Anvilogic high experimental spl
Suspicious SSH Child Process - *nix [splunk-edr]
Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. This use case detects potentially suspicious SSH (sshd) child processes with a specific execution user. This could be a sign of potential exploitation of CVE-2024-3094.
Detection Logic
`get_endpoint_data` `get_endpoint_data_edr` ("sshd" "root" ("bash -c"
OR "sh -c"))
OR "sshd"
| where match(parent_process_name, "sshd$") and ((match(user, "root") and match(process, "(ba)?sh\s.*-c")) or match(user, "sshd"))
| table _time, host, user, process, parent_process_name
| bin span=1s
| stats values(*) as * by _time, hostField Validations
Loading…
Comments (0)
Loading comments...