Skip to content

Hide Navigation Hide TOC

Symlink Etc Passwd (c67fc22a-0be5-4b4f-aad5-2b32c4b69523)

Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd

Cluster A Galaxy A Cluster B Galaxy B Level
Malicious Link - T1204.001 (ef67e13e-5598-4adc-bdb2-998225874fa9) Attack Pattern Symlink Etc Passwd (c67fc22a-0be5-4b4f-aad5-2b32c4b69523) Sigma-Rules 1
User Execution - T1204 (8c32eb4d-805f-4fc5-bf60-c4d476c131b5) Attack Pattern Malicious Link - T1204.001 (ef67e13e-5598-4adc-bdb2-998225874fa9) Attack Pattern 2