security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule tuning] Fix evasion for disable iptables rule (#5)

Browse Source
This commit is contained in:
Francesco Soncina
2020-07-01 20:08:32 +02:00
committed by GitHub
parent f800050e6b
commit 46a4008570
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/linux/defense_evasion_attempt_to_disable_iptables_or_firewall.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/04/24"
ecs_version = ["1.4.0"]
maturity = "production"
updated_date = "2020/04/24"
updated_date = "2020/07/01"
[rule]
author = ["Elastic"]
@@ -21,7 +21,7 @@ tags = ["Elastic", "Linux"]
type = "query"
query = '''
event.action:(executed or process_started) and (process.name:service and process.args:stop or process.name:chkconfig and process.args:off) and process.args:(ip6tables or iptables) or process.name:systemctl and process.args:(firewalld and (disable or stop or kill))
event.action:(executed or process_started) and (process.name:service and process.args:stop or process.name:chkconfig and process.args:off) and process.args:(ip6tables or iptables or firewalld) or process.name:systemctl and process.args:((firewalld or iptables or ip6tables) and (disable or stop or kill))
'''