From 028dc676889d9f2ff673bf8d5893426ea09c2d76 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 15 Mar 2022 12:17:45 -0700 Subject: [PATCH] Touched one search and broke another intentionally for generating a demo --- detections/endpoint/windows_disable_memory_crash_dump.yml | 2 +- detections/endpoint/windows_event_log_cleared.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_disable_memory_crash_dump.yml b/detections/endpoint/windows_disable_memory_crash_dump.yml index 71b3c6d86e..b1089de307 100644 --- a/detections/endpoint/windows_disable_memory_crash_dump.yml +++ b/detections/endpoint/windows_disable_memory_crash_dump.yml @@ -12,7 +12,7 @@ description: The following analytic identifies a process that is attempting to d 0. This feature is typically modified to perform a memory crash dump when a computer stops unexpectedly because of a Stop error (also known as a blue screen, system crash, or bug check). -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonlyy` count FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\CurrentControlSet\\Control\\CrashControl\\CrashDumpEnabled") AND Registry.registry_value_data="0x00000000" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data diff --git a/detections/endpoint/windows_event_log_cleared.yml b/detections/endpoint/windows_event_log_cleared.yml index 166f700a6f..781445e9f9 100644 --- a/detections/endpoint/windows_event_log_cleared.yml +++ b/detections/endpoint/windows_event_log_cleared.yml @@ -2,7 +2,7 @@ name: Windows Event Log Cleared id: ad517544-aff9-4c96-bd99-d6eb43bfbb6a version: 6 date: '2020-07-06' -author: Rico Valdez, Michael Haag, Splunk +author: Rico Valdez, Michael Haag, Splunk, NO CHANGE type: TTP datamodel: [] description: The following analytic utilizes Windows Security Event ID 1102 or System