restored the rule

2024-11-08 18:23:52 +00:00 · 2020-11-28 18:52:43 +01:00 · 2020-11-28 18:52:43 +01:00 · 5afb445b8b
commit 5afb445b8b
parent eee2ace2c6
1 changed files with 5 additions and 5 deletions
--- a/rules/linux/lnx_setgid_setuid.yml
+++ b/rules/linux/lnx_setgid_setuid.yml
@ -10,12 +10,12 @@ references:
 logsource:
    product: linux
 detection:
-    selection1|contains:
-        - 'chown root'    
-    selection2|contains:
-        - ' chmod u+s'
+    selection1:
+        - '*chown root*'
+    selection2:
+        - '* chmod u+s*'
    selection3|contains:
-        - ' chmod g+s'
+        - '* chmod g+s*'
    condition: (selection1 and selection2) or (selection1 and selection3)
 falsepositives:
    - Legitimate administration activities