Update proc_creation_lnx_rsync_shell_spawn.yml

SigmaHQ · Jan 18, 2025 · 22842e8 · 22842e8
1 parent dd76cd3
commit 22842e8
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/rules/linux/process_creation/proc_creation_lnx_rsync_shell_spawn.yml b/rules/linux/process_creation/proc_creation_lnx_rsync_shell_spawn.yml
@@ -16,11 +16,11 @@ logsource:
     category: process_creation
     product: linux
 detection:
-    selection:
+    selection_parent:
         ParentImage|endswith:
             - '/rsync'
             - '/rsyncd'
-    selection_cli:
+    selection_shells:
         Image|endswith:
             - '/ash'
             - '/bash'
@@ -32,7 +32,7 @@ detection:
             - '/zsh'
     filter_expected:
         CommandLine|contains: ' -e '
-    condition: selection and not 1 of filter_*
+    condition: all of selection_* and not 1 of filter_*
 falsepositives:
     - Unknown
 level: high