Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads962 copies13 likes34,167 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Linux BPFDoor iptables Redirect
Gravwell
Detects BPFDoor-style iptables NAT REDIRECT rules used to tunnel traffic from a
legitimate service port to a high ephemeral shell port (42391-43390) without
disrupting the real service for other clients. BPFDoor activates on magic packets, spawns a bind shell, inserts short-lived PREROUTING redirects for the controller IP, then deletes them.
legitimate service port to a high ephemeral shell port (42391-43390) without
disrupting the real service for other clients. BPFDoor activates on magic packets, spawns a bind shell, inserts short-lived PREROUTING redirects for the controller IP, then deletes them.
Hunting rule for Atomic Red Team T1090.001 test "Connection Proxy" (Proxy: Internal Proxy). Correlate with additional signals before alerting.
Hunting rule for Atomic Red Team T1090.001 test "Connection Proxy" (Proxy: Internal Proxy). Correlate with additional signals before alerting.
Detects fileless Linux malware execution patterns that run payloads from anonymous memory files (memfd_create) or inherited file descriptors under /proc/self/fd without touching disk. Used by Linux backdoors and miners to evade filesystem-based detection.
Hunting rule for nmap used for internal network discovery.
Legitimate vulnerability management and pentests also run nmap; prioritize hits when the source is a server or workload not in your scanner inventory, the parent is an interactive shell or script dropped, or the event chains with
tunneling (chisel, proxychains), or lateral movement.
Strongest signals: RFC1918 subnet sweeps, proxychains-wrapped
-sT/-Pn scans, and full-port sweeps across private ranges.
Legitimate vulnerability management and pentests also run nmap; prioritize hits when the source is a server or workload not in your scanner inventory, the parent is an interactive shell or script dropped, or the event chains with
tunneling (chisel, proxychains), or lateral movement.
Strongest signals: RFC1918 subnet sweeps, proxychains-wrapped
-sT/-Pn scans, and full-port sweeps across private ranges.
Detects attackers creating transient systemd units via systemd-run to persist malware or
reverse shells outside normal unit files. Linux malware families including cryptominers and
botnets use --remain-after-exit and custom unit names under /tmp or /dev/shm to survive
logout while evading static service file inspection.
reverse shells outside normal unit files. Linux malware families including cryptominers and
botnets use --remain-after-exit and custom unit names under /tmp or /dev/shm to survive
logout while evading static service file inspection.
Hunting rule for T1222 "Enable Local and Remote Symbolic Links via reg.exe". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule loosely modeled after Atomic Red Team T1112 test "Disable Windows Change Password Feature". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule loosely modeled after Atomic Red Team T1112 test "Disable Windows Task Manager application". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule based off of T1112 technique "Modify Registry of Local Machine - cmd". No public in-the-wild intel reference available; correlate before alerting.
Page 6 of 38