Browse Rules

[FORTINET] Filesystem Write Violation

[FORTINET] Filesystem Write Violation

EquationDrug_FileSystem_Filter [yara]

EquationDrug - Filesystem filter driver - volrec.sys, scsi2mgr.sys

EquationDrug_FileSystem_Filter [malware]

EquationDrug - Filesystem filter driver – volrec.sys, scsi2mgr.sys

[FORTINET] Filesystem write violation (LOG_ID_SYS_SECURITY_WRITE_VIOLATION)

[FORTINET] Filesystem write violation (LOG_ID_SYS_SECURITY_WRITE_VIOLATION)

Uncommon FileSystem Load Attempt By Format.com

Detects the execution of format.com with an uncommon filesystem selection that could indicate a defense evasion activity in which "format.com" is used to load malicious DLL files or other programs.

Uncommon FileSystem Load Attempt By Format.com

Detects the execution of format.com with an uncommon filesystem selection that could indicate a defense evasion activity in which "format.com" is used to load malicious DLL files or other programs.

Uncommon FileSystem Load Attempt By Format.com

Detects the execution of format.com with an uncommon filesystem selection that could indicate a defense evasion activity in which "format.com" is used to load malicious DLL files or other programs.

Manual Memory Dumping via Proc Filesystem

This rule monitors for manual memory dumping via the proc filesystem. The proc filesystem in Linux provides a virtual filesystem that contains information about system processes and their memory mappings. Attackers may use this technique to dump the memory of a process, potentially extracting sensitive information such as credentials or encryption keys.

Container Access to Host Sensitive Paths

Detects container processes accessing paths that typically only exist when the host filesystem is mounted into the container (like /host, /rootfs, /hostfs). This may indicate a container escape attempt or a misconfigured volume mount that exposes the host filesystem. Legitimate monitoring or backup containers may access these paths, so tune accordingly using the user_known_host_path_access macro.

Docker: Filesystem of container $(docker.Actor.Attributes.name) exported

Docker: Filesystem of container $(docker.Actor.Attributes.name) exported

SUSP_VBA_FileSystem_Access [yara]

Detects suspicious VBA that writes to disk and is activated on document open

MCP Sensitive System File Search

This detection identifies MCP filesystem tool usage attempting to search for files containing sensitive patterns such as passwords, credentials, API keys, secrets, and configuration files. Adversaries and malicious insiders may abuse legitimate MCP filesystem capabilities to conduct reconnaissance and discover sensitive data stores for exfiltration or credential harvesting.

Container Residence Discovery Via Proc Virtual FS

Detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem

Suspicious Path Mounted

This rule detects suspicious paths mounted on Linux systems. The mount command is used to attach filesystems to the system, and attackers may use it to mount malicious filesystems or directories for data exfiltration or persistence.

AWS Bedrock Claude High Risk Filesystem and Exec Tool Invocation

Detects identities invoking high-risk filesystem and execution tools via AWS Bedrock Claude. For each identity, monitors the usage of potentially dangerous commands and flags any anomalous activity that deviates from their historical baseline. This may indicate attempts to escalate privileges, exfiltrate data, or execute unauthorized commands.

MCP Filesystem Server Suspicious Extension Write

This detection identifies attempts to create executable or script files through MCP filesystem server connections. Threat actors leveraging LLM-based tools may attempt to write malicious executables, scripts, or batch files to disk for persistence or code execution. The detection prioritizes files written to system directories or startup locations which indicate higher likelihood of malicious intent.

Mount Launched in Privileged Container

Detect filesystem mounts (using the mount binary) within a privileged container. Due to the elevated privileges, this action could be one of the TTPs used in an attempt to escape from a container to the host. This type of action is often preceded by reconnaissance activities, for which you can also create custom rules.

Privileged Container Device Access

Detects container processes accessing raw block devices, which could be used to escape container isolation by directly reading or writing to host storage. This technique allows attackers to access the host filesystem, modify system files, or extract sensitive data even without traditional container escape. Requires the container to have privileged access or specific device permissions. Override user_known_privileged_device_access for legitimate storage operations.

Update Package Repository

This rule generically detects updates to package repositories and can be seen as an auditing measure. Recommend evaluating its relevance for your specific environment.

Overwriting Accessibility Binaries

The following analytic detects modifications to Windows accessibility binaries such as sethc.exe, utilman.exe, osk.exe, Magnify.exe, Narrator.exe, DisplaySwitch.exe, and AtBroker.exe. It leverages filesystem activity data from the Endpoint.Filesystem data model to identify changes to these specific files. This activity is significant because adversaries can exploit these binaries to gain unauthorized access or execute commands without logging in. If confirmed malicious, this could allow attacker

Persistence via Initramfs

This hunt identifies potential persistence mechanisms leveraging modifications to Initramfs (initial RAM filesystem) on Linux systems. Initramfs is a key component in the boot process, providing early user-space initialization before the main filesystem is mounted. Attackers can abuse Initramfs by injecting malicious scripts, modules, or files into its configuration, allowing them to gain persistence or execute malicious code during system boot. This hunt monitors file creations and modification

Shim Database File Creation

The following analytic detects the creation of shim database files (.sdb) in default directories using the sdbinst.exe application. It leverages filesystem activity data from the Endpoint.Filesystem data model to identify file writes to the Windows\AppPatch\Custom directory. This activity is significant because shims can intercept and alter API calls, potentially allowing attackers to bypass security controls or execute malicious code. If confirmed malicious, this could lead to unauthorized code

Modify Container Entrypoint

This rule detect an attempt to write on container entrypoint symlink (/proc/self/exe). Possible CVE-2019-5736 Container Breakout exploitation attempt. This rule has a more narrow scope.

Windows System File on Disk

The following analytic detects the creation of new .sys files on disk. It leverages the Endpoint.Filesystem data model to identify and log instances where .sys files are written to the filesystem. This activity is significant because .sys files are often used as kernel mode drivers, and their unauthorized creation can indicate malicious activity such as rootkit installation. If confirmed malicious, this could allow an attacker to gain kernel-level access, leading to full system compromise, persi

AWS Bedrock High Risk Filesystem or Execution Tool Invocation

Detects when a Bedrock model is prompted to invoke high-risk tools associated with shell execution, filesystem operations, or process spawning. Adversaries may use compromised AI agent pipelines or manipulated prompts to instruct the model to execute arbitrary system commands, read or write sensitive files, or spawn subprocesses — extending the blast radius of a credential compromise or prompt injection attack.