admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-02-02 07:54:15 -08:00
committed by GitHub
parent a5dad66205 89cb0a782a
commit 338ab883ab
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/linux_setuid_using_chmod_utility.yml
+1 -1
View File
@@ -18,7 +18,7 @@ description: This analytic looks for suspicious chmod utility execution to enabl
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes WHERE (Processes.process_name = chmod
OR Processes.process = "*chmod *") AND Processes.process IN("* g+s *", "* u+s *",
"* 4777 *", "* 4577 *") by Processes.dest Processes.user Processes.parent_process_name
"* 4777 *", "* 4577 *", "* 777 *") by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `linux_setuid_using_chmod_utility_filter`'