Elastic high stable eql

Privilege Escalation via Root Crontab File Modification

Identifies modifications to the root crontab file. Adversaries may overwrite this file to gain code execution with root privileges by exploiting privileged file write or move related vulnerabilities.

View Source

Detection Logic

file where host.os.type == "macos" and event.action == "modification" and
 file.path like "/private/var/at/tabs/root" and 
 not process.executable like "/usr/bin/crontab"

Field Validations

Loading…

Comments (0)

Loading comments...