Merge pull request #427 from tstromberg/nov19

suspicious systemd: accept any char instead of single quote
2024-11-19 16:12:21 -05:00 · 2024-11-19 16:12:21 -05:00 · d078e4a1ca
parent a2c2571ee9 4c4423a474
commit d078e4a1ca
1 changed files with 1 additions and 1 deletions
--- a/detection/persistence/suspicious-systemd-unit.sql
+++ b/detection/persistence/suspicious-systemd-unit.sql
@ -226,7 +226,7 @@ rule usr_bin_execstop_shell : medium {
    $execstop = /ExecStop=\/bin\/sh .{0,64}/
    $not_podman_logging = "/usr/bin/podman $LOGGING"
    $not_stderr = /ExecStop=\/bin\/sh .{0,64}set -eu/
-    $not_nfs = /ExecStop=\/bin\/sh -c \'\/usr\/sbin\/nfsdctl /
+    $not_nfs = /ExecStop=\/bin\/sh -c .\/usr\/sbin\/nfsdctl /
  condition:
    filesize < 4096 and $execstop and none of ($not*)
 }