Anvilogic medium experimental other

Suspicious Use of _dev_tcp [snowflake-crowdstrikefdr_process]

Detects suspicious command with /dev/tcp

View Source

Detection Logic

select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and (event_platform = 'Lin' or event_platform = 'Mac') and regexp_like(process, '.*(\\\/dev\\\/tcp).*', 'i')

Field Validations

Loading…

Comments (0)

Loading comments...