ogurexxx@root:~$ ls rules/
Detection rules
The server writes rules from what it sees in the honeypot: Sigma for command chains and YARA for dropped files. They are generated automatically, so test them on your own logs before production use.
- sshkey-830e.ymlSigma · SSH key implant5
- sshkey-b6c8.ymlSigma · SSH key implant4
- a8460f446be54041.yarYARA258
- a151d3f4f2422531.yarYARA · XMRig6
- 01ba4719c80b6fe9.yarYARA4
- a9f54da77d951446.yarYARA · XMRig1
- 0165937bc9d7a0a3.yarYARA · XMRig1
- 94f2e4d8d4436874.yarYARA · XMRig1
- d7f98e379c400c13.yarYARA1
- d70f917e35813a7a.yarYARA1
- d1cac82f44b54b0f.yarYARA1
- 8a68d1c08ea31250.yarYARA1
- 3f3a11bafabb1a35.yarYARA1
- f0aa83bbbd2c75e2.yarYARA1
On the right: addresses seen.