Anvilogic high experimental other
Linux Network Sniffing [snowflake-crowdstrikefdr_process]
An attacker may use a variety of tools to sniff the traffic on the network of a compromised machine. This is part of reconnaissance after compromising a system in order to gather more information about the network or other potentially vulnerable services/servers in order to pivot to them or make lateral movements inside the network. Atomic Test T1040 - Test #1
Detection Logic
select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and (event_platform = 'Lin' or event_platform = 'Mac') and regexp_like(process, '.*(tshark
| tcpdump\\\s+\\\S+).*', 'i')Field Validations
Loading…
Comments (0)
Loading comments...