Sagan high stable other

[BASH] make execution

Detection Logic

alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[BASH] make execution"; content:"make"; content:"HISTORY"; classtype: suspicious-command; program: bash
| -bash
| sh
| -sh; sid:5000006; rev:5;)

Field Validations

Loading…

Comments (0)

Loading comments...