Enhanced Detection Coverage
The Enhanced detection set provides deep insight into system activity. This enables Sophos Linux Sensor (SLS) to more intelligently determine the security relevance of this activity and provide more context for incident analysts. However, this increased depth does require more processing power, and not all of the detections exclusive to Enhanced detection are suitable for each workload type.
For example, New File Executed can be enormously valuable to detect something like an attacker creating and running a malware payload. But, for environments running configuration management tools like Chef or Puppet, which frequently create and run new files, this same detection will instead generate a lot of events that aren't indicative of unwanted activity.
This document includes information regarding Core and Enhanced detections provided by Sophos. These include the following categories:
- Detection Analytics: Core coverage that detects malicious behavior
- Smart Policy: Provides additional context to incidents without generating false positive alerts for benign behavior
For more information see Categories of Detections.
Detection Analytics
Application Exploitation
Memory Corruption
Memory Marked Executable
Severity: Medium
DescriptionMemory is often marked executable in order to allow malicious code to execute when an application is being exploited. Alerts when a program sets heap or stack memory permissions to executable. Deployment considerations
| Attributes
|
Repeated Program Crashes
Severity: Medium
DescriptionRepeated program crashes could indicate that an attacker is attempting to exploit a memory corruption vulnerability, or that there is a stability issue in the affected application. Alerts when more than 5 instances of an individual program crash via segmentation fault. Deployment considerations
| Attributes
|
Userfaultfd Usage
Severity: High
DescriptionCertain Linux functionality is almost exclusively used when exploiting kernel vulnerabilities, usually with the goal of privilege escalation. Alerts when a binary executes the userfaultfd system call. Deployment considerations
| Attributes
|
Unusual application behavior
New File Executed in Container
Severity: High
DescriptionAs containers are typically static workloads, this alert could indicate that an attacker has compromised the container and is attempting to install and run a backdoor. Alerts when a file that has been created or modified within 30 minutes is then executed within a container. Deployment considerations
| Attributes
|
New Script Executed in Container
Severity: High
DescriptionAs containers are typically static workloads, this alert could indicate that an attacker has compromised the container and is attempting to install and run a backdoor. Alerts when a script that has been created or modified within 5 minutes is then executed within a container. Deployment considerations
| Attributes
|
Process Dumping Via Proc
Severity: Medium
DescriptionAdversaries may inject malicious code into processes via the /proc filesystem in order to evade process-based defenses as well as possibly elevate privileges. Alerts when a program uses ptrace (debugging) mechanisms to extract process data via the /proc filesystem. Deployment considerations
| Attributes
|
Remote Interactive Shell
Severity: High
DescriptionRemote Interactive shells are rare occurrences on modern production infrastructure. Alerts when a remote interactive shell is started if the shell was not created by SSHD. Deployment considerations
| Attributes
|
Suspicious Interactive Shell
Severity: High
DescriptionInteractive shells are rare occurrences on modern production infrastructure. Alerts when an interactive shell is started with arguments commonly used for reverse shells. Deployment considerations
| Attributes
|
Suspicious Interactive Shell Advanced
Severity: High
DescriptionInteractive shells are rare occurrences on modern production infrastructure. Alerts when an interactive shell is started with arguments commonly used for reverse shells, started in a container, or started as a child of a network service that is not SSH. Deployment considerations
| Attributes
|
Persistence
Kernel backdoors BPF Program Executed
Severity: Medium
Description
The loading of a new BPF program could indicate that an attacker is loading a BPF-based rootkit to gain persistence and avoid detection. Alerts when a process loads a new privileged BPF program, if the process that is already part of an ongoing incident.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Kernel Module Loaded
Severity: High
Description
Attackers commonly load malicious kernel modules (rootkits) to evade detection and maintain persistence on a compromised node. Alerts when a kernel module is loaded, if the program is already part of an ongoing incident.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Resource hijacking
Cryptocurrency Miner Detected
Severity: Medium
Description
Opportunistic attackers often start cryptocurrency miners after compromising a node or container, usually indicating that the primary motive of the attacker is to hijack processor power. Alerts when a program with a name or arguments commonly associated with cryptocurrency miners is executed.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Remote Access Tool Download
Remote Access Tool Download
Severity: Medium
Description
After gaining access to a system, an attacker may download different tools using curl, wget etc with bash commands. Download commands can be encoded using base64 encoding.
Deployment considerations
- None
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Userland backdoors
Suspicious Program Name Executed-Space After File
Severity: Medium
Description
Attackers may create or rename malicious binaries to include a space at the end of the name in an effort to impersonate a legitimate system program or service. Alerts when a program is executed with a space after the program name.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Evading detection
User Command Logging Evasion
Severity: Medium
Description
Evading command logging is common practice for attackers, but may also indicate that a legitimate user is performing unauthorized actions or trying to evade policy. Alerts when a change to user command history logging is detected, indicating that a user is attempting to evade command logging.
Deployment considerations
- This detection requires uprobe support, present in kernels 4.8+.
Attributes
Default state Disabled Content versions 4.9.0+ Supports aarch64 Yes Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
System Exploitation
Tampering of security mechanisms
AppArmor Disabled In Kernel
Severity: High
Description
Modification of certain AppArmor attributes can only occur in-kernel, indicating that AppArmor has been disabled by a kernel exploit or rootkit. Alerts when the AppArmor state is changed from the AppArmor configuration detected when the sensor starts.
Deployment considerations
- If the kernel in use doesn't use AppArmor, an error may be logged for this detection when the sensor starts.
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
AppArmor Profile Modified
Severity: Medium
Description
Attackers may attempt to disable enforcement of AppArmor profiles as part of evading detection. Alerts when a command for modifying an AppArmor profile is executed, if it was not executed by a user in an SSH session.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
SELinux Disabled In Kernel
Severity: High
Description
Modification of certain SELinux attributes can only occur in-kernel, indicating that SELinux has been disabled by a kernel exploit or rootkit. Alerts when the SELinux state in the kernel has been changed from the SELinux configuration detected when the sensor starts.
Deployment considerations
- If the kernel in use doesn't use SELinux, an error may be logged for this detection when the sensor starts.
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
SELinux Enforcement Mode Disabled From Userland
Severity: High
Description
Attackers may disable enforcement mode as a precursor to making significant system changes. Alerts when SELinux enforcement mode is disabled.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Container escapes Container Escape via Kernel Exploitation
Severity: High
Description
Alerts when a program uses kernel functions commonly used in container escape exploits, indicating that an attacker is escalating privileges from container-access to node-access.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Docker Socket Accessed
Severity: Medium
Description
The Docker socket is used to create and interact with containers on a node, and is a common target for attackers. Alerts when a Docker socket is accessed, if the connector isn't a known container management tool.
Deployment considerations
- May issue unwanted alerts for legitimate container management tools.
- Requires tuning of allowlists and blocklists for different environments.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Privileged Container Launched
Severity: Low
Description
Privileged containers have direct access to host resources, leading to a greater impact when compromised. Alerts when a privileged container is launched, if the container isn't a known privileged image such as kube-proxy.
Deployment considerations
- Can issue unwanted alerts for legitimate privileged containers. Requires fine-tuning of allowlists and blocklists for different environments.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
RunC Container Escape
Severity: High
Description
Alerts when a modification is detected of the runc binary by a non-package manager, such as with CVE-2019-5736.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Userland Container Escape
Severity: High
Description
Many container escapes coerce the host to execute an in-container binary, resulting in the attacker gaining full control of the affected node. Alerts when a container-created file is executed from outside a container.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Common kernel exploitation methods
Illegal Elevation Of Privileges
Severity: High
Description
Kernel privilege escalation exploits commonly enable an unprivileged user to gain root privileges without passing standard gates for privilege changes. Alerts when a program attempts to elevate privileges through unusual means.
Deployment considerations
- Can issue false positive alerts on nodes with significant workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Kernel Exploit
Severity: High
Description
Internal kernel functions are not accessible to regular programs, and if called, are a strong indicator that a kernel exploit has executed and that the attacker has full control of the node. Alerts when a kernel function unexpectedly returns to userland.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Kernel ROP
Severity: High
Description
Kernel ROP (return-oriented programming) exploits are often used to illegally elevate privileges or bypass other security measures. Alerts when ROP is detected in the kernel, specifically in a call to prepare_kernel_cred which is indicative of an exploit.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.10.0 Minimum sensor version 4.2.0 Supports aarch64 Yes ATT&CK Techniques
Processor-Level Protections Disabled
Severity: High
Description
SMEP and SMAP are processor-level protections that increase difficulty for kernel exploits to succeed, and disabling these restrictions is a common early step in kernel exploits. Alerts when a program tampers with the kernel SMEP/SMAP configuration.
Deployment considerations
- This detection is not functional for kernels between v4.19 and v5.2 (inclusive) as kernel code changes removed visibility of attempts to modify SMEP/SMAP configuration.
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 No ATT&CK Techniques
Smart Policy
File Activity
Changes to system binaries
Boot Files Modified
Severity: Medium
Description
If not performed by a trusted source (e.g. package manager or configuration management tool), modification of boot files could be indicative of an attacker modifying the kernel or its options in order to gain persistent access to a host. Alerts when changes are made to files in /boot, indicating installation of a new kernel or boot configuration.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Indicator removal
Log Files Deleted
Severity: Low
Description
Log deletion not performed by a log management tool could indicate that an attacker is trying to remove indicators of compromise. Alerts on deletion of system log files.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Userland backdoors
Modification Of Common System Utilities
Severity: Low
Description
Attackers may modify system utilities in order to execute malicious payloads whenever these utilities are run. Alerts when a common system utility is modified by an unauthorized process.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Configuration changes
Root Certificate Store Modified
Severity: Medium
Description
Modification of the root certificate store could indicate the installation of a rogue certificate authority, enabling interception of network traffic or bypass of code signature verification. Alerts when a system CA certificate store is changed.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Sudoers File Modified
Severity: Medium
Description
Modifications to the sudoers file could indicate an attempt to escalate privileges or bypass password authentication. Alerts when the sudoers file is modified.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.10.0 Minimum sensor version 4.4.0 Supports aarch64 Yes ATT&CK Techniques
Privileged file operations
Setuid/Setgid Bit Set On File
Severity: Medium
Description
Setting setuid/setgid bits can be used to provide a persistent method for privilege escalation on a node. Alerts when the setuid or setgid bit's set on a file with the chmod family of system calls.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
System configuration changes
Systemd Unit File Modified
Severity: Medium
Description
Changes to systemd units could result in security controls being relaxed or disabled, or the installation of a malicious service. Alerts whenever a systemd unit file is modified by a program other than systemctl.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
User Scoped Systemd Service Created
Severity: Medium
Description
User-scoped systemd services start whenever a user first establishes a session, and run until the last session for the user is closed. This type of service is rare, and could indicate that an attacker is attempting to establish persistent access to a system. Alerts whenever a user-scoped systemd unit file is created.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Unusual Files Created
Hidden File Created
Severity: Low
Description
Attackers often create hidden files as a means of obscuring tools and payloads on a compromised host. Alerts when a hidden file is created by a process associated with an ongoing incident.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Network Activity
Lateral movement
Network Service Scanner Executed
Severity: Medium
Description
An attacker or rogue user may use or install these programs to survey connected networks for additional nodes to compromise. Alerts when common network scanning program tools are executed.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Network sniffing
Network Sniffing Program Executed
Severity: Medium
Description
An attacker or rogue user may execute network sniffing commands to capture credentials, PII, or other sensitive information. Alerts when a program is executed that allows network capture.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Discovery
Cloud Metadata API Accessed
Severity: Medium
Description
Attackers commonly enumerate cloud environment details and gain access to instance credentials by accessing the cloud provider's metadata API. Alerts when a program accesses the cloud metadata API, if the program is already part of an ongoing incident.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Network Connection Enumeration Via Program
Severity: Low
Description
A common post-exploitation activity for attackers involves discovering adjacent hosts and networks prior to lateral movement. Alerts when a program associated with network connection enumeration is executed, if the program is already part of an ongoing incident.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Network service behavior
Network Service Created
Severity: Medium
Description
Attackers may start a new network service to provide easy access to a host after compromise. Alerts when a program starts a new network service, if the program is already part of an ongoing incident.
Deployment considerations
- None
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Outbound connections
Remote File Copy Detected
Severity: Medium
Description
Use of file transfer tools could indicate that an attacker is attempting to move toolsets to additional hosts or exfiltrate data to a remote system. Alerts when a program associated with remote file copying is executed, if the program is already part of an ongoing incident.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Unusual Outbound Connection Detected
Severity: Low
Description
Command and Control channels and cryptocoin miners often create new outbound network connections on unusual ports. Alerts when a program initiates a new connection on an uncommon port, if the program is already part of an ongoing incident.
Deployment considerations
- Can cause a negative performance impact on network-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Process Activity
Compiler usage
Compiler usage
Severity: Low
Description
An attacker may compile a custom backdoor or kernel exploit on a node to ensure compatibility with the node. Alerts when a program is executed that compiles a binary.
Deployment considerations
- Can cause a decrease in performance for workloads that run build jobs regularly
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Abnormal process execution
New File Executed
Severity: Medium
Description
Newly created files from sources other than system update programs may be backdoors, kernel exploits, or part of an exploitation chain. Alerts when a file that has been created or modified within 30 minutes is then executed, excluding files created by system update programs.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
New Script Executed
Severity: Medium
Description
Newly created scripts from sources other than system update programs may be backdoors, kernel exploits, or part of an exploitation chain. Alerts when a file that has been created or modified within 5 minutes is then executed by a script interpreter, excluding files created by system update programs.
Deployment considerations
- Currently only works for Python scripts.
Attributes
Default state Disabled Content versions 4.10.0 Minimum sensor version 4.10.0 Supports aarch64 Yes ATT&CK Techniques
Debugging
Process Injection
Severity: Medium
Description
Use of process injection techniques commonly indicates that a user is debugging a program, but may also indicate that an attacker is reading secrets from or injecting code into other processes. Alerts when a program uses ptrace (debugging) mechanisms to interact with another process.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Scheduled task changes
Scheduled Tasks Modified Via File
Severity: Medium
Description
Modifying scheduled tasks is a common method for establishing persistence on a compromised node. Alerts when a cron-related file is modified, indicating a change to scheduled job configurations.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Scheduled Tasks Modified Via Program
Severity: Medium
Description
Modifying scheduled tasks is a common method for establishing persistence on a compromised node. Alerts when the "crontab", "at", or "batch" commands are used to modify scheduled task configurations.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
System configuration changes
Systemctl Usage Detected
Severity: Medium
Description
Changes to systemd units could result in security controls being relaxed or disabled, or the installation of a malicious service. Alerts when the systemctl command is used to modify systemd units.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Discovery
Account Enumeration Via Program
Severity: Low
Description
Attackers will often use account enumeration programs to determine their level of access and to see if other users are currently logged in to the node. Alerts when a program associated with account enumeration is executed, if the program is already part of an ongoing incident.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
File and Directory Discovery Via Program
Severity: Low
Description
Exploring file systems is common post-exploitation behavior for an attacker looking for credentials and data of interest. Alerts when a program associated with file and directory enumeration is executed, if the program is already part of an ongoing incident.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Network Configuration Enumeration Via Program
Severity: Low
Description
Attackers can interrogate local network and route information to identify adjacent hosts and networks ahead of lateral movement. Alerts when a program associated with network configuration enumeration is executed, if the program is already part of an ongoing incident.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Process Enumeration Via Program
Severity: Low
Description
Attackers often list running programs in order to identify the purpose of a node and whether any security or monitoring tools are in place. Alerts when a program associated with process enumeration is executed, if the program is already part of an ongoing incident.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
System Information Enumeration Via Program
Severity: Low
Description
Attackers will commonly execute system enumeration commands to determine Linux kernel and distribution versions and features, often to identify if the node is affected by specific vulnerabilities. Alerts when a program associated with system information enumeration is executed, if the program is already part of an ongoing incident.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Data collection
Data Archived Via Program
Severity: Low
Description
After gaining access to a system, an attacker may create a compressed archive of files to reduce the size of data for exfiltration. Alerts when a data compression program is executed, if the program is already part of an ongoing incident.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Data destruction
Data Destruction Via Program
Severity: Medium
Description
Data destruction performed by a non-trusted process may indicate that an attacker is trying to remove indicators of compromise or disrupt a node. Alerts when common tools for destroying data are used, if the process is already part of an ongoing incident.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Log Daemon Tampering
Log Daemon Tampering
Severity: Medium
Description
Attempts to tamper with log daemons may indicate that an attacker is trying to remove indicators of compromise and hide their trails. Alerts when daemon control programs are invoked with specific arguments, if the process is already part of an ongoing incident.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
User Activity
User account changes
Account Modification
Severity: Medium
Description
Attackers may directly modify identity-related files to add a new user to the system. Alerts when a file related to identity management is modified by a program unrelated to updating existing user information.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
- Deprecated: This detection has been superceded by 'New System User Added', and will be removed in the next major release (5.0).
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
New System User Added
Severity: Medium
Description
An attacker may add a new user to a host to provide a reliable method of access. Alerts if a new user entity is added to the local account management file /etc/passwd, if the entity is not added by a system update program.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Password Database Modification
Severity: High
Description
Attackers may directly modify identity-related files to add a new user to the system. Alerts when a file related to user passwords is modified by a program unrelated to updating existing user information.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
User Account Created Via CLI
Severity: High
Description
Adding a new user is a common step for attackers when establishing persistence on a compromised node. Alerts when an identity management program is executed by a program other than a package manager.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
User Configuration Changes
Severity: Medium
Description
User profile and configuration files are often modified as a method of persistence in order to execute a program whenever a user logs in. Alerts when .bash_profile and bashrc (as well as related files) are modified by a program other than a system update tool.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
SSH Authorized Keys Modification
Severity: Medium
Description
Adding a new SSH public key is a common method for gaining persistent access to a compromised host. Alerts when an attempt to write to a user's SSH authorized_keys file is observed, if the program is already part of an ongoing incident.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Risky developer activity
Shell Command Executed
Severity: Low
Description
This detection logs commands executed by a valid system user via SSH.
Deployment considerations
- Can result in a high volume of notifications.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
User Command History Cleared
Severity: Medium
Description
Deleting the history file is unusual, commonly performed by attackers hiding activity, or by legitimate users intending to evade audit controls. Alerts when command line history files are deleted.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
User Login Via SSH
Severity: Low
Description
Alerts when an interactive shell process is started by a valid system user via SSH.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Privileged command usage
User Execution Of su Command
Severity: Medium
Description
Explicit escalation to the root user decreases the ability to correlate privileged activity to a specific user. Alerts when the 'su' command is executed.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
User Execution Of sudo Command
Severity: Medium
Description
Alerts when the 'sudo' command is executed.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
User execution of unwanted sudo command
Severity: Medium
Description
Some commands run with sudo privileges are rarely used legitimately by system administrators and could indicate an account has been compromised. Alerts when 'sudo' is used to execute privileged commands common to post-exploitation activities.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Abnormal process execution
Credential Enumeration Detected
Severity: Low
Description
Attackers and rogue users may search for passwords or other credentials after gaining access to a system, and may use these credentials to compromise additional hosts or services. Alerts when common password enumeration commands are issued in an interactive shell, if the shell is part of an ongoing incident.
Deployment considerations
- None
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
BPF Program Executed
Severity: Medium
DescriptionThe loading of a new BPF program could indicate that an attacker is loading a BPF-based rootkit to gain persistence and avoid detection. Alerts when a process loads a new privileged BPF program, if the process that is already part of an ongoing incident. Deployment considerations
| Attributes
|
Kernel Module Loaded
Severity: High
DescriptionAttackers commonly load malicious kernel modules (rootkits) to evade detection and maintain persistence on a compromised node. Alerts when a kernel module is loaded, if the program is already part of an ongoing incident. Deployment considerations
| Attributes
|
Resource hijacking
Cryptocurrency Miner Detected
Severity: Medium
DescriptionOpportunistic attackers often start cryptocurrency miners after compromising a node or container, usually indicating that the primary motive of the attacker is to hijack processor power. Alerts when a program with a name or arguments commonly associated with cryptocurrency miners is executed. Deployment considerations
| Attributes
|
Remote Access Tool Download
Remote Access Tool Download
Severity: Medium
DescriptionAfter gaining access to a system, an attacker may download different tools using curl, wget etc with bash commands. Download commands can be encoded using base64 encoding. Deployment considerations
| Attributes
|
Userland backdoors
Suspicious Program Name Executed-Space After File
Severity: Medium
DescriptionAttackers may create or rename malicious binaries to include a space at the end of the name in an effort to impersonate a legitimate system program or service. Alerts when a program is executed with a space after the program name. Deployment considerations
| Attributes
|
Evading detection
User Command Logging Evasion
Severity: Medium
DescriptionEvading command logging is common practice for attackers, but may also indicate that a legitimate user is performing unauthorized actions or trying to evade policy. Alerts when a change to user command history logging is detected, indicating that a user is attempting to evade command logging. Deployment considerations
| Attributes
|
System Exploitation
Tampering of security mechanisms
AppArmor Disabled In Kernel
Severity: High
DescriptionModification of certain AppArmor attributes can only occur in-kernel, indicating that AppArmor has been disabled by a kernel exploit or rootkit. Alerts when the AppArmor state is changed from the AppArmor configuration detected when the sensor starts. Deployment considerations
| Attributes
|
AppArmor Profile Modified
Severity: Medium
DescriptionAttackers may attempt to disable enforcement of AppArmor profiles as part of evading detection. Alerts when a command for modifying an AppArmor profile is executed, if it was not executed by a user in an SSH session. Deployment considerations
| Attributes
|
SELinux Disabled In Kernel
Severity: High
DescriptionModification of certain SELinux attributes can only occur in-kernel, indicating that SELinux has been disabled by a kernel exploit or rootkit. Alerts when the SELinux state in the kernel has been changed from the SELinux configuration detected when the sensor starts. Deployment considerations
| Attributes
|
SELinux Enforcement Mode Disabled From Userland
Severity: High
DescriptionAttackers may disable enforcement mode as a precursor to making significant system changes. Alerts when SELinux enforcement mode is disabled. Deployment considerations
| Attributes
|
Container escapes Container Escape via Kernel Exploitation
Severity: High
Description
Alerts when a program uses kernel functions commonly used in container escape exploits, indicating that an attacker is escalating privileges from container-access to node-access.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Docker Socket Accessed
Severity: Medium
Description
The Docker socket is used to create and interact with containers on a node, and is a common target for attackers. Alerts when a Docker socket is accessed, if the connector isn't a known container management tool.
Deployment considerations
- May issue unwanted alerts for legitimate container management tools.
- Requires tuning of allowlists and blocklists for different environments.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Privileged Container Launched
Severity: Low
Description
Privileged containers have direct access to host resources, leading to a greater impact when compromised. Alerts when a privileged container is launched, if the container isn't a known privileged image such as kube-proxy.
Deployment considerations
- Can issue unwanted alerts for legitimate privileged containers. Requires fine-tuning of allowlists and blocklists for different environments.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
RunC Container Escape
Severity: High
Description
Alerts when a modification is detected of the runc binary by a non-package manager, such as with CVE-2019-5736.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Userland Container Escape
Severity: High
Description
Many container escapes coerce the host to execute an in-container binary, resulting in the attacker gaining full control of the affected node. Alerts when a container-created file is executed from outside a container.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Common kernel exploitation methods
Illegal Elevation Of Privileges
Severity: High
Description
Kernel privilege escalation exploits commonly enable an unprivileged user to gain root privileges without passing standard gates for privilege changes. Alerts when a program attempts to elevate privileges through unusual means.
Deployment considerations
- Can issue false positive alerts on nodes with significant workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Kernel Exploit
Severity: High
Description
Internal kernel functions are not accessible to regular programs, and if called, are a strong indicator that a kernel exploit has executed and that the attacker has full control of the node. Alerts when a kernel function unexpectedly returns to userland.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Kernel ROP
Severity: High
Description
Kernel ROP (return-oriented programming) exploits are often used to illegally elevate privileges or bypass other security measures. Alerts when ROP is detected in the kernel, specifically in a call to prepare_kernel_cred which is indicative of an exploit.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.10.0 Minimum sensor version 4.2.0 Supports aarch64 Yes ATT&CK Techniques
Processor-Level Protections Disabled
Severity: High
Description
SMEP and SMAP are processor-level protections that increase difficulty for kernel exploits to succeed, and disabling these restrictions is a common early step in kernel exploits. Alerts when a program tampers with the kernel SMEP/SMAP configuration.
Deployment considerations
- This detection is not functional for kernels between v4.19 and v5.2 (inclusive) as kernel code changes removed visibility of attempts to modify SMEP/SMAP configuration.
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 No ATT&CK Techniques
Smart Policy
File Activity
Changes to system binaries
Boot Files Modified
Severity: Medium
Description
If not performed by a trusted source (e.g. package manager or configuration management tool), modification of boot files could be indicative of an attacker modifying the kernel or its options in order to gain persistent access to a host. Alerts when changes are made to files in /boot, indicating installation of a new kernel or boot configuration.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Indicator removal
Log Files Deleted
Severity: Low
Description
Log deletion not performed by a log management tool could indicate that an attacker is trying to remove indicators of compromise. Alerts on deletion of system log files.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Userland backdoors
Modification Of Common System Utilities
Severity: Low
Description
Attackers may modify system utilities in order to execute malicious payloads whenever these utilities are run. Alerts when a common system utility is modified by an unauthorized process.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Configuration changes
Root Certificate Store Modified
Severity: Medium
Description
Modification of the root certificate store could indicate the installation of a rogue certificate authority, enabling interception of network traffic or bypass of code signature verification. Alerts when a system CA certificate store is changed.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Sudoers File Modified
Severity: Medium
Description
Modifications to the sudoers file could indicate an attempt to escalate privileges or bypass password authentication. Alerts when the sudoers file is modified.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.10.0 Minimum sensor version 4.4.0 Supports aarch64 Yes ATT&CK Techniques
Privileged file operations
Setuid/Setgid Bit Set On File
Severity: Medium
Description
Setting setuid/setgid bits can be used to provide a persistent method for privilege escalation on a node. Alerts when the setuid or setgid bit's set on a file with the chmod family of system calls.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
System configuration changes
Systemd Unit File Modified
Severity: Medium
Description
Changes to systemd units could result in security controls being relaxed or disabled, or the installation of a malicious service. Alerts whenever a systemd unit file is modified by a program other than systemctl.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
User Scoped Systemd Service Created
Severity: Medium
Description
User-scoped systemd services start whenever a user first establishes a session, and run until the last session for the user is closed. This type of service is rare, and could indicate that an attacker is attempting to establish persistent access to a system. Alerts whenever a user-scoped systemd unit file is created.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Unusual Files Created
Hidden File Created
Severity: Low
Description
Attackers often create hidden files as a means of obscuring tools and payloads on a compromised host. Alerts when a hidden file is created by a process associated with an ongoing incident.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Network Activity
Lateral movement
Network Service Scanner Executed
Severity: Medium
Description
An attacker or rogue user may use or install these programs to survey connected networks for additional nodes to compromise. Alerts when common network scanning program tools are executed.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Network sniffing
Network Sniffing Program Executed
Severity: Medium
Description
An attacker or rogue user may execute network sniffing commands to capture credentials, PII, or other sensitive information. Alerts when a program is executed that allows network capture.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Discovery
Cloud Metadata API Accessed
Severity: Medium
Description
Attackers commonly enumerate cloud environment details and gain access to instance credentials by accessing the cloud provider's metadata API. Alerts when a program accesses the cloud metadata API, if the program is already part of an ongoing incident.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Network Connection Enumeration Via Program
Severity: Low
Description
A common post-exploitation activity for attackers involves discovering adjacent hosts and networks prior to lateral movement. Alerts when a program associated with network connection enumeration is executed, if the program is already part of an ongoing incident.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Network service behavior
Network Service Created
Severity: Medium
Description
Attackers may start a new network service to provide easy access to a host after compromise. Alerts when a program starts a new network service, if the program is already part of an ongoing incident.
Deployment considerations
- None
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Outbound connections
Remote File Copy Detected
Severity: Medium
Description
Use of file transfer tools could indicate that an attacker is attempting to move toolsets to additional hosts or exfiltrate data to a remote system. Alerts when a program associated with remote file copying is executed, if the program is already part of an ongoing incident.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Unusual Outbound Connection Detected
Severity: Low
Description
Command and Control channels and cryptocoin miners often create new outbound network connections on unusual ports. Alerts when a program initiates a new connection on an uncommon port, if the program is already part of an ongoing incident.
Deployment considerations
- Can cause a negative performance impact on network-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Process Activity
Compiler usage
Compiler usage
Severity: Low
Description
An attacker may compile a custom backdoor or kernel exploit on a node to ensure compatibility with the node. Alerts when a program is executed that compiles a binary.
Deployment considerations
- Can cause a decrease in performance for workloads that run build jobs regularly
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Abnormal process execution
New File Executed
Severity: Medium
Description
Newly created files from sources other than system update programs may be backdoors, kernel exploits, or part of an exploitation chain. Alerts when a file that has been created or modified within 30 minutes is then executed, excluding files created by system update programs.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
New Script Executed
Severity: Medium
Description
Newly created scripts from sources other than system update programs may be backdoors, kernel exploits, or part of an exploitation chain. Alerts when a file that has been created or modified within 5 minutes is then executed by a script interpreter, excluding files created by system update programs.
Deployment considerations
- Currently only works for Python scripts.
Attributes
Default state Disabled Content versions 4.10.0 Minimum sensor version 4.10.0 Supports aarch64 Yes ATT&CK Techniques
Debugging
Process Injection
Severity: Medium
Description
Use of process injection techniques commonly indicates that a user is debugging a program, but may also indicate that an attacker is reading secrets from or injecting code into other processes. Alerts when a program uses ptrace (debugging) mechanisms to interact with another process.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Scheduled task changes
Scheduled Tasks Modified Via File
Severity: Medium
Description
Modifying scheduled tasks is a common method for establishing persistence on a compromised node. Alerts when a cron-related file is modified, indicating a change to scheduled job configurations.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Scheduled Tasks Modified Via Program
Severity: Medium
Description
Modifying scheduled tasks is a common method for establishing persistence on a compromised node. Alerts when the "crontab", "at", or "batch" commands are used to modify scheduled task configurations.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
System configuration changes
Systemctl Usage Detected
Severity: Medium
Description
Changes to systemd units could result in security controls being relaxed or disabled, or the installation of a malicious service. Alerts when the systemctl command is used to modify systemd units.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Discovery
Account Enumeration Via Program
Severity: Low
Description
Attackers will often use account enumeration programs to determine their level of access and to see if other users are currently logged in to the node. Alerts when a program associated with account enumeration is executed, if the program is already part of an ongoing incident.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
File and Directory Discovery Via Program
Severity: Low
Description
Exploring file systems is common post-exploitation behavior for an attacker looking for credentials and data of interest. Alerts when a program associated with file and directory enumeration is executed, if the program is already part of an ongoing incident.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Network Configuration Enumeration Via Program
Severity: Low
Description
Attackers can interrogate local network and route information to identify adjacent hosts and networks ahead of lateral movement. Alerts when a program associated with network configuration enumeration is executed, if the program is already part of an ongoing incident.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Process Enumeration Via Program
Severity: Low
Description
Attackers often list running programs in order to identify the purpose of a node and whether any security or monitoring tools are in place. Alerts when a program associated with process enumeration is executed, if the program is already part of an ongoing incident.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
System Information Enumeration Via Program
Severity: Low
Description
Attackers will commonly execute system enumeration commands to determine Linux kernel and distribution versions and features, often to identify if the node is affected by specific vulnerabilities. Alerts when a program associated with system information enumeration is executed, if the program is already part of an ongoing incident.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Data collection
Data Archived Via Program
Severity: Low
Description
After gaining access to a system, an attacker may create a compressed archive of files to reduce the size of data for exfiltration. Alerts when a data compression program is executed, if the program is already part of an ongoing incident.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Data destruction
Data Destruction Via Program
Severity: Medium
Description
Data destruction performed by a non-trusted process may indicate that an attacker is trying to remove indicators of compromise or disrupt a node. Alerts when common tools for destroying data are used, if the process is already part of an ongoing incident.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Log Daemon Tampering
Log Daemon Tampering
Severity: Medium
Description
Attempts to tamper with log daemons may indicate that an attacker is trying to remove indicators of compromise and hide their trails. Alerts when daemon control programs are invoked with specific arguments, if the process is already part of an ongoing incident.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
User Activity
User account changes
Account Modification
Severity: Medium
Description
Attackers may directly modify identity-related files to add a new user to the system. Alerts when a file related to identity management is modified by a program unrelated to updating existing user information.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
- Deprecated: This detection has been superceded by 'New System User Added', and will be removed in the next major release (5.0).
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
New System User Added
Severity: Medium
Description
An attacker may add a new user to a host to provide a reliable method of access. Alerts if a new user entity is added to the local account management file /etc/passwd, if the entity is not added by a system update program.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Password Database Modification
Severity: High
Description
Attackers may directly modify identity-related files to add a new user to the system. Alerts when a file related to user passwords is modified by a program unrelated to updating existing user information.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
User Account Created Via CLI
Severity: High
Description
Adding a new user is a common step for attackers when establishing persistence on a compromised node. Alerts when an identity management program is executed by a program other than a package manager.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
User Configuration Changes
Severity: Medium
Description
User profile and configuration files are often modified as a method of persistence in order to execute a program whenever a user logs in. Alerts when .bash_profile and bashrc (as well as related files) are modified by a program other than a system update tool.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
SSH Authorized Keys Modification
Severity: Medium
Description
Adding a new SSH public key is a common method for gaining persistent access to a compromised host. Alerts when an attempt to write to a user's SSH authorized_keys file is observed, if the program is already part of an ongoing incident.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Risky developer activity
Shell Command Executed
Severity: Low
Description
This detection logs commands executed by a valid system user via SSH.
Deployment considerations
- Can result in a high volume of notifications.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
User Command History Cleared
Severity: Medium
Description
Deleting the history file is unusual, commonly performed by attackers hiding activity, or by legitimate users intending to evade audit controls. Alerts when command line history files are deleted.
Deployment considerations
- Can cause a negative performance impact on file-heavy workloads.
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
User Login Via SSH
Severity: Low
Description
Alerts when an interactive shell process is started by a valid system user via SSH.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Privileged command usage
User Execution Of su Command
Severity: Medium
Description
Explicit escalation to the root user decreases the ability to correlate privileged activity to a specific user. Alerts when the 'su' command is executed.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
User Execution Of sudo Command
Severity: Medium
Description
Alerts when the 'sudo' command is executed.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
User execution of unwanted sudo command
Severity: Medium
Description
Some commands run with sudo privileges are rarely used legitimately by system administrators and could indicate an account has been compromised. Alerts when 'sudo' is used to execute privileged commands common to post-exploitation activities.
Deployment considerations
- None
Attributes
Default state Enabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Abnormal process execution
Credential Enumeration Detected
Severity: Low
Description
Attackers and rogue users may search for passwords or other credentials after gaining access to a system, and may use these credentials to compromise additional hosts or services. Alerts when common password enumeration commands are issued in an interactive shell, if the shell is part of an ongoing incident.
Deployment considerations
- None
Attributes
Default state Disabled Content versions 4.9.0+ Minimum sensor version 5.0.0 Supports aarch64 Yes ATT&CK Techniques
Container Escape via Kernel Exploitation
Severity: High
DescriptionAlerts when a program uses kernel functions commonly used in container escape exploits, indicating that an attacker is escalating privileges from container-access to node-access. Deployment considerations
| Attributes
|
Docker Socket Accessed
Severity: Medium
DescriptionThe Docker socket is used to create and interact with containers on a node, and is a common target for attackers. Alerts when a Docker socket is accessed, if the connector isn't a known container management tool. Deployment considerations
| Attributes
|
Privileged Container Launched
Severity: Low
DescriptionPrivileged containers have direct access to host resources, leading to a greater impact when compromised. Alerts when a privileged container is launched, if the container isn't a known privileged image such as kube-proxy. Deployment considerations
| Attributes
|
RunC Container Escape
Severity: High
DescriptionAlerts when a modification is detected of the runc binary by a non-package manager, such as with CVE-2019-5736. Deployment considerations
| Attributes
|
Userland Container Escape
Severity: High
DescriptionMany container escapes coerce the host to execute an in-container binary, resulting in the attacker gaining full control of the affected node. Alerts when a container-created file is executed from outside a container. Deployment considerations
| Attributes
|
Common kernel exploitation methods
Illegal Elevation Of Privileges
Severity: High
DescriptionKernel privilege escalation exploits commonly enable an unprivileged user to gain root privileges without passing standard gates for privilege changes. Alerts when a program attempts to elevate privileges through unusual means. Deployment considerations
| Attributes
|
Kernel Exploit
Severity: High
DescriptionInternal kernel functions are not accessible to regular programs, and if called, are a strong indicator that a kernel exploit has executed and that the attacker has full control of the node. Alerts when a kernel function unexpectedly returns to userland. Deployment considerations
| Attributes
|
Kernel ROP
Severity: High
DescriptionKernel ROP (return-oriented programming) exploits are often used to illegally elevate privileges or bypass other security measures. Alerts when ROP is detected in the kernel, specifically in a call to prepare_kernel_cred which is indicative of an exploit. Deployment considerations
| Attributes
|
Processor-Level Protections Disabled
Severity: High
DescriptionSMEP and SMAP are processor-level protections that increase difficulty for kernel exploits to succeed, and disabling these restrictions is a common early step in kernel exploits. Alerts when a program tampers with the kernel SMEP/SMAP configuration. Deployment considerations
| Attributes
|
Smart Policy
File Activity
Changes to system binaries
Boot Files Modified
Severity: Medium
DescriptionIf not performed by a trusted source (e.g. package manager or configuration management tool), modification of boot files could be indicative of an attacker modifying the kernel or its options in order to gain persistent access to a host. Alerts when changes are made to files in /boot, indicating installation of a new kernel or boot configuration. Deployment considerations
| Attributes
|
Indicator removal
Log Files Deleted
Severity: Low
DescriptionLog deletion not performed by a log management tool could indicate that an attacker is trying to remove indicators of compromise. Alerts on deletion of system log files. Deployment considerations
| Attributes
|
Userland backdoors
Modification Of Common System Utilities
Severity: Low
DescriptionAttackers may modify system utilities in order to execute malicious payloads whenever these utilities are run. Alerts when a common system utility is modified by an unauthorized process. Deployment considerations
| Attributes
|
Configuration changes
Root Certificate Store Modified
Severity: Medium
DescriptionModification of the root certificate store could indicate the installation of a rogue certificate authority, enabling interception of network traffic or bypass of code signature verification. Alerts when a system CA certificate store is changed. Deployment considerations
| Attributes
|
Sudoers File Modified
Severity: Medium
DescriptionModifications to the sudoers file could indicate an attempt to escalate privileges or bypass password authentication. Alerts when the sudoers file is modified. Deployment considerations
| Attributes
|
Privileged file operations
Setuid/Setgid Bit Set On File
Severity: Medium
DescriptionSetting setuid/setgid bits can be used to provide a persistent method for privilege escalation on a node. Alerts when the setuid or setgid bit's set on a file with the chmod family of system calls. Deployment considerations
| Attributes
|
System configuration changes
Systemd Unit File Modified
Severity: Medium
DescriptionChanges to systemd units could result in security controls being relaxed or disabled, or the installation of a malicious service. Alerts whenever a systemd unit file is modified by a program other than systemctl. Deployment considerations
| Attributes
|
User Scoped Systemd Service Created
Severity: Medium
DescriptionUser-scoped systemd services start whenever a user first establishes a session, and run until the last session for the user is closed. This type of service is rare, and could indicate that an attacker is attempting to establish persistent access to a system. Alerts whenever a user-scoped systemd unit file is created. Deployment considerations
| Attributes
|
Unusual Files Created
Hidden File Created
Severity: Low
DescriptionAttackers often create hidden files as a means of obscuring tools and payloads on a compromised host. Alerts when a hidden file is created by a process associated with an ongoing incident. Deployment considerations
| Attributes
|
Network Activity
Lateral movement
Network Service Scanner Executed
Severity: Medium
DescriptionAn attacker or rogue user may use or install these programs to survey connected networks for additional nodes to compromise. Alerts when common network scanning program tools are executed. Deployment considerations
| Attributes
|
Network sniffing
Network Sniffing Program Executed
Severity: Medium
DescriptionAn attacker or rogue user may execute network sniffing commands to capture credentials, PII, or other sensitive information. Alerts when a program is executed that allows network capture. Deployment considerations
| Attributes
|
Discovery
Cloud Metadata API Accessed
Severity: Medium
DescriptionAttackers commonly enumerate cloud environment details and gain access to instance credentials by accessing the cloud provider's metadata API. Alerts when a program accesses the cloud metadata API, if the program is already part of an ongoing incident. Deployment considerations
| Attributes
|
Network Connection Enumeration Via Program
Severity: Low
DescriptionA common post-exploitation activity for attackers involves discovering adjacent hosts and networks prior to lateral movement. Alerts when a program associated with network connection enumeration is executed, if the program is already part of an ongoing incident. Deployment considerations
| Attributes
|
Network service behavior
Network Service Created
Severity: Medium
DescriptionAttackers may start a new network service to provide easy access to a host after compromise. Alerts when a program starts a new network service, if the program is already part of an ongoing incident. Deployment considerations
| Attributes
|
Outbound connections
Remote File Copy Detected
Severity: Medium
DescriptionUse of file transfer tools could indicate that an attacker is attempting to move toolsets to additional hosts or exfiltrate data to a remote system. Alerts when a program associated with remote file copying is executed, if the program is already part of an ongoing incident. Deployment considerations
| Attributes
|
Unusual Outbound Connection Detected
Severity: Low
DescriptionCommand and Control channels and cryptocoin miners often create new outbound network connections on unusual ports. Alerts when a program initiates a new connection on an uncommon port, if the program is already part of an ongoing incident. Deployment considerations
| Attributes
|
Process Activity
Compiler usage
Compiler usage
Severity: Low
DescriptionAn attacker may compile a custom backdoor or kernel exploit on a node to ensure compatibility with the node. Alerts when a program is executed that compiles a binary. Deployment considerations
| Attributes
|
Abnormal process execution
New File Executed
Severity: Medium
DescriptionNewly created files from sources other than system update programs may be backdoors, kernel exploits, or part of an exploitation chain. Alerts when a file that has been created or modified within 30 minutes is then executed, excluding files created by system update programs. Deployment considerations
| Attributes
|
New Script Executed
Severity: Medium
DescriptionNewly created scripts from sources other than system update programs may be backdoors, kernel exploits, or part of an exploitation chain. Alerts when a file that has been created or modified within 5 minutes is then executed by a script interpreter, excluding files created by system update programs. Deployment considerations
| Attributes
|
Debugging
Process Injection
Severity: Medium
DescriptionUse of process injection techniques commonly indicates that a user is debugging a program, but may also indicate that an attacker is reading secrets from or injecting code into other processes. Alerts when a program uses ptrace (debugging) mechanisms to interact with another process. Deployment considerations
| Attributes
|
Scheduled task changes
Scheduled Tasks Modified Via File
Severity: Medium
DescriptionModifying scheduled tasks is a common method for establishing persistence on a compromised node. Alerts when a cron-related file is modified, indicating a change to scheduled job configurations. Deployment considerations
| Attributes
|
Scheduled Tasks Modified Via Program
Severity: Medium
DescriptionModifying scheduled tasks is a common method for establishing persistence on a compromised node. Alerts when the "crontab", "at", or "batch" commands are used to modify scheduled task configurations. Deployment considerations
| Attributes
|
System configuration changes
Systemctl Usage Detected
Severity: Medium
DescriptionChanges to systemd units could result in security controls being relaxed or disabled, or the installation of a malicious service. Alerts when the systemctl command is used to modify systemd units. Deployment considerations
| Attributes
|
Discovery
Account Enumeration Via Program
Severity: Low
DescriptionAttackers will often use account enumeration programs to determine their level of access and to see if other users are currently logged in to the node. Alerts when a program associated with account enumeration is executed, if the program is already part of an ongoing incident. Deployment considerations
| Attributes
|
File and Directory Discovery Via Program
Severity: Low
DescriptionExploring file systems is common post-exploitation behavior for an attacker looking for credentials and data of interest. Alerts when a program associated with file and directory enumeration is executed, if the program is already part of an ongoing incident. Deployment considerations
| Attributes
|
Network Configuration Enumeration Via Program
Severity: Low
DescriptionAttackers can interrogate local network and route information to identify adjacent hosts and networks ahead of lateral movement. Alerts when a program associated with network configuration enumeration is executed, if the program is already part of an ongoing incident. Deployment considerations
| Attributes
|
Process Enumeration Via Program
Severity: Low
DescriptionAttackers often list running programs in order to identify the purpose of a node and whether any security or monitoring tools are in place. Alerts when a program associated with process enumeration is executed, if the program is already part of an ongoing incident. Deployment considerations
| Attributes
|
System Information Enumeration Via Program
Severity: Low
DescriptionAttackers will commonly execute system enumeration commands to determine Linux kernel and distribution versions and features, often to identify if the node is affected by specific vulnerabilities. Alerts when a program associated with system information enumeration is executed, if the program is already part of an ongoing incident. Deployment considerations
| Attributes
|
Data collection
Data Archived Via Program
Severity: Low
DescriptionAfter gaining access to a system, an attacker may create a compressed archive of files to reduce the size of data for exfiltration. Alerts when a data compression program is executed, if the program is already part of an ongoing incident. Deployment considerations
| Attributes
|
Data destruction
Data Destruction Via Program
Severity: Medium
DescriptionData destruction performed by a non-trusted process may indicate that an attacker is trying to remove indicators of compromise or disrupt a node. Alerts when common tools for destroying data are used, if the process is already part of an ongoing incident. Deployment considerations
| Attributes
|
Log Daemon Tampering
Log Daemon Tampering
Severity: Medium
DescriptionAttempts to tamper with log daemons may indicate that an attacker is trying to remove indicators of compromise and hide their trails. Alerts when daemon control programs are invoked with specific arguments, if the process is already part of an ongoing incident. Deployment considerations
| Attributes
|
User Activity
User account changes
Account Modification
Severity: Medium
DescriptionAttackers may directly modify identity-related files to add a new user to the system. Alerts when a file related to identity management is modified by a program unrelated to updating existing user information. Deployment considerations
| Attributes
|
New System User Added
Severity: Medium
DescriptionAn attacker may add a new user to a host to provide a reliable method of access. Alerts if a new user entity is added to the local account management file /etc/passwd, if the entity is not added by a system update program. Deployment considerations
| Attributes
|
Password Database Modification
Severity: High
DescriptionAttackers may directly modify identity-related files to add a new user to the system. Alerts when a file related to user passwords is modified by a program unrelated to updating existing user information. Deployment considerations
| Attributes
|
User Account Created Via CLI
Severity: High
DescriptionAdding a new user is a common step for attackers when establishing persistence on a compromised node. Alerts when an identity management program is executed by a program other than a package manager. Deployment considerations
| Attributes
|
User Configuration Changes
Severity: Medium
DescriptionUser profile and configuration files are often modified as a method of persistence in order to execute a program whenever a user logs in. Alerts when .bash_profile and bashrc (as well as related files) are modified by a program other than a system update tool. Deployment considerations
| Attributes
|
SSH Authorized Keys Modification
Severity: Medium
DescriptionAdding a new SSH public key is a common method for gaining persistent access to a compromised host. Alerts when an attempt to write to a user's SSH authorized_keys file is observed, if the program is already part of an ongoing incident. Deployment considerations
| Attributes
|
Risky developer activity
Shell Command Executed
Severity: Low
DescriptionThis detection logs commands executed by a valid system user via SSH. Deployment considerations
| Attributes
|
User Command History Cleared
Severity: Medium
DescriptionDeleting the history file is unusual, commonly performed by attackers hiding activity, or by legitimate users intending to evade audit controls. Alerts when command line history files are deleted. Deployment considerations
| Attributes
|
User Login Via SSH
Severity: Low
DescriptionAlerts when an interactive shell process is started by a valid system user via SSH. Deployment considerations
| Attributes
|
Privileged command usage
User Execution Of su Command
Severity: Medium
DescriptionExplicit escalation to the root user decreases the ability to correlate privileged activity to a specific user. Alerts when the 'su' command is executed. Deployment considerations
| Attributes
|
User Execution Of sudo Command
Severity: Medium
DescriptionAlerts when the 'sudo' command is executed. Deployment considerations
| Attributes
|
User execution of unwanted sudo command
Severity: Medium
DescriptionSome commands run with sudo privileges are rarely used legitimately by system administrators and could indicate an account has been compromised. Alerts when 'sudo' is used to execute privileged commands common to post-exploitation activities. Deployment considerations
| Attributes
|
Abnormal process execution
Credential Enumeration Detected
Severity: Low
DescriptionAttackers and rogue users may search for passwords or other credentials after gaining access to a system, and may use these credentials to compromise additional hosts or services. Alerts when common password enumeration commands are issued in an interactive shell, if the shell is part of an ongoing incident. Deployment considerations
| Attributes
|