cscli scenarios install crowdsecurity/auditd-postexploit-pkillAttempt to detect a process that is attempting to kill a lot of 3rd party processes.
This pattern is usually seen in post-exploitation behaviors where a backdoors is trying to "kill" competition.
1type: leaky2#debug: true3name: crowdsecurity/auditd-postexploit-pkill4description: "Detect post-exploitation behaviour : pkill execve bursts"5#we're looking for the EXCVE syscalls to 'pkill' (which is actually pgrep)6filter: evt.Meta.log_type == 'execve' && evt.Meta.exe == '/usr/bin/pgrep'7#grouping by ppid to track on process doing a lot of invocations to rm, such as a shell script8groupby: evt.Meta.ppid9leakspeed: 1s10capacity: 511blackhole: 1m12labels:13 confidence: 214 spoofable: 015 classification:16 - attack.T1059.00417 behavior: "linux:post-exploitation"18 label: "Post Exploitation command execution"19 service: linux20 remediation: false21scope:22 type: pid23 expression: evt.Meta.ppid24