Index of /rules.d/653967e/
../
SOC.001-ssh-brute-force-succeeded.json 18-Jul-2026 19:17 1094
SOC.002-ssh-brute-force-on-root.json 18-Jul-2026 19:17 1365
SOC.003-backdoor-user-with-persistence.json 18-Jul-2026 19:17 1337
SOC.004-ssh-key-dropped-for-new-user.json 18-Jul-2026 19:17 1051
SOC.005-sudoers-tampering.json 18-Jul-2026 19:17 1029
SOC.006-shadow-file-tampering.json 18-Jul-2026 19:17 1020
SOC.007-uid-0-escalation.json 18-Jul-2026 19:17 1103
SOC.008-suspicious-binary-in-tmp.json 18-Jul-2026 19:17 1653
SOC.009-webroot-write-webshell.json 18-Jul-2026 19:17 1458
SOC.010-mass-ssh-failures.json 18-Jul-2026 19:17 1377
SOC.011-persistence-mechanism-added.json 18-Jul-2026 19:17 880
SOC.012-multiple-new-users-created.json 18-Jul-2026 19:17 1126
SOC.013-sensitive-file-write.json 18-Jul-2026 19:17 693
SOC.014-port-scan-rapid-port-discovery.json 18-Jul-2026 19:17 1227
SOC.015-ssh-probing-invalid-users.json 18-Jul-2026 19:17 1451
SOC.016-service-fingerprinting-connection-sweep..> 18-Jul-2026 19:17 785
SOC.017-host-file-tampering-etc-hosts.json 18-Jul-2026 19:17 1064
SOC.018-ssh-key-auth-from-new-ip.json 18-Jul-2026 19:17 1035
SOC.019-ssh-from-known-bad-asn.json 18-Jul-2026 19:17 1140
SOC.020-root-ssh-login.json 18-Jul-2026 19:17 1029
SOC.021-ssh-at-unusual-hour.json 18-Jul-2026 19:17 1018
SOC.022-ssh-config-permitrootlogin-changed.json 18-Jul-2026 19:17 1066
SOC.023-pam-configuration-modified.json 18-Jul-2026 19:17 1066
SOC.024-multiple-successful-ssh-from-same-ip.json 18-Jul-2026 19:17 1253
SOC.025-login-after-long-inactivity.json 18-Jul-2026 19:17 1101
SOC.026-reverse-shell-detected.json 18-Jul-2026 19:17 1505
SOC.027-curl-pipe-bash-dropper.json 18-Jul-2026 19:17 1492
SOC.028-python-suspicious-c-payload.json 18-Jul-2026 19:17 1232
SOC.029-netcat-listener.json 18-Jul-2026 19:17 1202
SOC.030-process-executing-from-dev-shm.json 18-Jul-2026 19:17 1190
SOC.031-base64-decode-and-execute.json 18-Jul-2026 19:17 1260
SOC.032-suspicious-interpreter-spawn.json 18-Jul-2026 19:17 1116
SOC.033-wget-download-to-tmp.json 18-Jul-2026 19:17 1044
SOC.034-cron-entry-with-curl-wget.json 18-Jul-2026 19:17 1354
SOC.035-cron-entry-with-tmp-path.json 18-Jul-2026 19:17 1031
SOC.036-systemd-unit-with-tmp-exec.json 18-Jul-2026 19:17 1031
SOC.037-systemd-timer-created.json 18-Jul-2026 19:17 1045
SOC.038-init-d-script-added.json 18-Jul-2026 19:17 661
SOC.039-rc-local-modified.json 18-Jul-2026 19:17 678
SOC.040-profile-d-script-added.json 18-Jul-2026 19:17 1001
SOC.041-motd-script-modified.json 18-Jul-2026 19:17 988
SOC.042-bashrc-modified-system-wide.json 18-Jul-2026 19:17 1059
SOC.043-ssh-authorizedkeys-forcecommand.json 18-Jul-2026 19:17 1073
SOC.044-at-job-scheduled.json 18-Jul-2026 19:17 994
SOC.045-user-crontab-modified.json 18-Jul-2026 19:17 979
SOC.046-new-suid-binary-created.json 18-Jul-2026 19:17 1545
SOC.047-sudoers-d-entry-added.json 18-Jul-2026 19:17 1053
SOC.048-user-added-to-privileged-group.json 18-Jul-2026 19:17 1145
SOC.049-capabilities-set-on-binary.json 18-Jul-2026 19:17 1058
SOC.050-polkit-policy-modified.json 18-Jul-2026 19:17 1029
SOC.051-doas-configuration-modified.json 18-Jul-2026 19:17 996
SOC.052-bash-history-cleared.json 18-Jul-2026 19:17 1130
SOC.053-log-file-deleted-or-modified.json 18-Jul-2026 19:17 1109
SOC.054-shred-command-usage.json 18-Jul-2026 19:17 721
SOC.055-ld-so-preload-modified.json 18-Jul-2026 19:17 1088
SOC.056-file-made-immutable-chattr-i.json 18-Jul-2026 19:17 1066
SOC.057-kernel-module-loaded.json 18-Jul-2026 19:17 1066
SOC.058-kernel-module-removed.json 18-Jul-2026 19:17 692
SOC.059-auditd-stopped-or-disabled.json 18-Jul-2026 19:17 1231
SOC.060-private-ssh-key-accessed.json 18-Jul-2026 19:17 1059
SOC.061-credentials-file-in-tmp.json 18-Jul-2026 19:17 1753
SOC.062-memory-dump-tool-gcore.json 18-Jul-2026 19:17 1113
SOC.063-aws-credentials-file-accessed.json 18-Jul-2026 19:17 1062
SOC.064-tcpdump-on-auth-traffic.json 18-Jul-2026 19:17 1031
SOC.065-sudo-failed-repeatedly.json 18-Jul-2026 19:17 1228
SOC.066-process-discovery-burst.json 18-Jul-2026 19:17 1179
SOC.067-network-service-discovery.json 18-Jul-2026 19:17 1167
SOC.068-host-information-discovery.json 18-Jul-2026 19:17 1229
SOC.069-sensitive-file-search.json 18-Jul-2026 19:17 1582
SOC.070-container-escape-detection.json 18-Jul-2026 19:17 1072
SOC.071-account-discovery-via-getent.json 18-Jul-2026 19:17 987
SOC.072-mass-archive-of-home-directory.json 18-Jul-2026 19:17 1097
SOC.073-database-dump-activity.json 18-Jul-2026 19:17 1091
SOC.074-document-harvesting.json 18-Jul-2026 19:17 1525
SOC.075-disk-image-capture-dd.json 18-Jul-2026 19:17 1015
SOC.076-connection-to-known-mining-pool.json 18-Jul-2026 19:17 1119
SOC.077-connection-via-tor.json 18-Jul-2026 19:17 1356
SOC.078-https-on-non-standard-port.json 18-Jul-2026 19:17 1352
SOC.079-dns-tunneling-indicator.json 18-Jul-2026 19:17 1054
SOC.080-encrypted-tunnel-stunnel-socat.json 18-Jul-2026 19:17 1066
SOC.081-beaconing-pattern-detected.json 18-Jul-2026 19:17 1191
SOC.082-large-outbound-transfer.json 18-Jul-2026 19:17 1043
SOC.083-outbound-on-non-standard-port.json 18-Jul-2026 19:17 1290
SOC.084-encrypted-archive-created.json 18-Jul-2026 19:17 1056
SOC.085-data-uploaded-to-file-sharing-service.json 18-Jul-2026 19:17 1618
SOC.086-cryptominer-process-detected.json 18-Jul-2026 19:17 838
SOC.087-mass-file-deletion-rm-rf.json 18-Jul-2026 19:17 1627
SOC.088-unexpected-system-reboot.json 18-Jul-2026 19:17 690
SOC.089-system-time-changed.json 18-Jul-2026 19:17 1102
SOC.090-disk-fill-attack.json 18-Jul-2026 19:17 1016
SOC.091-service-stopped-unexpectedly.json 18-Jul-2026 19:17 1365
SOC.092-high-cpu-sustained-anomaly.json 18-Jul-2026 19:17 1348
SOC.093-ssh-lateral-movement.json 18-Jul-2026 19:17 1070
SOC.094-scp-file-transfer-to-internal-host.json 18-Jul-2026 19:17 1123
SOC.095-shell-spawned-by-web-server.json 18-Jul-2026 19:17 1636
SOC.096-history-symlinked-to-dev-null.json 18-Jul-2026 19:17 1265
SOC.097-process-running-from-deleted-binary.json 18-Jul-2026 19:17 1334
SOC.098-crontab-modified-directly.json 18-Jul-2026 19:17 1015
SOC.099-nmap-installed.json 18-Jul-2026 19:17 1235
SOC.100-security-tool-uninstalled.json 18-Jul-2026 19:17 1173
index.txt 18-Jul-2026 19:17 3838