Skip to content
Threat Feed
Subscribe

Tag

Auditd Manager

1 brief RSS
medium advisory

LLM-Based Detection of Suspicious Curl Activity on Linux

Elastic's LLM-based detection rule identifies suspicious `curl` activity on Linux systems, aiming to detect command and control, data exfiltration, or ingress tool transfer by analyzing command-line parameters and network destinations via Auditd Manager or Auditbeat logs, which, if left unaddressed, could lead to system compromise or data breach.

Endpoint LLM Linux Threat Detection Collection Command and Control Exfiltration Auditd Manager
3t