admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2023-06-22 11:42:18 -07:00
committed by GitHub
parent dabd5a98fa f55a8b4fb7
commit 0085d759d0
3 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
+1 -1
View File
@@ -27,7 +27,7 @@ search:
- pwsh.exe
selection2:
process.cmd_line|re: (?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+[^-]
condition: selection1 and not selection2
condition: selection1 and selection2
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
Vendored
+1 -1
View File
@@ -29,7 +29,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe"
OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe"
OR process_file_name="pwsh.exe") AND (NOT match_regex(process_cmd_line, /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true)
OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true
| eval body=create_map(
"devices", [
ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
+1 -1
View File
@@ -35,7 +35,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe"
OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe"
OR process_file_name="pwsh.exe") AND (NOT match_regex(process_cmd_line, /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true)
OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true
--finding_report--'
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be