Fix typo on detection engine rule

elastic · Feb 6, 2020 · 1846d39 · 1846d39
1 parent 90a9dc2
commit 1846d39
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/...rver/lib/detection_engine/rules/prepackaged_rules/linux_shell_activity_by_web_server.json b/...rver/lib/detection_engine/rules/prepackaged_rules/linux_shell_activity_by_web_server.json
@@ -9,7 +9,7 @@
   "language": "kuery",
   "max_signals": 100,
   "name": "Potential Shell via Web Server",
-  "query": "process.name: bash and user.name: (apache or www or \"wwww-data\") and event.action:executed",
+  "query": "process.name: bash and user.name: (apache or www or \"www-data\") and event.action:executed",
   "references": [
     "https://pentestlab.blog/tag/web-shell/"
   ],