admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

linux_auditd_detection

Browse Source
This commit is contained in:
tccontre
2024-08-22 13:53:37 +02:00
parent d4d1d24dfa
commit dbbc8ddc45
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml
+2 -2
View File
@@ -13,8 +13,8 @@ description: The following analytic detects suspicious file permissions modifica
respond to and mitigate threats associated with unauthorized file attribute changes.
data_source:
- Linux Auditd Execve
search: '`linux_auditd` `linux_auditd_normalized_execve_process`| where LIKE(process_exec,
"%chattr%") AND LIKE(process_exec, "%-i%") | stats count min(_time) as firstTime
search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| where LIKE(process_exec,
"%chattr %") AND LIKE(process_exec, "% -i%") | stats count min(_time) as firstTime
max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_file_permissions_modification_via_chattr_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection