admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'AD_Discovery_TR-789_7' of https://github.com/splunk/security_content into AD_Discovery_TR-789_7

Browse Source
This commit is contained in:
Detection Testing Service
2021-09-10 00:52:16 +00:00
parent d200431336 d929d478d8
commit 00ccb9b107
1 changed files with 10 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/getadcomputer_with_powershell.yml
+10 -7
View File
@@ -7,13 +7,15 @@ type: Hunting
datamodel:
- Endpoint
description: This analytic looks for the execution of `powershell.exe` with command-line
arguments utilized to discover remote systems. The `Get-AdComputer' commandlet returns a list of all domain computers.
Red Teams and adversaries alike may use this commandlet to identify remote systems for situational awareness and Active Directory Discovery.
arguments utilized to discover remote systems. The `Get-AdComputer' commandlet returns
a list of all domain computers. Red Teams and adversaries alike may use this commandlet
to identify remote systems for situational awareness and Active Directory Discovery.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe")
(Processes.process=*Get-AdComputer*) by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getadcomputer_with_powershell_filter`'
as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe")
(Processes.process=*Get-AdComputer*) by Processes.dest Processes.user Processes.parent_process
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `getadcomputer_with_powershell_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -48,4 +50,5 @@ tags:
- name: dest
type: Endpoint
role:
- Victim
- Victim
automated_detection_testing: passed