Azure Alerts for Linux Machines Capability Group

This control is only relevant for Linux environments. Among the sub-techinques that are relevant for Linux, this control may only alert on SSH.

This control only provides detection coverage for the Compile After Delivery sub-technique while not providing detection for all other sub-techniques relevant to the Linux platform or most of its procedure examples. As a result of this minimal coverage, the overall score is assessed as Minimal.

This control may alert on suspicious compilation. No documentation is provided on the logic for determining a suspicious compilation event.

This control may alert on suspicious Unix shell and PHP execution. Mismatched script extensions may also generate alerts of suspicious activity. Only one of the technique's sub-techniques is covered, resulting in a score of Minimal.

This control may alert on suspicious arguments used to exploit Xorg vulnerabilities for privilege escalation.

This control provides partial detection for only one of this technique's sub-techniques and does not cover most of its procedure examples, resulting in a score of Minimal.

This control is only relevant for Linux endpoints, and it provides partial coverage for the only sub-technique relevant on Linux endpoints, Local Account.

This control provides coverage for the only sub-technique this control is relevant for, Web Shell, but that coverage is Minimal.

This control may alert on usage of web shells. No documentation is provided on logic for this detection.

This control is only relevant for Linux endpoint machines and the only sub-technique relevant for Linux is Kernel Modules and Extensions.

This control only provides coverage for a miniority of the sub-techniques under this technique and provides no coverage for other relevant sub-techniques, such as Impair Command History Logging or Disable or Modify Tools, resulting in a score of Minimal.

This control may alert on activity which disables auditd logging on Linux endpoints. The auditd package may not be the only logging system being utilized and this control may not alert on activity that disables other logging software.

This control only provides coverage for a minority of this technique's relevant sub-techniques, resulting in a score of Minimal.

This control may alert on the execution of hidden files. Since this control is only triggered on execution, it may not fire on a variety of hidden files or directories that are being utilized for malicious purposes.

This control is only relevant for Linux environments, and provides partial coverage for one of the technique's two Linux-relevant sub-techniques.

This control may alert on suspicious access to encrypted user passwords. The documentation does not reference "/etc/passwd" and "/etc/shadow" directly nor does it describe the logic in determining suspicious access.

This control may alerts on SSH brute force attempts, addition of new SSH keys, and usage of a SSH server within a container. Alerts may not be generated by usage of existing SSH keys by malicious actors for lateral movement.

This control can detect abuse of remote services.

This control can detect direct cloud VM connections.

This control can detect stripped payloads.

This control can detect embedded payloads.

This control can detect command obsfucation attacks.

This control can detect obsfucation via encrypted/encoded files.

This control can detect obsfucation via polymorphic code.

This control can detect if files are created or edited where the header and extension do not match.

This control may alert on suspicious commandline activity. Alerts may be generated on possible detection of shellcode usage on the commandline, based on arguments, location, user, etc.

This control is only relevant for Linux environments and provides partial coverage for multiple Linux-relevant sub-techniques.

This control may alert on possible log tampering activity, including deletion of logs. No documentation is provided on which log sources are targeted by this control.

This control may alert on clearing of the command history file. Documentation is not provided on the logic for detecting when the command history is cleared but on Linux machines the location of the history file tends not to change from the default.

This control may alert on addition of new SSH keys to the authorized key file and unusual process access of the authorized key file.

This control provides partial coverage for most of this technique's sub-techniques and procedures.

This control may alert on multiple successful and failed brute force attempts against SSH. There are no alerts for other methods of logging into Linux machines.

This control may alert on multiple successful and failed brute force attempts against SSH. There are no alerts for other methods of logging into Linux machines.

This control may alert on multiple successful and failed brute force attempts against SSH. There are no alerts for other methods of logging into Linux machines.

This control may alert on usage of a screenshot tool. Documentation is not provided on the logic for determining a screenshot tool.

This control may alert on usage of the useradd command to create new users and the creation of local user accounts with suspicious similarity to other account names.

This control may alert on suspicious container images running mining software or SSH servers. Privileged Docker containers and privileged commands running within containers may also be detected. These alerts are only generated on containers in Linux endpoint machines and not for containers running from Azure Docker deployment.

This control may alert on a suspicious shared object file being loaded as a kernel module. No documentation is provided on the logic but kernel module loading is a relatively rare event and can only be done with a small set of commands.

This control can detect command execution associated with xdg modification.

This control can detect command execution associated with this technique.

This control can detect command execution associated with this technique.

This control can detect command execution associated with this technique.

This control may alert on manipulation of the on-host firewall. Firewall rules should not be changed often in a standard environment and such an event can provide a high fidelity alert.

This control may alert on activity which disables auditd logging on Linux endpoints. The auditd package may not be the only logging system being utilized and this control may not alert on activity that disables other logging software.

This control may alert on containers using privileged commands, running SSH servers, or running mining software.