Linux Auditd Unix Shell Configuration Modification: endpointEndpointNoneversion:11
The following analytic detects suspicious access or modifications to Unix shell configuration files, which may indicate an attempt to alter system behavior or gain unauthorized access.
Unix shell configuration files, such as `.bashrc` or `.profile`, control user environment settings and command execution.
Unauthorized changes to these files can be used to execute malicious commands, escalate privileges, or hide malicious activities.
By monitoring for unusual or unauthorized modifications to shell configuration files, this analytic helps identify potential security threats, allowing security teams to respond quickly and mitigate risks.
Correlate this with related EXECVE or PROCTITLE events to identify the process or user responsible for the access or modification.
Linux Auditd AI CLI Permission Override Activated: endpointEndpointNoneversion:3
This detection identifies when an AI command-line tool is launched in an unsafe mode that bypasses normal safety checks and user approvals.
For instance, running claude --dangerously-skip-permissions skips all safety restrictions, allowing the tool to operate freely, while gemini --yolo automatically approves all actions without prompting the user.
These modes, often called permission overrides or YOLO mode, let the AI execute commands, modify files, or perform tasks without confirmation.
Detecting their use is important to prevent unintended or potentially harmful operations.
Linux Auditd Whoami User Discovery: endpointEndpointNoneversion:9
The following analytic detects the suspicious use of the whoami command, which may indicate an attacker trying to gather information about the current user account on a compromised system. The whoami command is commonly used to verify user privileges and identity, especially during initial stages of an attack to assess the level of access. By monitoring for unusual or unauthorized executions of whoami, this analytic helps in identifying potential reconnaissance activities, enabling security teams to take action before the attacker escalates privileges or conducts further malicious operations.
