1200KM / tag
linux — logsource-product tag
190 related reference pages for logsource-product: linux.
Meaning and evidence boundary
Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.
Related pages
- Access of Sudoers File Content · sigma-rule
- ASLR Disabled Via Sysctl or Direct Syscall - Linux · sigma-rule
- Audio Capture · sigma-rule
- Audit Rules Deleted Via Auditctl · sigma-rule
- Auditing Configuration Changes on Linux Host · sigma-rule
- Binary Padding - Linux · sigma-rule
- BPFDoor Abnormal Process ID or Lock File Accessed · sigma-rule
- Bpfdoor TCP Ports Redirect · sigma-rule
- BPFtrace Unsafe Option Usage · sigma-rule
- Buffer Overflow Attempts · sigma-rule
- Capabilities Discovery - Linux · sigma-rule
- Capsh Shell Invocation - Linux · sigma-rule
- Chmod Targeting Sensitive Directories · sigma-rule
- Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall · sigma-rule
- Clipboard Collection of Image Data with Xclip Tool · sigma-rule
- Clipboard Collection with Xclip Tool · sigma-rule
- Clipboard Collection with Xclip Tool - Auditd · sigma-rule
- Code Injection by ld.so Preload · sigma-rule
- Commands to Clear or Remove the Syslog - Builtin · sigma-rule
- Communication To LocaltoNet Tunneling Service Initiated - Linux · sigma-rule
- Communication To Ngrok Tunneling Service - Linux · sigma-rule
- Connection Proxy · sigma-rule
- Container Residence Discovery Via Proc Virtual FS · sigma-rule
- Copy Passwd Or Shadow From TMP Path · sigma-rule
- Creation Of An User Account · sigma-rule
- Credentials In Files - Linux · sigma-rule
- Crontab Enumeration · sigma-rule
- Curl Usage on Linux · sigma-rule
- Data Compressed · sigma-rule
- Data Exfiltration with Wget · sigma-rule
- DD File Overwrite · sigma-rule
- Decode Base64 Encoded Text · sigma-rule
- Disable Or Stop Services · sigma-rule
- Disable System Firewall · sigma-rule
- Disabling Security Tools · sigma-rule
- Disabling Security Tools - Builtin · sigma-rule
- Docker Container Discovery Via Dockerenv Listing · sigma-rule
- Download File To Potentially Suspicious Directory Via Wget · sigma-rule
- Equation Group Indicators · sigma-rule
- ESXi Account Creation Via ESXCLI · sigma-rule
- ESXi Admin Permission Assigned To Account Via ESXCLI · sigma-rule
- ESXi Network Configuration Discovery Via ESXCLI · sigma-rule
- ESXi Storage Information Discovery Via ESXCLI · sigma-rule
- ESXi Syslog Configuration Change Via ESXCLI · sigma-rule
- ESXi System Information Discovery Via ESXCLI · sigma-rule
- ESXi VM Kill Via ESXCLI · sigma-rule
- ESXi VM List Discovery Via ESXCLI · sigma-rule
- ESXi VSAN Information Discovery Via ESXCLI · sigma-rule
- File and Directory Discovery - Linux · sigma-rule
- File Deletion · sigma-rule
- File or Folder Permissions Change · sigma-rule
- File Time Attribute Change - Linux · sigma-rule
- Flush Iptables Ufw Chain · sigma-rule
- Group Has Been Deleted Via Groupdel · sigma-rule
- Guacamole Two Users Sharing Session Anomaly · sigma-rule
- Hidden Files and Directories · sigma-rule
- History File Deletion · sigma-rule
- Inline Python Execution - Spawn Shell Via OS System Library · sigma-rule
- Install Root Certificate · sigma-rule
- Interactive Bash Suspicious Children · sigma-rule
- JexBoss Command Sequence · sigma-rule
- Kaspersky Endpoint Security Stopped Via CommandLine - Linux · sigma-rule
- Linux Base64 Encoded Pipe to Shell · sigma-rule
- Linux Base64 Encoded Shebang In CLI · sigma-rule
- Linux Capabilities Discovery · sigma-rule
- Linux Command History Tampering · sigma-rule
- Linux Crypto Mining Indicators · sigma-rule
- Linux Crypto Mining Pool Connections · sigma-rule
- Linux Doas Conf File Creation · sigma-rule
- Linux Doas Tool Execution · sigma-rule
- Linux HackTool Execution · sigma-rule
- Linux Keylogging with Pam.d · sigma-rule
- Linux Logs Clearing Attempts · sigma-rule
- Linux Network Service Scanning - Auditd · sigma-rule
- Linux Network Service Scanning Tools Execution · sigma-rule
- Linux Package Uninstall · sigma-rule
- Linux Recon Indicators · sigma-rule
- Linux Remote System Discovery · sigma-rule
- Linux Reverse Shell Indicator · sigma-rule
- Linux Setgid Capability Set on a Binary via Setcap Utility · sigma-rule
- Linux Setuid Capability Set on a Binary via Setcap Utility · sigma-rule
- Linux Shell Pipe to Shell · sigma-rule
- Linux Sudo Chroot Execution · sigma-rule
- Linux Webshell Indicators · sigma-rule
- Loading of Kernel Module via Insmod · sigma-rule
- Local Groups Discovery - Linux · sigma-rule
- Local System Accounts Discovery - Linux · sigma-rule
- Logging Configuration Changes on Linux Host · sigma-rule
- Mask System Power Settings Via Systemctl · sigma-rule
- Masquerading as Linux Crond Process · sigma-rule
- Modification of ld.so.preload · sigma-rule
- Modify System Firewall · sigma-rule
- Modifying Crontab · sigma-rule
- Mount Execution With Hidepid Parameter · sigma-rule
- Network Sniffing - Linux · sigma-rule
- New Cron File Created · sigma-rule
- Nohup Execution · sigma-rule
- OMIGOD SCX RunAsProvider ExecuteScript · sigma-rule
- OMIGOD SCX RunAsProvider ExecuteShellCommand · sigma-rule
- OS Architecture Discovery Via Grep · sigma-rule
- Overwriting the File with Dev Zero or Null · sigma-rule
- Password Policy Discovery - Linux · sigma-rule
- Persistence Via Sudoers.d Files · sigma-rule
- Pnscan Binary Data Transmission Activity · sigma-rule
- Possible Coin Miner CPU Priority Param · sigma-rule
- Potential Abuse of Linux Magic System Request Key · sigma-rule
- Potential Container Discovery Via Inodes Listing · sigma-rule
- Potential Discovery Activity Using Find - Linux · sigma-rule
- Potential GobRAT File Discovery Via Grep · sigma-rule
- Potential Linux Amazon SSM Agent Hijacking · sigma-rule
- Potential Linux Process Code Injection Via DD Utility · sigma-rule
- Potential Netcat Reverse Shell Execution · sigma-rule
- Potential Suspicious Change To Sensitive/Critical Files · sigma-rule
- Potential Xterm Reverse Shell · sigma-rule
- Potentially Suspicious Execution From Tmp Folder · sigma-rule
- Potentially Suspicious Malware Callback Communication - Linux · sigma-rule
- Print History File Contents · sigma-rule
- Privileged User Has Been Created · sigma-rule
- Process Execution From Shared Memory Directory · sigma-rule
- Program Executions in Suspicious Folders · sigma-rule
- PUA - TruffleHog Execution - Linux · sigma-rule
- Python One-Liners with Base64 Decoding - Linux · sigma-rule
- Python Spawning Pretty TTY Via PTY Module · sigma-rule
- Python WebServer Execution - Linux · sigma-rule
- Relevant ClamAV Message · sigma-rule
- Remote Access Tool - Team Viewer Session Started On Linux Host · sigma-rule
- Remote File Copy · sigma-rule
- Remove Immutable File Attribute · sigma-rule
- Remove Immutable File Attribute - Auditd · sigma-rule
- Scheduled Cron Task/Job - Linux · sigma-rule
- Scheduled Task/Job At · sigma-rule
- Screen Capture with Import Tool · sigma-rule
- Screen Capture with Xwd · sigma-rule
- Script Interpreter Spawning Credential Scanner - Linux · sigma-rule
- Security Software Discovery - Linux · sigma-rule
- Service Reload or Start - Linux · sigma-rule
- Setuid and Setgid · sigma-rule
- Shell Execution GCC - Linux · sigma-rule
- Shell Execution via Find - Linux · sigma-rule
- Shell Execution via Flock - Linux · sigma-rule
- Shell Execution via Git - Linux · sigma-rule
- Shell Execution via Nice - Linux · sigma-rule
- Shell Execution via Rsync - Linux · sigma-rule
- Shell Invocation via Apt - Linux · sigma-rule
- Shell Invocation via Env Command - Linux · sigma-rule
- Shell Invocation Via Ssh - Linux · sigma-rule
- Shellshock Expression · sigma-rule
- Special File Creation via Mknod Syscall · sigma-rule
- Split A File Into Pieces - Linux · sigma-rule
- Steganography Extract Files with Steghide · sigma-rule
- Steganography Hide Files with Steghide · sigma-rule
- Steganography Hide Zip Information in Picture File · sigma-rule
- Steganography Unzip Hidden Information From Picture File · sigma-rule
- Suspicious Activity in Shell Commands · sigma-rule
- Suspicious Commands Linux · sigma-rule
- Suspicious Curl Change User Agents - Linux · sigma-rule
- Suspicious Curl File Upload - Linux · sigma-rule
- Suspicious Download and Execute Pattern via Curl/Wget · sigma-rule
- Suspicious Filename with Embedded Base64 Commands · sigma-rule
- Suspicious Git Clone - Linux · sigma-rule
- Suspicious History File Operations - Linux · sigma-rule
- Suspicious Invocation of Shell via AWK - Linux · sigma-rule
- Suspicious Invocation of Shell via Rsync · sigma-rule
- Suspicious Java Children Processes · sigma-rule
- Suspicious Named Error · sigma-rule
- Suspicious OpenSSH Daemon Error · sigma-rule
- Suspicious Package Installed - Linux · sigma-rule
- Suspicious Reverse Shell Command Line · sigma-rule
- Suspicious VSFTPD Error Messages · sigma-rule
- Symlink Etc Passwd · sigma-rule
- Syslog Clearing or Removal Via System Utilities · sigma-rule
- System and Hardware Information Discovery · sigma-rule
- System Info Discovery via Sysinfo Syscall · sigma-rule
- System Information Discovery · sigma-rule
- System Information Discovery - Auditd · sigma-rule
- System Network Connections Discovery - Linux · sigma-rule
- System Network Discovery - Linux · sigma-rule
- System Owner or User Discovery - Linux · sigma-rule
- System Shutdown/Reboot - Linux · sigma-rule
- Systemd Service Creation · sigma-rule
- Touch Suspicious Service File · sigma-rule
- Triple Cross eBPF Rootkit Default Persistence · sigma-rule
- Triple Cross eBPF Rootkit Install Commands · sigma-rule
- UFW Disable Attempt · sigma-rule
- Unix Shell Configuration Modification · sigma-rule
- Use Of Hidden Paths Or Files · sigma-rule
- User Has Been Deleted Via Userdel · sigma-rule
- Vim GTFOBin Abuse - Linux · sigma-rule
- Webshell Remote Command Execution · sigma-rule
- Wget Creating Files in Tmp Directory · sigma-rule
Connected ecosystem references
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.