Detection Engine

listen.dev provides comprehensive coverage against common attack vectors and known indicators of harmful behavior, as well as unknown and emerging threats. Below is an overview of the kind of detections listen.dev provides.

If you have any custom requests for detection rules or customization, please reach out at [e-mail]

Below are the high level detection categories covered. For more details into each type of detection, please see the comprehensive list here

Category	Attack Vector	Description	Impact
Evasion	Security Bypass	Techniques to avoid detection by security measures.	Missed threats due to undetected activities.
Escalation	Privilege Gain	Unauthorized elevation of access privileges.	Compromised systems with unauthorized access.
App Hooking	Code Manipulation	Altering application behavior to execute malicious code.	Applications behaving unpredictably or executing malicious actions.
Kernel Hooking	Kernel Modifications	Changing kernel operations to hide malicious activities.	Kernel instability and hidden malicious processes.
Execution	Unauthorized Code Execution	Running unauthorized or malicious code within the environment.	Potential malware execution and data breaches.
Persistence	Maintaining Access	Techniques to maintain access within the system over time.	Long-term compromises and recurring security incidents.
Exfiltration	Data Theft	Unauthorized transfer of data out of the system.	Data breaches and loss of sensitive information.
Discovery	Information Gathering	Efforts to gather sensitive information about the environment.	Increased risk of targeted attacks due to exposed information.
Tamper Kernel	Kernel-Level Attacks	Modifying the kernel for malicious purposes.	Deep system compromises and difficult-to-detect threats.
Lateral Move	Network Movement	Moving within the network to access additional resources.	Broadening attack scope and accessing critical infrastructure.