admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update linux_deletion_of_ssh_key.yml

Browse Source 
Check for deletion of SSH key material in the ~/.ssh directory as well. Not just in /etc/ssh.
This particular commit fixes minor logic error in including content in the ~/.ssh directory
This commit is contained in:
pyth0n1c
2022-05-06 13:58:32 -04:00
committed by GitHub
parent 00d82f98b2
commit 763e2eed8b
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/linux_deletion_of_ssh_key.yml
+1 -1
View File
@@ -12,7 +12,7 @@ description: This analytic is to detect a deletion of ssh key in a linux machine
acidrain malware does in linux or router machines. This detection can be a good pivot to check what process and user
tries to delete this type of files which is not so common and need further investigation.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
where Filesystem.action=deleted Filesystem.file_path = "/etc/ssh/*" AND Filesystem.file_path = "~/.ssh/*"
where Filesystem.action=deleted AND Filesystem.file_path IN ("/etc/ssh/*", "~/.ssh/*")
by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.process_guid Filesystem.action
| `drop_dm_object_name(Filesystem)`
|rename process_guid as proc_guid