Anvilogic medium experimental spl

NIX Interactive Shell [splunk-edr]

This use case detects the creation of an interactive shell on a NIX host -- Software Association: Kinsing

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_edr` "/bin/sh" TERM(-i)
| table _time, host, user src_ip, process_*, user, type, process
| bin span=1s
| stats values(*) as * by _time, host

Field Validations

Loading…

Comments (0)

Loading comments...