security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Rule description updates (#1811)

Browse Source 
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>

(cherry picked from commit f9503f2096)
This commit is contained in:
shashank-elastic
2022-03-07 19:33:11 +05:30
committed by github-actions[bot]
parent c4fea2fc00
commit aaf1ab6bb2
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/linux/defense_evasion_env_binary.toml
+6 -2
View File
@@ -1,11 +1,15 @@
[metadata]
creation_date = "2022/02/24"
maturity = "production"
updated_date = "2022/02/24"
updated_date = "2022/03/04"
[rule]
author = ["Elastic"]
description = "Identifies Linux binary env abuse to break out from restricted environments by spawning an interactive system shell"
description = """
Identifies Linux binary env abuse to break out from restricted environments by spawning an interactive system shell.This
activity is not standard use with this binary for a user or system administrator. It indicates a potentially malicious
actor attempting to improve the capabilities or stability of their access
"""
from = "now-9m"
index = ["logs-endpoint.events.*"]
language = "eql"