Sign in Get started

Tool

gist.github.com/stong/c8847ef27910ae344a7b5408d9840ee1

https://gist.github.com/stong/c8847ef27910ae344a7b5408d9840ee1

Published on: gist.github.com

ATT&CK techniques those detections carry

T1203Exploitation for Client Execution
T1059Command and Scripting Interpreter
T1059.004Unix Shell
T1003OS Credential Dumping
T1003.008/etc/passwd and /etc/shadow
T1053Scheduled Task/Job
T1053.003Cron
T1105Ingress Tool Transfer
+2 more

Open the original

5 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
Detection	Severity	Source	Published	Licence
Suspicious Execution from Foomatic-rip or Cupsd Parent	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Cupsd or Foomatic-rip Shell Execution	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Printer User (lp) Shell Execution	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
File Creation by Cups or Foomatic-rip Child	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Network Connection by Cups or Foomatic-rip Child	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0

Showing 5 of 5

Filter in the catalogue

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice