Update persistence_python_launch_agent_or_daemon_creation_first_occurrence.toml (#5937)
This commit is contained in:
+2
-2
@@ -2,7 +2,7 @@
|
||||
creation_date = "2026/02/23"
|
||||
integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
updated_date = "2026/03/24"
|
||||
updated_date = "2026/04/08"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -13,7 +13,7 @@ writing plist files to LaunchAgent or LaunchDaemon directories. Legitimate Pytho
|
||||
persistence mechanisms, so a first occurrence is a strong indicator of compromise.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["logs-endpoint.events.persistence-*"]
|
||||
index = ["logs-endpoint.events.file-*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "First Time Python Created a LaunchAgent or LaunchDaemon"
|
||||
|
||||
Reference in New Issue
Block a user