Anvilogic medium experimental spl
Python module loaded [splunk-unix]
This use case detects when a Python module and possible destination port has been executed in the command line. Adversaries may abuse Python commands and scripts for execution. Atomic Test T1048.003 Test #1
Detection Logic
`get_endpoint_data` `get_endpoint_data_unix` (TERM(python))
| regex process="(i?)python\d?\s+(-m
| --module)\s+\w*\s+[0-9]{3,5}"
| table _time, host, user, process, process_*, file_name `group_events(host,1)`Field Validations
Loading…
Comments (0)
Loading comments...