security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update file path regex for /run (#2749)

Browse Source
This commit is contained in:
shashank-elastic
2023-04-26 14:02:16 +05:30
committed by GitHub
parent e254816068
commit cd5bc2c44b
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/linux/execution_abnormal_process_id_file_created.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/02/24"
updated_date = "2023/04/25"
[rule]
author = ["Elastic"]
@@ -81,7 +81,7 @@ type = "eql"
query = '''
/* add file size filters when data is available */
file where host.os.type == "linux" and event.type == "creation" and user.id == "0" and
file.path regex~ """/var/run/\w+\.(pid|lock|reboot)""" and file.extension in ("pid","lock","reboot") and
file.path regex~ """(/var/run|/run)/\w+\.(pid|lock|reboot)""" and file.extension in ("pid","lock","reboot") and
/* handle common legitimate files */