Symlink Etc Passwd

Title: Symlink Etc Passwd
Status: test
Description:Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd
References:
  -https://www.qualys.com/2021/05/04/21nails/21nails.txt
Author: Florian Roth (Nextron Systems)
Date: 2019-04-05
modified:2021-11-27
Tags:

• -'attack.t1204.001'
• -'attack.execution'

Logsource:

• product: linux

Detection:
  keywords:
    - 'ln -s -f /etc/passwd'
    - 'ln -s /etc/passwd'
  condition:keywords
Falsepositives:
  -Unknown
Level: high