Skip to content

[Rule Tuning] Rewriting execution through perl rule due to impossible condition - #6549

Open
litemars wants to merge 1 commit into
elastic:mainfrom
litemars:fixing_perl_tty_rule
Open

[Rule Tuning] Rewriting execution through perl rule due to impossible condition#6549
litemars wants to merge 1 commit into
elastic:mainfrom
litemars:fixing_perl_tty_rule

Conversation

@litemars

Copy link
Copy Markdown
Contributor

Pull Request

Issue:

The previous query included a condition on process.args that may not have matched.

process.name == "perl" and process.args == "exec" and
process.args in ("\"sh\";", "\"/bin/sh\";", ...)

Summary - What I changed

I have rewritten the rule based on Python’s sibling rule. This query may have an impact on the cluster because of the multiple * wildcards, so I’m open to suggestions for further improvements.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant