Rule Info
Name
Suspicious Nohup Execution
Author
Joseliyo Sanchez, @Joseliyo_Jstnk
Description
Detects execution of binaries located in potentially suspicious locations via "nohup"
Date
2023-06-02 00:00:00
Modified
None
Id
457df417-8b9d-4912-85f3-9dbda39c3645
Tags
attack.execution DEMO
Type
Community Rule
Link to Public Repo
Scan your endpoints, forensic images or collected files with our portable scanner THOR