Anvilogic high experimental other
Access Common Package Config file [snowflake-crowdstrikefdr_process]
Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. An Adversary with access could identify or modify configuration of packages in order to execute code and evade defenses.
Detection Logic
select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and event_platform = 'Win' and regexp_like(process, '.*((vi
| vim
| nano
| visudo
| edit
| copy\\\s+con
| cat
| more
| gc
| get-content
| type
| \\\>\\\>
| \\\>)\\\s+.*(requirements\\\.txt
| pip\\\.conf
| package.json
| \\\\.gemspec
| gemrc)).*', 'i')Field Validations
Loading…
Comments (0)
Loading comments...