Adding auditd compatibility

2024-11-07 01:45:21 +00:00 · 2019-11-29 09:32:05 +01:00 · 2019-11-29 09:32:05 +01:00 · bf5e6cc56b
commit bf5e6cc56b
parent a15c84eb80
1 changed files with 8 additions and 6 deletions
--- a/rules/linux/lnx_dd_delete_file.yml
+++ b/rules/linux/lnx_dd_delete_file.yml
@ -6,13 +6,15 @@ tags:
    - attack.t1485
 logsource:
    product: linux
+    service: auditd
 detection:
-    keywords1:
-        - 'dd'   
-    keywords2:
-        - 'if=/dev/null'    
-        - 'if=/dev/zero'    
-    condition: keywords1 and keywords2
+    selection:
+        type: 'EXECVE'
+        a0: 'dd'   
+        a1:
+            - 'if=/dev/null'    
+            - 'if=/dev/zero'    
+    condition: selection
 falsepositives:
    - Unknown
 level: low