[Rule Tuning] Abnormal Process ID or Lock File Created (#2113)

* [Rule Tuning] Abnormal Process ID or Lock File Created * Update rules/linux/execution_abnormal_process_id_file_created.toml * Update execution_abnormal_process_id_file_created.toml Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
2022-08-23 09:59:31 -03:00
parent 6631c4927d
commit c5ff8511a9
1 changed files with 11 additions and 1 deletions
@@ -61,7 +61,17 @@ file where event.type == "creation" and user.id == "0" and
    "unattended-upgrades.lock",
    "unattended-upgrades.pid",
    "cmd.pid",
-    "cron*.pid"
+    "cron*.pid",
+    "yum.pid",
+    "netconfig.pid",
+    "docker.pid",
+    "atd.pid",
+    "lfd.pid",
+    "atop.pid",
+    "nginx.pid",
+    "dhclient.pid",
+    "smtpd.pid",
+    "stunnel.pid"
    )
 '''