VerdantBamboo BRICKSTORM rc.d Init Script Modification on FreeBSD/pfSense
Detects unauthorized modifications to FreeBSD init scripts located in /etc/rc.d/, /usr/local/etc/rc.d/, or /etc/rc.subr. These directories are used for system service startup. The rule specifically monitors for modifications related to the BRICKSTORM persistence mechanism, which targets these scripts to execute malicious binaries such as /usr/local/libexec/ipsec/blacklist.
Microsoft Sentinel (KQL)
