Techniques
Sample rules
Touch Suspicious Service File
- source: sigma
- technicques:
- t1070
- t1070.006
Description
Detects usage of the “touch” process in service file.
Detection logic
condition: selection
selection:
CommandLine|contains: ' -t '
CommandLine|endswith: .service
Image|endswith: /touch