mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-07 01:45:21 +00:00
Create lnx_space_after_filename_
This commit is contained in:
parent
c749aa2539
commit
4b74a0df76
20
rules/linux/lnx_space_after_filename_
Normal file
20
rules/linux/lnx_space_after_filename_
Normal file
@ -0,0 +1,20 @@
|
||||
title: Space After Filename
|
||||
id: 879c3015-c88b-4782-93d7-07adf92dbcb7
|
||||
description: Detects space after filename
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/T1064
|
||||
author: Ömer Günal
|
||||
date: 2020/06/17
|
||||
tags:
|
||||
- attack.execution
|
||||
level: low
|
||||
logsource:
|
||||
product: linux
|
||||
detection:
|
||||
selection1:
|
||||
- 'echo "*" > * && chmod +x *'
|
||||
selection2:
|
||||
- 'mv * "* "'
|
||||
condition: selection1 and selection2
|
||||
falsepositives:
|
||||
- Typos
|
Loading…
Reference in New Issue
Block a user