Update lnx_auditd_masquerading_crond.yml · 950796f71f - blue-team-tools - GreySec Git

security-tools/blue-team-tools

Update lnx_auditd_masquerading_crond.yml

This commit is contained in:

zinint

2019-10-29 22:48:39 +03:00

committed by

GitHub

parent c5599399b5

commit 950796f71f

1 changed files with 1 additions and 1 deletions

									
										rules/linux/auditd/lnx_auditd_masquerading_crond.yml
									
		+1
		-1
	
												View File
												
				@@ -16,7 +16,7 @@ detection:

				        a2: '/bin/sh'

				        a3: '*/crond'

				    condition: selection

				level: low

				level: medium

				tags:

				    - attack.defense_evasion

				    - attack.t1036