Sigma low stable sigma

Process Discovery

Detects process discovery commands. Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network

View Source

Detection Logic

{
  "selection": {
    "Image
| endswith": [
      "/atop",
      "/htop",
      "/pgrep",
      "/ps",
      "/pstree",
      "/top"
    ]
  },
  "condition": "selection"
}

False Positives

  • ⚠ Legitimate administration activities

Field Validations

Loading…

Comments (0)

Loading comments...