security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Update Rule Name: Suspicious Network Connection Attempt Sequence by Root (#1983)

Browse Source 
* [Rule Tuning] Update Rule Name

* Update rules/linux/command_and_control_connection_attempt_by_non_ssh_root_session.toml
This commit is contained in:
Colson Wilhoit
2022-05-17 17:41:05 -05:00
committed by GitHub
parent c89f423961
commit d12f45c6ba
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/linux/command_and_control_connection_attempt_by_non_ssh_root_session.toml
+1 -1
View File
@@ -20,7 +20,7 @@ from = "now-9m"
index = ["logs-endpoint.events.*"]
language = "eql"
license = "Elastic License v2"
name = "Suspicious Outbound Network Connection Sequence by Root"
name = "Suspicious Network Connection Attempt by Root"
note = """## Triage and analysis
### Investigating Connection Attempt by Non-SSH Root Session
Detection alerts from this rule indicate a strange or abnormal outbound connection attempt by a privileged process. Here are some possible avenues of investigation: