File tree Expand file tree Collapse file tree 1 file changed +3
-3
lines changed
rules/linux/process_creation Expand file tree Collapse file tree 1 file changed +3
-3
lines changed Original file line number Diff line number Diff line change 55 type : similar
66status : experimental
77description : |
8- Detects suspicious commands spawned by shell scripts running under the Azure Run Command
8+ Detects suspicious commands spawned by shell scripts running under the Azure Run Command
99 extension context on Linux virtual machines.
1010author : Vladan Sekulic
1111date : 2025-12-17
@@ -20,7 +20,7 @@ detection:
2020 - ' /bin/sh'
2121 - ' /var/lib/waagent/run-command/download/'
2222 - ' /script.sh'
23-
23+
2424 selection_child :
2525 Image|endswith :
2626 - ' /whoami' # recon
@@ -32,7 +32,7 @@ detection:
3232 - ' /python3'
3333 - ' /perl'
3434 - ' /socat' # port forwarding/shell
35-
35+
3636 condition : selection_parent and selection_child
3737falsepositives :
3838 - Custom admin scripts invoking specific diagnostics
You can’t perform that action at this time.
0 commit comments