security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update defense_evasion_agent_spoofing_multiple_hosts.toml (#5446)

Browse Source
This commit is contained in:
Samirbous
2025-12-12 17:47:11 +00:00
committed by GitHub
parent ef0ec1ac83
commit a6548d9773
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/cross-platform/defense_evasion_agent_spoofing_multiple_hosts.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2021/07/14"
integration = ["endpoint"]
maturity = "production"
updated_date = "2025/11/13"
updated_date = "2025/12/10"
[rule]
author = ["Elastic"]
@@ -30,7 +30,7 @@ type = "esql"
query = '''
from logs-endpoint.* metadata _id
| where event.agent_id_status is not null
| where event.agent_id_status is not null and agent.id is not null
| stats Esql.count_distinct_host_ids = count_distinct(host.id), Esql.host_id_values = values(host.id), Esql.user_id_values_user_id = values(user.id) by agent.id
| where Esql.count_distinct_host_ids >= 2
| keep Esql.count_distinct_host_ids, Esql.host_id_values, Esql.user_id_values_user_id, agent.id