Builtin Recipes

Jibril ships with numerous built-in detection recipes

Public Detection Recipes

• binary_self_deletion

• capabilities_modification

• code_modification_through_procfs

• core_pattern_access

• cpu_fingerprint

• data_encoder_exec

• filesystem_fingerprint

• global_shlib_modification

• hidden_elf_exec

• java_debug_lib_load

• java_instrument_lib_load

• machine_fingerprint

• os_fingerprint

• os_network_fingerprint

• os_status_fingerprint

• package_repo_config_modification

• pam_config_modification

• passwd_usage

• sched_debug_access

• shell_config_modification

• sysrq_access

• unprivileged_bpf_config_access

Public Detection Recipes Repository: https://github.com/garnet-org/jibril-wahy

You may use public detection recipes as examples to create your own recipe.

The public recipes include a few (to be completed) recipes translate from open-source projects.

Private Recipes

• auth_logs_tamper
• binary_executed_by_loader
• code_on_the_fly
• credentials_files_access
• crypto_miner_execution
• crypto_miner_files
• denial_of_service_tools
• environ_read_from_procfs
• exec_from_unusual_dir
• file_attribute_change
• interpreter_shell_spawn
• net_filecopy_tool_exec
• net_mitm_tool_exec
• net_scan_tool_exec
• net_sniff_tool_exec
• net_suspicious_tool_exec
• net_suspicious_tool_shell
• plaintext_communication
• runc_suspicious_exec
• ssl_certificate_access
• sudoers_modification
• webserver_exec
• webserver_shell_exec
• adult_domain_access
• badware_domain_access
• dyndns_domain_access
• fake_domain_access
• gambling_domain_access
• piracy_domain_access
• threat_domain_access
• tracking_domain_access
• vpnlike_domain_access

Some signatures are private-only for now.