Anvilogic medium experimental spl

Python Script with URL Argument - *nix [splunk-unix]

This use case detects when a URL is supplied to an argument to a Python script in suspicious locations (/Users/, /tmp/, /var/tmp/, or /private/tmp/) via the command line.

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_unix` TERM(python) ("tp://" 
OR "tps://") ("/Users/" 
OR "/tmp/")
| where match(process, "(?i)python.*tps?://") and match (process, "(?i)/(Users
| (/(var
| private)/)?tmp)/") and match(process_name, "(?i)zsh
| bash
| sh
| tcsh
| csh
| ksh")
| table _time, host, user
| bin span=1s
| stats values(*) as * by _time, host

Field Validations

Loading…

Comments (0)

Loading comments...