Elastic low stable kql

Suspicious Sysctl File Event

Monitors file events on sysctl configuration files (e.g., /etc/sysctl.conf, /etc/sysctl.d/*.conf) to identify potential unauthorized access or manipulation of system-level configuration settings. Attackers may tamper with the sysctl configuration files to modify kernel parameters, potentially compromising system stability, performance, or security.

View Source

Detection Logic

host.os.type:linux and event.category:file and event.action:("opened-file" or "read-file" or "wrote-to-file") and
file.path : ("/etc/sysctl.conf" or "/etc/sysctl.d" or /etc/sysctl.d/*) and not (
  process.name:(
    dpkg or dockerd or unattended-upg or systemd-sysctl or python* or auditbeat or dpkg or pool*
  ) or
  process.executable:(
    /opt/sophos-spl/plugins/av/bin/* or /usr/bin/pacman or "/usr/lib/dracut/dracut-install" or /var/lib/elastic-agent/*
  )
)

Field Validations

Loading…

Comments (0)

Loading comments...