SOC.001-ssh-brute-force-succeeded.json
SOC.002-ssh-brute-force-on-root.json
SOC.003-backdoor-user-with-persistence.json
SOC.004-ssh-key-dropped-for-new-user.json
SOC.005-sudoers-tampering.json
SOC.006-shadow-file-tampering.json
SOC.007-uid-0-escalation.json
SOC.008-suspicious-binary-in-tmp.json
SOC.009-webroot-write-webshell.json
SOC.010-mass-ssh-failures.json
SOC.011-persistence-mechanism-added.json
SOC.012-multiple-new-users-created.json
SOC.013-sensitive-file-write.json
SOC.014-port-scan-rapid-port-discovery.json
SOC.015-ssh-probing-invalid-users.json
SOC.016-service-fingerprinting-connection-sweep.json
SOC.017-host-file-tampering-etc-hosts.json
SOC.018-ssh-key-auth-from-new-ip.json
SOC.019-ssh-from-known-bad-asn.json
SOC.020-root-ssh-login.json
SOC.021-ssh-at-unusual-hour.json
SOC.022-ssh-config-permitrootlogin-changed.json
SOC.023-pam-configuration-modified.json
SOC.024-multiple-successful-ssh-from-same-ip.json
SOC.025-login-after-long-inactivity.json
SOC.026-reverse-shell-detected.json
SOC.027-curl-pipe-bash-dropper.json
SOC.028-python-suspicious-c-payload.json
SOC.029-netcat-listener.json
SOC.030-process-executing-from-dev-shm.json
SOC.031-base64-decode-and-execute.json
SOC.032-suspicious-interpreter-spawn.json
SOC.033-wget-download-to-tmp.json
SOC.034-cron-entry-with-curl-wget.json
SOC.035-cron-entry-with-tmp-path.json
SOC.036-systemd-unit-with-tmp-exec.json
SOC.037-systemd-timer-created.json
SOC.038-init-d-script-added.json
SOC.039-rc-local-modified.json
SOC.040-profile-d-script-added.json
SOC.041-motd-script-modified.json
SOC.042-bashrc-modified-system-wide.json
SOC.043-ssh-authorizedkeys-forcecommand.json
SOC.044-at-job-scheduled.json
SOC.045-user-crontab-modified.json
SOC.046-new-suid-binary-created.json
SOC.047-sudoers-d-entry-added.json
SOC.048-user-added-to-privileged-group.json
SOC.049-capabilities-set-on-binary.json
SOC.050-polkit-policy-modified.json
SOC.051-doas-configuration-modified.json
SOC.052-bash-history-cleared.json
SOC.053-log-file-deleted-or-modified.json
SOC.054-shred-command-usage.json
SOC.055-ld-so-preload-modified.json
SOC.056-file-made-immutable-chattr-i.json
SOC.057-kernel-module-loaded.json
SOC.058-kernel-module-removed.json
SOC.059-auditd-stopped-or-disabled.json
SOC.060-private-ssh-key-accessed.json
SOC.061-credentials-file-in-tmp.json
SOC.062-memory-dump-tool-gcore.json
SOC.063-aws-credentials-file-accessed.json
SOC.064-tcpdump-on-auth-traffic.json
SOC.065-sudo-failed-repeatedly.json
SOC.066-process-discovery-burst.json
SOC.067-network-service-discovery.json
SOC.068-host-information-discovery.json
SOC.069-sensitive-file-search.json
SOC.070-container-escape-detection.json
SOC.071-account-discovery-via-getent.json
SOC.072-mass-archive-of-home-directory.json
SOC.073-database-dump-activity.json
SOC.074-document-harvesting.json
SOC.075-disk-image-capture-dd.json
SOC.076-connection-to-known-mining-pool.json
SOC.077-connection-via-tor.json
SOC.078-https-on-non-standard-port.json
SOC.079-dns-tunneling-indicator.json
SOC.080-encrypted-tunnel-stunnel-socat.json
SOC.081-beaconing-pattern-detected.json
SOC.082-large-outbound-transfer.json
SOC.083-outbound-on-non-standard-port.json
SOC.084-encrypted-archive-created.json
SOC.085-data-uploaded-to-file-sharing-service.json
SOC.086-cryptominer-process-detected.json
SOC.087-mass-file-deletion-rm-rf.json
SOC.088-unexpected-system-reboot.json
SOC.089-system-time-changed.json
SOC.090-disk-fill-attack.json
SOC.091-service-stopped-unexpectedly.json
SOC.092-high-cpu-sustained-anomaly.json
SOC.093-ssh-lateral-movement.json
SOC.094-scp-file-transfer-to-internal-host.json
SOC.095-shell-spawned-by-web-server.json
SOC.096-history-symlinked-to-dev-null.json
SOC.097-process-running-from-deleted-binary.json
SOC.098-crontab-modified-directly.json
SOC.099-nmap-installed.json
SOC.100-security-tool-uninstalled.json