Skip to content

Commit 34da43b

Browse files
authored
Fix formatting and improve YAML clarity
removed trailing spaces
1 parent 43e0f5a commit 34da43b

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

rules/linux/process_creation/proc_creation_lnx_azure_run_command_suspicious_child.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ related:
55
type: similar
66
status: experimental
77
description: |
8-
Detects suspicious commands spawned by shell scripts running under the Azure Run Command
8+
Detects suspicious commands spawned by shell scripts running under the Azure Run Command
99
extension context on Linux virtual machines.
1010
author: Vladan Sekulic
1111
date: 2025-12-17
@@ -20,7 +20,7 @@ detection:
2020
- '/bin/sh'
2121
- '/var/lib/waagent/run-command/download/'
2222
- '/script.sh'
23-
23+
2424
selection_child:
2525
Image|endswith:
2626
- '/whoami' # recon
@@ -32,7 +32,7 @@ detection:
3232
- '/python3'
3333
- '/perl'
3434
- '/socat' # port forwarding/shell
35-
35+
3636
condition: selection_parent and selection_child
3737
falsepositives:
3838
- Custom admin scripts invoking specific diagnostics

0 commit comments

Comments
 (0)