Import SigmaHQ auditd rules #1194
Conversation
|
Hello @buixor and thank you for your contribution! ❗ It seems that the following scenarios are not part of the 'crowdsecurity/appsec-virtual-patching' collection: 🔴 crowdsecurity/vpatch-CVE-2023-6567 🔴 |
|
Hello @buixor, Scenarios/AppSec Rule are compliant with the taxonomy, thank you for your contribution! |
|
Hello @buixor, Scenarios/AppSec Rule are compliant with the taxonomy, thank you for your contribution! |
|
Hello @buixor, Scenarios/AppSec Rule are compliant with the taxonomy, thank you for your contribution! |
1 similar comment
|
Hello @buixor, Scenarios/AppSec Rule are compliant with the taxonomy, thank you for your contribution! |
| @@ -17,7 +17,8 @@ nodes: | |||
| - meta: service | |||
| value: laurel | |||
| - meta: log_type | |||
| expression: evt.Unmarshaled.laurel.SYSCALL.SYSCALL | |||
| expression: | | |||
| evt.Unmarshaled.laurel.SYSCALL.SYSCALL == "execve" ? "auditd_syscall_execve" : "auditd_syscall" | |||
There was a problem hiding this comment.
Maybe we should just return
'auditd_syscall_' + evt.Unmarshaled.laurel.SYSCALL.SYSCALL ?
| @@ -2,7 +2,7 @@ type: trigger | |||
| #debug: true | |||
| name: crowdsecurity/auditd-sus-exec | |||
| description: "Detect post-exploitation behaviour : exec from suspicious locations" | |||
| filter: evt.Meta.log_type == 'execve' and ( evt.Meta.exe startsWith "/tmp/" or evt.Meta.exe contains "/." ) | |||
| filter: evt.Meta.log_type == 'syscall_execve' and ( evt.Meta.exe startsWith "/tmp/" or evt.Meta.exe contains "/." ) | |||
There was a problem hiding this comment.
should be auditd_syscall_execve?
sigmahqauditd rules