Linux stager profiling host and gating deployment on HAProxy/cron + root
Detects a sequence of system reconnaissance commands consistent with a Linux stager preparing to deploy a malicious cron payload. The rule identifies the combination of process enumeration (specifically targeting haproxy or cron services), privilege verification, and OS environment profiling (hostname, kernel, or distribution details) occurring within a single execution context.
Microsoft Sentinel (KQL)
