Removing the echo detection

2024-11-07 01:45:21 +00:00 · 2020-10-28 10:07:59 +01:00 · 2020-10-28 10:07:59 +01:00 · 3a58c00feb
commit 3a58c00feb
parent 5e5576a91b
2 changed files with 6 additions and 12 deletions
--- a/rules/linux/lnx_network_service_scanning.yml
+++ b/rules/linux/lnx_network_service_scanning.yml
@ -11,18 +11,15 @@ logsource:
  product: linux
 detection:
  selection_1:
-    CommandLine|contains:
-      - '/dev/tcp/'
-  selection_2:
    ProcessName|endswith:
      - '/cat'
-  selection_3:
+  selection_2:
    ProcessName|endswith:
      - '/nmap'
-  selection_4:
+  selection_3:
    ProcessName|endswith:
      - '/telnet'
-  selection_5:
+  selection_4:
    ProcessName|endswith:
      - '/nc'
  condition: 1 of them
--- a/rules/linux/macos_network_service_scanning.yml
+++ b/rules/linux/macos_network_service_scanning.yml
@ -11,18 +11,15 @@ logsource:
  product: macos
 detection:
  selection_1:
-    CommandLine|contains:
-      - '/dev/tcp/'
-  selection_2:
    ProcessName|endswith:
      - '/cat'
-  selection_3:
+  selection_2:
    ProcessName|endswith:
      - '/nmap'
-  selection_4:
+  selection_3:
    ProcessName|endswith:
      - '/telnet'
-  selection_5:
+  selection_4:
    ProcessName|endswith:
      - '/nc'
  condition: 1 of them