Update defense_evasion_attempt_to_disable_iptables_or_firewall.toml (#11)

2020-07-02 11:31:19 -06:00
parent f438a222d5
commit 51fed4f537
1 changed files with 5 additions and 1 deletions
@@ -21,7 +21,11 @@ tags = ["Elastic", "Linux"]
 type = "query"

 query = '''
-event.action:(executed or process_started) and (process.name:service and process.args:stop or process.name:chkconfig and process.args:off) and process.args:(ip6tables or iptables or firewalld) or process.name:systemctl and process.args:((firewalld or iptables or ip6tables) and (disable or stop or kill))
+event.action:(executed or process_started) and (
+  (process.name:service and process.args:stop) or
+  (process.name:chkconfig and process.args:off) or
+  (process.name:systemctl and process.args:(disable or stop or kill))
+) and process.args:(ip6tables or iptables or firewalld)
 '''