From 05cd8a648db02a23dbf08ecb3ddf0041118ad318 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 3 Jun 2022 21:35:48 -0600
Subject: [PATCH] Update java_writing_jsp_file.yml

---
 detections/endpoint/java_writing_jsp_file.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/java_writing_jsp_file.yml b/detections/endpoint/java_writing_jsp_file.yml
index d95f7c766d..d190e1b7af 100644
--- a/detections/endpoint/java_writing_jsp_file.yml
+++ b/detections/endpoint/java_writing_jsp_file.yml
@@ -1,12 +1,13 @@
 name: Java Writing JSP File
 id: eb65619c-4f8d-4383-a975-d352765d344b
-version: 1
-date: '2022-04-05'
+version: 2
+date: '2022-06-03'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
 description: The following analytic identifies the process java writing a .jsp to disk. This is potentially indicative of a web shell being written to disk. 
+  Modify and tune the analytic based on data ingested. For instance, it may be worth running a broad query for jsp file writes first before performing a join.
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name IN ("java","java.exe", "javaw.exe")
   by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid
   Processes.user | `drop_dm_object_name(Processes)` | join process_guid [| tstats