": "System Network Connections Discovery" }],
"telemetry": ["execve() of netstat", "reads of /proc/net/*"],
"detections": [{ "source": "Sigma", "rule": "Network connection discovery utility (proc_creation_lnx)", "confidence": "low" }],
"noise": 40
},
{
"id": "ss",
"match": { "program": "ss" },
"description": "Socket / network connection discovery",
"techniques": [{ "id": "T1049", "name": "System Network Connections Discovery" }],
"telemetry": ["execve() of ss", "netlink socket enumeration"],
"detections": [{ "source": "Sigma", "rule": "Network connection discovery utility (proc_creation_lnx)", "confidence": "low" }],
"noise": 40
},
{
"id": "ip-addr",
"match": { "program": "ip", "args": { "contains": "addr" } },
"description": "Network interface configuration discovery",
"techniques": [{ "id": "T1016", "name": "System Network Configuration Discovery" }],
"telemetry": ["execve() of ip", "netlink RTM_GETADDR"],
"detections": [{ "source": "Sigma", "rule": "Network configuration discovery utility (proc_creation_lnx)", "confidence": "low" }],
"noise": 30
},
{
"id": "ifconfig",
"match": { "program": "ifconfig" },
"description": "Network interface configuration discovery",
"techniques": [{ "id": "T1016", "name": "System Network Configuration Discovery" }],
"telemetry": ["execve() of ifconfig"],
"detections": [{ "source": "Sigma", "rule": "Network configuration discovery utility (proc_creation_lnx)", "confidence": "low" }],
"noise": 30
},
{
"id": "arp",
"match": { "program": "arp" },
"description": "ARP cache enumeration — adjacent host discovery",
"techniques": [{ "id": "T1018", "name": "Remote System Discovery" }],
"telemetry": ["execve() of arp", "reads of /proc/net/arp"],
"detections": [{ "source": "Sigma", "rule": "Remote system discovery utility (proc_creation_lnx)", "confidence": "low" }],
"noise": 40
},
{
"id": "sudo-l",
"match": { "line": { "any": [{ "contains": "sudo -l" }, { "contains": "sudo --list" }] } },
"description": "Enumeration of the current user's sudo privileges",
"techniques": [{ "id": "T1069", "name": "Permission Groups Discovery" }],
"telemetry": ["execve() of sudo with -l", "auditd USER_CMD / sudo log entry in /var/log/auth.log"],
"detections": [{ "source": "Sigma", "rule": "Sudo privilege enumeration (proc_creation_lnx / auth logs)", "confidence": "medium" }],
"noise": 55
},
{
"id": "crontab-l",
"match": { "program": "crontab", "args": { "contains": "-l" } },
"description": "Scheduled task (cron) discovery",
"techniques": [{ "id": "T1053.003", "name": "Scheduled Task/Job: Cron" }],
"telemetry": ["execve() of crontab", "reads under /var/spool/cron"],
"detections": [{ "source": "Sigma", "rule": "Cron enumeration (proc_creation_lnx)", "confidence": "low" }],
"noise": 40
},
{
"id": "find-suid",
"match": { "program": "find", "args": { "contains": "-perm" } },
"description": "SUID/SGID binary hunting — privilege-escalation recon",
"techniques": [
{ "id": "T1083", "name": "File and Directory Discovery" },
{ "id": "T1548.001", "name": "Abuse Elevation Control Mechanism: Setuid and Setgid" }
],
"telemetry": ["execve() of find with -perm", "large burst of stat()/openat() across the filesystem"],
"detections": [{ "source": "Sigma", "rule": "SUID/SGID discovery via find -perm (proc_creation_lnx)", "confidence": "medium" }],
"noise": 55
},
{
"id": "find-generic",
"match": { "program": "find" },
"description": "File and directory discovery",
"techniques": [{ "id": "T1083", "name": "File and Directory Discovery" }],
"telemetry": ["execve() of find", "burst of stat()/openat() syscalls"],
"detections": [{ "source": "Sigma", "rule": "Filesystem discovery utility (proc_creation_lnx)", "confidence": "low" }],
"noise": 25
},
{
"id": "wget",
"match": { "program": "wget" },
"description": "Remote file download — tool ingress",
"techniques": [{ "id": "T1105", "name": "Ingress Tool Transfer" }],
"telemetry": ["execve() of wget", "outbound connect() to remote host", "file create() in cwd/tmp"],
"detections": [{ "source": "Sigma", "rule": "File download via wget (proc_creation_lnx / network)", "confidence": "medium" }],
"noise": 60
},
{
"id": "curl",
"match": { "program": "curl" },
"description": "Remote file transfer / HTTP client — tool ingress or exfil",
"techniques": [{ "id": "T1105", "name": "Ingress Tool Transfer" }],
"telemetry": ["execve() of curl", "outbound connect() to remote host"],
"detections": [{ "source": "Sigma", "rule": "File transfer via curl (proc_creation_lnx / network)", "confidence": "medium" }],
"noise": 55
},
{
"id": "pipe-to-shell",
"match": { "line": { "word": "| bash" } },
"description": "Piping downloaded content directly into a shell interpreter",
"techniques": [
{ "id": "T1059.004", "name": "Command and Scripting Interpreter: Unix Shell" },
{ "id": "T1105", "name": "Ingress Tool Transfer" }
],
"telemetry": ["shell process with network-client parent (curl/wget) in the process tree", "no file written to disk — memory-only execution"],
"detections": [{ "source": "Sigma", "rule": "Download piped to shell interpreter (proc_creation_lnx)", "confidence": "high" }],
"noise": 80
},
{
"id": "pipe-to-sh",
"match": { "line": { "word": "| sh" } },
"description": "Piping downloaded content directly into a shell interpreter",
"techniques": [
{ "id": "T1059.004", "name": "Command and Scripting Interpreter: Unix Shell" },
{ "id": "T1105", "name": "Ingress Tool Transfer" }
],
"telemetry": ["shell process with network-client parent in the process tree", "memory-only execution"],
"detections": [{ "source": "Sigma", "rule": "Download piped to shell interpreter (proc_creation_lnx)", "confidence": "high" }],
"noise": 80
},
{
"id": "netcat",
"match": { "program": "nc" },
"description": "Raw TCP/UDP connection — potential C2 or exfil channel",
"techniques": [
{ "id": "T1095", "name": "Non-Application Layer Protocol" },
{ "id": "T1071", "name": "Application Layer Protocol" }
],
"telemetry": ["execve() of nc/ncat", "outbound or listening socket via connect()/bind()/listen()"],
"detections": [{ "source": "Sigma", "rule": "Netcat execution / suspicious socket (proc_creation_lnx)", "confidence": "high" }],
"noise": 70
},
{
"id": "reverse-shell-devtcp",
"match": { "line": { "contains": "/dev/tcp" } },
"description": "Bash /dev/tcp reverse shell — interactive C2 channel",
"techniques": [
{ "id": "T1059.004", "name": "Command and Scripting Interpreter: Unix Shell" },
{ "id": "T1071", "name": "Application Layer Protocol" }
],
"telemetry": ["bash execve() followed by connect() to attacker IP", "stdin/stdout/stderr duped to a socket fd"],
"detections": [{ "source": "Sigma", "rule": "Reverse shell via /dev/tcp redirection (proc_creation_lnx)", "confidence": "high" }],
"noise": 82
},
{
"id": "python-c",
"match": { "program": "python3", "args": { "contains": "-c" } },
"description": "Inline Python execution — common for one-liner payloads",
"techniques": [{ "id": "T1059.006", "name": "Command and Scripting Interpreter: Python" }],
"telemetry": ["execve() of python with -c", "child sockets/processes spawned from interpreter"],
"detections": [{ "source": "Sigma", "rule": "Inline Python one-liner execution (proc_creation_lnx)", "confidence": "medium" }],
"noise": 55
},
{
"id": "history-clear",
"match": { "line": { "contains": "history -c" } },
"description": "Shell command-history clearing — anti-forensics",
"techniques": [{ "id": "T1070.003", "name": "Indicator Removal: Clear Command History" }],
"telemetry": ["history builtin (no execve)", "truncate()/write() of ~/.bash_history if flushed"],
"detections": [{ "source": "Sigma", "rule": "Command history clearing (proc_creation_lnx / file_event_lnx)", "confidence": "high" }],
"noise": 75
},
{
"id": "bash-history-tamper",
"match": { "line": { "contains": ".bash_history" } },
"description": "Direct manipulation/removal of shell history file — anti-forensics",
"techniques": [{ "id": "T1070.003", "name": "Indicator Removal: Clear Command History" }],
"telemetry": ["unlink()/truncate() of ~/.bash_history — auditd file watch", "redirection of history to /dev/null"],
"detections": [{ "source": "Sigma", "rule": "Shell history file tampering (file_event_lnx)", "confidence": "high" }],
"noise": 78
},
{
"id": "authorized-keys",
"match": { "line": { "contains": "authorized_keys" } },
"description": "Modification of SSH authorized_keys — persistence / account manipulation",
"techniques": [
{ "id": "T1098.004", "name": "Account Manipulation: SSH Authorized Keys" },
{ "id": "T1547", "name": "Boot or Logon Autostart Execution" }
],
"telemetry": ["write()/create() of ~/.ssh/authorized_keys — auditd file watch", "chmod 600 on the key file"],
"detections": [{ "source": "Sigma", "rule": "Modification of authorized_keys (file_event_lnx)", "confidence": "high" }],
"noise": 72
},
{
"id": "useradd",
"match": { "program": "useradd" },
"description": "Local account creation — persistence",
"techniques": [{ "id": "T1136.001", "name": "Create Account: Local Account" }],
"telemetry": ["execve() of useradd/adduser", "writes to /etc/passwd,/etc/shadow — auditd file watch"],
"detections": [{ "source": "Sigma", "rule": "Local account creation (proc_creation_lnx / file_event_lnx)", "confidence": "high" }],
"noise": 70
},
{
"id": "systemd-persistence",
"match": { "program": "systemctl", "args": { "contains": "enable" } },
"description": "Enabling a systemd unit — service persistence",
"techniques": [{ "id": "T1543.002", "name": "Create or Modify System Process: Systemd Service" }],
"telemetry": ["execve() of systemctl enable", "create()/symlink of unit under /etc/systemd/system"],
"detections": [{ "source": "Sigma", "rule": "Systemd service persistence (proc_creation_lnx / file_event_lnx)", "confidence": "medium" }],
"noise": 55
},
{
"id": "selinux-disable",
"match": { "line": { "contains": "setenforce 0" } },
"description": "Disabling SELinux enforcement — defense impairment",
"techniques": [{ "id": "T1562.001", "name": "Impair Defenses: Disable or Modify Tools" }],
"telemetry": ["execve() of setenforce", "write to /sys/fs/selinux/enforce"],
"detections": [{ "source": "Sigma", "rule": "SELinux enforcement disabled (proc_creation_lnx)", "confidence": "high" }],
"noise": 75
},
{
"id": "iptables-flush",
"match": { "program": "iptables", "args": { "contains": "-F" } },
"description": "Flushing firewall rules — defense impairment",
"techniques": [{ "id": "T1562.004", "name": "Impair Defenses: Disable or Modify System Firewall" }],
"telemetry": ["execve() of iptables -F", "netfilter table changes"],
"detections": [{ "source": "Sigma", "rule": "Firewall rules flushed (proc_creation_lnx)", "confidence": "medium" }],
"noise": 65
},
{
"id": "chattr-immutable",
"match": { "program": "chattr" },
"description": "Setting file attributes (e.g. immutable) — hide artifacts / resist removal",
"techniques": [
{ "id": "T1222.002", "name": "File and Directory Permissions Modification: Linux and Mac" },
{ "id": "T1564", "name": "Hide Artifacts" }
],
"telemetry": ["execve() of chattr", "ioctl(FS_IOC_SETFLAGS)"],
"detections": [{ "source": "Sigma", "rule": "chattr immutable/append attribute change (proc_creation_lnx)", "confidence": "medium" }],
"noise": 55
},
{
"id": "chmod-exec",
"match": { "program": "chmod", "args": { "contains": "+x" } },
"description": "Making a file executable — staging a dropped payload",
"techniques": [{ "id": "T1222.002", "name": "File and Directory Permissions Modification: Linux and Mac" }],
"telemetry": ["execve() of chmod", "chmod() syscall setting execute bit"],
"detections": [{ "source": "Sigma", "rule": "chmod +x on file in tmp/user dir (proc_creation_lnx)", "confidence": "low" }],
"noise": 40
},
{
"id": "shred",
"match": { "program": "shred" },
"description": "Secure file deletion — anti-forensics",
"techniques": [{ "id": "T1070.004", "name": "Indicator Removal: File Deletion" }],
"telemetry": ["execve() of shred", "repeated overwrite write() + unlink()"],
"detections": [{ "source": "Sigma", "rule": "Secure deletion via shred (proc_creation_lnx)", "confidence": "medium" }],
"noise": 60
},
{
"id": "tar-archive",
"match": { "program": "tar" },
"description": "Archiving data — collection prior to exfiltration",
"techniques": [{ "id": "T1560.001", "name": "Archive Collected Data: Archive via Utility" }],
"telemetry": ["execve() of tar", "sequential read() across many files"],
"detections": [{ "source": "Sigma", "rule": "Bulk archive creation (proc_creation_lnx)", "confidence": "low" }],
"noise": 45
},
{
"id": "base64-decode",
"match": { "program": "base64", "args": { "contains": "-d" } },
"description": "Base64 decoding — deobfuscation of payloads",
"techniques": [{ "id": "T1140", "name": "Deobfuscate/Decode Files or Information" }],
"telemetry": ["execve() of base64 with -d", "often chained into a shell interpreter"],
"detections": [{ "source": "Sigma", "rule": "Base64 decode chained to execution (proc_creation_lnx)", "confidence": "medium" }],
"noise": 45
},
{
"id": "scp",
"match": { "program": "scp" },
"description": "File transfer over SSH — ingress or exfiltration",
"techniques": [
{ "id": "T1105", "name": "Ingress Tool Transfer" },
{ "id": "T1048", "name": "Exfiltration Over Alternative Protocol" }
],
"telemetry": ["execve() of scp", "outbound SSH connection connect() :22"],
"detections": [{ "source": "Sigma", "rule": "File transfer via scp (proc_creation_lnx / network)", "confidence": "low" }],
"noise": 45
},
{
"id": "ssh-lateral",
"match": { "program": "ssh" },
"description": "Interactive SSH — potential lateral movement",
"techniques": [{ "id": "T1021.004", "name": "Remote Services: SSH" }],
"telemetry": ["execve() of ssh", "outbound connect() :22", "auth event on the destination host"],
"detections": [{ "source": "Sigma", "rule": "Outbound SSH from unusual context (proc_creation_lnx)", "confidence": "low" }],
"noise": 45
},
{
"id": "private-key-rsa",
"match": { "line": { "all": [{ "word": "id_rsa" }, { "not": { "contains": "id_rsa.pub" } }] } },
"description": "Access to an SSH RSA private key — unsecured credential theft",
"techniques": [{ "id": "T1552.004", "name": "Unsecured Credentials: Private Keys" }],
"telemetry": ["openat() of ~/.ssh/id_rsa — auditd file watch", "read by non-ssh process"],
"detections": [{ "source": "Sigma", "rule": "Private key file access (file_event_lnx)", "confidence": "medium" }],
"noise": 65
},
{
"id": "private-key-ed25519",
"match": { "line": { "all": [{ "word": "id_ed25519" }, { "not": { "contains": "id_ed25519.pub" } }] } },
"description": "Access to an SSH Ed25519 private key — unsecured credential theft",
"techniques": [{ "id": "T1552.004", "name": "Unsecured Credentials: Private Keys" }],
"telemetry": ["openat() of ~/.ssh/id_ed25519 — auditd file watch", "read by non-ssh process"],
"detections": [{ "source": "Sigma", "rule": "Private key file access (file_event_lnx)", "confidence": "medium" }],
"noise": 65
},
{
"id": "creds-in-files",
"match": { "program": "grep", "args": { "contains": "password" } },
"description": "Grepping the filesystem for passwords — credentials in files",
"techniques": [{ "id": "T1552.001", "name": "Unsecured Credentials: Credentials In Files" }],
"telemetry": ["execve() of grep with a credential keyword", "recursive read() across many files"],
"detections": [{ "source": "Sigma", "rule": "Credential keyword search (proc_creation_lnx)", "confidence": "medium" }],
"noise": 55
},
{
"id": "group-discovery",
"match": { "program": "cat", "args": { "contains": "/etc/group" } },
"description": "Enumeration of local groups via /etc/group",
"techniques": [{ "id": "T1069.001", "name": "Permission Groups Discovery: Local Groups" }],
"telemetry": ["openat() of /etc/group"],
"detections": [{ "source": "Sigma", "rule": "Local group enumeration (file_event_lnx)", "confidence": "low" }],
"noise": 40
},
{
"id": "sudoers-tamper",
"match": { "line": { "contains": "/etc/sudoers" } },
"description": "Reading or modifying /etc/sudoers — privilege escalation / persistence",
"techniques": [{ "id": "T1548.003", "name": "Abuse Elevation Control Mechanism: Sudo and Sudo Caching" }],
"telemetry": ["openat()/write() of /etc/sudoers or /etc/sudoers.d/* — high-signal auditd file watch"],
"detections": [{ "source": "Sigma", "rule": "Sudoers file modification (file_event_lnx)", "confidence": "high" }],
"noise": 72
},
{
"id": "nmap",
"match": { "program": "nmap" },
"description": "Active network service scanning",
"techniques": [{ "id": "T1046", "name": "Network Service Discovery" }],
"telemetry": ["execve() of nmap", "burst of outbound connect() across many hosts/ports"],
"detections": [{ "source": "Sigma", "rule": "Port/service scanner execution (proc_creation_lnx)", "confidence": "medium" }],
"noise": 65
},
{
"id": "masscan",
"match": { "program": "masscan" },
"description": "High-rate network port scanning",
"techniques": [{ "id": "T1046", "name": "Network Service Discovery" }],
"telemetry": ["execve() of masscan", "very high rate of outbound SYN packets"],
"detections": [{ "source": "Sigma", "rule": "Mass port scanner execution (proc_creation_lnx)", "confidence": "medium" }],
"noise": 65
},
{
"id": "tcpdump",
"match": { "program": "tcpdump" },
"description": "Packet capture — network sniffing",
"techniques": [{ "id": "T1040", "name": "Network Sniffing" }],
"telemetry": ["execve() of tcpdump", "creation of an AF_PACKET raw socket (needs CAP_NET_RAW)"],
"detections": [{ "source": "Sigma", "rule": "Packet capture utility execution (proc_creation_lnx)", "confidence": "medium" }],
"noise": 60
},
{
"id": "socat",
"match": { "program": "socat" },
"description": "Bidirectional relay — potential C2 or reverse shell channel",
"techniques": [
{ "id": "T1095", "name": "Non-Application Layer Protocol" },
{ "id": "T1071", "name": "Application Layer Protocol" }
],
"telemetry": ["execve() of socat", "outbound/listening socket, often with EXEC:/bin/sh"],
"detections": [{ "source": "Sigma", "rule": "socat relay / reverse shell (proc_creation_lnx)", "confidence": "high" }],
"noise": 70
},
{
"id": "python-http-server",
"match": { "program": "python3", "args": { "contains": "http.server" } },
"description": "Ad-hoc HTTP server — data staging / exfiltration channel",
"techniques": [
{ "id": "T1105", "name": "Ingress Tool Transfer" },
{ "id": "T1567", "name": "Exfiltration Over Web Service" }
],
"telemetry": ["execve() of python -m http.server", "listening socket bind()/listen() on a high port"],
"detections": [{ "source": "Sigma", "rule": "Python http.server execution (proc_creation_lnx)", "confidence": "medium" }],
"noise": 55
},
{
"id": "kernel-module-insmod",
"match": { "program": "insmod" },
"description": "Loading a kernel module — potential rootkit / persistence",
"techniques": [{ "id": "T1547.006", "name": "Boot or Logon Autostart Execution: Kernel Modules and Extensions" }],
"telemetry": ["execve() of insmod", "init_module()/finit_module() syscall — high-signal auditd event"],
"detections": [{ "source": "Sigma", "rule": "Kernel module load via insmod (proc_creation_lnx)", "confidence": "high" }],
"noise": 68
},
{
"id": "kernel-module-modprobe",
"match": { "program": "modprobe" },
"description": "Loading a kernel module by name — potential rootkit / persistence",
"techniques": [{ "id": "T1547.006", "name": "Boot or Logon Autostart Execution: Kernel Modules and Extensions" }],
"telemetry": ["execve() of modprobe", "finit_module() syscall"],
"detections": [{ "source": "Sigma", "rule": "Kernel module load via modprobe (proc_creation_lnx)", "confidence": "medium" }],
"noise": 55
},
{
"id": "ld-preload",
"match": { "line": { "contains": "ld.so.preload" } },
"description": "Writing /etc/ld.so.preload — dynamic linker hijacking (userland rootkit)",
"techniques": [{ "id": "T1574.006", "name": "Hijack Execution Flow: Dynamic Linker Hijacking" }],
"telemetry": ["create()/write() of /etc/ld.so.preload — high-signal auditd file watch"],
"detections": [{ "source": "Sigma", "rule": "ld.so.preload modification (file_event_lnx)", "confidence": "high" }],
"noise": 80
},
{
"id": "shell-profile-persist",
"match": { "line": { "contains": ".bashrc" } },
"description": "Modifying a shell rc file (.bashrc) — logon persistence",
"techniques": [{ "id": "T1546.004", "name": "Event Triggered Execution: Unix Shell Configuration Modification" }],
"telemetry": ["write()/append to ~/.bashrc — auditd file watch"],
"detections": [{ "source": "Sigma", "rule": "Shell rc file modification (file_event_lnx)", "confidence": "medium" }],
"noise": 55
},
{
"id": "cron-persist",
"match": { "line": { "contains": "/etc/cron" } },
"description": "Writing to system cron locations — scheduled-task persistence",
"techniques": [{ "id": "T1053.003", "name": "Scheduled Task/Job: Cron" }],
"telemetry": ["create()/write() under /etc/cron.d, /etc/crontab, /etc/cron.* — auditd file watch"],
"detections": [{ "source": "Sigma", "rule": "System cron persistence (file_event_lnx)", "confidence": "medium" }],
"noise": 58
},
{
"id": "at-job",
"match": { "program": "at" },
"description": "One-off scheduled job via at — execution / persistence",
"techniques": [{ "id": "T1053.002", "name": "Scheduled Task/Job: At" }],
"telemetry": ["execve() of at", "spool file created under /var/spool/at|cron/atjobs"],
"detections": [{ "source": "Sigma", "rule": "at job scheduling (proc_creation_lnx)", "confidence": "medium" }],
"noise": 48
},
{
"id": "disable-audit",
"match": { "line": { "contains": "auditctl" } },
"description": "Manipulating the Linux audit subsystem — defense/telemetry impairment",
"techniques": [{ "id": "T1562.012", "name": "Impair Defenses: Disable or Modify Linux Audit System" }],
"telemetry": ["execve() of auditctl", "changes to audit rules / auditd state"],
"detections": [{ "source": "Sigma", "rule": "Audit subsystem tampering (proc_creation_lnx)", "confidence": "high" }],
"noise": 75
},
{
"id": "clear-syslog-rm",
"match": { "program": "rm", "args": { "path_under": "/var/log" } },
"description": "Deleting system logs under /var/log — log clearing (anti-forensics)",
"techniques": [{ "id": "T1070.002", "name": "Indicator Removal: Clear Linux or Mac System Logs" }],
"telemetry": ["unlink() under /var/log — auditd file watch"],
"detections": [{ "source": "Sigma", "rule": "System log tampering (file_event_lnx)", "confidence": "medium" }],
"noise": 60
},
{
"id": "clear-syslog-truncate",
"match": { "program": "truncate", "args": { "path_under": "/var/log" } },
"description": "Truncating system logs under /var/log — log clearing (anti-forensics)",
"techniques": [{ "id": "T1070.002", "name": "Indicator Removal: Clear Linux or Mac System Logs" }],
"telemetry": ["truncate() under /var/log — auditd file watch"],
"detections": [{ "source": "Sigma", "rule": "System log tampering (file_event_lnx)", "confidence": "medium" }],
"noise": 60
},
{
"id": "clear-syslog-shred",
"match": { "program": "shred", "args": { "path_under": "/var/log" } },
"description": "Shredding system logs under /var/log — log clearing (anti-forensics)",
"techniques": [{ "id": "T1070.002", "name": "Indicator Removal: Clear Linux or Mac System Logs" }],
"telemetry": ["write()/unlink() under /var/log — auditd file watch"],
"detections": [{ "source": "Sigma", "rule": "System log tampering (file_event_lnx)", "confidence": "medium" }],
"noise": 60
},
{
"id": "journal-vacuum",
"match": { "program": "journalctl", "args": { "prefix": "--vacuum" } },
"description": "journalctl --vacuum — deleting systemd journal logs (anti-forensics)",
"techniques": [{ "id": "T1070.002", "name": "Indicator Removal: Clear Linux or Mac System Logs" }],
"telemetry": ["execve() of journalctl --vacuum-*", "unlink() of journal files under /var/log/journal"],
"detections": [{ "source": "Sigma", "rule": "systemd journal vacuum (proc_creation_lnx)", "confidence": "high" }],
"noise": 70
},
{
"id": "docker-sock",
"match": { "line": { "contains": "docker.sock" } },
"description": "Interacting with the Docker socket — container-to-host escape vector",
"techniques": [{ "id": "T1611", "name": "Escape to Host" }],
"telemetry": ["connect() to /var/run/docker.sock", "container spawning a privileged sibling"],
"detections": [{ "source": "Sigma", "rule": "Docker socket abuse (proc_creation_lnx)", "confidence": "high" }],
"noise": 75
},
{
"id": "privileged-container",
"match": { "line": { "contains": "--privileged" } },
"description": "Launching a privileged container — container escape vector",
"techniques": [{ "id": "T1611", "name": "Escape to Host" }],
"telemetry": ["execve() of a container runtime with --privileged", "container with full host capabilities"],
"detections": [{ "source": "Sigma", "rule": "Privileged container launch (proc_creation_lnx)", "confidence": "high" }],
"noise": 70
},
{
"id": "login-discovery",
"match": { "program": "last" },
"description": "Login history enumeration",
"techniques": [{ "id": "T1087.001", "name": "Account Discovery: Local Account" }],
"telemetry": ["execve() of last", "read of /var/log/wtmp"],
"detections": [{ "source": "Sigma", "rule": "Login history discovery (proc_creation_lnx)", "confidence": "low" }],
"noise": 30
},
{
"id": "capabilities-enum",
"match": { "program": "getcap" },
"description": "Enumerating file capabilities — privilege-escalation recon",
"techniques": [
{ "id": "T1083", "name": "File and Directory Discovery" },
{ "id": "T1548.001", "name": "Abuse Elevation Control Mechanism: Setuid and Setgid" }
],
"telemetry": ["execve() of getcap", "recursive getxattr() for security.capability"],
"detections": [{ "source": "Sigma", "rule": "Capabilities enumeration via getcap (proc_creation_lnx)", "confidence": "medium" }],
"noise": 45
},
{
"id": "usermod-group",
"match": { "program": "usermod" },
"description": "Modifying user group membership — privilege escalation / account manipulation",
"techniques": [{ "id": "T1098", "name": "Account Manipulation" }],
"telemetry": ["execve() of usermod", "writes to /etc/group,/etc/passwd — auditd file watch"],
"detections": [{ "source": "Sigma", "rule": "User account/group modification (proc_creation_lnx)", "confidence": "medium" }],
"noise": 60
},
{
"id": "cloud-imds",
"match": { "line": { "contains": "169.254.169.254" } },
"description": "Querying the cloud instance metadata endpoint — credential theft",
"techniques": [{ "id": "T1552.005", "name": "Unsecured Credentials: Cloud Instance Metadata API" }],
"telemetry": ["connect() to the link-local metadata endpoint 169.254.169.254:80 from a shell/utility", "outbound HTTP GET to /latest/meta-data/iam/security-credentials/"],
"detections": [{ "source": "Sigma", "rule": "Cloud instance metadata access (net_connection_lnx)", "confidence": "medium" }],
"noise": 60
},
{
"id": "k8s-sa-token",
"match": { "line": { "contains": "serviceaccount/token" } },
"description": "Reading the Kubernetes service-account token — credential theft",
"techniques": [{ "id": "T1552.007", "name": "Unsecured Credentials: Container API" }],
"telemetry": ["openat()/read() of /var/run/secrets/kubernetes.io/serviceaccount/token"],
"detections": [{ "source": "Sigma", "rule": "Kubernetes service account token access (file_event_lnx)", "confidence": "medium" }],
"noise": 60
},
{
"id": "kubectl-exec",
"match": { "program": "kubectl", "args": { "contains": "exec" } },
"description": "Command execution inside a pod via kubectl exec",
"techniques": [{ "id": "T1609", "name": "Container Administration Command" }],
"telemetry": ["execve() of kubectl exec — running a command inside a container/pod"],
"detections": [{ "source": "Sigma", "rule": "kubectl exec into a pod (proc_creation_lnx)", "confidence": "medium" }],
"noise": 50
},
{
"id": "kubectl-get",
"match": { "program": "kubectl", "args": { "contains": "get" } },
"description": "Enumerating cluster resources via kubectl get",
"techniques": [{ "id": "T1613", "name": "Container and Resource Discovery" }],
"telemetry": ["execve() of kubectl get — enumerating pods, secrets, or nodes"],
"detections": [{ "source": "Sigma", "rule": "Kubernetes resource enumeration (proc_creation_lnx)", "confidence": "low" }],
"noise": 40
},
{
"id": "nsenter-escape",
"match": { "program": "nsenter" },
"description": "Entering host namespaces via nsenter — container escape",
"techniques": [{ "id": "T1611", "name": "Escape to Host" }],
"telemetry": ["execve() of nsenter joining host namespaces (often --target 1 --mount)", "container process attaching to PID 1 namespaces"],
"detections": [{ "source": "Sigma", "rule": "Container escape via nsenter (proc_creation_lnx)", "confidence": "high" }],
"noise": 65
},
{
"id": "proc-root-escape",
"match": { "line": { "contains": "/proc/1/root" } },
"description": "Accessing the host filesystem via /proc/1/root — container escape",
"techniques": [{ "id": "T1611", "name": "Escape to Host" }],
"telemetry": ["openat() under /proc/1/root — reaching the host root filesystem from a container"],
"detections": [{ "source": "Sigma", "rule": "Host filesystem access via /proc/1/root (file_event_lnx)", "confidence": "high" }],
"noise": 60
},
{
"id": "ptrace-gdb",
"match": { "program": "gdb", "args": { "contains": "-p" } },
"description": "Attaching to a live process with gdb — process injection / inspection",
"techniques": [{ "id": "T1055.008", "name": "Process Injection: Ptrace System Calls" }],
"telemetry": ["execve() of gdb attaching to a running PID (ptrace PTRACE_ATTACH)", "ptrace() syscall against another process"],
"detections": [{ "source": "Sigma", "rule": "Process attach via gdb/ptrace (proc_creation_lnx)", "confidence": "medium" }],
"noise": 55
},
{
"id": "timestomp-touch",
"match": { "program": "touch", "args": { "contains": "-r" } },
"description": "Copying a reference file's timestamps with touch — timestomping",
"techniques": [{ "id": "T1070.006", "name": "Indicator Removal: Timestomp" }],
"telemetry": ["utimensat()/utimes() setting a file's times to match a reference", "execve() of touch with -r"],
"detections": [{ "source": "Sigma", "rule": "Timestomping via touch (proc_creation_lnx)", "confidence": "medium" }],
"noise": 45
},
{
"id": "rc-local-persist",
"match": { "line": { "contains": "rc.local" } },
"description": "Writing to /etc/rc.local — boot persistence",
"techniques": [{ "id": "T1037.004", "name": "Boot or Logon Initialization Scripts: RC Scripts" }],
"telemetry": ["write()/create() to /etc/rc.local", "auditd file watch on /etc/rc.local"],
"detections": [{ "source": "Sigma", "rule": "RC script persistence (file_event_lnx)", "confidence": "medium" }],
"noise": 55
},
{
"id": "systemd-timer-persist",
"match": { "line": { "contains": ".timer" } },
"description": "Installing a systemd .timer unit — scheduled-task persistence",
"techniques": [{ "id": "T1053.006", "name": "Scheduled Task/Job: Systemd Timers" }],
"telemetry": ["write()/create() of a .timer unit under /etc/systemd/system or ~/.config/systemd/user", "systemctl enabling a timer unit"],
"detections": [{ "source": "Sigma", "rule": "Systemd timer persistence (file_event_lnx)", "confidence": "medium" }],
"noise": 55
},
{
"id": "proxychains",
"match": { "line": { "contains": "proxychains" } },
"description": "Wrapping a tool with proxychains — multi-hop proxying",
"techniques": [{ "id": "T1090.003", "name": "Proxy: Multi-hop Proxy" }],
"telemetry": ["execve() of proxychains/proxychains4 wrapping another program", "child-process traffic relayed through a proxy chain"],
"detections": [{ "source": "Sigma", "rule": "Proxied execution via proxychains (proc_creation_lnx)", "confidence": "medium" }],
"noise": 50
},
{
"id": "ssh-socks-proxy",
"match": { "program": "ssh", "args": { "flag": "-D" } },
"description": "SSH dynamic port forwarding (-D SOCKS) — tunneling",
"techniques": [{ "id": "T1572", "name": "Protocol Tunneling" }],
"telemetry": ["execve() of ssh with dynamic port forwarding (-D)", "long-lived ssh session carrying tunneled traffic"],
"detections": [{ "source": "Sigma", "rule": "SSH dynamic port forwarding (proc_creation_lnx)", "confidence": "medium" }],
"noise": 50
},
{
"id": "dnscat",
"match": { "line": { "contains": "dnscat" } },
"description": "DNS-tunneled C2 via dnscat",
"techniques": [{ "id": "T1071.004", "name": "Application Layer Protocol: DNS" }],
"telemetry": ["execve() of dnscat/dnscat2", "burst of TXT/NULL DNS queries to a single authoritative name server"],
"detections": [{ "source": "Sigma", "rule": "DNS tunneling C2 (proc_creation_lnx)", "confidence": "high" }],
"noise": 65
},
{
"id": "rclone-exfil",
"match": { "program": "rclone" },
"description": "Copying data to a remote/cloud backend via rclone — exfiltration",
"techniques": [{ "id": "T1567.002", "name": "Exfiltration Over Web Service: Exfiltration to Cloud Storage" }],
"telemetry": ["execve() of rclone copying to a remote backend", "sustained outbound TLS to a cloud storage provider"],
"detections": [{ "source": "Sigma", "rule": "Data exfiltration via rclone (proc_creation_lnx)", "confidence": "medium" }],
"noise": 55
},
{
"id": "aws-s3-exfil",
"match": { "program": "aws", "args": { "contains": "s3" } },
"description": "Transferring data via the aws CLI (s3 cp/sync) — exfiltration",
"techniques": [{ "id": "T1567.002", "name": "Exfiltration Over Web Service: Exfiltration to Cloud Storage" }],
"telemetry": ["execve() of the aws CLI performing an s3 cp/sync", "outbound TLS to *.amazonaws.com carrying object data"],
"detections": [{ "source": "Sigma", "rule": "S3 data transfer via aws CLI (proc_creation_lnx)", "confidence": "low" }],
"noise": 45
},
{
"id": "histfile-tamper",
"match": { "line": { "contains": "histfile" } },
"description": "Disabling shell history (HISTFILE) — impairing command logging",
"techniques": [{ "id": "T1562.003", "name": "Impair Defenses: Impair Command History Logging" }],
"telemetry": ["shell setting HISTFILE=/dev/null or unsetting HISTFILE (no execve)", "command-history logging disabled for the session"],
"detections": [{ "source": "Sigma", "rule": "Shell history logging disabled (proc_creation_lnx)", "confidence": "medium" }],
"noise": 55
},
{
"id": "find-exec-shell",
"match": { "line": { "contains": "-exec /bin" } },
"description": "Spawning a shell via find -exec — SUID/restricted-shell escape (GTFOBins)",
"techniques": [{ "id": "T1548.001", "name": "Abuse Elevation Control Mechanism: Setuid and Setgid" }, { "id": "T1059.004", "name": "Command and Scripting Interpreter: Unix Shell" }],
"telemetry": ["execve() of find spawning a shell through -exec", "child /bin/sh inheriting the parent's (possibly SUID) privileges"],
"detections": [{ "source": "Sigma", "rule": "Shell spawned via find -exec (proc_creation_lnx)", "confidence": "high" }],
"noise": 55
},
{
"id": "awk-system-exec",
"match": { "line": { "contains": "begin{system" } },
"description": "Command execution via awk system() (GTFOBins)",
"techniques": [{ "id": "T1059.004", "name": "Command and Scripting Interpreter: Unix Shell" }],
"telemetry": ["execve() of awk invoking system() to run a command"],
"detections": [{ "source": "Sigma", "rule": "Command execution via awk system() (proc_creation_lnx)", "confidence": "medium" }],
"noise": 55
},
{
"id": "dd-wipe",
"match": { "program": "dd", "args": { "contains": "of=/dev/" } },
"description": "Overwriting a block device with dd — data destruction",
"techniques": [{ "id": "T1485", "name": "Data Destruction" }],
"telemetry": ["execve() of dd writing to a raw block device (e.g. of=/dev/sda)", "large write() burst to a disk device"],
"detections": [{ "source": "Sigma", "rule": "Disk overwrite via dd (proc_creation_lnx)", "confidence": "high" }],
"noise": 65
}
]
}