Elastic medium stable kql
Remote File Creation in World Writeable Directory
This rule detects the creation of a file in a world-writeable directory through a service that is commonly used for file transfer. This behavior is often associated with lateral movement and can be an indicator of an attacker attempting to move laterally within a network.
Detection Logic
event.category:file and host.os.type:linux and event.action:creation and
process.name:(ftp or rsync or scp or sftp or sftp-server or ssh or sshd or vsftpd) and
file.path:((/dev/shm/* or /tmp* or /var/tmp*) and not (/tmp/ansible-tmp-* or /var/tmp/ansible-tmp-*)) and
not user.id:0Field Validations
Loading…
Comments (0)
Loading comments...