Sagan critical stable other

[CROWDSTRIKE] A command was run that is indicative of a Jynx Rootkit installation.

[CROWDSTRIKE] A command was run that is indicative of a Jynx Rootkit installation.

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[CROWDSTRIKE] A command was run that is indicative of a Jynx Rootkit installation."; program:CrowdStrike; content:"msg=A command was run that is indicative of a Jynx Rootkit installation."; parse_src_ip:1; normalize; reference:url,https://www.reddit.com/r/crowdstrike/comments/rbbzwi/pattern_disposition_values_in_detect_api/; classtype:trojan-activity; sid:5016585; rev:1; metadata:created_at 2025_06_25, updated_at 2025_06_25;)

Field Validations

Loading…

Comments (0)

Loading comments...