Appearance
Built-in Rules
A rule is just a name for a Detection Recipe in YAML format.
Public Rules Repository
Why Public Rules ?
- Reference Examples: Learn how to write custom rules
- Starting Templates: Modify existing recipes for your environment
- Direct Deployment: Deploy recipes as-is in your Jibril configuration
- Community Contributions: Submit your own recipes to help others
Why Private Rules?
The reason private rules are private is to:
- maintain competitive advantage in threat detection
- protect proprietary threat intelligence sources
- prevent adversaries from ingesting detection logic
End users are free to use all private rules, despite the fact that their YAML source code is not publicly available.
File Access Mechanism
Public Recipes
- binary_self_deletion - Binary deleting itself after execution
- capabilities_modification - Linux capabilities changes
- code_modification_through_procfs - Process memory manipulation via /proc
- core_pattern_access - Core dump pattern configuration access
- cpu_fingerprint - CPU information enumeration
- filesystem_fingerprint - Filesystem enumeration and discovery
- global_shlib_modification - System-wide shared library tampering
- java_debug_lib_load - Java debugging library loading
- java_instrument_lib_load - Java instrumentation library loading
- machine_fingerprint - Hardware and machine identification
- os_fingerprint - Operating system enumeration
- os_network_fingerprint - Network configuration discovery
- os_status_fingerprint - System status information gathering
- package_repo_config_modification - Package repository configuration changes
- pam_config_modification - PAM authentication configuration tampering
- sched_debug_access - Kernel scheduler debugging interface access
- shell_config_modification - Shell configuration file changes
- sysrq_access - SysRq kernel interface access
- unprivileged_bpf_config_access - Unprivileged BPF configuration access
Private Recipes
- auth_logs_tamper - Authentication log tampering
- credentials_files_access - Credential file access (SSH keys, passwords)
- crypto_miner_files - Cryptocurrency miner file operations
- environ_read_from_procfs - Environment variable extraction from /proc
- ssl_certificate_access - SSL/TLS certificate and private key access
- sudoers_modification - Sudoers privilege configuration changes
Execution Mechanism
Public Recipes
- data_encoder_exec - Data encoding tool execution (base64, etc.)
- hidden_elf_exec - Execution of hidden ELF binaries
- passwd_usage - Password utility execution
Private Recipes
- binary_executed_by_loader - Binary executed through system loader
- code_on_the_fly - Dynamic code generation and execution
- credentials_text_lookup - Credential search utilities
- crypto_miner_execution - Cryptocurrency miner execution
- denial_of_service_tools - DoS/DDoS tool execution
- exec_from_unusual_dir - Execution from /tmp or hidden directories
- file_attribute_change - File attribute modification utilities
- interpreter_shell_spawn - Shell spawned from interpreter (PHP, Python, etc.)
- net_filecopy_tool_exec - Network file copy tool execution
- net_mitm_tool_exec - Man-in-the-middle tool execution
- net_scan_tool_exec - Network scanning tool execution (nmap, masscan)
- net_sniff_tool_exec - Network sniffing tool execution (tcpdump, wireshark)
- net_suspicious_tool_exec - Suspicious network tool execution
- net_suspicious_tool_shell - Shell spawned by network tools
- runc_suspicious_exec - Suspicious runc container runtime execution
- webserver_exec - Web server executing suspicious commands
- webserver_shell_exec - Web server spawning shell