security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Update Rule Content Changes from Security Docs Team (#1945)

Browse Source 
* updated content to reflect changes from Security Docs team

* Update rules/linux/execution_flock_binary.toml

* Update rules/linux/execution_expect_binary.toml

* TOML linting

* added escape for crdential_access_spn_attribute_modified.toml
This commit is contained in:
Terrance DeJesus
2022-05-06 13:21:12 -04:00
committed by GitHub
parent 8168551c59
commit e9f5585a9f
14 changed files with 88 additions and 85 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/linux/execution_gcc_binary.toml
+4 -4
View File
@@ -1,14 +1,14 @@
[metadata]
creation_date = "2022/03/09"
maturity = "production"
updated_date = "2022/03/31"
updated_date = "2022/04/29"
[rule]
author = ["Elastic"]
description = """
Identifies Linux binary gcc abuse to break out from restricted environments by spawning an interactive system shell.The
gcc utility is a complier system for various languages and mainly used to complie C and C++ programs and the activity of
spawning shell is not a standard use of this binary for a user or system administrator.It indicates a potentially
Identifies Linux binary gcc abuse to break out from restricted environments by spawning an interactive system shell. The
gcc utility is a complier system for various languages and mainly used to compile C and C++ programs. The activity of
spawning shell is not a standard use of this binary for a user or system administrator. It indicates a potentially
malicious actor attempting to improve the capabilities or stability of their access.
"""
from = "now-9m"