IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Hping Process Activityedit
Hping ran on a Linux host. Hping is a FOSS command-line packet analyzer and has the ability to construct network packets for a wide variety of network security testing applications, including scanning and firewall auditing.
Rule indices:
- auditbeat-*
Severity: high
Risk score: 73
Runs every: 5 minutes
Searches indices from: now-6m (Date Math format, see also Additional look-back time
)
Maximum signals per execution: 100
References:
Tags:
- Elastic
- Linux
Rule version: 1
Added (Elastic Stack release): 7.6.0
Potential false positivesedit
Normal use of hping is uncommon apart from security testing and research. Use by non-security engineers is very uncommon.
Rule queryedit
process.name: (hping3 or hping2 or hping) and event.action:executed