From 04e8fd24b2e41073df2ec1c7c7db87ece3d8be71 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 16 Sep 2021 17:56:37 +0000 Subject: [PATCH] Added detection testing service results inDomain Account Discovery With Net App --- .../endpoint/domain_account_discovery_with_net_app.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/domain_account_discovery_with_net_app.yml b/detections/endpoint/domain_account_discovery_with_net_app.yml index 8454154d22..bcc418af61 100644 --- a/detections/endpoint/domain_account_discovery_with_net_app.yml +++ b/detections/endpoint/domain_account_discovery_with_net_app.yml @@ -11,11 +11,11 @@ description: This search is to detect a process command line for AD discovery. T the targetted machine. This techique was seen in several malware as part of there recon and can be a good pivot of analysis. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process = "* user*" AND Processes.process - = "*/do*" by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `domain_account_discovery_with_net_app_filter`' + as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process + = "* user*" AND Processes.process = "*/do*" by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `domain_account_discovery_with_net_app_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the