security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update description (#2149)

Browse Source
This commit is contained in:
Mika Ayenson
2022-07-22 17:12:41 -04:00
committed by GitHub
parent b3334941f9
commit f07c72254d
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/macos/lateral_movement_vpn_connection_attempt.toml
+5 -2
View File
@@ -1,11 +1,14 @@
[metadata]
creation_date = "2020/01/25"
maturity = "production"
updated_date = "2022/03/31"
updated_date = "2022/07/22"
[rule]
author = ["Elastic"]
description = "Identifies the execution of macOS built-in commands to connect to an existing Virtual Private Network (VPN)."
description = """
Identifies the execution of macOS built-in commands to connect to an existing Virtual Private Network (VPN).
Adversaries may use VPN connections to laterally move and control remote systems on a network.
"""
from = "now-9m"
index = ["auditbeat-*", "logs-endpoint.events.*"]
language = "eql"