Elastic low stable kql

RPM Package Installed by Unusual Parent Process

This rule leverages the new_terms rule type to identify the installation of RPM packages by an unusual parent process. RPM is a package management system used in Linux systems such as Red Hat, CentOS and Fedora. Attacks may backdoor RPM packages to gain initial access or install malicious RPM packages to maintain persistence.

View Source

Detection Logic

host.os.type:linux and event.category:process and event.type:start and event.action:exec and process.name:rpm and
process.args:("-i" or "--install")

Field Validations

Loading…

Comments (0)

Loading comments...