Index of /rules.d/0.1.0/
../
SOC.001-ssh-brute-force-succeeded.json 29-Jul-2026 11:58 1094
SOC.002-ssh-brute-force-on-root.json 29-Jul-2026 11:58 1365
SOC.003-backdoor-user-with-persistence.json 29-Jul-2026 11:58 1337
SOC.004-ssh-key-dropped-for-new-user.json 29-Jul-2026 11:58 1051
SOC.005-sudoers-tampering.json 29-Jul-2026 11:58 1029
SOC.006-shadow-file-tampering.json 29-Jul-2026 11:58 1020
SOC.007-uid-0-escalation.json 29-Jul-2026 11:58 1103
SOC.008-suspicious-binary-in-tmp.json 29-Jul-2026 11:58 1653
SOC.009-webroot-write-webshell.json 29-Jul-2026 11:58 1458
SOC.010-mass-ssh-failures.json 29-Jul-2026 11:58 1377
SOC.011-persistence-mechanism-added.json 29-Jul-2026 11:58 880
SOC.012-multiple-new-users-created.json 29-Jul-2026 11:58 1126
SOC.013-sensitive-file-write.json 29-Jul-2026 11:58 693
SOC.014-port-scan-rapid-port-discovery.json 29-Jul-2026 11:58 1227
SOC.015-ssh-probing-invalid-users.json 29-Jul-2026 11:58 1451
SOC.016-service-fingerprinting-connection-sweep..> 29-Jul-2026 11:58 785
SOC.017-host-file-tampering-etc-hosts.json 29-Jul-2026 11:58 1064
SOC.018-ssh-key-auth-from-new-ip.json 29-Jul-2026 11:58 1035
SOC.019-ssh-from-known-bad-asn.json 29-Jul-2026 11:58 1140
SOC.020-root-ssh-login.json 29-Jul-2026 11:58 1029
SOC.021-ssh-at-unusual-hour.json 29-Jul-2026 11:58 1018
SOC.022-ssh-config-permitrootlogin-changed.json 29-Jul-2026 11:58 1066
SOC.023-pam-configuration-modified.json 29-Jul-2026 11:58 1066
SOC.024-multiple-successful-ssh-from-same-ip.json 29-Jul-2026 11:58 1253
SOC.025-login-after-long-inactivity.json 29-Jul-2026 11:58 1101
SOC.026-reverse-shell-detected.json 29-Jul-2026 11:58 1505
SOC.027-curl-pipe-bash-dropper.json 29-Jul-2026 11:58 1492
SOC.028-python-suspicious-c-payload.json 29-Jul-2026 11:58 1232
SOC.029-netcat-listener.json 29-Jul-2026 11:58 1202
SOC.030-process-executing-from-dev-shm.json 29-Jul-2026 11:58 1190
SOC.031-base64-decode-and-execute.json 29-Jul-2026 11:58 1260
SOC.032-suspicious-interpreter-spawn.json 29-Jul-2026 11:58 1116
SOC.033-wget-download-to-tmp.json 29-Jul-2026 11:58 1044
SOC.034-cron-entry-with-curl-wget.json 29-Jul-2026 11:58 1354
SOC.035-cron-entry-with-tmp-path.json 29-Jul-2026 11:58 1031
SOC.036-systemd-unit-with-tmp-exec.json 29-Jul-2026 11:58 1031
SOC.037-systemd-timer-created.json 29-Jul-2026 11:58 1045
SOC.038-init-d-script-added.json 29-Jul-2026 11:58 661
SOC.039-rc-local-modified.json 29-Jul-2026 11:58 678
SOC.040-profile-d-script-added.json 29-Jul-2026 11:58 1001
SOC.041-motd-script-modified.json 29-Jul-2026 11:58 988
SOC.042-bashrc-modified-system-wide.json 29-Jul-2026 11:58 1059
SOC.043-ssh-authorizedkeys-forcecommand.json 29-Jul-2026 11:58 1073
SOC.044-at-job-scheduled.json 29-Jul-2026 11:58 994
SOC.045-user-crontab-modified.json 29-Jul-2026 11:58 979
SOC.046-new-suid-binary-created.json 29-Jul-2026 11:58 1545
SOC.047-sudoers-d-entry-added.json 29-Jul-2026 11:58 1053
SOC.048-user-added-to-privileged-group.json 29-Jul-2026 11:58 1145
SOC.049-capabilities-set-on-binary.json 29-Jul-2026 11:58 1058
SOC.050-polkit-policy-modified.json 29-Jul-2026 11:58 1029
SOC.051-doas-configuration-modified.json 29-Jul-2026 11:58 996
SOC.052-bash-history-cleared.json 29-Jul-2026 11:58 1130
SOC.053-log-file-deleted-or-modified.json 29-Jul-2026 11:58 1109
SOC.054-shred-command-usage.json 29-Jul-2026 11:58 721
SOC.055-ld-so-preload-modified.json 29-Jul-2026 11:58 1088
SOC.056-file-made-immutable-chattr-i.json 29-Jul-2026 11:58 1066
SOC.057-kernel-module-loaded.json 29-Jul-2026 11:58 1066
SOC.058-kernel-module-removed.json 29-Jul-2026 11:58 692
SOC.059-auditd-stopped-or-disabled.json 29-Jul-2026 11:58 1231
SOC.060-private-ssh-key-accessed.json 29-Jul-2026 11:58 1059
SOC.061-credentials-file-in-tmp.json 29-Jul-2026 11:58 1753
SOC.062-memory-dump-tool-gcore.json 29-Jul-2026 11:58 1113
SOC.063-aws-credentials-file-accessed.json 29-Jul-2026 11:58 1062
SOC.064-tcpdump-on-auth-traffic.json 29-Jul-2026 11:58 1031
SOC.065-sudo-failed-repeatedly.json 29-Jul-2026 11:58 1228
SOC.066-process-discovery-burst.json 29-Jul-2026 11:58 1179
SOC.067-network-service-discovery.json 29-Jul-2026 11:58 1167
SOC.068-host-information-discovery.json 29-Jul-2026 11:58 1229
SOC.069-sensitive-file-search.json 29-Jul-2026 11:58 1582
SOC.070-container-escape-detection.json 29-Jul-2026 11:58 1072
SOC.071-account-discovery-via-getent.json 29-Jul-2026 11:58 987
SOC.072-mass-archive-of-home-directory.json 29-Jul-2026 11:58 1097
SOC.073-database-dump-activity.json 29-Jul-2026 11:58 1091
SOC.074-document-harvesting.json 29-Jul-2026 11:58 1525
SOC.075-disk-image-capture-dd.json 29-Jul-2026 11:58 1015
SOC.076-connection-to-known-mining-pool.json 29-Jul-2026 11:58 1119
SOC.077-connection-via-tor.json 29-Jul-2026 11:58 1356
SOC.078-https-on-non-standard-port.json 29-Jul-2026 11:58 1352
SOC.079-dns-tunneling-indicator.json 29-Jul-2026 11:58 1054
SOC.080-encrypted-tunnel-stunnel-socat.json 29-Jul-2026 11:58 1066
SOC.081-beaconing-pattern-detected.json 29-Jul-2026 11:58 1191
SOC.082-large-outbound-transfer.json 29-Jul-2026 11:58 1043
SOC.083-outbound-on-non-standard-port.json 29-Jul-2026 11:58 1290
SOC.084-encrypted-archive-created.json 29-Jul-2026 11:58 1056
SOC.085-data-uploaded-to-file-sharing-service.json 29-Jul-2026 11:58 1618
SOC.086-cryptominer-process-detected.json 29-Jul-2026 11:58 838
SOC.087-mass-file-deletion-rm-rf.json 29-Jul-2026 11:58 1627
SOC.088-unexpected-system-reboot.json 29-Jul-2026 11:58 690
SOC.089-system-time-changed.json 29-Jul-2026 11:58 1102
SOC.090-disk-fill-attack.json 29-Jul-2026 11:58 1016
SOC.091-service-stopped-unexpectedly.json 29-Jul-2026 11:58 1365
SOC.092-high-cpu-sustained-anomaly.json 29-Jul-2026 11:58 1348
SOC.093-ssh-lateral-movement.json 29-Jul-2026 11:58 1070
SOC.094-scp-file-transfer-to-internal-host.json 29-Jul-2026 11:58 1123
SOC.095-shell-spawned-by-web-server.json 29-Jul-2026 11:58 1636
SOC.096-history-symlinked-to-dev-null.json 29-Jul-2026 11:58 1265
SOC.097-process-running-from-deleted-binary.json 29-Jul-2026 11:58 1334
SOC.098-crontab-modified-directly.json 29-Jul-2026 11:58 1015
SOC.099-nmap-installed.json 29-Jul-2026 11:58 1235
SOC.100-security-tool-uninstalled.json 29-Jul-2026 11:58 1173
index.txt 29-Jul-2026 11:58 3838