kqlElastic-2.0from elastic/detection-rules
First Time Python Accessed Sensitive Credential Files
Quality
92
FP risk
—
Forks
0
Views
0
Rule sourcerules/macos/credential_access_python_sensitive_file_access_first_occurrence.toml
event.category:file and host.os.type:macos and event.action:open and
process.name:python*