kqlElastic-2.0from elastic/detection-rules
Suspicious rc.local Error Message
Quality
92
FP risk
—
Forks
0
Views
0
Rule sourcerules/linux/persistence_rc_local_error_via_syslog.toml
host.os.type:linux and data_stream.dataset:system.syslog and process.name:rc.local and
message:("Connection refused" or "No such file or directory" or "command not found")