suspicious systemd: accept any char instead of single quote

2024-11-19 16:09:38 -05:00 · 2024-11-19 16:09:38 -05:00 · 4c4423a474
parent 8237521d0d
commit 4c4423a474
1 changed files with 1 additions and 1 deletions
--- a/detection/persistence/suspicious-systemd-unit.sql
+++ b/detection/persistence/suspicious-systemd-unit.sql
@ -226,7 +226,7 @@ rule usr_bin_execstop_shell : medium {
    $execstop = /ExecStop=\/bin\/sh .{0,64}/
    $not_podman_logging = "/usr/bin/podman $LOGGING"
    $not_stderr = /ExecStop=\/bin\/sh .{0,64}set -eu/
-    $not_nfs = /ExecStop=\/bin\/sh -c \'\/usr\/sbin\/nfsdctl /
+    $not_nfs = /ExecStop=\/bin\/sh -c .\/usr\/sbin\/nfsdctl /
  condition:
    filesize < 4096 and $execstop and none of ($not*)
 }