security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix pipe characters in rule descriptions (#4893)

Browse Source
This commit is contained in:
shashank-elastic
2025-07-10 15:11:20 +05:30
committed by GitHub
parent 932163e9cd
commit b70792082a
22 changed files with 46 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/linux/persistence_web_server_sus_command_execution.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2025/03/04"
integration = ["endpoint"]
maturity = "production"
updated_date = "2025/04/07"
updated_date = "2025/07/10"
[rule]
author = ["Elastic"]
@@ -11,7 +11,7 @@ This rule detects potential command execution from a web server parent process o
to execute commands from a web server parent process to blend in with normal web server activity and evade detection.
This behavior is commonly observed in web shell attacks where adversaries exploit web server vulnerabilities to execute
arbitrary commands on the host. The detection rule identifies unusual command execution from web server parent
processes, which may indicate a compromised host or an ongoing attack. ES|QL rules have limited fields available in its
processes, which may indicate a compromised host or an ongoing attack. ESQL rules have limited fields available in its
alert documents. Make sure to review the original documents to aid in the investigation of this alert.
"""
from = "now-61m"