Update audit.rules

Neo23x0 · Aug 15, 2023 · 3057a30 · 3057a30
1 parent 639bad5
commit 3057a30
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/audit.rules b/audit.rules
@@ -417,6 +417,10 @@
 -w /bin/open -p x -k susp_shell
 -w /bin/rbash -p x -k susp_shell
 
+### https://gtfobins.github.io/gtfobins/wish/
+-w /bin/wish -p x -k susp_shell
+-w /usr/bin/wish -p x -k susp_shell
+
 # Web Server Actvity
 ## Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33
 -a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www