admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update java_writing_jsp_file.yml

Browse Source
This commit is contained in:
mhaag-spl
2022-06-03 21:35:48 -06:00
parent a28de38199
commit 05cd8a648d
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/java_writing_jsp_file.yml
+3 -2
View File
@@ -1,12 +1,13 @@
name: Java Writing JSP File
id: eb65619c-4f8d-4383-a975-d352765d344b
version: 1
date: '2022-04-05'
version: 2
date: '2022-06-03'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
description: The following analytic identifies the process java writing a .jsp to disk. This is potentially indicative of a web shell being written to disk.
Modify and tune the analytic based on data ingested. For instance, it may be worth running a broad query for jsp file writes first before performing a join.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name IN ("java","java.exe", "javaw.exe")
by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid
Processes.user | `drop_dm_object_name(Processes)` | join process_guid [| tstats