Elastic low stable eql

SSL Certificate Deletion

This rule detects the deletion of SSL certificates on a Linux system. Adversaries may delete SSL certificates to subvert trust controls and negatively impact the system.

View Source

Detection Logic

file where host.os.type == "linux" and event.type == "deletion" and process.executable != null and
file.path : "/etc/ssl/certs/*" and file.extension in ("pem", "crt") and
not (
  process.name in ("dockerd", "pacman") or
  process.executable in (
    "/kaniko/executor", "/usr/sbin/update-ca-certificates", "/usr/bin/gnurm", "/usr/bin/podman",
    "/usr/local/bin/executor", "/opt/kaniko/executor", "/.envbuilder/bin/envbuilder", "/opt/kaspersky/kesl/libexec/kesl"
  )
)

Field Validations

Loading…

Comments (0)

Loading comments...