admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
Bhavin Patel
2024-10-10 14:30:19 -07:00
committed by GitHub
parent 6fb828212f 992c8c4268
commit e5da8270ef
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/linux_auditd_change_file_owner_to_root.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: Linux Auditd Change File Owner To Root
id: 7b87c556-0ca4-47e0-b84c-6cd62a0a3e90
version: 1
date: '2024-09-04'
version: 2
date: '2024-10-09'
author: Teoderick Contreras, Splunk
status: production
type: TTP
@@ -14,7 +14,7 @@ description: The following analytic detects the use of the 'chown' command to ch
data_source:
- Linux Auditd Proctitle
search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| rename host as
dest | where LIKE (process_exec, "%chown %") AND LIKE (process_exec, "% root %")
dest | where LIKE (process_exec, "%chown %root%")
| stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle
normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
`linux_auditd_change_file_owner_to_root_filter`'