deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: FortiGate - New Firewall Policy Added
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Marco Pedrinazzi @pedrinazziM (InTheCyber)
Date: 2025-11-01
ATT&CK techniques: T1685
Log source: fortigate/

Description:
Detects the addition of a new firewall policy on a Fortinet FortiGate Firewall.

Detection logic:
{
  "selection": {
    "action": "Add",
    "cfgpath": "firewall.policy"
  },
  "condition": "selection"
}

References:
  - https://www.fortiguard.com/psirt/FG-IR-24-535
  - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
  - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/333889629/config-firewall-policy
  - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr
Sigma Detection Rule: OneLogin User Account Locked
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Austin Songer @austinsonger
Date: 2021-10-12
Log source: onelogin/

Description:
Detects when an user account is locked or suspended.

Detection logic:
{
  "selection1": {
    "event_type_id": 532
  },
  "selection2": {
    "event_type_id": 553
  },
  "selection3": {
    "event_type_id": 551
  },
  "condition": "1 of selection*"
}

References:
  - https://developers.onelogin.com/api-docs/1/events/event-resource/
Sigma Detection Rule: OneLogin User Assumed Another User
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Austin Songer @austinsonger
Date: 2021-10-12
Log source: onelogin/

Description:
Detects when an user assumed another user account.

Detection logic:
{
  "selection": {
    "event_type_id": 3
  },
  "condition": "selection"
}

References:
  - https://developers.onelogin.com/api-docs/1/events/event-resource
Sigma Detection Rule: Cisco Duo Successful MFA Authentication Via Bypass Code
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nikita Khalimonenkov
Date: 2024-04-17
Log source: cisco/

Description:
Detects when a successful MFA authentication occurs due to the use of a bypass code.
A bypass code is a temporary passcode created by an administrator for a specific user to access a Duo-protected application. These are generally used as "backup codes," so that enrolled users who are having problems with their mobile devices (e.g., mobile service is disrupted, the device is lost or stolen, etc.) or who temporarily can't use their enrolled devices (on a plane without mobile data services) can still access their Duo-protected systems.


Detection logic:
{
  "selection": {
    "event_type": "authentication",
    "reason": "bypass_user"
  },
  "condition": "selection"
}

References:
  - https://duo.com/docs/adminapi#logs
  - https://help.duo.com/s/article/6327?language=en_US
Sigma Detection Rule: Potential Okta Password in AlternateID Field
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: kelnage
Date: 2023-04-03
ATT&CK techniques: T1552
Log source: okta/

Description:
Detects when a user has potentially entered their password into the
username field, which will cause the password to be retained in log files.


Detection logic:
{
  "selection": {
    "legacyEventType": "core.user_auth.login_failed"
  },
  "filter_main": {
    "actor.alternateId|re": "(^0oa.*|[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,10})"
  },
  "condition": "selection and not filter_main"
}

References:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://www.mitiga.io/blog/how-okta-passwords-can-be-compromised-uncovering-a-risk-to-user-data
  - https://help.okta.com/en-us/Content/Topics/users-groups-profiles/usgp-create-character-restriction.htm
Sigma Detection Rule: Okta Policy Modified or Deleted
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Austin Songer @austinsonger
Date: 2021-09-12
Log source: okta/

Description:
Detects when an Okta policy is modified or deleted.

Detection logic:
{
  "selection": {
    "eventType": [
      "policy.lifecycle.update",
      "policy.lifecycle.delete"
    ]
  },
  "condition": "selection"
}

References:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
Sigma Detection Rule: Okta Identity Provider Created
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: kelnage
Date: 2023-09-07
ATT&CK techniques: T1098.001
Log source: okta/

Description:
Detects when a new identity provider is created for Okta.

Detection logic:
{
  "selection": {
    "eventType": "system.idp.lifecycle.create"
  },
  "condition": "selection"
}

References:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
Sigma Detection Rule: Okta Application Modified or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-09-12
Log source: okta/

Description:
Detects when an application is modified or deleted.

Detection logic:
{
  "selection": {
    "eventType": [
      "application.lifecycle.update",
      "application.lifecycle.delete"
    ]
  },
  "condition": "selection"
}

References:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
Sigma Detection Rule: Okta User Account Locked Out
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-09-12
ATT&CK techniques: T1531
Log source: okta/

Description:
Detects when an user account is locked out.

Detection logic:
{
  "selection": {
    "displayMessage": "Max sign in attempts exceeded"
  },
  "condition": "selection"
}

References:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
Sigma Detection Rule: Okta Unauthorized Access to App
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-09-12
Log source: okta/

Description:
Detects when unauthorized access to app occurs.

Detection logic:
{
  "selection": {
    "displayMessage": "User attempted unauthorized access to app"
  },
  "condition": "selection"
}

References:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
Sigma Detection Rule: Okta New Admin Console Behaviours
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: kelnage
Date: 2023-09-07
ATT&CK techniques: T1078.004
Log source: okta/

Description:
Detects when Okta identifies new activity in the Admin Console.

Detection logic:
{
  "selection_event": {
    "eventType": "policy.evaluate_sign_on",
    "target.displayName": "Okta Admin Console"
  },
  "selection_positive": [
    {
      "debugContext.debugData.behaviors|contains": "POSITIVE"
    },
    {
      "debugContext.debugData.logOnlySecurityData|contains": "POSITIVE"
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
Sigma Detection Rule: New Okta User Created
Repository: SigmaHQ/sigma
Severity: informational
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-10-25
Log source: okta/

Description:
Detects new user account creation

Detection logic:
{
  "selection": {
    "eventType": "user.lifecycle.create"
  },
  "condition": "selection"
}

References:
  - https://developer.okta.com/docs/reference/api/event-types/
Sigma Detection Rule: Okta Application Sign-On Policy Modified or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-09-12
Log source: okta/

Description:
Detects when an application Sign-on Policy is modified or deleted.

Detection logic:
{
  "selection": {
    "eventType": [
      "application.policy.sign_on.update",
      "application.policy.sign_on.rule.delete"
    ]
  },
  "condition": "selection"
}

References:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
Sigma Detection Rule: Okta Admin Functions Access Through Proxy
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Muhammad Faisal @faisalusuf
Date: 2023-10-25
Log source: okta/

Description:
Detects access to Okta admin functions through proxy.

Detection logic:
{
  "selection": {
    "debugContext.debugData.requestUri|contains": "admin",
    "securityContext.isProxy": "true"
  },
  "condition": "selection"
}

References:
  - https://www.beyondtrust.com/blog/entry/okta-support-unit-breach
  - https://dataconomy.com/2023/10/23/okta-data-breach/
  - https://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-compromise/
Sigma Detection Rule: Okta Policy Rule Modified or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-09-12
Log source: okta/

Description:
Detects when an Policy Rule is Modified or Deleted.

Detection logic:
{
  "selection": {
    "eventType": [
      "policy.rule.update",
      "policy.rule.delete"
    ]
  },
  "condition": "selection"
}

References:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
Sigma Detection Rule: Okta API Token Created
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-09-12
Log source: okta/

Description:
Detects when a API token is created

Detection logic:
{
  "selection": {
    "eventType": "system.api_token.create"
  },
  "condition": "selection"
}

References:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
Sigma Detection Rule: Okta User Session Start Via An Anonymising Proxy Service
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: kelnage
Date: 2023-09-07
ATT&CK techniques: T1685
Log source: okta/

Description:
Detects when an Okta user session starts where the user is behind an anonymising proxy service.

Detection logic:
{
  "selection": {
    "eventType": "user.session.start",
    "securityContext.isProxy": "true"
  },
  "condition": "selection"
}

References:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
Sigma Detection Rule: Okta Admin Role Assignment Created
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nikita Khalimonenkov
Date: 2023-01-19
Log source: okta/

Description:
Detects when a new admin role assignment is created. Which could be a sign of privilege escalation or persistence

Detection logic:
{
  "selection": {
    "eventType": "iam.resourceset.bindings.add"
  },
  "condition": "selection"
}

References:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
Sigma Detection Rule: Okta MFA Reset or Deactivated
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-09-21
ATT&CK techniques: T1556.006
Log source: okta/

Description:
Detects when an attempt at deactivating  or resetting MFA.

Detection logic:
{
  "selection": {
    "eventType": [
      "user.mfa.factor.deactivate",
      "user.mfa.factor.reset_all"
    ]
  },
  "condition": "selection"
}

References:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
Sigma Detection Rule: Okta FastPass Phishing Detection
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Austin Songer @austinsonger
Date: 2023-05-07
ATT&CK techniques: T1566
Log source: okta/

Description:
Detects when Okta FastPass prevents a known phishing site.

Detection logic:
{
  "selection": {
    "outcome.reason": "FastPass declined phishing attempt",
    "outcome.result": "FAILURE",
    "eventType": "user.authentication.auth_via_mfa"
  },
  "condition": "selection"
}

References:
  - https://sec.okta.com/fastpassphishingdetection
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
Sigma Detection Rule: Okta Admin Role Assigned to an User or Group
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-09-12
ATT&CK techniques: T1098.003
Log source: okta/

Description:
Detects when an the Administrator role is assigned to an user or group.

Detection logic:
{
  "selection": {
    "eventType": [
      "group.privilege.grant",
      "user.account.privilege.grant"
    ]
  },
  "condition": "selection"
}

References:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
Sigma Detection Rule: Okta API Token Revoked
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-09-12
Log source: okta/

Description:
Detects when a API Token is revoked.

Detection logic:
{
  "selection": {
    "eventType": "system.api_token.revoke"
  },
  "condition": "selection"
}

References:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
Sigma Detection Rule: Okta Security Threat Detected
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-09-12
Log source: okta/

Description:
Detects when an security threat is detected in Okta.

Detection logic:
{
  "selection": {
    "eventType": "security.threat.detected"
  },
  "condition": "selection"
}

References:
  - https://okta.github.io/okta-help/en/prod/Content/Topics/Security/threat-insight/configure-threatinsight-system-log.htm
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
Sigma Detection Rule: Okta Network Zone Deactivated or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-09-12
Log source: okta/

Description:
Detects when an Network Zone is Deactivated or Deleted.

Detection logic:
{
  "selection": {
    "eventType": [
      "zone.deactivate",
      "zone.delete"
    ]
  },
  "condition": "selection"
}

References:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
Sigma Detection Rule: Okta Suspicious Activity Reported by End-user
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: kelnage
Date: 2023-09-07
ATT&CK techniques: T1586.003
Log source: okta/

Description:
Detects when an Okta end-user reports activity by their account as being potentially suspicious.

Detection logic:
{
  "selection": {
    "eventType": "user.account.report_suspicious_activity_by_enduser"
  },
  "condition": "selection"
}

References:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://github.com/okta/workflows-templates/blob/1164f0eb71ce47c9ddc7d850e9ab87b5a2b42333/workflows/suspicious_activity_reported/readme.md
Sigma Detection Rule: Password Policy Discovery - Linux
Repository: SigmaHQ/sigma
Severity: low
Status: stable
Author: Ömer Günal, oscd.community, Pawel Mazur
Date: 2020-10-08
ATT&CK techniques: T1201
Log source: linux/

Description:
Detects password policy discovery commands

Detection logic:
{
  "selection_files": {
    "type": "PATH",
    "name": [
      "/etc/login.defs",
      "/etc/pam.d/auth",
      "/etc/pam.d/common-account",
      "/etc/pam.d/common-auth",
      "/etc/pam.d/common-password",
      "/etc/pam.d/system-auth",
      "/etc/security/pwquality.conf"
    ]
  },
  "selection_chage": {
    "type": "EXECVE",
    "a0": "chage",
    "a1": [
      "--list",
      "-l"
    ]
  },
  "selection_passwd": {
    "type": "EXECVE",
    "a0": "passwd",
    "a1": [
      "-S",
      "--status"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1201/T1201.md
  - https://linux.die.net/man/1/chage
  - https://man7.org/linux/man-pages/man1/passwd.1.html
  - https://superuser.com/questions/150675/how-to-display-password-policy-information-for-a-user-ubuntu
Sigma Detection Rule: Linux Keylogging with Pam.d
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Pawel Mazur
Date: 2021-05-24
ATT&CK techniques: T1003, T1056.001
Log source: linux/

Description:
Detect attempt to enable auditing of TTY input

Detection logic:
{
  "selection_path_events": {
    "type": "PATH",
    "name": [
      "/etc/pam.d/system-auth",
      "/etc/pam.d/password-auth"
    ]
  },
  "selection_tty_events": {
    "type": [
      "TTY",
      "USER_TTY"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.001/T1056.001.md
  - https://linux.die.net/man/8/pam_tty_audit
  - https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sec-configuring_pam_for_auditing
  - https://access.redhat.com/articles/4409591#audit-record-types-2
Sigma Detection Rule: System Information Discovery - Auditd
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Pawel Mazur
Date: 2021-09-03
ATT&CK techniques: T1082
Log source: linux/

Description:
Detects System Information Discovery commands

Detection logic:
{
  "selection_1": {
    "type": "PATH",
    "name": [
      "/etc/lsb-release",
      "/etc/redhat-release",
      "/etc/issue"
    ]
  },
  "selection_2": {
    "type": "EXECVE",
    "a0": [
      "uname",
      "uptime",
      "lsmod",
      "hostname",
      "env"
    ]
  },
  "selection_3": {
    "type": "EXECVE",
    "a0": "grep",
    "a1|contains": [
      "vbox",
      "vm",
      "xen",
      "virtio",
      "hv"
    ]
  },
  "selection_4": {
    "type": "EXECVE",
    "a0": "kmod",
    "a1": "list"
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f296668303c29d3f4c07e42bdd2b28d8dd6625f9/atomics/T1082/T1082.md
Sigma Detection Rule: Audio Capture
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Pawel Mazur, Milad Cheraghi
Date: 2021-09-04
ATT&CK techniques: T1123
Log source: linux/

Description:
Detects attempts to record audio using the arecord and ecasound utilities.

Detection logic:
{
  "selection_execve": {
    "type": "EXECVE",
    "a0": "arecord",
    "a1": "-vv",
    "a2": "-fdat"
  },
  "selection_syscall_memfd_create": {
    "type": "SYSCALL",
    "exe|endswith": "/ecasound",
    "SYSCALL": "memfd_create"
  },
  "condition": "1 of selection_*"
}

References:
  - https://linux.die.net/man/1/arecord
  - https://linuxconfig.org/how-to-test-microphone-with-audio-linux-sound-architecture-alsa
  - https://manpages.debian.org/unstable/ecasound/ecasound.1.en.html
  - https://ecasound.seul.org/ecasound/Documentation/examples.html#fconversions
Sigma Detection Rule: Suspicious C2 Activities
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Marie Euler
Date: 2020-05-18
Log source: linux/

Description:
Detects suspicious activities as declared by Florian Roth in its 'Best Practice Auditd Configuration'.
This includes the detection of the following commands; wget, curl, base64, nc, netcat, ncat, ssh, socat, wireshark, rawshark, rdesktop, nmap.
These commands match a few techniques from the tactics "Command and Control", including not exhaustively the following; Application Layer Protocol (T1071), Non-Application Layer Protocol (T1095), Data Encoding (T1132)


Detection logic:
{
  "selection": {
    "key": "susp_activity"
  },
  "condition": "selection"
}

References:
  - https://github.com/Neo23x0/auditd
Sigma Detection Rule: ASLR Disabled Via Sysctl or Direct Syscall - Linux
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Milad Cheraghi
Date: 2025-05-26
ATT&CK techniques: T1685, T1055.009
Log source: linux/

Description:
Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including:
  - Use of the `personality` syscall with the ADDR_NO_RANDOMIZE flag (0x0040000)
  - Modification of the /proc/sys/kernel/randomize_va_space file
  - Execution of the `sysctl` command to set `kernel.randomize_va_space=0`
Disabling ASLR is often used by attackers during exploit development or to bypass memory protection mechanisms.
A successful use of these methods can reduce the effectiveness of ASLR and make memory corruption attacks more reliable.


Detection logic:
{
  "selection_syscall": {
    "type": "SYSCALL",
    "SYSCALL": "personality",
    "a0": 40000
  },
  "selection_sysctl": {
    "type": "EXECVE",
    "a0": "sysctl",
    "a1": "-w",
    "a2": "kernel.randomize_va_space=0"
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/personality-syscall/README.md
  - https://man7.org/linux/man-pages/man2/personality.2.html
  - https://manual.cs50.io/2/personality
  - https://linux-audit.com/linux-aslr-and-kernelrandomize_va_space-setting/
Sigma Detection Rule: System Owner or User Discovery - Linux
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Timur Zinniatullin, oscd.community
Date: 2019-10-21
ATT&CK techniques: T1033
Log source: linux/

Description:
Detects the execution of host or user discovery utilities such as "whoami", "hostname", "id", etc.
Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.


Detection logic:
{
  "selection": {
    "type": "EXECVE",
    "a0": [
      "hostname",
      "id",
      "last",
      "uname",
      "users",
      "w",
      "who",
      "whoami"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1033/T1033.md
Sigma Detection Rule: Modify System Firewall
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: IAI
Date: 2023-03-06
ATT&CK techniques: T1686
Log source: linux/

Description:
Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to bypass controls limiting network usage or access.
Detection rules that match only on the disabling of firewalls will miss this.


Detection logic:
{
  "selection1": {
    "type": "EXECVE",
    "a0": "iptables",
    "a1|contains": "DROP"
  },
  "selection2": {
    "type": "EXECVE",
    "a0": "firewall-cmd",
    "a1|contains": "remove"
  },
  "selection3": {
    "type": "EXECVE",
    "a0": "ufw",
    "a1|contains": "delete"
  },
  "selection4": {
    "type": "EXECVE",
    "a0": "nft",
    "a1|contains": [
      "delete",
      "flush"
    ]
  },
  "condition": "1 of selection*"
}

References:
  - https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html
  - https://blog.aquasec.com/container-security-tnt-container-attack
  - https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/getting-started-with-nftables_configuring-and-managing-networking
Sigma Detection Rule: Clipboard Collection of Image Data with Xclip Tool
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Pawel Mazur
Date: 2021-10-01
ATT&CK techniques: T1115
Log source: linux/

Description:
Detects attempts to collect image data stored in the clipboard from users with the usage of xclip tool.
Xclip has to be installed.
Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.


Detection logic:
{
  "selection": {
    "type": "EXECVE",
    "a0": "xclip",
    "a1": [
      "-selection",
      "-sel"
    ],
    "a2": [
      "clipboard",
      "clip"
    ],
    "a3": "-t",
    "a4|startswith": "image/",
    "a5": "-o"
  },
  "condition": "selection"
}

References:
  - https://linux.die.net/man/1/xclip