kqlElastic-2.0from elastic/detection-rules
Authentication via Unusual PAM Grantor
Quality
92
FP risk
—
Forks
0
Views
0
Rule sourcerules/linux/persistence_unusual_pam_grantor.toml
event.category:authentication and host.os.type:linux and event.action:authenticated and event.outcome:success and
auditd.data.grantors:(* and not (pam_rootok or *pam_cap* or *pam_permit*))