Anomalous Unix Password Change Activity
Last updated on:
In this page
About the rule
Rule Type
Anomaly
Rule Description
Flags irregular password change behavior in Unix environments.
Severity
Critical
Rule Requirement
Criteria
Action1:
actionname = "Successful user account password change"
| isanomalous(Log source at an unusual Time)
| isanomalous(Log source with abnormal Count)
select Action1.HOSTNAME,Action1.TARGETUSER,Action1.USERID,Action1.MESSAGE
Detection
Execution Mode
Intelligent
Log Sources
Miscellaneous
