Browse Rules

Search and filter across all detection sources

1,396 rules

yara unknown yara

ELF_Linux_Torte [malware]

Detects ELF Linux/Torte infection

yara unknown yara

LinuxHelios [malware]

Linux.Helios

hayabusa high sigma

WSL Kali-Linux Usage

Detects the use of Kali Linux through Windows Subsystem for Linux

sigma high sigma

WSL Kali-Linux Usage

Detects the use of Kali Linux through Windows Subsystem for Linux

yara unknown yara

LinuxBew [malware]

Linux.Bew Backdoor

hayabusa high sigma

WSL Kali-Linux Usage

Detects the use of Kali Linux through Windows Subsystem for Linux

signature-base unknown yara

derusbi_linux [yara]

Derusbi Server Linux version

yara unknown yara

derusbi_linux [malware]

Derusbi Server Linux version

sagan high other

[LINUX-AUDITD] base64 execution

[LINUX-AUDITD] base64 execution

sagan high other

[LINUX-AUDITD] curl execution

[LINUX-AUDITD] curl execution

sagan high other

[LINUX-AUDITD] id execution

[LINUX-AUDITD] id execution

sagan high other

[LINUX-AUDITD] Netcat execution

[LINUX-AUDITD] Netcat execution

sagan high other

[LINUX-AUDITD] netstat execution

[LINUX-AUDITD] netstat execution

sagan high other

[LINUX-AUDITD] nmap execution

[LINUX-AUDITD] nmap execution

sagan high other

[LINUX-AUDITD] PHP execution

[LINUX-AUDITD] PHP execution

sagan high other

[LINUX-AUDITD] socat execution

[LINUX-AUDITD] socat execution

sagan high other

[LINUX-AUDITD] stunnel execution

[LINUX-AUDITD] stunnel execution

sagan high other

[LINUX-AUDITD] sudoedit access

[LINUX-AUDITD] sudoedit access

sagan high other

[LINUX-AUDITD] suidperl access

[LINUX-AUDITD] suidperl access

sagan high other

[LINUX-AUDITD] telnet execution

[LINUX-AUDITD] telnet execution

sagan high other

[LINUX-AUDITD] wget execution

[LINUX-AUDITD] wget execution

sagan high other

[LINUX-AUDITD] whoami execution

[LINUX-AUDITD] whoami execution

signature-base unknown yara

LinuxHacktool_eyes_a [yara]

Linux hack tools - file a

signature-base unknown yara

LinuxHacktool_eyes_mass [yara]

Linux hack tools - file mass

signature-base unknown yara

LinuxHacktool_eyes_pscan2 [yara]

Linux hack tools - file pscan2