Falco low stable other
Remove Bulk Data from Disk
Detect a process running to clear bulk data from disk with the intention to destroy data, possibly interrupting availability to systems. Profile your environment and use user_known_remove_data_activities to tune this rule.
Detection Logic
spawned_process and clear_data_procs and not user_known_remove_data_activitiesField Validations
Loading…
Comments (0)
Loading comments...