security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity

Fixing path in execution_shell_via_java_revshell_linux.toml (#6079)
Code checks / code-checks (push) Waiting to run
Details
docs-build / build (push) Waiting to run
Details
Unit Tests / build (push) Waiting to run
Details

Browse Source 
The double slash // means this exclusion path will never match a real process argument of /opt/tomcat/statistics/statistics.jar.
This commit is contained in:
yuriShafet
2026-05-05 10:01:06 -04:00
committed by GitHub
parent c744a6c6a1
commit 36e6f54e43
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/linux/execution_shell_via_java_revshell_linux.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2023/07/04" creation_date = "2023/07/04"
integration = ["endpoint"] integration = ["endpoint"]
maturity = "production" maturity = "production"
updated_date = "2025/12/19" updated_date = "2026/05/05"
[rule] [rule]
author = ["Elastic"] author = ["Elastic"]
@@ -106,7 +106,7 @@ sequence by host.id with maxspan=5s
and not ( and not (
process.parent.args in ( process.parent.args in (
"/usr/lib/jenkins/jenkins.war", "/etc/remote-iot/services/remoteiot.jar", "/opt/pentaho/data-integration/launcher/launcher.jar", "/usr/lib/jenkins/jenkins.war", "/etc/remote-iot/services/remoteiot.jar", "/opt/pentaho/data-integration/launcher/launcher.jar",
"/usr/share/java/jenkins.war", "/opt//tomcat/statistics/statistics.jar", "/usr/lib64/NetExtender.jar", "/usr/share/java/jenkins.war", "/opt/tomcat/statistics/statistics.jar", "/usr/lib64/NetExtender.jar",
"/var/lib/jenkins/workspace/MP-QA/tc_certified_copy*/tc_certified_copy_web_ui_test/target/surefire/surefirebooter*.jar", "/var/lib/jenkins/workspace/MP-QA/tc_certified_copy*/tc_certified_copy_web_ui_test/target/surefire/surefirebooter*.jar",
"-javaagent:/opt/opentelemetry/opentelemetry-javaagent-all.jar", "./lib/pipeline-job-executor*SNAPSHOT.jar", "-javaagent:/opt/opentelemetry/opentelemetry-javaagent-all.jar", "./lib/pipeline-job-executor*SNAPSHOT.jar",
"./lib/worker-launcher-agent*SNAPSHOT.jar", "/opt/Seqrite_EndPoint_Security/wildfly/jboss-modules.jar", "./lib/worker-launcher-agent*SNAPSHOT.jar", "/opt/Seqrite_EndPoint_Security/wildfly/jboss-modules.jar",