Sagan high stable other

[LINUX-AUDITD] stunnel execution

[LINUX-AUDITD] stunnel execution

View Source

Detection Logic

alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[LINUX-AUDITD] stunnel execution"; content: "type=EXECVE"; content:"
| 22
| stunnel
| 22
| "; classtype:suspicious-command; program:audispd; sid:5005636; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...