security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Improve ECS compatibility for endpoint rules

Browse Source
This commit is contained in:
Justin Ibarra
2020-07-07 13:43:33 -05:00
committed by Ross Wolf
parent cae5fee025
commit 95908c22a4
75 changed files with 362 additions and 231 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/linux/execution_python_tty_shell.toml
+6 -3
View File
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2020/04/15"
ecs_version = ["1.4.0"]
ecs_version = ["1.5.0"]
maturity = "production"
updated_date = "2020/04/15"
updated_date = "2020/06/25"
[rule]
author = ["Elastic"]
@@ -21,7 +21,10 @@ tags = ["Elastic", "Linux"]
type = "query"
query = '''
event.action:executed and process.name:python and process.args:("import pty; pty.spawn(\"/bin/sh\")" or "import pty; pty.spawn(\"/bin/dash\")" or "import pty; pty.spawn(\"/bin/bash\")")
event.category:process and event.type:(start or process_started) and process.name:python and
process.args:("import pty; pty.spawn(\"/bin/sh\")" or
"import pty; pty.spawn(\"/bin/dash\")" or
"import pty; pty.spawn(\"/bin/bash\")")
'''