Anvilogic high experimental other

Suspicious SSH Child Process - *nix [snowflake-crowdstrikefdr_process]

Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. This use case detects potentially suspicious SSH (sshd) child processes with a specific execution user. This could be a sign of potential exploitation of CVE-2024-3094.

View Source

Detection Logic

select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and event_platform ilike '%Lin%' and parent_process_name ilike '%sshd' and ((user ilike 'root' and regexp_like(process, '.*(ba)?sh\s.*-c.*', 'i')) or (process_path ilike '%sshd' and process ilike '%root%'))

Field Validations

Loading…

Comments (0)

Loading comments...