security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Rule Tuning as part of 8.6 (#2398)

Browse Source
This commit is contained in:
shashank-elastic
2022-11-17 22:55:39 +05:30
committed by GitHub
parent 6555bba965
commit 8766a23ad6
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/linux/persistence_etc_file_creation.toml
+5 -2
View File
@@ -3,7 +3,7 @@ creation_date = "2022/07/22"
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
updated_date = "2022/11/17"
[rule]
author = ["Elastic"]
@@ -27,7 +27,10 @@ timestamp_override = "event.ingested"
type = "eql"
query = '''
file where event.action == "creation" and user.name == "root" and file.path : ("/etc/ld.so.conf.d/*", "/etc/cron.d/*", "/etc/sudoers.d/*", "/etc/rc.d/init.d/*", "/etc/systemd/system/*") and not process.executable : ("*/dpkg", "*/yum", "*/apt", "*/dnf", "*/systemd")
file where event.action == "creation" and user.name == "root" and
file.path : ("/etc/ld.so.conf.d/*", "/etc/cron.d/*", "/etc/sudoers.d/*", "/etc/rc.d/init.d/*", "/etc/systemd/system/*")
and not process.executable : ("*/dpkg", "*/yum", "*/apt", "*/dnf", "*/systemd", "*/snapd", "*/dnf-automatic",
"*/yum-cron", "*/elastic-agent", "*/dnfdaemon-system")
'''
[[rule.threat]]