Sagan high stable other

[BASH] csh shell execution

Detection Logic

alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[BASH] csh shell execution"; content:"HISTORY"; pcre:"/\s+((\/usr)?\/s?bin\/)?csh/"; classtype:suspicious-command; program:bash
| -bash
| sh
| -sh; sid:5002319; rev:2;)

Field Validations

Loading…

Comments (0)

Loading comments...