security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Switch from process.ppid to process.parent.pid (#1255)

Browse Source 
* Switch from process.ppid to process.parent.pid
* Bump updated date
* Bump updated date

(cherry picked from commit 31f63e728e)
This commit is contained in:
Ross Wolf
2021-06-22 09:10:28 -06:00
committed by github-actions[bot]
parent 549cc9992d
commit ba5f3eed82
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/macos/execution_shell_execution_via_apple_scripting.toml
+2 -2
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/12/07"
maturity = "production"
updated_date = "2021/03/03"
updated_date = "2021/06/22"
[rule]
author = ["Elastic"]
@@ -27,7 +27,7 @@ type = "eql"
query = '''
sequence by host.id with maxspan=5s
[process where event.type in ("start", "process_started", "info") and process.name == "osascript"] by process.pid
[process where event.type in ("start", "process_started") and process.name == "sh" and process.args == "-c"] by process.ppid
[process where event.type in ("start", "process_started") and process.name == "sh" and process.args == "-c"] by process.parent.pid
'''
rules/macos/persistence_folder_action_scripts_runtime.toml
+2 -2
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/12/07"
maturity = "production"
updated_date = "2021/03/03"
updated_date = "2021/06/22"
[rule]
author = ["Elastic"]
@@ -25,7 +25,7 @@ type = "eql"
query = '''
sequence by host.id with maxspan=5s
[process where event.type in ("start", "process_started", "info") and process.name == "com.apple.foundation.UserScriptService"] by process.pid
[process where event.type in ("start", "process_started") and process.name in ("osascript", "sh")] by process.ppid
[process where event.type in ("start", "process_started") and process.name in ("osascript", "sh")] by process.parent.pid
'''