kqlElastic-2.0from elastic/detection-rules

File Creation in /var/log via Suspicious Process

Quality

FP risk

—

Forks

Views

ATT&CK techniques

T1070 T1070.002 T1564 T1564.001 T1059 T1059.004

Rule sourcerules/linux/defense_evasion_var_log_file_creation_by_unsual_process.toml

event.category:file and host.os.type:linux and event.action:(creation or file_create_event or file_rename_event or rename) and
(process.executable:(/tmp/* or /var/tmp/* or /dev/shm/* or ./* or /boot/*) or process.name:.*) and
file.path:/var/log/* and not file.extension:* and
not process.executable:("./usr/bin/podman" or "./install" or /tmp/vmis.*/install/vmware-installer/vmis-launcher or /tmp/ubuntu-release-upgrader-*)