security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Expand timestamp override tests (#1907)

Browse Source 
* Expand timestamp_override tests
* removed timestamp_override from eql sequence rules
* add config entry for eql rules with beats index and t_o
* add timestamp_override to missing fields
This commit is contained in:
Justin Ibarra
2022-04-01 15:27:08 -08:00
committed by GitHub
parent 648daf1237
commit 6bdfddac8e
233 changed files with 1695 additions and 731 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/linux/execution_ssh_binary.toml
+3 -3
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2022/03/10"
maturity = "production"
updated_date = "2022/03/28"
updated_date = "2022/03/31"
[rule]
author = ["Elastic"]
@@ -25,8 +25,8 @@ timestamp_override = "event.ingested"
type = "eql"
query = '''
process where event.type == "start" and process.name : ("bash", "sh", "dash") and
process.parent.name == "ssh" and process.parent.args == "-o" and
process where event.type == "start" and process.name : ("bash", "sh", "dash") and
process.parent.name == "ssh" and process.parent.args == "-o" and
process.parent.args in ("ProxyCommand=;sh 0<&2 1>&2", "ProxyCommand=;bash 0<&2 1>&2", "ProxyCommand=;dash 0<&2 1>&2", "ProxyCommand=;/bin/sh 0<&2 1>&2", "ProxyCommand=;/bin/bash 0<&2 1>&2", "ProxyCommand=;/bin/dash 0<&2 1>&2")
'''