- from: base
test: ':\(\)\{ :|:& \};:'
description: "This short line defines a shell function that creates new copies of itself.\nThe process continually replicates itself, and its copies continually replicate themselves, quickly taking up all your CPU time and memory.\nThis can cause your computer to freeze. It's basically a denial-of-service attack."
id: base:bash_fork_bomb
severity: Critical
- from: base
test: \s*crontab\s+-r
description: "You are going to remove your entire table of cron tasks."
id: base:delete_all_cron_tasks
severity: High
- from: base
test: \s*history(.*)[|](.*)(bash|sh)($|\s)
description: "You are going to executes every command from the command log that you have already executed."
id: base:execute_all_history_commands
severity: Critical
- from: base
test: (^|\s)reboot(\s|$)
description: "You are going to reboot your machine."
id: base:reboot_machine
severity: High
- from: base
test: (^|\s)shutdown(\s|$)
description: "You are going to shutdown your machine."
id: base:shutdown_machine
severity: High
- from: base
test: kill\s+-9\s+
description: "SIGKILL gives no chance for graceful shutdown or cleanup."
id: process:kill_9
severity: Low
alternative: "kill <pid>"
alternative_info: "Send SIGTERM first to allow graceful shutdown, then kill -9 if needed."
- from: base
test: killall\s+
description: "Kills ALL processes matching the name."
id: process:killall
severity: Medium
- from: base
test: pkill\s+
description: "Kills processes matching a pattern — could match unintended processes."
id: process:pkill
severity: Medium
- from: base
test: systemctl\s+(disable|mask)\s+
description: "Disabling or masking a service prevents it from starting on boot."
id: systemd:disable_service
severity: Medium
- from: base
test: systemctl\s+stop\s+(docker|sshd|nginx|apache2|httpd|postgresql|mysql|redis)[\w.-]*(\s|$)
description: "Stopping a critical system service can cause outages."
id: systemd:stop_critical_service
severity: High
- from: base
test: (halt|poweroff)(\s|$)
description: "This command will immediately power off your machine."
id: base:poweroff_machine
severity: High
- from: base
test: init\s+(0|6)(\s|$)
description: "This command will shutdown (init 0) or reboot (init 6) your machine."
id: base:init_shutdown_reboot
severity: High
- from: base
test: ssh-add\s+-D
description: "Removes all SSH identities from the agent."
id: ssh:delete_all_identities
severity: Medium
- from: base
test: ssh-keygen\s+-R\s+
description: "Removes a host from known_hosts — could enable MITM attacks."
id: ssh:remove_known_host
severity: Low