Anvilogic high experimental other

Potential SSH Authorized Key Overwrite [snowflake-crowdstrikefdr_process]

Potential overwrites of authorized_keys file for ssh. -- Threat Actor Association: TeamTNT

View Source

Detection Logic

select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and (event_platform = 'Lin' or event_platform = 'Mac') and regexp_like(process, '.*((vi
| visudo
| vim
| nano
| (echo
| cat)\\\s+.*>>?
| cp
| mv
| cd)\\\s+.*?(authorized_keys
| \\\.ssh)).*', 'i')

Field Validations

Loading…

Comments (0)

Loading comments...