35 lines
685 B
YAML
35 lines
685 B
YAML
|
title: Enumération de /etc/passwd via ls
|
||
|
|
id: b3f1c2a4-9e7d-4b2a-8f0e-1a2b3c4d5e6f
|
||
|
|
status: experimental
|
||
|
|
description: Détecte l'exécution exacte de la commande "ls /etc/passwd"
|
||
|
|
references:
|
||
|
|
- https://attack.mitre.org/techniques/T1087/
|
||
|
|
author: Detection Rule
|
||
|
|
date: 2024-01-01
|
||
|
|
tags:
|
||
|
|
- attack.discovery
|
||
|
|
- attack.t1087.001
|
||
|
|
|
||
|
|
logsource:
|
||
|
|
category: process_creation
|
||
|
|
product: linux
|
||
|
|
|
||
|
|
detection:
|
||
|
|
selection:
|
||
|
|
Image|endswith: '/ls'
|
||
|
|
CommandLine|contains: '/etc/passwd'
|
||
|
|
|
||
|
|
filter_legit_users:
|
||
|
|
User|contains:
|
||
|
|
- 'monitoring'
|
||
|
|
- 'backup'
|
||
|
|
|
||
|
|
condition: selection and not 1 of filter_*
|
||
|
|
|
||
|
|
falsepositives:
|
||
|
|
- Aucun (la commande exacte est très spécifique)
|
||
|
|
|
||
|
|
level: high
|
||
|
|
|
||
|
|
|