From 72859e63e832ef0cd03a4e119574330020a5d448 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 10 Jan 2022 09:43:33 +0100 Subject: [PATCH] Update linux_possible_append_command_to_at_allow_config_file.yml --- ...linux_possible_append_command_to_at_allow_config_file.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml index 53759c627d..516207b4a6 100644 --- a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml +++ b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml @@ -12,8 +12,7 @@ description: This analytic looks for suspicious commandline that may use to appe create a user or add the compromised username to that config file to execute at to schedule it malicious code. This anomaly detection can be a good indicator to investigate further the entry in created config file and who created it to verify if it is a false positive. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes - where Processes.process = "*echo*" Processes.process = "*>>*" - AND Processes.process IN("*/etc/at.allow", "*/etc/at.deny") + where Processes.process = "*echo*" AND Processes.process IN("*/etc/at.allow", "*/etc/at.deny") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` @@ -70,4 +69,4 @@ tags: cis20: - CIS 3 - CIS 5 - - CIS 16 \ No newline at end of file + - CIS 16