Panther medium experimental python

OSSEC Rootkit Detected via Osquery

Checks if any results are returned for the Osquery OSSEC Rootkit pack.

View Source

Detection Logic

def rule(event):
    return "ossec-rootkit" in event.get("name", "") and event.get("action") == "added"


def title(event):
    return f"OSSEC rootkit found on [{event.get('hostIdentifier')}]"

Field Validations

Loading…

Comments (0)

Loading comments...