Fix typo on detection engine rule (#56993) (#57045)

Co-authored-by: Elastic Machine <[email protected]> Co-authored-by: Elastic Machine <[email protected]>
elastic · Feb 6, 2020 · 6604f13 · 6604f13
1 parent 2231a92
commit 6604f13
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/...rver/lib/detection_engine/rules/prepackaged_rules/linux_shell_activity_by_web_server.json b/...rver/lib/detection_engine/rules/prepackaged_rules/linux_shell_activity_by_web_server.json
@@ -9,7 +9,7 @@
   "language": "kuery",
   "max_signals": 100,
   "name": "Potential Shell via Web Server",
-  "query": "process.name: bash and user.name: (apache or www or \"wwww-data\") and event.action:executed",
+  "query": "process.name: bash and user.name: (apache or www or \"www-data\") and event.action:executed",
   "references": [
     "https://pentestlab.blog/tag/web-shell/"
   ],