security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update credential_access_suspicious_web_browser_sensitive_file_access.toml (#4029)

Browse Source 
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
This commit is contained in:
Samirbous
2024-08-28 16:33:44 +01:00
committed by GitHub
parent 0c38662cf3
commit 3e831b82c3
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/macos/credential_access_suspicious_web_browser_sensitive_file_access.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: file_access_events, process.Ext.effective_parent"
min_stack_version = "8.11.0"
updated_date = "2024/05/17"
updated_date = "2024/08/28"
[rule]
author = ["Elastic"]
@@ -60,7 +60,7 @@ file where event.action == "open" and host.os.type == "macos" and process.execut
"Login Data") and
((process.code_signature.trusted == false or process.code_signature.exists == false) or process.name : "osascript") and
not process.code_signature.signing_id : "org.mozilla.firefox" and
not process.Ext.effective_parent.executable : "/Library/Elastic/Endpoint/elastic-endpoint.app/Contents/MacOS/elastic-endpoint"
not Effective_process.executable : "/Library/Elastic/Endpoint/elastic-endpoint.app/Contents/MacOS/elastic-endpoint"
'''