action[.]idDomain
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 5 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
DFIR: From alert to root cause using Osquery without leaving Elastic Security“Each query execution is identified by the action[.]id field.”
-
Linux Detection Engineering - The Grand Finale on Linux Persistence“if (action[.]id == "org.freedesktop.systemd1.manage-units" &&”
Indicators reported together
named in the same reports- system[.]mapin 1 report
- breachlabs[.]ioin 1 report
- hxxp://www.freedesktop[.]org/standards/dbus/1.0/busconfig.dtdin 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.