admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update linux_possible_append_command_to_at_allow_config_file.yml

Browse Source
This commit is contained in:
tccontre
2022-01-10 09:43:33 +01:00
committed by GitHub
parent cebc5ac4fd
commit 72859e63e8
1 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml
+2 -3
View File
@@ -12,8 +12,7 @@ description: This analytic looks for suspicious commandline that may use to appe
create a user or add the compromised username to that config file to execute at to schedule it malicious code. This anomaly detection
can be a good indicator to investigate further the entry in created config file and who created it to verify if it is a false positive.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes
where Processes.process = "*echo*" Processes.process = "*>>*"
AND Processes.process IN("*/etc/at.allow", "*/etc/at.deny")
where Processes.process = "*echo*" AND Processes.process IN("*/etc/at.allow", "*/etc/at.deny")
by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
@@ -70,4 +69,4 @@ tags:
cis20:
- CIS 3
- CIS 5
- CIS 16
- CIS 16