From 07157ba511c48440261f4aef6bfd15badbe5c61e Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 27 Jul 2022 15:23:34 +0200 Subject: [PATCH] dcrat-analytics2 --- detections/endpoint/windows_system_logoff_commandline.yml | 2 +- detections/endpoint/windows_system_reboot_commandline.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_system_logoff_commandline.yml b/detections/endpoint/windows_system_logoff_commandline.yml index 2de971fd7c..3eedeecac0 100644 --- a/detections/endpoint/windows_system_logoff_commandline.yml +++ b/detections/endpoint/windows_system_logoff_commandline.yml @@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_system_shutdown_commandline_filter`' + | `windows_system_logoff_commandline_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/detections/endpoint/windows_system_reboot_commandline.yml b/detections/endpoint/windows_system_reboot_commandline.yml index fd9827856f..09df254484 100644 --- a/detections/endpoint/windows_system_reboot_commandline.yml +++ b/detections/endpoint/windows_system_reboot_commandline.yml @@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_system_shutdown_commandline_filter`' + | `windows_system_reboot_commandline_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the