Auditd, Sentinel, Threat Detection, Incident Response, Blue Team.
"/tmp/" | where full_cli has_any ('sh','zsh','bash','perl','python','chmod','chown') Lets execute the following script that was dropped. # cat /tmp/go.sh #!/bin/sh echo "lets go" pkill -9 "nothing" cat /etc/passwd And we can see that we have an execution from a bad dir If we click on the events and