Merge pull request #1057 from omergunal/patch-4

[OSCD] T1057: Process Discovery

rules/linux/lnx_process_discovery.yml

@@ -0,0 +1,23 @@
+title: Process Discovery
+id: 4e2f5868-08d4-413d-899f-dc2f1508627b
+status: stable
+description: Detects process discovery commands
+author: Ömer Günal, oscd.community
+date: 2020/10/06
+references:
+    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1057/T1057.md
+logsource:
+    product: linux
+    category: process_creation
+detection:
+    selection:
+        - ProcessName|endswith:
+          - '/ps'
+          - '/top'
+    condition: selection
+falsepositives:
+    - Legitimate administration activities
+level: low
+tags:
+    - attack.discovery
+    - attack.t1057