Elastic Defend high stable eql

Potential Privilege Escalation via Root Crontab File Modification

Identifies modifications to the root crontab file. Adversaries may overwrite this file to gain code execution with root privileges by exploiting privileged file write or move related vulnerabilities.

View Source

Detection Logic

file where event.type != "deletion" and
 file.path == "/private/var/at/tabs/root" and not process.executable == "/usr/bin/crontab"

Field Validations

Loading…

Comments (0)

Loading comments...