9 lines
211 B
TOML
9 lines
211 B
TOML
[[exec_rules]]
|
|
sid = 190001
|
|
msg = "Custom replay rule"
|
|
severity = "medium"
|
|
classtype = "custom-exec"
|
|
path_prefixes = ["/opt/custom/"]
|
|
parent_comm = ["cron"]
|
|
argv_regex = 'danger\s+now'
|
|
parent_exclude = ["sshd"]
|