Merge pull request #115 from Pierre-Gronau-ndaal/master-5

Update audit.rules yash
Neo23x0 · Feb 5, 2024 · f93b05e · f93b05e
2 parents db36864 + 19b8601
commit f93b05e
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/audit.rules b/audit.rules
@@ -461,6 +461,10 @@
 -w /bin/open -p x -k susp_shell
 -w /bin/rbash -p x -k susp_shell
 
+### https://gtfobins.github.io/gtfobins/yash/
+-w /bin/yash -p x -k susp_shell
+-w /usr/bin/yash -p x -k susp_shell
+
 # Web Server Actvity
 ## Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33
 -a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www