admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update detections/endpoint/linux_auditd_change_file_owner_to_root.yml

Browse Source 
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
This commit is contained in:
Br3akp0int
2025-02-21 09:36:11 +01:00
committed by GitHub
parent 6ae3bcfc42
commit 64fcd2a6d4
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/linux_auditd_change_file_owner_to_root.yml
+1 -1
View File
@@ -4,7 +4,7 @@ version: 6
date: '2025-02-20'
author: Teoderick Contreras, Splunk
status: production
type: TTP
type: Anomaly
description: The following analytic detects the use of the 'chown' command to change
a file owner to 'root' on a Linux system. It leverages Linux Auditd telemetry, specifically
monitoring command-line executions and process details. This activity is significant