admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Touched one search and broke another

Browse Source 
intentionally for generating a demo
This commit is contained in:
pyth0n1c
2022-03-15 12:17:45 -07:00
committed by GitHub
parent afd49d8c1b
commit 028dc67688
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_disable_memory_crash_dump.yml
+1 -1
View File
@@ -12,7 +12,7 @@ description: The following analytic identifies a process that is attempting to d
0. This feature is typically modified to perform a memory crash dump when a computer
stops unexpectedly because of a Stop error (also known as a blue screen, system
crash, or bug check).
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonlyy` count FROM datamodel=Endpoint.Registry
where (Registry.registry_path="*\\CurrentControlSet\\Control\\CrashControl\\CrashDumpEnabled")
AND Registry.registry_value_data="0x00000000" by _time span=1h Registry.dest Registry.user
Registry.registry_path Registry.registry_value_name Registry.registry_value_data
detections/endpoint/windows_event_log_cleared.yml
+1 -1
View File
@@ -2,7 +2,7 @@ name: Windows Event Log Cleared
id: ad517544-aff9-4c96-bd99-d6eb43bfbb6a
version: 6
date: '2020-07-06'
author: Rico Valdez, Michael Haag, Splunk
author: Rico Valdez, Michael Haag, Splunk, NO CHANGE
type: TTP
datamodel: []
description: The following analytic utilizes Windows Security Event ID 1102 or System