2022-03-20 05:18 AM
App rule 'remote directory Traversal' generating high number of alerts on EPLH, and I tried to fine tune this app rule but whenever i tried to filter based on "param.src" all Mata keys disapper. This app rule is very generic and it need a lot of fine-tuning , but very limited options for fine-tuning. if someone did fine-tuning for this app rule, please share based on which key get the desired result.
2022-06-15 10:20 PM
Hello Younis
The remote_directory_traversal.nwr contains the following syntax
name="remote directory traversal" rule="device.type = 'nwendpoint' && OS = 'windows' && category = 'console event' && filename.src='cmd.exe','powershell.exe' && param.src exists && param.src regex '(dir|tree).*?\\.*?$'" alert=boc order=1 type=application
What are you changing the param.src to so it returns no meta?