rare iptable delete command

Muthuvel — Wed, 28 Dec 2022 10:03:35 GMT

We received couple of alerts on rare iptable delete command.On checking the host activity, we could able to observe all commands including newly entered command in the host machine but not able to see the iptable delete/flush command in the activity log under Query builder.

Re: rare iptable delete command

etugriceri — Thu, 29 Dec 2022 14:07:33 GMT

Hi Muthuvel,

I think the question is how can we see delete/flush command ?

But event its, still some of the important informations are missing like

What is the alert source?

did you try to investigate casualty chain?

did you check action_remote_process_image_command_line or actor_process_command_line fields for parameters?

is your time line correct when you use Query builder?

topic Re: rare iptable delete command in Cortex XDR Discussions

rare iptable delete command

Re: rare iptable delete command