Sagan high stable other

[BASH] /etc/passwd access

Detection Logic

alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[BASH] /etc/passwd access"; content:"/etc/passwd"; content:"HISTORY"; classtype: suspicious-command; program: bash
| -bash
| sh
| -sh; sid:5000004; rev:5;)

Field Validations

Loading…

Comments (0)

Loading comments...