<group name="tetragon,">
  <rule id="700001" level="3">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.exec_id">\.*</field>
    <options>no_full_log</options>
	<group>process_exec,</group>
	<description>Process Execution detected</description>
  </rule>
  <rule id="700002" level="3">
    <decoded_as>json</decoded_as>
    <field name="process_kprobe.process.exec_id">\.*</field>
    <options>no_full_log</options>
	<group>process_kprobe,</group>
	<description>Kernel probe detected</description>
  </rule>
  <rule id="700003" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/sbin/insmod</field>
    <description>Potential rootkit activity: insmod command executed</description>
    <mitre>
      <id>T1543</id>
      <id>T1205</id>
    </mitre>
  </rule>

<rule id="700004" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/usr/bin/systemd-detect-virt$</field>
  <description>Virtualization detection command executed: systemd-detect-virt</description>
  <mitre>
    <id>T1497.001</id>
  </mitre>
</rule>
<rule id="700005" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/usr/bin/rm$</field>
  <field name="process_exit.process.arguments" type="pcre2">(?i)^/root/\.bash_history$</field>
  <description>Command to remove bash history detected: rm /root/.bash_history  command = rm /root/.bash_history</description>
  <mitre>
    <id>T1070.003</id>
  </mitre>
</rule>

<rule id="700006" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/usr/bin/cat$</field>
  <field name="process_exit.process.arguments" type="pcre2">(?i)^/dev/null$</field>
  <description>Command to read or clear data using /dev/null detected: cat /dev/null  command = cat /dev/null</description>
  <mitre>
    <id>T1070.003</id>
  </mitre>
</rule>

<rule id="700007" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/usr/bin/ln$</field>
  <field name="process_exit.process.arguments" type="pcre2">(?i)-sf\s+/dev/null\s+/root/\.bash_history$</field>
  <description>Command to symlink /root/.bash_history to /dev/null detected: ln -sf   command = ln -sf /dev/null /root/.bash_history</description>
  <mitre>
    <id>T1070.003</id>
  </mitre>
</rule>

<rule id="700008" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/usr/bin/passwd$</field>
  <description>Execution of passwd detected - potential account access modification</description>
  <mitre>
    <id>T1531</id>
  </mitre>
</rule>


<rule id="700010" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/systemctl$</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)--type=service</field>
  <description>System service enumeration using systemctl detected</description>
  <mitre>
    <id>T1007</id>
  </mitre>
</rule>

<rule id="700011" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/sudo$</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)\b/usr/sbin/useradd\b</field>
  <description>User creation attempt via sudo detected (useradd)</description>
  <mitre>
    <id>T1136.001</id>
  </mitre>
</rule>

<rule id="700012" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)\bbase64\s+-d\b</field>
  <description>Base64 decode operation detected - possible obfuscation (T1027)</description>
  <mitre>
    <id>T1027</id>
  </mitre>
</rule>


<rule id="700013" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/usr/bin/cp$</field>
  <field name="process_exit.process.arguments" type="pcre2">(?i)^/bin/sh\s+/tmp/[^ ]+$</field>
  <description>Copying system shell to /tmp with new name — potential masquerading (T1036.003)</description>
  <mitre>
    <id>T1036.003</id>
  </mitre>
</rule>

<rule id="700014" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)/ping$</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)-c\s+\d+</field>
  <description>Ping command used with -c option — potential sandbox evasion (T1497.003) command= ping -c 3 8.8.8.8</description>
  <mitre>
    <id>T1497.003</id>
  </mitre>
</rule>

<rule id="700015" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)/(usr/sbin|usr/bin)/tcpdump$</field>
  <description>Execution of tcpdump detected — potential network sniffing (T1040)</description>
  <mitre>
    <id>T1040</id> <!-- Network Sniffing -->
  </mitre>
</rule>

<rule id="700016" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)/(usr/sbin|usr/bin)/tshark$</field>
  <description>Execution of tshark detected — potential network sniffing (T1040)</description>
  <mitre>
    <id>T1040</id>
  </mitre>
</rule>

<rule id="700017" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/usr/sbin/ufw$</field>
  <field name="process_exit.process.arguments" type="pcre2">(?i)\bdisable\b</field>
  <description>UFW firewall disable attempt detected — potential defense evasion (T1562.004) command = ufw disable</description>
  <mitre>
    <id>T1562.004</id>
  </mitre>
</rule>


<rule id="700018" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/usr/sbin/ufw$</field>
  <field name="process_exit.process.arguments" type="pcre2">(?i)\blogging\s+off\b</field>
  <description>Attempt to disable UFW firewall logging — potential defense evasion (T1562.004) command= ufw logging off</description>
  <mitre>
    <id>T1562.004</id>
  </mitre>
</rule>

<rule id="700019" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/usr/bin/tail$</field>
  <field name="process_exit.process.arguments" type="pcre2">(?i)/var/log/ufw\.log</field>
  <description>Access to UFW firewall log detected — potential reconnaissance before firewall tampering (T1562.004)  command= tail /var/log/ufw.log</description>
  <mitre>
    <id>T1562.004</id>
  </mitre>
</rule>

<rule id="700020" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/usr/sbin/iptables-save$</field>
  <description>Execution of iptables-save — possible firewall config enumeration or backup (T1562.004) command = iptables-save</description>
  <mitre>
    <id>T1562.004</id>
  </mitre>
</rule>

<rule id="700021" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/usr/sbin/iptables$</field>
  <field name="process_exit.process.arguments" type="pcre2">(?i)^-F$</field>
  <description>iptables -F executed — firewall rules flushed (T1562.004) command= iptables -F</description>
  <mitre>
    <id>T1562.004</id>
  </mitre>
</rule>


<rule id="700022" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.arguments" type="pcre2">(?i)\biptables\b\s+-A\s+INPUT\b.*--dport\s+9999</field>
  <description>iptables INPUT rule added — possible firewall rule injection (T1562.004)       still need to be fixed , it's not matching yet with the command = iptables -A INPUT -p tcp --dport 9999 -j ACCEPT and sudo iptables -A INPUT -p tcp --dport 9999 -j ACCEPT</description>
  <mitre>
    <id>T1562.004</id>
  </mitre>
</rule>



<rule id="700023" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.arguments" type="pcre2">(?i)\buseradd\b.*\b(G|--groups)\s*(sudo|wheel)</field>
  <description>Privileged user account creation detected — possible local account persistence (T1136.001)</description>
  <mitre>
    <id>T1136.001</id>
  </mitre>
</rule>
<rule id="700024" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/sbin/insmod$</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)\.ko\b</field>
  <description>Kernel module insertion detected — possible rootkit activity (T1014)</description>
  <mitre>
    <id>T1014</id>
  </mitre>
</rule>
<rule id="700025" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)^/sbin/modprobe$</field>
  <description>Kernel module load via modprobe detected — possible rootkit activity (T1014)</description>
  <mitre>
    <id>T1014</id>
  </mitre>
</rule>

<rule id="700026" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.arguments" type="pcre2">(?i)\b/etc/ld\.so\.preload\b</field>
  <description>Potential rootkit behavior — modification of ld.so.preload (T1014)</description>
  <mitre>
    <id>T1014</id>
  </mitre>
</rule>

<rule id="700027" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/(usr/bin|bin)/python3$</field>
  <field name="process_exit.process.arguments" type="pcre2">(?i)/(usr/local|tmp|dev/shm|var/tmp)/.*\.(py|sh|pl)\b</field>
  <description>Suspicious script execution from non-standard path — potential user-space rootkit activity (T1014)</description>
  <mitre>
    <id>T1014</id>
  </mitre>
</rule>

<rule id="700028" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/(python3|perl|base64|xxd)$</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)(b64decode|base64\.b64decode|base64 -d|xxd -r|-r -p)</field>
  <description>Deobfuscation or decoding activity detected — possible adversary behavior (T1140)</description>
  <mitre>
    <id>T1140</id>
  </mitre>
</rule>

<rule id="700029" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/(bash|sh)$</field>
  <field name="process_exec.process.parent.binary" type="pcre2">(?i)^/usr/bin/(base64|xxd)$</field>
  <description>Shell launched from decoding utility — suspicious execution chain (T1140)</description>
  <mitre>
    <id>T1140</id>
  </mitre>
</rule>

<rule id="700030" level="10">
  <decoded_as>json</decoded_as>
<field name="process_exit.process.binary" type="pcre2">(?i)^/(usr/bin|bin)/(cp|mv|rsync|tee|echo|sed|cat|rm|shred|unlink)$</field>
  <field name="process_exit.process.arguments" type="pcre2">(?i)/var/(spool|mail)/mail/</field>
  <description>Direct mailbox access or tampering attempt (T1070.008)   command= sudo cp /var/spool/mail/testuser /var/spool/mail/mail/testuser.bak</description>
  <mitre>
    <id>T1070.008</id>
  </mitre>
</rule>

<rule id="700031" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/usr/bin/touch$</field>
  <field name="process_exit.process.arguments" type="pcre2">(?i)(\s|^)(-a|-m|-r)\b</field>
  <description>Timestamp manipulation detected using 'touch' — possible timestomp activity (T1070.006)</description>
  <mitre>
    <id>T1070.006</id>
  </mitre>
</rule>


  <rule id="700032" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/sbin/insmod</field>
    <description>Potential rootkit activity: insmod command executed</description>
    <mitre>
      <id>T1543</id>
      <id>T1205</id>
    </mitre>
  </rule>

<rule id="700033" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/usr/bin/systemd-detect-virt$</field>
  <description>Virtualization detection command executed: systemd-detect-virt</description>
  <mitre>
    <id>T1497.001</id>
  </mitre>
</rule>
<rule id="700034" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/usr/bin/rm$</field>
  <field name="process_exit.process.arguments" type="pcre2">(?i)^/root/\.bash_history$</field>
  <description>Command to remove bash history detected: rm /root/.bash_history</description>
  <mitre>
    <id>T1070.003</id> <!-- Indicator Removal on Host: Clear Command History -->
  </mitre>
</rule>

<rule id="700035" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/usr/bin/cat$</field>
  <field name="process_exit.process.arguments" type="pcre2">(?i)^/dev/null$</field>
  <description>Command to read or clear data using /dev/null detected: cat /dev/null</description>
  <mitre>
    <id>T1070.003</id>
  </mitre>
</rule>

<rule id="700036" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/usr/bin/ln$</field>
  <field name="process_exit.process.arguments" type="pcre2">(?i)-sf\s+/dev/null\s+/root/\.bash_history$</field>
  <description>Command to symlink /root/.bash_history to /dev/null detected: ln -sf</description>
  <mitre>
    <id>T1070.003</id>
  </mitre>
</rule>
<rule id="700037" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/usr/sbin/setenforce$</field>
  <field name="process_exit.process.arguments" type="pcre2">(?i)^0$</field>
  <description>SELinux disable attempt detected: setenforce 0  command = setenforce 0</description>
  <mitre>
    <id>T1562.001</id>
  </mitre>
</rule>

<rule id="700038" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/systemctl$</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)\bstop\s+(rsyslog|systemd-journald|auditd)\b</field>
  <description>Attempt to stop a logging service: systemctl stop rsyslog/systemd-journald/auditd command = systemctl stop rsyslog/systemd-journald/auditd</description>
  <mitre>
    <id>T1562.001</id>
  </mitre>
</rule>


<rule id="700039" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/systemctl$</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)\bstop\s+syslogd\.service\b</field>
  <field name="process_exec.parent.binary" type="pcre2">(?i)^/usr/sbin/service$</field>
  <field name="process_exec.parent.arguments" type="pcre2">(?i)\bservice\s+syslogd\s+stop\b</field>
  <description>Command to stop syslogd detected via 'service' -> 'systemctl'</description>
  <mitre>
    <id>T1562.001</id>
  </mitre>
</rule>

<rule id="700040" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_tracepoint.process.binary" type="pcre2">(?i)^/usr/bin/systemctl$</field>
  <field name="process_tracepoint.process.arguments" type="pcre2">(?i)^stop cbdaemon.service$</field>
  <description>Command to stop the cbdaemon service detected: systemctl stop cbdaemon.service</description>
  <mitre>
    <id>T1071.001</id>
  </mitre>
</rule>
<rule id="700041" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/usr/bin/systemctl$</field>
  <field name="process_exit.process.arguments" type="pcre2">(?i)^stop falcon-sensor(\.service)?$</field>
  <description>Command to stop the falcon-sensor service detected: systemctl stop falcon-sensor or systemctl stop falcon-sensor.service</description>
  <mitre>
    <id>T1071.001</id>
  </mitre>
</rule>
<rule id="700042" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/usr/bin/systemctl$</field>
  <field name="process_exit.process.arguments" type="pcre2">(?i)^disable falcon-sensor(\.service)?$</field>
  <description>Command to stop the falcon-sensor service detected: systemctl disable falcon-sensor or systemctl disable falcon-sensor.service</description>
  <mitre>
    <id>T1071.001</id>
  </mitre>
</rule>

<rule id="700043" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/usr/bin/(gcc|g\+\+|clang\+\+|clang|go)$</field>
  <description>Compilation tool execution detected (gcc, g++, clang, clang++, go) - potential Compile After Delivery</description>
  <mitre>
    <id>T1027.004</id>
  </mitre>
</rule>

<rule id="700044" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/usr/bin/(rm|shred)$</field>
  <field name="process_exit.process.arguments" type="pcre2">(?i)^.*(-f|-rf|-u)?\s*(/etc/|/var/log/|/usr/bin/|/boot/).*$</field>
  <description>Potential indicator removal: deletion or shredding of critical files in sensitive Linux paths (/etc, /var/log, /usr/bin, /boot)</description>
  <mitre>
    <id>T1070.004</id>
  </mitre>
</rule>

<rule id="700045" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">^/usr/bin/mkdir$</field>
  <field name="process_exit.process.arguments" type="pcre2">/\.[^/]+$</field>
  <description>Suspicious use of mkdir to create a hidden directory (starts with a dot)</description>
  <mitre>
    <id>T1564.001</id>
  </mitre>
</rule>


<rule id="700046" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/usr/sbin/useradd$</field>
  <field name="process_exit.process.arguments" type="pcre2">(?i).*--password\s+\$1\$.*</field>
  <description>Local account creation detected with password hash (useradd)</description>
  <mitre>
    <id>T1078.003</id>
  </mitre>
</rule>

<rule id="700047" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/usr/bin/openssl$</field>
  <field name="process_exit.process.arguments" type="pcre2">(?i)^passwd\s+-1\s+.*$</field>
  <description>Password hash generation using openssl (passwd -1) detected — possible account creation preparation</description>
  <mitre>
    <id>T1078.003</id>
  </mitre>
</rule>

<rule id="700048" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/usr/sbin/atd$</field>
  <description>Scheduled task execution by at daemon detected (atd) command = echo "echo Hello from Atomic Red Team" | at now + 1 minute</description>
  <mitre>
    <id>T1053.002</id>
  </mitre>
</rule>

<rule id="700049" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/usr/sbin/useradd$</field>
  <field name="process_exit.process.arguments" type="pcre2">(?i)^.*-c\s+evil_account.*$</field>
  <description>Local user account creation detected via useradd with comment 'evil_account'</description>
  <mitre>
    <id>T1136.001</id>
  </mitre>
</rule>

<rule id="700050" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/usr/sbin/useradd$</field>
  <field name="process_exit.process.arguments" type="pcre2">(?i).*-g\s*0.*</field>
  <description>Root-level user creation detected via useradd -g 0 — possible privilege escalation</description>
  <mitre>
    <id>T1136.001</id>
  </mitre>
</rule>

<rule id="700051" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/usr/bin/ldapadd$</field>
  <field name="process_exit.process.arguments" type="pcre2">(?i).*ldap://[a-z0-9\.\-]+:389.*-D\s+\S+@[\w\.-]+\s+-w\s+\S+\s+-f\s+.*admin.*\.ldif.*</field>
  <description>LDAP domain admin account creation attempt detected (ldapadd targeting admin-related LDIF)</description>
  <mitre>
    <id>T1136.002</id>
  </mitre>
</rule>

<rule id="700052" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/usr/bin/ldapadd$</field>
  <field name="process_exit.process.arguments" type="pcre2">(?i).*ldap://[a-z0-9\.\-]+:389.*-D\s+\S+@[\w\.-]+\s+-w\s+\S+\s+-f\s+.*\.ldif.*</field>
  <description>LDAP domain user account creation attempt detected (ldapadd with any LDIF file)</description>
  <mitre>
    <id>T1136.002</id>
  </mitre>
</rule>

<rule id="700053" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/usr/bin/curl$</field>
  <field name="process_exit.process.arguments" type="pcre2">(?i)-XPOST\s+[A-Za-z0-9+/=]+\.[\w\-\.]+</field>
  <description>curl POST with base64-like subdomain detected — possible data exfiltration (T1568.003)</description>
  <mitre>
    <id>T1132.001</id>
  </mitre>
</rule>


<rule id="700054" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.arguments" type="pcre2">(?i)code\s+tunnel\s+--accept-server-license-terms</field>
  <description>VSCode Remote Tunnel usage detected (potential protocol tunneling)</description>
  <mitre>
    <id>T1572</id>
  </mitre>
</rule>

<rule id="700055" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.arguments" type="pcre2">(?i)devtunnel\s+host\s+-p\s+\d+</field>
  <description>Microsoft Dev Tunnel usage detected (potential protocol tunneling)</description>
  <mitre>
    <id>T1572</id>
  </mitre>
</rule>

<rule id="700056" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.arguments" type="pcre2">(?i)cloudflared\s+tunnel\s+--url\s+(localhost|127\.0\.0\.1):\d+</field>
  <description>Cloudflared tunnel usage detected (potential protocol tunneling)</description>
  <mitre>
    <id>T1572</id>
  </mitre>
</rule>

<rule id="700057" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.arguments" type="pcre2">(?i)(code|cloudflared|devtunnel).+tunnel</field>
  <description>Generic tunneling command detected (possible protocol tunneling)</description>
  <mitre>
    <id>T1572</id>
  </mitre>
</rule>

<rule id="700058" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.arguments" type="pcre2">(?i)(^|\s)(systemctl|service)\s+start\s+tor(\s|$)</field>
  <description>Tor proxy service start detected (potential anonymizing proxy usage)</description>
  <mitre>
    <id>T1090.003</id>
  </mitre>
</rule>

<rule id="700059" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/telnet$</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)\b(102[5-9]|10[3-9][0-9]|1[1-9][0-9]{2,}|[2-9][0-9]{3,4}|[1-9][0-9]{5,})\b</field>
  <description>Telnet connection to an uncommon/high port (MITRE T1571 - Non-Standard Port)</description>
  <mitre>
    <id>T1571</id>
  </mitre>
</rule>

<rule id="700060" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)^/tmp/icmpdoor/icmpdoor$</field>
  <description>ICMP-based reverse shell client execution detected (MITRE T1095 - Non-Application Layer Protocol)</description>
  <mitre>
    <id>T1095</id>
  </mitre>
  <group>icmpdoor,reverse_shell,</group>
</rule>

<rule id="700061" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/curl$</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)\s+-A\s+("[^"]*"|'[^']*'|[^"\s]+)</field>
  <description>Use of curl with custom User-Agent (MITRE T1071.001 - C2 over HTTP)</description>
  <mitre>
    <id>T1071.001</id>
  </mitre>
  <group>tetragon,process_exec,network,curl,suspicious</group>
</rule>

<rule id="700062" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/usr/bin/curl$</field>
  <field name="process_exit.process.arguments" type="pcre2">(?i)\s+-A\s+("[^"]*"|'[^']*'|[^"\s]+)</field>
  <description>Use of curl with custom User-Agent (MITRE T1071.001 - C2 over HTTP) - Exit Event</description>
  <mitre>
    <id>T1071.001</id>
  </mitre>
  <group>tetragon,process_exit,network,curl,suspicious</group>
</rule>

<rule id="700063" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exit.process.binary" type="pcre2">(?i)^/(usr|bin|sbin)/.*(curl|wget|scp|sftp|ftp|nc|ncat|telnet|timeout|whois)$</field>
    <description>Suspicious network tool execution detected - Possible Ingress Tool Transfer (T1105)</description>
    <field name="process_exit.process.arguments" type="pcre2">(?i).*(localhost|127\.0\.0\.1|--output|--data|--post|--preserve-status|:[0-9]+).*</field>
    <mitre>
      <id>T1105</id>
    </mitre>
  </rule>

  <rule id="700064" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">/usr/bin/(xargs|xxd|strings|tail|base64|sh)</field>
    <description>Suspicious command used in possible steganographic payload delivery (T1001.002)</description>
    <mitre>
      <id>T1001.002</id>
      <id>T1027</id>
      <id>T1059.004</id>
    </mitre>
    <options>no_full_log</options>
  </rule>

  <rule id="700065" level="10">
    <if_sid>700064</if_sid>
    <field name="process_exec.process.binary">/usr/bin/sh</field>
    <description>Script executed from hidden payload likely appended to image (Stego + Execution)</description>
    <mitre>
      <id>T1001.002</id>
      <id>T1059.004</id>
    </mitre>
    <options>no_full_log</options>
  </rule>



<rule id="700066" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/curl</field>
  <field name="process_exec.process.arguments" type="pcre2">https?:\/\/[a-zA-Z0-9._-]+(:[0-9]+)?</field>
  <description>Possible proxy usage with curl detected (MITRE T1090.001)</description>
  <mitre>
    <id>T1090.001</id>
  </mitre>
</rule>

<rule id="700067" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(http|https|ftp)_proxy=</field>
  <description>Proxy environment variable set — possible redirection attempt (T1090.001)</description>
  <mitre>
    <id>T1090.001</id>
  </mitre>
</rule>


<rule id="700068" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/zip$</field>
    <description>Archiving with zip detected (T1560.001 - Archive via Utility)</description>
    <mitre>
      <id>T1560.001</id>
      </mitre>
</rule>

<rule id="700069" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/gzip$</field>
    <description>File compression with gzip detected (T1560.001 - Archive via Utility)</description>
    <mitre>
      <id>T1560.001</id>
    </mitre>
</rule>

<rule id="700070" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/tar$</field>
    <description>Tar archiving detected (T1560.001 - Archive via Utility)</description>
    <mitre>
      <id>T1560.001</id>
    </mitre>
</rule>

<rule id="700071" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.arguments" type="pcre2">(?i)--password</field>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/zip$</field>
    <description>Password-protected zip file detected (T1560.001 - Archive via Utility)</description>
    <mitre>
      <id>T1560.001</id>
    </mitre>
</rule>

<rule id="700072" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/gpg$</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)--symmetric|-c</field>
    <description>GPG symmetric encryption activity (T1560.001 - Archive via Utility)</description>
    <mitre>
      <id>T1560.001</id>
    </mitre>
</rule>

<rule id="700073" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/openssl$</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)enc.*-aes</field>
    <description>OpenSSL encryption used for data archiving (T1560.001 - Archive via Utility)</description>
    <mitre>
      <id>T1560.001</id>
    </mitre>
</rule>

<rule id="700074" level="11">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/base64$</field>
    <description>Base64 encoding used on local file (T1560.001 - Archive via Utility)</description>
    <mitre>
      <id>T1560.001</id>
    </mitre>
</rule>


<rule id="700075" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/xwd$</field>
    <description>Suspicious activity: X11 screen capture detected using xwd</description>
    <mitre>
      <id>T1113</id>
    </mitre>
</rule>

<rule id="700076" level="7">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/xwud$</field>
    <description>Screen capture viewer (xwud) executed - possible X11 data review</description>
    <mitre>
      <id>T1113</id>
    </mitre>
</rule>

<rule id="700077" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/import</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)-window\s+root.*</field>
    <description>Potential screen capture using ImageMagick import command (T1113)</description>
    <mitre>
      <id>T1113</id>
    </mitre>
</rule>

<rule id="700078" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exit.process.binary" type="pcre2">(?i)^/usr/bin/(tee|echo)$</field>
  <field name="process_exit.process.arguments" type="pcre2">(?i)(/etc/pam\.d/(password-auth|system-auth))</field>
  <description>Suspicious PAM modification attempt — Possible keylogging configuration (T1056.001)</description>
  <mitre>
    <id>T1056.001</id>
  </mitre>
</rule>



  <rule id="700079" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/tee$</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)-a\s+/root/\.bash_history</field>
    <description>Keylogging attempt detected via PROMPT_COMMAND (tee to .bash_history)</description>
    <mitre>
      <id>T1056.001</id>
    </mitre>
  </rule>

  <rule id="700080" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/logger$</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)-t\s+\"?\w+\[\d+\].*\"?</field>
    <description>Keylogging attempt detected via PROMPT_COMMAND (logger with process ID and session info)</description>
    <mitre>
      <id>T1056.001</id>
    </mitre>
  </rule>


<rule id="700081" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/logger</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)-t\s+root\s+-f\s+/root/\.sh_history</field>
  <description>Keylogging attempt using PS2 with logger to .sh_history (T1056.001)</description>
  <mitre>
    <id>T1056.001</id>
  </mitre>
</rule>

<rule id="700082" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)/tmp/\.keyboard\.log</field>
  <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/(cat|tail|less|more|grep)$</field>
  <description>Access to potential keylogger file /tmp/.keyboard.log (T1056.001)</description>
  <mitre>
    <id>T1056.001</id>
  </mitre>
</rule>


  <rule id="700083" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/systemctl</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)\brestart\s+(sshd|auditd)\b</field>
    <description>Potential activation of PAM TTY keylogging or auditd manipulation (T1056.001 / T1562.001)</description>
    <mitre>
      <id>T1056.001</id>
    </mitre>
  </rule>

  <rule id="700084" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/sbin/auditctl</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)(-S\s+execve).*?(-k\s+CMDS)</field>
    <description>Potential auditd keylogger detected via auditctl execve rule with key CMDS</description>
    <mitre>
      <id>T1056.001</id>
    </mitre>
  </rule>



  <rule id="700085" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/xclip</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)(-sel\s+clip|-o)</field>
    <description>Clipboard activity detected using xclip (T1115)</description>
    <mitre>
      <id>T1115</id>
    </mitre>
  </rule>

  <rule id="700086" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exit.process.binary">/usr/bin/xclip</field>
    <field name="process_exit.process.arguments" type="pcre2">(?i)(-sel\s+clip|-o)</field>
    <description>Clipboard access (xclip) detected on process exit (T1115)</description>
    <mitre>
      <id>T1115</id>
    </mitre>
  </rule>


  <rule id="700087" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)/usr/bin/(bash|sh)</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)(head\s+-c\s+15.*\|\s*strings.*SQLite\s+format\s+3)</field>
    <description>Suspicious file scan: SQLite file header inspection and conditional bash execution</description>
    <mitre>
      <id>T1005</id>
    </mitre>
  </rule>



  <rule id="700088" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/python[0-9.]*$</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)(gzip\.GzipFile|import\s+gzip)</field>
    <description>Suspicious compression via Python GZip — possible data staging</description>
    <mitre>
      <id>T1560.002</id>
    </mitre>
  </rule>

  <rule id="700089" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)\.gz</field>
  <description>File created or manipulated with .gz extension — possible compression</description>
  <mitre>
      <id>T1560.002</id>
  </mitre>
  </rule>


  <rule id="700090" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/python[0-9.]*$</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)(import\s+gzip|gzip\.GzipFile|import\s+bz2|bz2\.compress|zipfile\.ZipFile|import\s+tarfile|tarfile\.open)</field>
    <description>Python-based file compression detected (gzip, bz2, zipfile, tarfile) — possible data staging</description>
    <mitre>
      <id>T1560.002</id>
    </mitre>
  </rule>

<rule id="700091" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/sudo$</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)^-S whoami$</field>
  <description>Possible sudo brute-force detected: use of 'sudo -S whoami'</description>
  <mitre>
    <id>T1110.001</id>
  </mitre>
</rule>


<rule id="700092" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)/usr/bin/python3</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)laZagne\.py\s+browsers(\s+-[\w]+)?</field>
  <description>Potential credential dumping with LaZagne targeting browser password stores</description>
  <mitre>
    <id>T1555.003</id>
  </mitre>
</rule>

  <rule id="700093" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/find$</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)(find\s+)?/.*-name\s+id_rsa.*cp\s+</field>
    <description>Possible credential theft attempt: copying private SSH keys using 'find' and 'cp'</description>
    <mitre>
      <id>T1552.004</id>
    </mitre>
  </rule>

<rule id="700094" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)^/bin/cp$|^/usr/bin/cp$</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)id_rsa</field>
  <description>Suspicious copy of SSH private key file detected (cp id_rsa)</description>
  <mitre>
    <id>T1552.004</id>
  </mitre>
</rule>

  <rule id="700095" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/rsync$</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)(rsync\s+-R\s+.*id_rsa|id_rsa.*\s+/tmp)</field>
    <description>Possible credential theft: rsync used to copy private SSH keys</description>
    <mitre>
      <id>T1552.004</id>
    </mitre>
  </rule>

<rule id="700096" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/rsync$</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)(?=.*-R)(?=.*id_rsa)(?=.*\/tmp\/art-staging)</field>
  <description>Detected rsync used to stage SSH private keys to /tmp/art-staging (T1552.004)</description>
  <mitre>
    <id>T1552.004</id>
  </mitre>
</rule>

<rule id="700097" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/rsync$</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)(?=.*\.gnupg)(?=.*-Rr)(?=.*\/tmp\/GnuPG)</field>
  <description>Detected rsync used to exfiltrate GnuPG directory to /tmp/GnuPG (T1552.004)</description>
  <mitre>
    <id>T1552.004</id>
  </mitre>
</rule>

<rule id="700098" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/find$</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)(\.oci/sessions.*token)</field>
  <description>Possible credential discovery attempt: scanning for Oracle Cloud credentials token file</description>
  <mitre>
    <id>T1552.001</id>
  </mitre>
</rule>

<rule id="700099" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/find$</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)\.config/gcloud.*(credentials\.db|access_tokens\.db)</field>
  <description>Possible GCP credential discovery attempt using find on .config/gcloud (T1552.001)</description>
  <mitre>
    <id>T1552.001</id>
  </mitre>
</rule>

<rule id="700100" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)(msal_token_cache\.json|accessTokens\.json)</field>
  <description>Possible Azure token access (T1552.001)</description>
  <mitre>
    <id>T1552.001</id>
  </mitre>
</rule>

<rule id="700101" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)\.netrc</field>
  <description>Suspicious access to .netrc file (possible credential discovery or exfiltration)</description>
  <mitre>
    <id>T1552.001</id>
  </mitre>
</rule>

<rule id="700102" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)/usr/bin/(curl|wget)</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)@-</field>
  <description>Possible credential exfiltration via curl/wget using stdin</description>
  <mitre>
    <id>T1552.001</id>
  </mitre>
</rule>

<rule id="700103" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/sh</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)sshpass\s+-p\s+[`"]?echo.*cut.*f2[`"]?\s+ssh.*@localhost</field>
  <description>Credential stuffing attempt using sshpass inside shell script (T1110.004)</description>
  <mitre>
    <id>T1110.004</id>
  </mitre>
</rule>


<rule id="700104" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/sh$</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)sshpass\s+-p\s+\S+\s+ssh\s+-o.*@localhost</field>
  <description>Brute-force SSH attempt with sshpass targeting localhost (T1110.004 - Credential Stuffing)</description>
  <mitre>
    <id>T1110.004</id>
  </mitre>
</rule>


  <rule id="700105" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/(users|w|who|id|logname)$</field>
    <description>System Owner/User Discovery via {{process_exec.process.binary}} (T1033)</description>
    <mitre>
      <id>T1033</id>
    </mitre>
  </rule>

  <rule id="700106" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/ping$</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)(0\.0\.0\.0|8\.8\.8\.8|1\.1\.1\.1|google\.com|localhost)</field>
    <description>Internet Connectivity Check using ping (T1016.001)</description>
    <mitre>
      <id>T1016.001</id>
    </mitre>
  </rule>



  <rule id="700107" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/ldapsearch$</field>
    <description>LDAP domain account enumeration attempt detected using ldapsearch (T1087.002)</description>
    <mitre>
      <id>T1087.002</id>
    </mitre>
  </rule>


  <rule id="700108" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)ldapdomaindump</field>
    <description>Possible domain account enumeration using ldapdomaindump</description>
    <mitre>
      <id>T1087.002</id>
    </mitre>
  </rule>


  <rule id="700110" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/cat</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)^.*\/etc\/passwd.*$</field>
    <description>Account Discovery: Access to /etc/passwd detected (T1087.001)</description>
    <mitre>
      <id>T1087.001</id>
    </mitre>
  </rule>

  <rule id="700111" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">/usr/bin/cat</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)/etc/sudoers</field>
    <description>Access to sudoers file detected - possible privilege enumeration</description>
    <mitre>
      <id>T1087.001</id>
    </mitre>
  </rule>


  <rule id="700112" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">/usr/bin/grep</field>
    <field name="process_exec.process.arguments" type="pcre2">(x:0:|\*:0:)</field>
    <description>UID 0 Enumeration Detected in /etc/passwd</description>
    <mitre>
      <id>T1087.001</id>
    </mitre>
  </rule>


  <rule id="700113" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/lsof</field>
    <description>Enumeration of user open files using lsof</description>
    <mitre>
      <id>T1087.001</id>
    </mitre>
  </rule>


  <rule id="700114" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/lastlog</field>
    <description>Enumeration of local account login history using lastlog</description>
    <mitre>
      <id>T1087.001</id>
    </mitre>
  </rule>


  <rule id="700115" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/(id|groups)$</field>
    <description>User account or group enumeration detected (id/groups command)</description>
    <mitre>
      <id>T1087.001</id>
    </mitre>
  </rule>


  <rule id="700116" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/ldapsearch$</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)objectClass=group</field>
    <description>Possible LDAP enumeration of domain groups using ldapsearch</description>
    <mitre>
      <id>T1087.002</id>
    </mitre>
  </rule>


  <rule id="700117" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/smbstatus$</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)--shares</field>
    <description>Network Share Discovery attempt detected via smbstatus</description>
    <mitre>
      <id>T1135</id>
    </mitre>
  </rule>

  <rule id="700118" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/uname</field>
    <description>System information discovered using uname</description>
    <mitre>
      <id>T1082</id>
    </mitre>
  </rule>

  <rule id="700119" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/uptime</field>
    <description>System uptime queried using uptime command</description>
    <mitre>
      <id>T1082</id>
    </mitre>
  </rule>

  <rule id="700120" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/cat</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)/etc/lsb-release</field>
    <description>System info file /etc/lsb-release read using cat</description>
    <mitre>
      <id>T1082</id>
    </mitre>
  </rule>

  <rule id="700121" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/cat</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)/etc/os-release</field>
    <description>System info file /etc/os-release read using cat</description>
    <mitre>
      <id>T1082</id>
    </mitre>
  </rule>

  <rule id="700122" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/cat</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)/etc/issue</field>
    <description>System info file /etc/issue read using cat</description>
    <mitre>
      <id>T1082</id>
    </mitre>
  </rule>

  <rule id="700123" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/sbin/dmidecode$</field>
    <description>System info discovery via dmidecode (T1082)</description>
    <mitre>
      <id>T1082</id>
    </mitre>
  </rule>

  <rule id="700124" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/lspci$</field>
    <description>System info discovery via lspci (T1082)</description>
    <mitre>
      <id>T1082</id>
    </mitre>
  </rule>

  <rule id="700125" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/lscpu$</field>
    <description>System info discovery via lscpu (T1082)</description>
    <mitre>
      <id>T1082</id>
    </mitre>
  </rule>

  <rule id="700126" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/cat$</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)/sys/class/dmi/id/|/proc/scsi/scsi|/proc/ide/|/proc/cmdline</field>
    <description>System info discovery via cat on hardware-identifying files (T1082)</description>
    <mitre>
      <id>T1082</id>
    </mitre>
  </rule>


<rule id="700127" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)vboxsf\|vboxguest</field>
  <field name="process_exec.process.binary">/usr/bin/grep</field>
  <description>Virtual machine detection: VirtualBox modules grep</description>
  <mitre>
    <id>T1082</id>
  </mitre>
</rule>

<rule id="700128" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)vmw_baloon\|vmxnet</field>
  <field name="process_exec.process.binary">/usr/bin/grep</field>
  <description>Virtual machine detection: VMware modules grep</description>
  <mitre>
    <id>T1082</id>
  </mitre>
</rule>


<rule id="700129" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)xen-vbd\|xen-vnif</field>
  <field name="process_exec.process.binary">/usr/bin/grep</field>
  <description>Virtual machine detection: Xen modules grep</description>
  <mitre>
    <id>T1082</id>
  </mitre>
</rule>


<rule id="700130" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)hv_vmbus\|hv_blkvsc\|hv_netvsc\|hv_utils\|hv_storvsc</field>
  <field name="process_exec.process.binary">/usr/bin/grep</field>
  <description>Virtual machine detection: Hyper-V modules grep</description>
  <mitre>
    <id>T1082</id>
  </mitre>
</rule>

<rule id="700131" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)vbox|vmxnet|virtio|xen|hv_</field>
  <field name="process_exec.process.binary">/usr/bin/grep</field>
  <description>Potential VM discovery: grep for virtualization kernel modules</description>
  <mitre>
    <id>T1082</id>
  </mitre>
</rule>

<rule id="700132" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/sbin/kldstat</field>
  <description>FreeBSD: Kernel module listing (kldstat) - potential virtualization check</description>
  <mitre>
    <id>T1082</id>
  </mitre>
</rule>


<rule id="700133" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)vmm</field>
  <field name="process_exec.process.binary">/usr/bin/grep</field>
  <description>FreeBSD virtualization detection: grep for vmm after kldstat</description>
  <mitre>
    <id>T1082</id>
  </mitre>
</rule>


<rule id="700134" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)vbox</field>
  <field name="process_exec.process.binary">/usr/bin/grep</field>
  <description>FreeBSD virtualization detection: grep for vbox after kldstat</description>
  <mitre>
    <id>T1082</id>
  </mitre>
</rule>

<rule id="700135" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)kldstat.*\|.*grep.*(vmm|vbox)</field>
  <description>FreeBSD VM detection activity via kldstat and grep</description>
  <mitre>
    <id>T1082</id>
  </mitre>
</rule>


<rule id="700136" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/env</field>
  <description>FreeBSD: Suspicious use of 'env' (possible virtualization check using sh or script chain)</description>
  <mitre>
    <id>T1082</id>
  </mitre>
</rule>

<rule id="700137" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">^/usr/bin/find$</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i).*places\.sqlite.*</field>
    <description>Potential Firefox bookmark database discovery using find - T1217</description>
    <mitre>
      <id>T1217</id>
    </mitre>
  </rule>

<rule id="700138" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/find</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)\.config/chromium/.*/Bookmarks</field>
    <description>Possible Chromium bookmark discovery using find command (T1217)</description>
    <mitre>
      <id>T1217</id>
    </mitre>
</rule>

<rule id="700139" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)^/(usr/bin|bin)/(find|locate|ls|cat|which|file|du|stat|tree)$</field>
  <description>Possible File and Directory Discovery (MITRE T1083)</description>
  <mitre>
    <id>T1083</id>
  </mitre>
</rule>


  <rule id="700140" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/(usr/bin|bin)/(netstat|ss|lsof)$</field>
    <description>Possible system network connection discovery command executed (MITRE T1049)</description>
    <mitre>
      <id>T1049</id>
    </mitre>
  </rule>

  <rule id="700141" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/ps</field>
    <description>Process Discovery attempt: 'ps' command executed</description>
    <mitre>
      <id>T1057</id>
    </mitre>
  </rule>

  <rule id="700142" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/(id|groups|getent|cat)$</field>
    <description>Permission Groups Discovery - Possible local group enumeration activity detected</description>
    <mitre>
      <id>T1069.001</id>
    </mitre>
  </rule>


  <rule id="700143" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/cat$</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)/etc/pam\.d/common-password</field>
    <description>Access to password complexity policy file detected (/etc/pam.d/common-password)</description>
    <mitre>
      <id>T1201</id>
    </mitre>
  </rule>

<rule id="700144" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/cat$</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)/etc/pam\.d/passwd</field>
  <description>Potential credential policy discovery via /etc/pam.d/passwd</description>
  <mitre>
    <id>T1201</id>
  </mitre>
</rule>

<rule id="700145" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/cat</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)/etc/security/pwquality\.conf</field>
  <description>Attempt to read password policy: /etc/security/pwquality.conf</description>
  <mitre>
    <id>T1201</id>
  </mitre>
</rule>

<rule id="700146" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/cat</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)/etc/security/.*\.conf</field>
  <description>Read attempt on /etc/security/*.conf - Possible Discovery</description>
  <mitre>
    <id>T1201</id>
  </mitre>
</rule>


<rule id="700177" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/cat</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)/etc/login\.defs</field>
  <description>Access to password expiration policy file /etc/login.defs</description>
  <mitre>
    <id>T1201</id>
  </mitre>
</rule>

  <rule id="700178" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/locale</field>
    <description>System location discovery using locale command (T1614)</description>
    <mitre>
      <id>T1614.001</id>
    </mitre>
  </rule>


  <rule id="700179" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/localectl</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)\blocalectl\s+status\b</field>
    <description>System locale command executed via localectl (Possible reconnaissance)</description>
    <mitre>
      <id>T1614.001</id>
    </mitre>
  </rule>

  <rule id="700180" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/cat</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)(/etc/(default/locale|locale.conf))</field>
    <description>System locale configuration file accessed (T1614.001 - System Language Discovery)</description>
    <mitre>
      <id>T1614.001</id>
    </mitre>
  </rule>

<rule id="700181" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">^/usr/bin/(env|printenv)$</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)\bLANG\b</field>
  <description>System language discovery attempt via environment variable query (env or printenv).</description>
  <mitre>
    <id>T1614.001</id>
  </mitre>
</rule>

<rule id="700182" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/curl</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)ipinfo\.io</field>
  <description>Possible IP geolocation lookup with curl (T1592.002)</description>
  <mitre>
    <id>T1614</id>
  </mitre>
</rule>


  <rule id="700183" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/ping</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)\b(?:\d{1,3}\.){3}\d{1,3}\b</field>
    <description>Remote system discovery attempt via ping (IPv4 address detected)</description>
    <mitre>
      <id>T1018</id>
    </mitre>
  </rule>

<rule id="700184" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/sbin/arp</field>
  <description>Remote system discovery attempt using ARP command</description>
  <mitre>
    <id>T1018</id>
  </mitre>
</rule>


  <rule id="700185" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/sbin/ip</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)neighbour\s+show</field>
    <description>Remote system discovery attempt via 'ip neighbour show'.</description>
    <mitre>
      <id>T1018</id>
    </mitre>
  </rule>


<rule id="700186" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/sbin/ip</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)\broute\s+show\b</field>
  <description>Remote system discovery attempt using 'ip route show'.</description>
  <mitre>
    <id>T1018</id>
  </mitre>
</rule>

<rule id="700187" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/netstat</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)\b-r\b</field>
  <description>Remote system discovery attempt using netstat -r</description>
  <mitre>
    <id>T1018</id>
  </mitre>
</rule>

<rule id="700188" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/sbin/ip</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)\btcp_metrics\b</field>
  <description>Remote system discovery attempt using 'ip tcp_metrics show'.</description>
  <mitre>
    <id>T1018</id>
  </mitre>
</rule>

  <rule id="700190" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/nmap$</field>
    <description>Potential network service discovery activity using nmap</description>
    <mitre>
      <id>T1046</id>
    </mitre>
  </rule>

<rule id="700191" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)^/bin/bash$</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)/dev/tcp/\d{1,3}(\.\d{1,3}){3}/\d{1,5}</field>
  <description>Suspicious bash port scan using /dev/tcp (T1046 - Network Service Discovery)</description>
  <mitre>
    <id>T1046</id>
  </mitre>
</rule>


  <rule id="700192" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/systemctl</field>
    <field name="process_exec.process.arguments" type="pcre2">
      (?i)\bstop\b.*\b(ssh|sshd|wazuh|wazuh-agent|firewalld|auditd|cron|rsyslog|suricata|fail2ban|clamav|ufw)\b
    </field>
    <description>Critical service stop attempt detected via systemctl (Possible defense evasion)</description>
    <mitre>
      <id>T1562.001</id>
    </mitre>
  </rule>

  <rule id="700193" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/killall</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)\-(SIGTERM|SIGKILL|SIGSTOP)\s+\w+</field>
    <description>Potential service stop attempt using killall and signal (e.g., SIGTERM).</description>
    <mitre>
      <id>T1489</id>
    </mitre>
  </rule>


  <rule id="700194" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/kill</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)-SIGTERM\s+\$\((pgrep|pidof)\s+\w+\)</field>
    <description>Potential service stop attempt using kill with pgrep/pidof substitution.</description>
    <mitre>
      <id>T1489</id>
    </mitre>
  </rule>

  <rule id="700195" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/pkill</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)-SIGTERM\s+\^?\w+\$?</field>
    <description>Potential service stop attempt using pkill with SIGTERM signal.</description>
    <mitre>
      <id>T1489</id>
    </mitre>
  </rule>

  <rule id="700196" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/passwd</field>
    <description>Password change attempt detected (T1531 - Account Access Removal)</description>
    <mitre>
      <id>T1531</id>
    </mitre>
  </rule>

  <rule id="700197" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/gpg</field>
    <description>Suspicious file encryption detected using gpg (T1027.009)</description>
    <mitre>
      <id>T1486</id>
    </mitre>
  </rule>

  <rule id="700198" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)/7z$</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)(\s|-)p[^ ]+</field>
    <description>Potential file encryption activity using 7z with password (T1022.001)</description>
    <mitre>
      <id>T1486</id>
    </mitre>
  </rule>

  <rule id="700199" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/ccencrypt$</field>
    <description>Suspicious encryption activity detected: use of ccencrypt binary (possible ransomware behavior).</description>
    <mitre>
      <id>T1486</id>
    </mitre>
  </rule>

  <rule id="700200" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/openssl$</field>
    <description>Suspicious OpenSSL encryption or key generation activity detected (MITRE T1486)</description>
    <mitre>
      <id>T1486</id>
    </mitre>
  </rule>

  <rule id="700201" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/yes$</field>
    <description>High CPU usage process detected: /usr/bin/yes may indicate resource hijacking (T1496).</description>
    <mitre>
      <id>T1496</id>
    </mitre>
  </rule>


  <rule id="700202" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/(usr/)?sbin/shutdown$</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)\-r\s+now</field>
    <description>System restart attempt via shutdown -r now (T1529)</description>
    <mitre>
      <id>T1529</id>
    </mitre>
  </rule>


  <rule id="700203" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/(usr/)?sbin/reboot$</field>
    <description>System reboot command executed via /sbin/reboot or /usr/sbin/reboot (T1529)</description>
    <mitre>
      <id>T1529</id>
    </mitre>
  </rule>

  <rule id="700204" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/(usr/)?sbin/halt$</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)-p</field>
    <description>System shutdown command executed via halt -p (T1529)</description>
    <mitre>
      <id>T1529</id>
    </mitre>
  </rule>


  <rule id="700205" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/(usr/)?sbin/halt$</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)-r</field>
    <description>System reboot command executed via halt -r (T1529)</description>
    <mitre>
      <id>T1529</id>
    </mitre>
  </rule>


  <rule id="700206" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/(usr/)?sbin/halt$</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)--reboot</field>
    <description>System reboot attempt via halt --reboot (MITRE T1529)</description>
    <mitre>
      <id>T1529</id>
    </mitre>
  </rule>


  <rule id="700207" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/(usr/)?sbin/poweroff$</field>
    <description>System shutdown attempt via poweroff command (MITRE T1529)</description>
    <mitre>
      <id>T1529</id>
    </mitre>
  </rule>


  <rule id="700208" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/(usr/)?sbin/poweroff$</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)(--reboot|-r)</field>
    <description>System reboot attempt via poweroff with reboot flag (MITRE T1529)</description>
    <mitre>
      <id>T1529</id>
    </mitre>
  </rule>

  <rule id="700209" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/curl$</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)(file=@|--data-binary|--upload-file)</field>
    <description>Potential exfiltration over HTTPS using curl to file.io (T1048.002)</description>
    <mitre>
      <id>T1048.002</id>
    </mitre>
  </rule>

  <rule id="700210" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/wget</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)--post-file=</field>
    <description>Data exfiltration attempt using wget --post-file</description>
    <mitre>
      <id>T1048.002</id>
    </mitre>
  </rule>


  <rule id="700211" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/split</field>
    <description>Potential data staging or splitting operation detected using 'split'.</description>
    <mitre>
      <id>T1030</id>
    </mitre>
  </rule>

<rule id="700212" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/(sh|bash)$</field>
  <field name="process_exec.parent.binary" type="pcre2">(?i)^/usr/bin/(curl|wget)$</field>
  <description>Suspicious script execution via curl or wget piped to shell (Possible T1059.004 or T1074.001)</description>
  <mitre>
    <id>T1074.001</id>
  </mitre>
</rule>


<rule id="700213" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)virtio_pci\|virtio_net</field>
  <field name="process_exec.process.binary">/usr/bin/grep</field>
  <description>Virtual machine detection: VirtIO modules grep</description>
  <mitre>
    <id>T1082</id>
  </mitre>
</rule>

<rule id="700214" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)^/tmp/packed_bin$</field>
  <description>Execution of packed binary from /tmp (Likely obfuscated or staged payload)</description>
  <mitre>
    <id>T1027.002</id>
  </mitre>
</rule>

<rule id="700215" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)(test_upx|test_upx_header_changed)$</field>
  <description>Execution of packed binary (UPX or modified header - software packing detected)</description>
  <mitre>
    <id>T1027.002</id>
  </mitre>
</rule>

<rule id="700216" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/(sh|bash)$</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)/tmp/(packed_bin|test_upx|test_upx_header_changed)</field>
  <description>Shell executed packed binary from /tmp (Software packing or staging activity)</description>
  <mitre>
    <id>T1027.002</id>
  </mitre>
</rule>

<rule id="700217" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/dd</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)(/dev/zero|/dev/random|/dev/urandom).+evil-binary</field>
  <description>Binary padding detected via dd on evil-binary (Possible hash evasion)</description>
  <mitre>
    <id>T1027.001</id>
  </mitre>
</rule>

<rule id="700218" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/truncate</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)\+1.+evil-binary</field>
  <description>Binary padding detected via truncate on evil-binary (Hash modification attempt)</description>
  <mitre>
    <id>T1027.001</id>
  </mitre>
</rule>

<rule id="700219" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/crontab</field>
  <description>Modification of crontab detected (Potential persistence mechanism)</description>
  <mitre>
    <id>T1053.003</id>
  </mitre>
</rule>

<rule id="700220" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)/etc/cron\.d/</field>
  <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/(echo|tee|bash|sh)$</field>
  <description>File created or modified in /etc/cron.d using shell or echo/tee</description>
  <mitre>
    <id>T1053.003</id>
  </mitre>
</rule>

<rule id="700221" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)/etc/cron\.(daily|hourly|weekly|monthly)/</field>
  <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/(echo|tee|bash|sh)$</field>
  <description>Script created in /etc/cron.(daily|hourly|weekly|monthly) for persistence</description>
  <mitre>
    <id>T1053.003</id>
  </mitre>
</rule>

<rule id="700222" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)/var/spool/cron/crontabs/</field>
  <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/(echo|tee|bash|sh)$</field>
  <description>Possible persistence: writing cron job to /var/spool/cron/crontabs</description>
  <mitre>
    <id>T1053.003</id>
  </mitre>
</rule>

<rule id="700223" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/(sh|bash)$</field>
  <field name="process_exec.parent.binary" type="pcre2">(?i)/etc/cron\.(d|daily|hourly|weekly|monthly)/persistevil$</field>
  <description>Suspicious shell execution from cron folder (Possible malicious scheduled task)</description>
  <mitre>
    <id>T1053.003</id>
  </mitre>
</rule>

<rule id="700224" level="10">
  <decoded_as>json</decoded_as>
  <field name="fs.path" type="pcre2">(?i)^/etc/systemd/system/.*\.(service|timer)$</field>
  <description>Creation or modification of persistent systemd timer or service file (T1053.006)</description>
  <mitre>
    <id>T1053.006</id>
  </mitre>
</rule>

<rule id="700225" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/systemctl</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)\b(start|enable)\b</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)\.timer\b</field>
  <description>Systemd timer activation via systemctl start/enable (T1053.006)</description>
  <mitre>
    <id>T1053.006</id>
  </mitre>
</rule>

<rule id="700226" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/systemd-run</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)--user</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)--on-calendar</field>
  <description>User-level transient timer execution using systemd-run (T1053.006)</description>
  <mitre>
    <id>T1053.006</id>
  </mitre>
</rule>

<rule id="700227" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/systemd-run</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)--on-calendar</field>
  <description>System-level transient timer execution using systemd-run (T1053.006)</description>
  <mitre>
    <id>T1053.006</id>
  </mitre>
</rule>

<rule id="700228" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)/tmp/(log|art-systemd-timer-marker)</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)(echo|touch)</field>
  <description>Suspicious payload executed from systemd timer (T1053.006)</description>
  <mitre>
    <id>T1053.006</id>
  </mitre>
</rule>

<rule id="700238" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)(curl|wget)[^|]+?\|\s*(bash|sh)</field>
  <description>Suspicious use of curl or wget piped to shell (T1059.004)</description>
  <mitre><id>T1059.004</id></mitre>
</rule>

<rule id="700239" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(AutoSUID\.sh|LinEnum\.sh)</field>
  <description>Execution of privilege escalation scripts (AutoSUID, LinEnum) - T1059.004</description>
  <mitre><id>T1059.004</id></mitre>
</rule>
<rule id="700240" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)/etc/shells</field>
  <description>Shell discovery via reading /etc/shells (T1059.004)</description>
  <mitre><id>T1059.004</id></mitre>
</rule>

<rule id="700241" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)base64\s+-[^\s]+\s*\|\s*/bin/(bash|sh)</field>
  <description>Obfuscated base64-encoded payload piped to shell (T1059.004)</description>
  <mitre><id>T1059.004</id></mitre>
</rule>

<rule id="700242" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)/usr/bin/chsh</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)-s\s+/bin/sh</field>
  <description>Change of login shell to /bin/sh (T1059.004)</description>
  <mitre><id>T1059.004</id></mitre>
</rule>

<rule id="700244" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)pipe-to-shell\.sh</field>
  <description>Execution of remote script via pipe-to-shell method (T1059.004)</description>
  <mitre><id>T1059.004</id></mitre>
</rule>

<rule id="700245" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/awk</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)BEGIN\s*{.*system\("/bin/sh.*"\)}</field>
  <description>Shell creation using awk system call (T1059.004)</description>
  <mitre><id>T1059.004</id></mitre>
</rule>

<rule id="700246" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/busybox</field>
  <description>Shell spawned via busybox (T1059.004)</description>
  <mitre><id>T1059.004</id></mitre>
</rule>

<rule id="700247" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/emacs</field>
  <description>Shell spawned through emacs term (T1059.004)</description>
  <mitre><id>T1059.004</id></mitre>
</rule>

<rule id="700248" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/ldapsearch</field>
  <description>LDAPSearch execution detected - Possible domain enumeration (T1069.002)</description>
  <mitre>
    <id>T1069.002</id>
  </mitre>
</rule>

<rule id="700249" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)(rm|truncate|shred|unlink|cat|dd|journalctl|srm|echo|osascript|log)</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)/var/(log|audit|spool)/</field>
  <description>Suspicious log deletion or truncation attempt (T1070.002)</description>
  <mitre>
    <id>T1070.002</id>
  </mitre>
</rule>

<rule id="700250" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/rm</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)/var/(log|audit)/</field>
  <description>Use of rm to delete system logs (T1070.002)</description>
  <mitre>
  <id>T1070.002</id>
  </mitre>
</rule>

<rule id="700251" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/truncate</field>
  <field name="process_exec.process.arguments" type="pcre2">-s 0\s+/var/log/</field>
  <description>Log truncation detected using truncate (T1070.002)</description>
  <mitre><id>T1070.002</id></mitre>
</rule>

<rule id="700252" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)(/usr/bin/cat|/usr/bin/dd)</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)(/dev/null|/dev/zero).*/var/log/</field>
  <description>Attempt to overwrite or clear logs using cat/dd and /dev/null or /dev/zero (T1070.002)</description>
  <mitre>
  <id>T1070.002</id>
  </mitre>
</rule>

<rule id="700253" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/shred</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)/var/log/</field>
  <description>Log shredding detected (T1070.002)</description>
  <mitre>
  <id>T1070.002</id>
  </mitre>
</rule>

<rule id="700254" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/unlink</field>
  <field name="process_exec.process.arguments" type="pcre2">/var/log/</field>
  <description>Unlink attempt on system log (T1070.002)</description>
  <mitre>
  <id>T1070.002</id>
  </mitre>
</rule>

<rule id="700255" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/echo</field>
  <field name="process_exec.process.arguments" type="pcre2">['"]{0,1}\s{0,1}['"]{0,1}\s*>\s*/var/log/</field>
  <description>Echo used to overwrite log files (T1070.002)</description>
  <mitre>
  <id>T1070.002</id>
  </mitre>
</rule>

<rule id="700256" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/cat</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)\.ssh/authorized_keys</field>
  <description>Suspicious read access to SSH authorized_keys file (T1098.004)</description>
  <mitre>
    <id>T1098.004</id>
  </mitre>
</rule>

<rule id="700257" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/date</field>
  <description>System time discovery using the 'date' command (T1124)</description>
  <mitre>
    <id>T1124</id>
  </mitre>
</rule>

  <rule id="700258" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/chmod</field>
    <field name="process_exec.process.arguments" type="pcre2">^\d{3}\s+/.*</field>
    <description>chmod used to change file/folder permissions (numeric mode) - T1222.002</description>
    <mitre>
      <id>T1222.002</id>
    </mitre>
  </rule>

  <rule id="700259" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/chmod</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)[ugoa]*[+-=][rwxXsStT]+</field>
    <description>chmod used to change file/folder permissions (symbolic mode) - T1222.002</description>
    <mitre>
      <id>T1222.002</id>
    </mitre>
  </rule>

  <rule id="700260" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/chmod</field>
    <field name="process_exec.process.arguments" type="pcre2">-R\s+[a-z0-9+=,-]+\s+/.*</field>
    <description>chmod used recursively on directory - T1222.002</description>
    <mitre>
      <id>T1222.002</id>
    </mitre>
  </rule>

  <rule id="700261" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/chown</field>
    <field name="process_exec.process.arguments" type="pcre2">\b(root|[a-z0-9_]+):?(root|[a-z0-9_]+)?\s+/.*</field>
    <description>chown used to change file/folder ownership - T1222.002</description>
    <mitre>
      <id>T1222.002</id>
    </mitre>
  </rule>

  <rule id="700262" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/chown</field>
    <field name="process_exec.process.arguments" type="pcre2">-R\s+\S+</field>
    <description>chown used recursively - T1222.002</description>
    <mitre>
      <id>T1222.002</id>
    </mitre>
  </rule>

  <rule id="700263" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/chattr</field>
    <field name="process_exec.process.arguments" type="pcre2">-i\s+/.*</field>
    <description>chattr used to remove immutable attribute - T1222.002</description>
    <mitre>
      <id>T1222.002</id>
    </mitre>
  </rule>

  <rule id="700264" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.arguments" type="pcre2">chflags\s+(no)?simmutable</field>
    <description>chflags used to modify immutable flag - T1222.002</description>
    <mitre>
      <id>T1222.002</id>
    </mitre>
  </rule>


  <rule id="700266" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/dd</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)if=\/dev\/(zero|random).*of=\/var\/log\/[^\s]+</field>
    <description>Possible data destruction via dd overwriting log files - T1485</description>
    <mitre>
      <id>T1485</id>
    </mitre>
  </rule>

  <rule id="700267" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/dd</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)if=\/dev\/(zero|random)</field>
    <description>dd command used with /dev/zero or /dev/random (possible wipe) - T1485</description>
    <mitre>
      <id>T1485</id>
    </mitre>
  </rule>

  <rule id="700271" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/openssl</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)rsautl\s+-encrypt.*-inkey\s+\/tmp\/pub\.pem.*-in\s+\/etc\/passwd.*-out\s+\/tmp\/passwd\.zip</field>
    <description>File encryption using OpenSSL rsautl with RSA public key (T1486)</description>
    <mitre>
      <id>T1486</id>
    </mitre>
  </rule>

    <rule id="700270" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/ccencrypt</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)-T\s+-K\s+\S+\s+\/tmp\/passwd</field>
    <description>File encryption using ccencrypt and password (T1486)</description>
    <mitre>
      <id>T1486</id>
    </mitre>
  </rule>

  <rule id="700268" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/7z</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)\ba\s+-p\S+\s+\/tmp\/passwd\.zip</field>
    <description>File encryption using 7z with password (T1486)</description>
    <mitre>
      <id>T1486</id>
    </mitre>
  </rule>

    <rule id="700269" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/gpg</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)--cipher-algo\s+AES-256.*--passphrase-fd\s+0.*-c\s+\/etc\/passwd</field>
    <description>File encryption using GPG and AES-256 (T1486)</description>
    <mitre>
      <id>T1486</id>
    </mitre>
  </rule>


<rule id="700272" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/pgrep</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)(bareos-fd|icinga2|cbagentd|wazuh-agent|packetbeat|filebeat|osqueryd)</field>
  <description>Attempt to enumerate security software using pgrep (T1518.001)</description>
  <mitre>
    <id>T1518.001</id>
  </mitre>
</rule>

<rule id="700273" level="9">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)/usr/bin/(bash|sh)</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)(ps\s+aux\s+\|\s+egrep|pgrep\s+-l)</field>
  <description>Wrapped shell command for security software discovery (T1518.001)</description>
  <mitre>
    <id>T1518.001</id>
  </mitre>
</rule>


<rule id="700274" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/sudo</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)(-l|cat\s+/etc/sudoers|vim\s+/etc/sudoers)</field>
  <description>Privilege escalation via sudo enumeration (T1548.003)</description>
  <mitre>
    <id>T1548.003</id>
  </mitre>
</rule>


<rule id="700275" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/sudo</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)sed.*timestamp_timeout=\-?1</field>
  <description>Sudo configuration change to disable password timeout (T1548.003)</description>
  <mitre>
    <id>T1548.003</id>
  </mitre>
</rule>


<rule id="700276" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/sudo</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)tty_tickets</field>
  <description>Sudo configuration modified to disable tty_tickets (T1548.003)</description>
  <mitre>
    <id>T1548.003</id>
  </mitre>
</rule>


<rule id="700277" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)/usr/sbin/visudo</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)(-c\s+-f\s+/etc/sudoers|/usr/local/etc/sudoers)</field>
  <description>visudo used to validate modified sudoers file (T1548.003)</description>
  <mitre>
    <id>T1548.003</id>
  </mitre>
</rule>

<rule id="700278" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)/bin/sh</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)echo\s+Defaults\s+\!tty_tickets\s*>>\s*(/etc/sudoers|/usr/local/etc/sudoers)</field>
  <description>Sudoers file modified via echo (tty_tickets disabled) (T1548.003)</description>
  <mitre>
    <id>T1548.003</id>
  </mitre>
</rule>

<rule id="700279" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)/usr/bin/cat</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)\.bash_history</field>
  <description>Reading bash history file - possible credential harvesting (T1552.003)</description>
  <mitre>
    <id>T1552.003</id>
  </mitre>
</rule>

<rule id="700280" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)/usr/bin/cat</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)\.history</field>
  <description>Reading sh history file - possible credential harvesting (T1552.003)</description>
  <mitre>
    <id>T1552.003</id>
  </mitre>
</rule>

<rule id="700281" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)/usr/bin/grep</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)(pass|ssh|-p)</field>
  <description>Grep used to extract credentials - suspicious search terms (T1552.003)</description>
  <mitre>
    <id>T1552.003</id>
  </mitre>
</rule>

<rule id="700282" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)cat\s+\S*history\s*\|\s*grep\s+.*(pass|ssh|-p)</field>
  <description>Pipeline to extract sensitive entries from history files (T1552.003)</description>
  <mitre>
    <id>T1552.003</id>
  </mitre>
</rule>

<rule id="700283" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)kubectl</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)get\s+secrets\s+--all-namespaces</field>
  <description>Kubernetes: List all secrets from all namespaces (T1552.007)</description>
  <mitre>
    <id>T1552.007</id>
  </mitre>
</rule>

<rule id="700284" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)kubectl</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)get\s+secrets\s+-n\s+\w+</field>
  <description>Kubernetes: List secrets from a specific namespace (T1552.007)</description>
  <mitre>
    <id>T1552.007</id>
  </mitre>
</rule>

<rule id="700285" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)kubectl</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)exec\s+\S+\s+--\s+cat\s+/run/secrets/kubernetes\.io/serviceaccount/token</field>
  <description>Kubernetes: Attempt to read service account token via exec (T1552.007)</description>
  <mitre>
    <id>T1552.007</id>
  </mitre>
</rule>

<!-- T1546.005 - General detection of trap command with EXIT -->
<rule id="700286" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)/bin/bash$|/usr/bin/bash$</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)trap\s+['"][^'"]+['"]\s+EXIT</field>
  <description>Potential persistence via bash trap on EXIT signal (T1546.005)</description>
  <mitre>
    <id>T1546.005</id>
  </mitre>
</rule>

<rule id="700287" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)/bin/bash$|/usr/bin/bash$</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)trap\s+['"][^'"]+['"]\s+SIGINT</field>
  <description>Potential persistence via bash trap on SIGINT (CTRL+C) (T1546.005)</description>
  <mitre>
    <id>T1546.005</id>
  </mitre>
</rule>

<rule id="700288" level="11">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)/bin/bash$|/usr/bin/bash$</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)trap\s+['"][^'"]+['"]\s+(SIGINT|EXIT|SIGTERM|SIGHUP|SIGUSR1|SIGUSR2)</field>
  <description>Generic detection of bash trap command with signal and script (T1546.005)</description>
  <mitre>
    <id>T1546.005</id>
  </mitre>
</rule>

  <rule id="700289" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/sbin/(insmod|modprobe)$</field>
    <description>Kernel module loading detected via insmod or modprobe (T1547.006)</description>
    <mitre>
      <id>T1547.006</id>
    </mitre>
  </rule>

  <rule id="700290" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.arguments" type="pcre2">\.ko(\s|$)</field>
    <description>Potential malicious kernel module (.ko) being inserted (T1547.006)</description>
    <mitre>
      <id>T1547.006</id>
    </mitre>
  </rule>

  <rule id="700291" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/sbin/(insmod|modprobe)$</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)/tmp/|/var/tmp/|/dev/shm/</field>
    <description>Kernel module loaded from suspicious path (tmp, shm) - T1547.006</description>
    <mitre>
      <id>T1547.006</id>
    </mitre>
  </rule>

  <rule id="700292" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/chmod$</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)(\+s|[0-9]*[4-6]000)</field>
    <description>Setuid or Setgid permission set via chmod (T1548.001)</description>
    <mitre>
      <id>T1548.001</id>
    </mitre>
  </rule>


  <rule id="700293" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/find$</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)-perm\s+-?[42]000</field>
    <description>Reconnaissance for SUID/SGID binaries via find (T1548.001)</description>
    <mitre>
      <id>T1548.001</id>
    </mitre>
  </rule>

  <rule id="700294" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/sbin/setcap$</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)cap_setuid</field>
    <description>Setuid capability added to binary using setcap (T1548.001)</description>
    <mitre>
      <id>T1548.001</id>
    </mitre>
  </rule>


  <rule id="700295" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/chown$</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)\sroot\s+/tmp/</field>
    <description>Ownership of file in /tmp changed to root (T1548.001)</description>
    <mitre>
      <id>T1548.001</id>
    </mitre>
  </rule>

  <rule id="700296" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/openssl$</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)(genrsa|req\s+-x509)</field>
    <description>OpenSSL used to generate root certificate and key (T1553.004)</description>
    <mitre>
      <id>T1553.004</id>
    </mitre>
  </rule>

  <rule id="700297" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/cp$</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)/etc/pki/ca-trust/source/anchors/</field>
    <description>Certificate copied to /etc/pki/ca-trust/source/anchors/ (T1553.004)</description>
    <mitre>
      <id>T1553.004</id>
    </mitre>
  </rule>

  <rule id="700298" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/(cp|mv)$</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)/usr/local/share/ca-certificates/</field>
    <description>Certificate moved to /usr/local/share/ca-certificates/ (T1553.004)</description>
    <mitre>
      <id>T1553.004</id>
    </mitre>
  </rule>

  <rule id="700299" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.arguments" type="pcre2">(?i)/usr/local/share/certs/</field>
    <description>Certificate copied to /usr/local/share/certs (T1553.004)</description>
    <mitre>
      <id>T1553.004</id>
    </mitre>
  </rule>

  <rule id="700300" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/(update-ca-certificates|update-ca-trust|certctl)$</field>
    <description>CA trust database updated (T1553.004)</description>
    <mitre>
      <id>T1553.004</id>
    </mitre>
  </rule>

  <rule id="700301" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/sed</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)/etc/pam\.d/</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)(auth|account|session|password)\s+sufficient\s+.*\.so</field>
    <description>Possible PAM backdoor rule inserted (T1556.003)</description>
    <mitre>
      <id>T1556.003</id>
    </mitre>
  </rule>

  <rule id="700302" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/gcc</field>
    <field name="process_exec.process.arguments" type="pcre2">-o\s+.*pam.*\.so</field>
    <description>Possible compilation of custom PAM module (T1556.003)</description>
    <mitre>
      <id>T1556.003</id>
    </mitre>
  </rule>


  <rule id="700303" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.arguments" type="pcre2">(?i)(/tmp/|/dev/shm/|/var/tmp/).+\.so</field>
    <description>Suspicious PAM module path used from temp directory (T1556.003)</description>
    <mitre>
      <id>T1556.003</id>
    </mitre>
  </rule>

  <rule id="700304" level="8">
    <decoded_as>json</decoded_as>
    <field name="fs.path" type="pcre2">(?i)^/etc/pam\.d/.+</field>
    <field name="fs.action" type="pcre2">(?i)write</field>
    <description>Write to PAM configuration file (T1556.003)</description>
    <mitre>
      <id>T1556.003</id>
    </mitre>
  </rule>

  <rule id="700305" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.arguments" type="pcre2">pam_succeed_if\.so</field>
    <description>Use of pam_succeed_if.so may indicate PAM rule bypass attempt (T1556.003)</description>
    <mitre>
      <id>T1556.003</id>
    </mitre>
  </rule>

  <rule id="700306" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.arguments" type="pcre2">(?i)export\s+HISTFILE\s*=\s*/dev/null</field>
    <description>HISTFILE redirected to /dev/null (T1562.003)</description>
    <mitre>
      <id>T1562.003</id>
    </mitre>
  </rule>

  <rule id="700307" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.arguments" type="pcre2">(?i)unset\s+HISTFILE</field>
    <description>HISTFILE variable unset (T1562.003)</description>
    <mitre>
      <id>T1562.003</id>
    </mitre>
  </rule>

  <rule id="700308" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.arguments" type="pcre2">(?i)export\s+HIST(FILE)?SIZE\s*=\s*0</field>
    <description>HISTFILESIZE or HISTSIZE set to 0 (T1562.003)</description>
    <mitre>
      <id>T1562.003</id>
    </mitre>
  </rule>

  <rule id="700309" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.arguments" type="pcre2">(?i)export\s+HISTCONTROL\s*=\s*(ignoreboth|ignorespace|erasedups)</field>
    <description>HISTCONTROL set to ignore logging behavior (T1562.003)</description>
    <mitre>
      <id>T1562.003</id>
    </mitre>
  </rule>

  <rule id="700310" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.arguments" type="pcre2">(?i)export\s+HISTIGNORE\s*=\s*.*</field>
    <description>HISTIGNORE variable modified to ignore commands (T1562.003)</description>
    <mitre>
      <id>T1562.003</id>
    </mitre>
  </rule>

  <rule id="700311" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.arguments">history -c</field>
    <description>Bash history cleared via history -c (T1562.003)</description>
    <mitre>
      <id>T1562.003</id>
    </mitre>
  </rule>

  <rule id="700312" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.arguments" type="pcre2">(?i)echo\s+.*\s+>\s+\$?HISTFILE</field>
    <description>Command history file cleared (T1562.003)</description>
    <mitre>
      <id>T1562.003</id>
    </mitre>
  </rule>

  <rule id="700313" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary">/usr/bin/sed</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)(auditd\.conf|audispd\.conf|rsyslog\.conf|syslog-ng\.conf)</field>
    <description>Possible tampering using sed on log/audit configuration files (T1562.006)</description>
    <mitre>
      <id>T1562.006</id>
    </mitre>
  </rule>

  <rule id="700314" level="10">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/(echo|tee)$</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)/etc/(auditd\.conf|audispd\.conf|rsyslog\.conf|syslog-ng\.conf)</field>
    <description>Suspicious echo or tee command modifying log configs (T1562.006)</description>
    <mitre>
      <id>T1562.006</id>
    </mitre>
  </rule>

  <rule id="700315" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.binary" type="pcre2">(?i)^/usr/bin/(vi|nano)$</field>
    <field name="process_exec.process.arguments" type="pcre2">(?i)/etc/(auditd\.conf|audispd\.conf|rsyslog\.conf|syslog-ng\.conf)</field>
    <description>Manual editing of logging or audit configuration files (T1562.006)</description>
    <mitre>
      <id>T1562.006</id>
    </mitre>
  </rule>

  <rule id="700316" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_exec.process.arguments" type="pcre2">(?i)esxcli system syslog config set</field>
    <description>Modification of ESXi syslog configuration (T1562.006)</description>
    <mitre>
      <id>T1562.006</id>
    </mitre>
  </rule>

<rule id="700317" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)\.software\.acceptance\.set\.Invoke\s*\(\s*@\{\s*level\s*=\s*"CommunitySupported"\s*\}\s*\)</field>
  <description>PowerCLI downgrade attack – Set ESXi VIB acceptance to CommunitySupported (T1562.010)</description>
  <mitre>
    <id>T1562.010</id>
  </mitre>
</rule>

<rule id="700318" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)(/usr)?/sbin/auditctl</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)\bauditctl\s+-D\b</field>
  <description>Auditd rules deleted using auditctl -D (T1562.012)</description>
  <mitre>
    <id>T1562.012</id>
  </mitre>
</rule>


<rule id="700319" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)(/usr)?/sbin/auditctl</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)\bauditctl\s+-e\s+0\b</field>
  <description>Audit system disabled using auditctl -e 0 (T1562.012)</description>
  <mitre>
    <id>T1562.012</id>
  </mitre>
</rule>

<rule id="700320" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)^(/usr)?/bin/systemctl$</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)\bsystemctl\s+stop\s+systemd-journald\b</field>
  <description>Attempt to disable journal logging using systemctl (T1562)</description>
  <mitre>
    <id>T1562</id>
  </mitre>
</rule>

<rule id="700321" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)^(/usr)?/bin/sed$</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)Storage=none.*journald\.conf</field>
  <description>Modification of journald.conf to disable persistent journal logging (T1562)</description>
  <mitre>
    <id>T1562</id>
  </mitre>
</rule>


<rule id="700322" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)psexec\.py\b</field>
  <description>Use of Impacket's psexec.py tool (T1569.002)</description>
  <mitre>
    <id>T1569.002</id>
  </mitre>
</rule>

<rule id="700323" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)\bLD_PRELOAD=</field>
  <description>Potential LD_PRELOAD hijack detected (T1574.006)</description>
  <mitre>
    <id>T1574.006</id>
  </mitre>
</rule>

<rule id="700324" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)/etc/ld\.so\.preload</field>
  <description>Write attempt to /etc/ld.so.preload (T1574.006)</description>
  <mitre>
    <id>T1574.006</id>
  </mitre>
</rule>

<rule id="700325" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)/stratus$</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)\b(det[o]nate|warmup|cleanup)\s+aws\.discovery\.ec2-enumerate-from-instance\b</field>
  <description>Execution of Stratus Red Team EC2 discovery technique (T1580 - Cloud Infrastructure Discovery)</description>
  <mitre>
    <id>T1580</id>
  </mitre>
</rule>

<rule id="700326" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)^.*(dirb|gobuster|ffuf|dirbuster).*$</field>
  <description>Wordlist scanning tool execution detected (T1595.003)</description>
  <mitre>
    <id>T1595.003</id>
  </mitre>
</rule>

<rule id="700327" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)(wordlist|wordlists|common\.txt|dirb\.txt|directories\.txt|directory-list|raft-large-directories)</field>
  <description>Possible wordlist scanning based on known filename patterns (T1595.003)</description>
  <mitre>
    <id>T1595.003</id>
  </mitre>
</rule>

<rule id="700328" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)totally_legit</field>
  <description>Process name masquerading via prctl - renamed to 'totally_legit' (T1036.004)</description>
  <mitre>
    <id>T1036.004</id>
  </mitre>
</rule>

<rule id="700329" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)mount\s+-B\s+/proc/</field>
  <description>Masquerading via bind mount of /proc (T1036.004)</description>
  <mitre>
    <id>T1036.004</id>
  </mitre>
</rule>

<rule id="700330" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)mount.*-B.*\/proc\/[0-9]+</field>
  <description>Potential process hiding by bind-mounting into another PID's /proc entry (T1036.004)</description>
  <mitre>
    <id>T1036.004</id>
  </mitre>
</rule>

<rule id="700331" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)/\.\.\./</field>
  <description>Execution from a suspicious '...' directory (Masquerading - T1036.005)</description>
  <mitre>
    <id>T1036.005</id>
  </mitre>
</rule>

<rule id="700332" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)/\.\.\./sh</field>
  <description>Suspicious shell launched from a masquerading '...' directory (T1036.005)</description>
  <mitre>
    <id>T1036.005</id>
  </mitre>
</rule>

<rule id="700333" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)(python3?|python3\.9)(\s+-m)?\s+http\.server\s+(1337|9090)</field>
  <description>Python HTTP server launched on suspicious port (T1048.003 - Exfiltration Over Alt Protocol)</description>
  <mitre>
    <id>T1048.003</id>
  </mitre>
</rule>

<rule id="700334" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)http://[0-9\.]+:1337/</field>
  <description>File download from HTTP server on port 1337 (Potential Exfiltration - T1048.003)</description>
  <mitre>
    <id>T1048.003</id>
  </mitre>
</rule>

<rule id="700335" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)dig\s+[a-f0-9]{8,}\.[a-z0-9\-]+\.[a-z]+</field>
  <description>Possible DNS-based data exfiltration using hex-encoded subdomain (T1048.003)</description>
  <mitre>
    <id>T1048.003</id>
  </mitre>
</rule>

<rule id="700336" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)python(\d(\.\d)?)?\s+-c\s+.*(requests|get|os\.system|linpeas|sh)</field>
  <description>Suspicious inline Python execution with download or system call (T1059.006)</description>
  <mitre>
    <id>T1059.006</id>
  </mitre>
</rule>

<rule id="700337" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)(https:\/\/github\.com\/.*\/linpeas\.sh|requests\.get\(.*\))</field>
  <description>Python script downloading external payload (e.g., linpeas.sh) – T1059.006</description>
  <mitre>
    <id>T1059.006</id>
  </mitre>
</rule>

<rule id="700338" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary" type="pcre2">(?i)python(\d(\.\d)?)?</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)\.pyc</field>
  <description>Execution of compiled Python bytecode file (.pyc) (T1059.006)</description>
  <mitre>
    <id>T1059.006</id>
  </mitre>
</rule>

<rule id="700339" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.arguments" type="pcre2">(?i)pty\.spawn\(['"]\/bin\/(sh|bash)['"]\)</field>
  <description>Python pty spawn used to escalate shell (T1059.006)</description>
  <mitre>
    <id>T1059.006</id>
  </mitre>
</rule>
<rule id="700340" level="10">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/ps</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)aux</field>
  <description>Discovery of security software using ps aux (T1518.001)</description>
  <mitre>
    <id>T1518.001</id>
  </mitre>
</rule>

<rule id="700341" level="8">
  <decoded_as>json</decoded_as>
  <field name="process_exec.process.binary">/usr/bin/egrep</field>
  <field name="process_exec.process.arguments" type="pcre2">(?i)(falcond|nessusd|cbagentd|td-agent|packetbeat|filebeat|auditbeat|osqueryd)</field>
  <description>Attempt to enumerate security software using egrep (T1518.001)</description>
  <mitre>
    <id>T1518.001</id>
  </mitre>
</rule>
</group>
