From 3ca03bc7fa63590fef9309785e531412e101e8b2 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 4 Apr 2022 17:11:12 +0200 Subject: [PATCH] descp_fix --- .../endpoint/linux_common_process_for_elevation_control.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/linux_common_process_for_elevation_control.yml b/detections/endpoint/linux_common_process_for_elevation_control.yml index d8c011b22b..2da48d919a 100644 --- a/detections/endpoint/linux_common_process_for_elevation_control.yml +++ b/detections/endpoint/linux_common_process_for_elevation_control.yml @@ -9,7 +9,7 @@ datamodel: description: This analytic is to look for possible elevation control access using a common known process in linux platform to change the attribute and file ownership. This technique is commonly abused by adversaries, malware author and red teamers - to gain persistence or privilege escalation on the target or compromised host. Tis + to gain persistence or privilege escalation on the target or compromised host. This common process is used to modify file attribute, file ownership or SUID. This tools can be used in legitimate purposes so filter is needed. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)