admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'develop' into misko_credential_probing

Browse Source
This commit is contained in:
Jose Enrique Hernandez
2020-11-18 12:22:08 -05:00
committed by GitHub
parent 1db0cb220e bc1d33add5
commit 023e57056f
2 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
automated_detection_testing/requirements.txt
+2 -2
View File
@@ -6,9 +6,9 @@ atomicwrites==1.4.0
attackcti==0.3.3
attrs==20.3.0
bcrypt==3.2.0
botocore==1.19.19
botocore==1.19.20
certifi==2019.11.28
boto3==1.16.19
boto3==1.16.20
cffi==1.14.3
cfgv==2.0.1
chardet==3.0.4
detections/endpoint/windows_connhost_exe_force_flag.yml → detections/deprecated/windows_connhost_exe_force_flag.yml
+4 -1
View File
@@ -3,7 +3,10 @@ id: c114aaca-68ee-41c2-ad8c-32bf21db8769
version: 1
date: '2020-11-06'
description: 'The search looks for the Console Window Host process (connhost.exe) executed using the force flag -ForceV1.
This is not regular behavior in the Windows OS and is often seen executed by the Ryuk Ransomware.'
This is not regular behavior in the Windows OS and is often seen executed by the Ryuk Ransomware.
DEPRECATED
This event is actually seen in the windows 10 client of attack_range_local. After further testing we realized this is not specific to Ryuk.
'
how_to_implement: You must be ingesting data that records the process-system activity
from your hosts to populate the Endpoint Processes data-model object. If you are
using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which