Elastic low stable kql
DPKG Package Installed by Unusual Parent Process
This rule detects the installation of a Debian package (dpkg) by an unusual parent process. The dpkg command is used to install, remove, and manage Debian packages on a Linux system. Attackers can abuse the dpkg command to install malicious packages on a system.
Detection Logic
host.os.type:linux and event.category:process and event.type:start and event.action:exec and process.name:dpkg and
process.args:("-i" or "--install")Field Validations
Loading…
Comments (0)
Loading comments...