Anvilogic medium experimental spl

Suspicious Use of _dev_tcp [splunk-unix]

Detects suspicious command with /dev/tcp

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_unix` "/dev/tcp"
| table _time, host, user, process
| bin span=1s
| stats values(*) as * by _time, host
| where match(process, "(?i)/dev/tcp")

Field Validations

Loading…

Comments (0)

Loading comments...