admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inDomain Account Discovery With Net App

Browse Source
This commit is contained in:
root
2021-09-16 17:56:37 +00:00
parent 70fb8aaf78
commit 04e8fd24b2
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/domain_account_discovery_with_net_app.yml
+5 -5
View File
@@ -11,11 +11,11 @@ description: This search is to detect a process command line for AD discovery. T
the targetted machine. This techique was seen in several malware as part of there
recon and can be a good pivot of analysis.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process = "* user*" AND Processes.process
= "*/do*" by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `domain_account_discovery_with_net_app_filter`'
as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process
= "* user*" AND Processes.process = "*/do*" by Processes.dest Processes.user Processes.parent_process
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `domain_account_discovery_with_net_app_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the