Anomalous Unix Password Change Activity
Last updated on:
In this page
About the rule
Rule Type
Anomaly
Rule Description
Flags irregular password change behavior in Unix environments.
Severity
Critical
Rule Requirement
Criteria
Action1: actionname = "unix_successful_user_account_password_change" | isanomalous(Log source at an unusual Time) | isanomalous(Log source with abnormal Count) select Action1.HOSTNAME,Action1.TARGETUSER,Action1.USERID,Action1.MESSAGE
Detection
Execution Mode
Intelligent
Log Sources
Miscellaneous
