Explore Kunai Events

caution

Some fields have been renamed in this version, introducing breaking changes in events compared to earlier versions. If you're using an older version of Kunai, please update your detection/filtering rules to account for these changes before migrating to the new version.

📄️ Event Layout and Info Section

Every kunai event gets a set of common fields shared between all the events. These fields give various information which might be used for advanced purposes such as event identification, grouping or correlation.

📄️ Execve

Execve events are generated whenever an execve syscall happens on the system. It provides information about the current binary currently running.

📄️ Execve Script

This event is generated under the same conditions as execve event. The only difference is that it provides additional information about the interpreter when the file being executed is a script.

📄️ Exit

Exit events get generated when a single task (process or thread) exits.

📄️ Exit Group

Event generated when a thread-group (process and all its threads) exits.

📄️ Clone

A task is being cloned/forked. This means that a new task will be created

📄️ Prctl

A prctl event is generated when a process makes a call to the prctl syscall. As you can

📄️ Kill

This event is generated when kill signal is send to a foreign process.

📄️ Ptrace

Event generated when a ptrace syscall is issued. .data.mode reflects the ptrace mode as defined in Linux Kernel headers

📄️ Init Module

This kind of event is generated when a kernel module is loaded into the kernel.

📄️ Bpf Prog Load

This event is generated every time a BPF program is loaded into the kernel.

📄️ Bpf Socket Filter Attached

A socket filter attachement has been made (for instance via getsockopt syscall).

📄️ Mprotect Exec

This kind of event is generated when memory protection is turned to executable.

📄️ Mmap Exec

This events is generated whenever the mmap syscall is used to map an executable file in memory, with memory execution protection.

📄️ Connect

This event gets generated every time a connect attempt is made to a remote IP.

📄️ Dns Query

This event is generated when the a DNS response is received on the host and gives insight both on the query, the response and the DNS resolver.

📄️ Send Data

This events gets generated when data is sent to a remote IP address.

📄️ Read

This event gets generated whenever a file is read.

📄️ Read Config

This file is generated whenever a file located in /etc is being read.

📄️ Write

This event gets generated whenever a file is write.

📄️ Write Config

This file is generated whenever a file located in /etc is being written.

📄️ File Rename

This event gets generated whenever a file is being renamed.

📄️ File Unlink

Event generated when a file gets unlinked

📄️ Write and Close

An event generated when a file that has been written is just being closed. This is a great hook event to trigger a file scan as the file is not supposed to be written again.

📄️ File Scan

Such events are generated when a scan-files action is requested. This event is a bit particular compared to other because it is triggered from another event. You can find the **cross-reference** to the **triggering event** in .data.sourceevent field.