security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Tuning] Potential Execution via XZBackdoor (#4053)

Browse Source 
* Update persistence_suspicious_ssh_execution_xzbackdoor.toml

* Update persistence_suspicious_ssh_execution_xzbackdoor.toml
This commit is contained in:
Samirbous
2024-09-05 20:13:32 +01:00
committed by GitHub
parent be611be8b3
commit e30dc312e4
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/linux/persistence_suspicious_ssh_execution_xzbackdoor.toml
+4 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2024/04/01"
integration = ["endpoint"]
maturity = "production"
updated_date = "2024/05/21"
updated_date = "2024/09/03"
[rule]
author = ["Elastic"]
@@ -36,7 +36,9 @@ sequence by host.id, user.id with maxspan=1s
[process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.name == "sshd" and
process.args == "-D" and process.args == "-R"] by process.pid, process.entity_id
[process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.parent.name == "sshd" and
process.executable != "/usr/sbin/sshd"] by process.parent.pid, process.parent.entity_id
process.executable != null and
not process.executable in ("/usr/sbin/sshd", "/usr/sbin/unix_chkpwd", "/usr/bin/google_authorized_keys", "/usr/bin/fipscheck") and
process.command_line != "sh -c /usr/bin/env -i PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin run-parts --lsbsysinit /etc/update-motd.d > /run/motd.dynamic.new"] by process.parent.pid, process.parent.entity_id
[process where host.os.type == "linux" and event.action == "end" and process.name == "sshd" and process.exit_code != 0] by process.pid, process.entity_id
[network where host.os.type == "linux" and event.type == "end" and event.action == "disconnect_received" and process.name == "sshd"] by process.pid, process.entity_id
'''