Skip to content

[Rule Tuning] Linux DR Tuning - 9#5508

Merged
Aegrah merged 13 commits intomainfrom
detection-rule-tuning-linux-9
Jan 7, 2026
Merged

[Rule Tuning] Linux DR Tuning - 9#5508
Aegrah merged 13 commits intomainfrom
detection-rule-tuning-linux-9

Conversation

@Aegrah
Copy link
Copy Markdown
Contributor

@Aegrah Aegrah commented Dec 22, 2025 •
edited
Loading

PR 5508 Reviewer Summary

Why

This PR updates and refines a broad set of Linux persistence detection rules to:

  • Reduce false positives and operational noise.
  • Improve detection accuracy for real-world threats.
  • Expand coverage for new attack and system behaviors.
  • Provide clearer, actionable triage and investigation guidance.
  • Align rule metadata, severity, and risk scoring with current threat intelligence and operational feedback.

What Changed

  • Severity & Risk Score Adjustments

    • Many rules had their severity and/or risk_score lowered (e.g., from "medium" to "low", 47→21) to reduce alert fatigue.
    • Some rules (e.g., persistence_bpf_probe_write_user, persistence_linux_backdoor_user_creation) had severity/risk increased to highlight criticality.

  • Expanded Exclusions & Pattern Matching

    • Added more process, file path, and extension exclusions to reduce false positives from legitimate system, automation, and package management activity.
    • Switched many strict matches (:, in) to pattern-based (like, like~) for broader, more accurate detection.
    • Exclusions now cover more tools (e.g., podman, dnf5, buildah, ansible, puppet, chef, etc.), file types (e.g., .dpkg-new, .source), and benign system behaviors.

  • Query & Logic Improvements

    • Refined EQL/KQL queries for better context and accuracy.
    • Improved parent/child process logic and handling of temporary/automation files.
    • Updated new_terms windows (e.g., history_window_start from 7d/10d to 5d).

  • Metadata & Integration Updates

    • Updated integration and index lists (e.g., added/removed auditd_manager, crowdstrike, sentinel_one_cloud_funnel).
    • Clarified rule names and descriptions for accuracy and intent.

  • Triage/Investigation Guide Enhancements

    • Many rules now include or update a note section with detailed, AI-generated triage, false positive analysis, and response/remediation steps.
    • Added disclaimers to investigation guides, recommending local validation.

  • Rule-Specific Notables

    • persistence_apt_package_manager_execution: Lowered severity/risk, expanded process exclusions, improved query.
    • persistence_bpf_probe_write_user: Severity/risk increased to "high"/73.
    • persistence_credential_access_modify_ssh_binaries: Lowered severity/risk, renamed for clarity, expanded exclusions.
    • persistence_dpkg_package_installation_from_unusual_parent/persistence_dpkg_unusual_execution: Added/updated triage notes, adjusted risk/severity, refined new_terms window.
    • persistence_git_hook_ rules*: Lowered severity/risk, expanded exclusions, improved pattern matching.
    • persistence_kernel_driver_load_by_non_root_user/persistence_kernel_object_file_creation: Added/updated triage notes, expanded index/exclusion logic.
    • persistence_linux_backdoor_user_creation: Severity/risk increased to "high"/73, query now matches both short and long argument forms.
    • persistence_kde_autostart_modification: Renamed for clarity, improved exclusions, now only matches creation events.
    • persistence_insmod_kernel_module_load: Added crowdstrike integration, expanded indices, improved exclusions.
    • persistence_grub_configuration_creation/persistence_grub_makeconfig: Added exclusions for python/ansible automation, expanded parent process exclusions.
    • persistence_init_d_file_creation: Expanded exclusions, improved handling of benign automation/system processes.
    • persistence_kworker_file_creation: Expanded file path exclusions for benign kworker activity.
    • persistence_kubernetes_sensitive_file_activity: Improved handling of vim/vi temp files, expanded process exclusions.

Behavioral Impact

  • Reduced False Positives: More comprehensive exclusions and refined queries should significantly reduce noise from legitimate system and automation activity.
  • Improved Detection Quality: Adjusted severities and risk scores better align with real-world threat impact, helping SOCs prioritize.
  • Clearer Triage Guidance: Enhanced investigation notes provide analysts with actionable steps and context, improving response times and accuracy.
  • Broader Coverage: New and updated exclusions and logic account for a wider range of Linux distributions, tools, and operational scenarios.

Risks / Edge Cases

  • Potential for Missed Detections: Aggressive exclusions, especially for automation and package management tools, may inadvertently suppress some true positives if attackers abuse these tools.
  • Rule Downgrades: Lowering severity/risk on some rules may deprioritize alerts that could be significant in certain environments—review local risk appetite.
  • Rule Upgrades: Increasing severity/risk on others (e.g., bpf_probe_write_user, linux_backdoor_user_creation) may increase alert volume for rare but critical events.
  • Pattern Matching Changes: Switching from strict to pattern-based matching (like, like~) may have unforeseen effects on rule triggering in edge cases.

Rollout Notes

  • Review and Test: Before deploying to production, review all updated rules in a staging environment to ensure exclusions and logic match your operational context.
  • Update Playbooks: SOC/IR teams should update their playbooks to align with new triage/investigation notes and severity/risk changes.
  • Monitor Alert Volumes: Track alert volumes post-rollout to ensure that noise is reduced and critical detections are not missed.
  • Feedback Loop: Encourage feedback from analysts to further tune exclusions and triage guidance as needed.

@Aegrah Aegrah self-assigned this Dec 22, 2025
@Aegrah Aegrah added OS: Linux Rule: Tuning tweaking or tuning an existing rule Team: TRADE labels Dec 22, 2025
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Dec 22, 2025

Rule: Tuning - Guidelines

These guidelines serve as a reminder set of considerations when tuning an existing rule.

Documentation and Context

  • Detailed description of the suggested changes.
  • Provide example JSON data or screenshots.
  • Provide evidence of reducing benign events mistakenly identified as threats (False Positives).
  • Provide evidence of enhancing detection of true threats that were previously missed (False Negatives).
  • Provide evidence of optimizing resource consumption and execution time of detection rules (Performance).
  • Provide evidence of specific environment factors influencing customized rule tuning (Contextual Tuning).
  • Provide evidence of improvements made by modifying sensitivity by changing alert triggering thresholds (Threshold Adjustments).
  • Provide evidence of refining rules to better detect deviations from typical behavior (Behavioral Tuning).
  • Provide evidence of improvements of adjusting rules based on time-based patterns (Temporal Tuning).
  • Provide reasoning of adjusting priority or severity levels of alerts (Severity Tuning).
  • Provide evidence of improving quality integrity of our data used by detection rules (Data Quality).
  • Ensure the tuning includes necessary updates to the release documentation and versioning.

Rule Metadata Checks

  • updated_date matches the date of tuning PR merged.
  • min_stack_version should support the widest stack versions.
  • name and description should be descriptive and not include typos.
  • query should be inclusive, not overly exclusive. Review to ensure the original intent of the rule is maintained.

Testing and Validation

  • Validate that the tuned rule's performance is satisfactory and does not negatively impact the stack.
  • Ensure that the tuned rule has a low false positive rate.

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Dec 22, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Renaming of OpenSSH Binaries (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ rc.local/rc.common File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Polkit Policy Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kubernetes Sensitive Configuration File Activity (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Initramfs Extraction via CPIO (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Simple HTTP Web Server Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Object File Creation (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Module Load via insmod (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Shell Configuration Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNF Package Manager Plugin File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Login via System User (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux User Added to Privileged Group (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System V Init Script Created (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Linux Backdoor User Account Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Process Spawned from Message-of-the-Day (MOTD) (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Pluggable Authentication Module (PAM) Source Download (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Boot File Copy (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pluggable Authentication Module (PAM) Creation in Unusual Directory (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection Initiated by Suspicious SSHD Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Web Server Command Execution (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious rc.local Error Message (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Loadable Kernel Module Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Execution of rc.local Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ APT Package Manager Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Python Path File (pth) Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Dracut Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ At Job Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ NetworkManager Dispatcher Script Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPM Package Installed by Unusual Parent Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Simple HTTP Web Server Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable Bit Set for Potential Persistence Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ D-Bus Service Created (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Message-of-the-Day (MOTD) File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Backdoor Execution Through PAM_EXEC (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual D-Bus Daemon Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Egress Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux Group Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ GRUB Configuration Generation through Built-in Utilities (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious APT Package Manager Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ✅ Suspicious File Creation via Kworker (eql)
  • ❌ Shared Object Created by Previously Unknown Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Chkconfig Service Add (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Driver Load by non-root User (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Usage of bpf_probe_write_user Helper (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Shadow File Modification by Unusual Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ GRUB Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual DPKG Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Python Site or User Customize File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Command Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dracut Module Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dynamic Linker Copy (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ KDE AutoStart Script or Desktop File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious APT Package Manager Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux User Account Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Child Execution via Web Server (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Process Capability Set via setcap Utility (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pluggable Authentication Module or Configuration Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ OpenSSL Password Hash Generation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DPKG Package Installed by Unusual Parent Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Setcap setuid/setgid Capability Set (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Cron Job Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

Aegrah
Aegrah commented Dec 23, 2025
View reviewed changes
Comment thread rules/linux/persistence_apt_package_manager_file_creation.toml Outdated
@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Dec 23, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Renaming of OpenSSH Binaries (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ rc.local/rc.common File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Polkit Policy Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kubernetes Sensitive Configuration File Activity (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Initramfs Extraction via CPIO (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Simple HTTP Web Server Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Object File Creation (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Module Load via insmod (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Shell Configuration Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNF Package Manager Plugin File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Login via System User (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux User Added to Privileged Group (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System V Init Script Created (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Linux Backdoor User Account Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Process Spawned from Message-of-the-Day (MOTD) (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Pluggable Authentication Module (PAM) Source Download (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Boot File Copy (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pluggable Authentication Module (PAM) Creation in Unusual Directory (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection Initiated by Suspicious SSHD Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Web Server Command Execution (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious rc.local Error Message (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Loadable Kernel Module Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Execution of rc.local Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ APT Package Manager Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Python Path File (pth) Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Dracut Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ At Job Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ NetworkManager Dispatcher Script Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPM Package Installed by Unusual Parent Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Simple HTTP Web Server Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable Bit Set for Potential Persistence Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ D-Bus Service Created (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Message-of-the-Day (MOTD) File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Backdoor Execution Through PAM_EXEC (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual D-Bus Daemon Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Egress Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux Group Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ GRUB Configuration Generation through Built-in Utilities (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious APT Package Manager Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ✅ Suspicious File Creation via Kworker (eql)
  • ❌ Shared Object Created by Previously Unknown Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Chkconfig Service Add (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Driver Load by non-root User (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Usage of bpf_probe_write_user Helper (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Shadow File Modification by Unusual Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ GRUB Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual DPKG Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Python Site or User Customize File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Command Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dracut Module Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dynamic Linker Copy (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ KDE AutoStart Script or Desktop File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious APT Package Manager Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux User Account Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Child Execution via Web Server (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Process Capability Set via setcap Utility (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pluggable Authentication Module or Configuration Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ OpenSSL Password Hash Generation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DPKG Package Installed by Unusual Parent Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Setcap setuid/setgid Capability Set (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Cron Job Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Dec 23, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Renaming of OpenSSH Binaries (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ rc.local/rc.common File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Polkit Policy Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kubernetes Sensitive Configuration File Activity (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Initramfs Extraction via CPIO (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Simple HTTP Web Server Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Object File Creation (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Module Load via insmod (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Shell Configuration Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNF Package Manager Plugin File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Login via System User (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux User Added to Privileged Group (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System V Init Script Created (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Linux Backdoor User Account Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Process Spawned from Message-of-the-Day (MOTD) (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Pluggable Authentication Module (PAM) Source Download (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Boot File Copy (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pluggable Authentication Module (PAM) Creation in Unusual Directory (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection Initiated by Suspicious SSHD Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Web Server Command Execution (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious rc.local Error Message (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Loadable Kernel Module Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Execution of rc.local Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ APT Package Manager Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Python Path File (pth) Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Dracut Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ At Job Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ NetworkManager Dispatcher Script Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPM Package Installed by Unusual Parent Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Simple HTTP Web Server Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable Bit Set for Potential Persistence Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ D-Bus Service Created (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Message-of-the-Day (MOTD) File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Backdoor Execution Through PAM_EXEC (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual D-Bus Daemon Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Egress Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux Group Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ GRUB Configuration Generation through Built-in Utilities (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious APT Package Manager Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ✅ Suspicious File Creation via Kworker (eql)
  • ❌ Shared Object Created by Previously Unknown Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Chkconfig Service Add (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Driver Load by non-root User (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Usage of bpf_probe_write_user Helper (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Shadow File Modification by Unusual Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ GRUB Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual DPKG Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Python Site or User Customize File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Command Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dracut Module Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dynamic Linker Copy (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ KDE AutoStart Script or Desktop File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious APT Package Manager Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux User Account Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Child Execution via Web Server (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Process Capability Set via setcap Utility (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pluggable Authentication Module or Configuration Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ OpenSSL Password Hash Generation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DPKG Package Installed by Unusual Parent Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Setcap setuid/setgid Capability Set (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Cron Job Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Dec 23, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Renaming of OpenSSH Binaries (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ rc.local/rc.common File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Polkit Policy Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kubernetes Sensitive Configuration File Activity (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Initramfs Extraction via CPIO (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Simple HTTP Web Server Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Object File Creation (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Module Load via insmod (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Shell Configuration Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNF Package Manager Plugin File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Login via System User (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux User Added to Privileged Group (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System V Init Script Created (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Linux Backdoor User Account Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Process Spawned from Message-of-the-Day (MOTD) (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Pluggable Authentication Module (PAM) Source Download (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Boot File Copy (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pluggable Authentication Module (PAM) Creation in Unusual Directory (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection Initiated by Suspicious SSHD Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Web Server Command Execution (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious rc.local Error Message (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Loadable Kernel Module Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Execution of rc.local Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ APT Package Manager Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Python Path File (pth) Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Dracut Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ At Job Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ NetworkManager Dispatcher Script Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPM Package Installed by Unusual Parent Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Simple HTTP Web Server Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable Bit Set for Potential Persistence Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ D-Bus Service Created (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Message-of-the-Day (MOTD) File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Backdoor Execution Through PAM_EXEC (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual D-Bus Daemon Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Egress Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux Group Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ GRUB Configuration Generation through Built-in Utilities (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious APT Package Manager Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ✅ Suspicious File Creation via Kworker (eql)
  • ❌ Shared Object Created by Previously Unknown Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Chkconfig Service Add (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Driver Load by non-root User (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Usage of bpf_probe_write_user Helper (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Shadow File Modification by Unusual Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ GRUB Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual DPKG Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Python Site or User Customize File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Command Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dracut Module Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dynamic Linker Copy (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ KDE AutoStart Script or Desktop File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious APT Package Manager Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux User Account Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Child Execution via Web Server (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Process Capability Set via setcap Utility (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pluggable Authentication Module or Configuration Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ OpenSSL Password Hash Generation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DPKG Package Installed by Unusual Parent Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Setcap setuid/setgid Capability Set (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Cron Job Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Dec 23, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Renaming of OpenSSH Binaries (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ rc.local/rc.common File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Polkit Policy Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kubernetes Sensitive Configuration File Activity (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Initramfs Extraction via CPIO (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Simple HTTP Web Server Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Object File Creation (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Module Load via insmod (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Shell Configuration Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNF Package Manager Plugin File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Login via System User (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux User Added to Privileged Group (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System V Init Script Created (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Linux Backdoor User Account Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Process Spawned from Message-of-the-Day (MOTD) (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Pluggable Authentication Module (PAM) Source Download (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Boot File Copy (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pluggable Authentication Module (PAM) Creation in Unusual Directory (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection Initiated by Suspicious SSHD Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Web Server Command Execution (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious rc.local Error Message (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Loadable Kernel Module Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Execution of rc.local Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ APT Package Manager Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Python Path File (pth) Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Dracut Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ At Job Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ NetworkManager Dispatcher Script Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPM Package Installed by Unusual Parent Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Simple HTTP Web Server Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable Bit Set for Potential Persistence Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ D-Bus Service Created (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Message-of-the-Day (MOTD) File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Backdoor Execution Through PAM_EXEC (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual D-Bus Daemon Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Egress Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux Group Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ GRUB Configuration Generation through Built-in Utilities (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious APT Package Manager Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ✅ Suspicious File Creation via Kworker (eql)
  • ❌ Shared Object Created by Previously Unknown Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Chkconfig Service Add (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Driver Load by non-root User (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Usage of bpf_probe_write_user Helper (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Shadow File Modification by Unusual Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ GRUB Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual DPKG Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Python Site or User Customize File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Command Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dracut Module Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dynamic Linker Copy (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ KDE AutoStart Script or Desktop File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious APT Package Manager Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux User Account Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Child Execution via Web Server (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Process Capability Set via setcap Utility (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pluggable Authentication Module or Configuration Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ OpenSSL Password Hash Generation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DPKG Package Installed by Unusual Parent Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Setcap setuid/setgid Capability Set (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Cron Job Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Dec 23, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Renaming of OpenSSH Binaries (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ rc.local/rc.common File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Polkit Policy Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kubernetes Sensitive Configuration File Activity (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Initramfs Extraction via CPIO (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Simple HTTP Web Server Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Object File Creation (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Module Load via insmod (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Shell Configuration Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNF Package Manager Plugin File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Login via System User (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux User Added to Privileged Group (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System V Init Script Created (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Linux Backdoor User Account Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Process Spawned from Message-of-the-Day (MOTD) (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Pluggable Authentication Module (PAM) Source Download (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Boot File Copy (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pluggable Authentication Module (PAM) Creation in Unusual Directory (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection Initiated by Suspicious SSHD Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Web Server Command Execution (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious rc.local Error Message (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Loadable Kernel Module Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Execution of rc.local Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ APT Package Manager Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Python Path File (pth) Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Dracut Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ At Job Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ NetworkManager Dispatcher Script Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPM Package Installed by Unusual Parent Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Simple HTTP Web Server Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable Bit Set for Potential Persistence Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ D-Bus Service Created (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Message-of-the-Day (MOTD) File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Backdoor Execution Through PAM_EXEC (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual D-Bus Daemon Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Egress Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux Group Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ GRUB Configuration Generation through Built-in Utilities (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious APT Package Manager Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ✅ Suspicious File Creation via Kworker (eql)
  • ❌ Shared Object Created by Previously Unknown Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Chkconfig Service Add (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Driver Load by non-root User (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Usage of bpf_probe_write_user Helper (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Shadow File Modification by Unusual Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ GRUB Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual DPKG Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Python Site or User Customize File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Command Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dracut Module Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dynamic Linker Copy (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ KDE AutoStart Script or Desktop File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious APT Package Manager Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux User Account Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Child Execution via Web Server (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Process Capability Set via setcap Utility (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pluggable Authentication Module or Configuration Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ OpenSSL Password Hash Generation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DPKG Package Installed by Unusual Parent Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Setcap setuid/setgid Capability Set (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Cron Job Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Dec 23, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Renaming of OpenSSH Binaries (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ rc.local/rc.common File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Polkit Policy Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kubernetes Sensitive Configuration File Activity (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Initramfs Extraction via CPIO (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Simple HTTP Web Server Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Object File Creation (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Module Load via insmod (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Shell Configuration Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNF Package Manager Plugin File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Login via System User (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux User Added to Privileged Group (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System V Init Script Created (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Linux Backdoor User Account Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Process Spawned from Message-of-the-Day (MOTD) (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Pluggable Authentication Module (PAM) Source Download (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Boot File Copy (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pluggable Authentication Module (PAM) Creation in Unusual Directory (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection Initiated by Suspicious SSHD Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Web Server Command Execution (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious rc.local Error Message (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Loadable Kernel Module Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Execution of rc.local Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ APT Package Manager Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Python Path File (pth) Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Dracut Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ At Job Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ NetworkManager Dispatcher Script Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPM Package Installed by Unusual Parent Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Simple HTTP Web Server Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable Bit Set for Potential Persistence Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ D-Bus Service Created (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Message-of-the-Day (MOTD) File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Backdoor Execution Through PAM_EXEC (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual D-Bus Daemon Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Egress Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux Group Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ GRUB Configuration Generation through Built-in Utilities (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious APT Package Manager Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ✅ Suspicious File Creation via Kworker (eql)
  • ❌ Shared Object Created by Previously Unknown Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Chkconfig Service Add (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Driver Load by non-root User (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Usage of bpf_probe_write_user Helper (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Shadow File Modification by Unusual Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ GRUB Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual DPKG Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Python Site or User Customize File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Command Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dracut Module Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dynamic Linker Copy (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ KDE AutoStart Script or Desktop File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious APT Package Manager Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux User Account Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Child Execution via Web Server (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Process Capability Set via setcap Utility (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pluggable Authentication Module or Configuration Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ OpenSSL Password Hash Generation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DPKG Package Installed by Unusual Parent Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Setcap setuid/setgid Capability Set (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Cron Job Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Dec 23, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Renaming of OpenSSH Binaries (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ rc.local/rc.common File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Polkit Policy Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kubernetes Sensitive Configuration File Activity (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Initramfs Extraction via CPIO (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Simple HTTP Web Server Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Object File Creation (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Module Load via insmod (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Shell Configuration Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNF Package Manager Plugin File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Login via System User (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux User Added to Privileged Group (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System V Init Script Created (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Linux Backdoor User Account Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Process Spawned from Message-of-the-Day (MOTD) (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Pluggable Authentication Module (PAM) Source Download (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Boot File Copy (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pluggable Authentication Module (PAM) Creation in Unusual Directory (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection Initiated by Suspicious SSHD Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Web Server Command Execution (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious rc.local Error Message (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Loadable Kernel Module Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Execution of rc.local Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ APT Package Manager Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Python Path File (pth) Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Dracut Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ At Job Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ NetworkManager Dispatcher Script Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPM Package Installed by Unusual Parent Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Simple HTTP Web Server Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable Bit Set for Potential Persistence Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ D-Bus Service Created (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Message-of-the-Day (MOTD) File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Backdoor Execution Through PAM_EXEC (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual D-Bus Daemon Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Egress Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux Group Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ GRUB Configuration Generation through Built-in Utilities (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious APT Package Manager Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ✅ Suspicious File Creation via Kworker (eql)
  • ❌ Shared Object Created by Previously Unknown Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Chkconfig Service Add (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Driver Load by non-root User (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Usage of bpf_probe_write_user Helper (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Shadow File Modification by Unusual Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ GRUB Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual DPKG Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Python Site or User Customize File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Command Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dracut Module Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dynamic Linker Copy (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ KDE AutoStart Script or Desktop File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious APT Package Manager Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux User Account Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Child Execution via Web Server (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Process Capability Set via setcap Utility (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pluggable Authentication Module or Configuration Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ OpenSSL Password Hash Generation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DPKG Package Installed by Unusual Parent Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Setcap setuid/setgid Capability Set (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Cron Job Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@Aegrah
Copy link
Copy Markdown
Contributor Author

Aegrah commented Dec 23, 2025

@copilot Summarize this entire pull request. Consider all commits, file diffs, and conversations. Overwrite the main summary comment with the summary you created. Also, use these instructions: “Generate a PR summary for reviewers. Include: Why (problem), What changed (bullets), Behavioral impact, Risk/edge cases, How to test, and Notes for rollout. Keep it concise and accurate; if unsure, say so.”

Copilot AI mentioned this pull request Dec 23, 2025
Closed
Copy link
Copy Markdown

Copilot AI commented Dec 23, 2025

@Aegrah I've opened a new pull request, #5513, to work on those changes. Once the pull request is ready, I'll request review from you.

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Dec 23, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Renaming of OpenSSH Binaries (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ rc.local/rc.common File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Polkit Policy Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kubernetes Sensitive Configuration File Activity (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Initramfs Extraction via CPIO (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Simple HTTP Web Server Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Object File Creation (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Module Load via insmod (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Shell Configuration Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNF Package Manager Plugin File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Login via System User (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux User Added to Privileged Group (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System V Init Script Created (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Linux Backdoor User Account Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Process Spawned from Message-of-the-Day (MOTD) (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Pluggable Authentication Module (PAM) Source Download (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Boot File Copy (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pluggable Authentication Module (PAM) Creation in Unusual Directory (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection Initiated by Suspicious SSHD Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Web Server Command Execution (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious rc.local Error Message (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Loadable Kernel Module Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Execution of rc.local Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ APT Package Manager Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Python Path File (pth) Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Dracut Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ At Job Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ NetworkManager Dispatcher Script Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPM Package Installed by Unusual Parent Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Simple HTTP Web Server Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable Bit Set for Potential Persistence Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ D-Bus Service Created (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Message-of-the-Day (MOTD) File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Backdoor Execution Through PAM_EXEC (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual D-Bus Daemon Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Egress Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux Group Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ GRUB Configuration Generation through Built-in Utilities (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious APT Package Manager Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ✅ Suspicious File Creation via Kworker (eql)
  • ❌ Shared Object Created by Previously Unknown Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Chkconfig Service Add (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Driver Load by non-root User (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Usage of bpf_probe_write_user Helper (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Shadow File Modification by Unusual Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ GRUB Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual DPKG Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Python Site or User Customize File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Command Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dracut Module Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dynamic Linker Copy (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ KDE AutoStart Script or Desktop File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious APT Package Manager Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux User Account Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Child Execution via Web Server (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Process Capability Set via setcap Utility (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pluggable Authentication Module or Configuration Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ OpenSSL Password Hash Generation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DPKG Package Installed by Unusual Parent Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Setcap setuid/setgid Capability Set (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Cron Job Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Dec 23, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Renaming of OpenSSH Binaries (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ rc.local/rc.common File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Polkit Policy Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kubernetes Sensitive Configuration File Activity (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Initramfs Extraction via CPIO (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Simple HTTP Web Server Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Object File Creation (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Module Load via insmod (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Shell Configuration Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNF Package Manager Plugin File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Login via System User (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux User Added to Privileged Group (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System V Init Script Created (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Linux Backdoor User Account Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Process Spawned from Message-of-the-Day (MOTD) (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Pluggable Authentication Module (PAM) Source Download (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Boot File Copy (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pluggable Authentication Module (PAM) Creation in Unusual Directory (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection Initiated by Suspicious SSHD Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Web Server Command Execution (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious rc.local Error Message (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Loadable Kernel Module Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Execution of rc.local Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ APT Package Manager Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Python Path File (pth) Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Dracut Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ At Job Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ NetworkManager Dispatcher Script Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPM Package Installed by Unusual Parent Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Simple HTTP Web Server Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable Bit Set for Potential Persistence Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ D-Bus Service Created (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Message-of-the-Day (MOTD) File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Backdoor Execution Through PAM_EXEC (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual D-Bus Daemon Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Egress Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux Group Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ GRUB Configuration Generation through Built-in Utilities (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious APT Package Manager Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ✅ Suspicious File Creation via Kworker (eql)
  • ❌ Shared Object Created by Previously Unknown Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Chkconfig Service Add (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Driver Load by non-root User (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Usage of bpf_probe_write_user Helper (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Shadow File Modification by Unusual Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ GRUB Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual DPKG Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Python Site or User Customize File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Command Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dracut Module Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dynamic Linker Copy (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ KDE AutoStart Script or Desktop File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious APT Package Manager Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux User Account Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Child Execution via Web Server (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Process Capability Set via setcap Utility (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pluggable Authentication Module or Configuration Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ OpenSSL Password Hash Generation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DPKG Package Installed by Unusual Parent Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Setcap setuid/setgid Capability Set (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Cron Job Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

terrancedejesus
terrancedejesus reviewed Jan 5, 2026
View reviewed changes
Comment thread rules/linux/persistence_linux_shell_activity_via_web_server.toml
DefSecSentinel
DefSecSentinel approved these changes Jan 7, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@DefSecSentinel DefSecSentinel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Jan 7, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Renaming of OpenSSH Binaries (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ rc.local/rc.common File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Polkit Policy Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kubernetes Sensitive Configuration File Activity (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Initramfs Extraction via CPIO (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Simple HTTP Web Server Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Object File Creation (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Module Load via insmod (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Shell Configuration Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNF Package Manager Plugin File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Login via System User (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux User Added to Privileged Group (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System V Init Script Created (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Linux Backdoor User Account Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Process Spawned from Message-of-the-Day (MOTD) (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Pluggable Authentication Module (PAM) Source Download (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Boot File Copy (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pluggable Authentication Module (PAM) Creation in Unusual Directory (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection Initiated by Suspicious SSHD Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Web Server Command Execution (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious rc.local Error Message (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Loadable Kernel Module Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Execution of rc.local Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ APT Package Manager Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Python Path File (pth) Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Dracut Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ At Job Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ NetworkManager Dispatcher Script Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPM Package Installed by Unusual Parent Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Simple HTTP Web Server Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable Bit Set for Potential Persistence Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ D-Bus Service Created (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Message-of-the-Day (MOTD) File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Backdoor Execution Through PAM_EXEC (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual D-Bus Daemon Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Egress Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux Group Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ GRUB Configuration Generation through Built-in Utilities (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious APT Package Manager Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ✅ Suspicious File Creation via Kworker (eql)
  • ❌ Shared Object Created by Previously Unknown Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Chkconfig Service Add (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Driver Load by non-root User (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Usage of bpf_probe_write_user Helper (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Shadow File Modification by Unusual Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ GRUB Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual DPKG Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Python Site or User Customize File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Command Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dracut Module Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dynamic Linker Copy (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ KDE AutoStart Script or Desktop File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious APT Package Manager Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux User Account Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Child Execution via Web Server (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Process Capability Set via setcap Utility (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pluggable Authentication Module or Configuration Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ OpenSSL Password Hash Generation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DPKG Package Installed by Unusual Parent Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Setcap setuid/setgid Capability Set (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Cron Job Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Jan 7, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Renaming of OpenSSH Binaries (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ rc.local/rc.common File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Polkit Policy Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kubernetes Sensitive Configuration File Activity (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Initramfs Extraction via CPIO (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Simple HTTP Web Server Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Object File Creation (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Module Load via insmod (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Shell Configuration Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNF Package Manager Plugin File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Login via System User (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux User Added to Privileged Group (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System V Init Script Created (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Linux Backdoor User Account Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Process Spawned from Message-of-the-Day (MOTD) (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Pluggable Authentication Module (PAM) Source Download (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Boot File Copy (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pluggable Authentication Module (PAM) Creation in Unusual Directory (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection Initiated by Suspicious SSHD Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Web Server Command Execution (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious rc.local Error Message (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Loadable Kernel Module Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Execution of rc.local Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ APT Package Manager Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Python Path File (pth) Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Dracut Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ At Job Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ NetworkManager Dispatcher Script Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPM Package Installed by Unusual Parent Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Simple HTTP Web Server Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable Bit Set for Potential Persistence Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ D-Bus Service Created (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Message-of-the-Day (MOTD) File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Backdoor Execution Through PAM_EXEC (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual D-Bus Daemon Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Egress Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux Group Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ GRUB Configuration Generation through Built-in Utilities (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious APT Package Manager Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ✅ Suspicious File Creation via Kworker (eql)
  • ❌ Shared Object Created by Previously Unknown Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Chkconfig Service Add (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Driver Load by non-root User (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Usage of bpf_probe_write_user Helper (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Shadow File Modification by Unusual Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ GRUB Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual DPKG Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Python Site or User Customize File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Command Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dracut Module Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dynamic Linker Copy (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ KDE AutoStart Script or Desktop File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious APT Package Manager Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux User Account Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Child Execution via Web Server (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Process Capability Set via setcap Utility (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pluggable Authentication Module or Configuration Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ OpenSSL Password Hash Generation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DPKG Package Installed by Unusual Parent Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Setcap setuid/setgid Capability Set (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Cron Job Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Jan 7, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Renaming of OpenSSH Binaries (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ rc.local/rc.common File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Polkit Policy Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kubernetes Sensitive Configuration File Activity (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Initramfs Extraction via CPIO (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Simple HTTP Web Server Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Object File Creation (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Module Load via insmod (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Shell Configuration Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNF Package Manager Plugin File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Login via System User (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux User Added to Privileged Group (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System V Init Script Created (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Linux Backdoor User Account Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Process Spawned from Message-of-the-Day (MOTD) (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Pluggable Authentication Module (PAM) Source Download (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Boot File Copy (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pluggable Authentication Module (PAM) Creation in Unusual Directory (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection Initiated by Suspicious SSHD Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Web Server Command Execution (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious rc.local Error Message (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Loadable Kernel Module Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Execution of rc.local Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ APT Package Manager Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Python Path File (pth) Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Dracut Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ At Job Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ NetworkManager Dispatcher Script Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPM Package Installed by Unusual Parent Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Simple HTTP Web Server Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable Bit Set for Potential Persistence Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ D-Bus Service Created (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Message-of-the-Day (MOTD) File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Backdoor Execution Through PAM_EXEC (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual D-Bus Daemon Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Egress Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux Group Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ GRUB Configuration Generation through Built-in Utilities (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious APT Package Manager Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ✅ Suspicious File Creation via Kworker (eql)
  • ❌ Shared Object Created by Previously Unknown Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Chkconfig Service Add (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kernel Driver Load by non-root User (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Usage of bpf_probe_write_user Helper (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Shadow File Modification by Unusual Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ GRUB Configuration File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual DPKG Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Python Site or User Customize File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Git Hook Command Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dracut Module Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dynamic Linker Copy (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ KDE AutoStart Script or Desktop File Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious APT Package Manager Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux User Account Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Child Execution via Web Server (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Process Capability Set via setcap Utility (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pluggable Authentication Module or Configuration Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ OpenSSL Password Hash Generation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DPKG Package Installed by Unusual Parent Process (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Setcap setuid/setgid Capability Set (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Cron Job Created or Modified (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@Aegrah Aegrah merged commit a973da1 into main Jan 7, 2026
16 of 24 checks passed
@Aegrah Aegrah deleted the detection-rule-tuning-linux-9 branch January 7, 2026 15:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@terrancedejesus terrancedejesus terrancedejesus approved these changes

@w0rk3r w0rk3r Awaiting requested review from w0rk3r

@Samirbous Samirbous Awaiting requested review from Samirbous

@shashank-elastic shashank-elastic Awaiting requested review from shashank-elastic

+1 more reviewer

@DefSecSentinel DefSecSentinel DefSecSentinel approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

@Aegrah Aegrah

Labels

backport: auto Domain: Endpoint OS: Linux Rule: Tuning tweaking or tuning an existing rule Team: TRADE

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@Aegrah @tradebot-elastic @DefSecSentinel @terrancedejesus