We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
There was an error while loading. Please reload this page.
1 parent 1eefd8f commit 8af6a90Copy full SHA for 8af6a90
detections/endpoint/linux_auditd_magic_system_request_key.yml renamed to detections/endpoint/linux_magic_sysrq_key_abuse.yml
@@ -17,7 +17,7 @@ search: '`linux_auditd` type=Path name="/proc/sysrq-trigger" OR name="/proc/sys/
17
| stats count min(_time) as firstTime max(_time) as lastTime by dest name
18
| `security_content_ctime(firstTime)`
19
| `security_content_ctime(lastTime)`
20
- | `linux_macro_sysrq_abuse_filter`'
+ | `linux_magic_sysrq_key_abuse_filter`'
21
how_to_implement: |
22
To implement this detection, ensure auditd is configured to watch:
23
- /proc/sysrq-trigger
0 commit comments