Anvilogic high experimental spl

Hidden Executable with Command Line IP Argument - *nix [splunk-unix]

This use case detects when a hidden executable (any process name starting with .) is supplied with a command line argument containing an IP address.

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_unix` "/."
| where match(process_path, "^.*\/\.[^\/]*$") and match (process, "[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}")
| table _time, host, user process_path, process
| bin span=1s
| stats values(*) as * by _time, host

Field Validations

Loading…

Comments (0)

Loading comments...