Rule Info
Name
Potentially Suspicious Shell Script Creation in Profile Folder
Author
Joseliyo Sanchez, @Joseliyo_Jstnk
Description
Detects the creation of shell scripts under the "profile.d" path.
Date
2023-06-02 00:00:00
Modified
None
Id
13f08f54-e705-4498-91fd-cce9d9cee9f1
Tags
attack.persistence DEMO
Type
Community Rule
Link to Public Repo
Scan your endpoints, forensic images or collected files with our portable scanner THOR