Sagan high stable other

[BASH] /etc/shadow access

Detection Logic

alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[BASH] /etc/shadow access"; content:"/etc/shadow"; content:"HISTORY"; classtype: suspicious-command; program: bash
| -bash
| sh
| -sh; sid:5000005; rev:5;)

Field Validations

Loading…

Comments (0)

Loading comments...