admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update create_or_delete_windows_shares_using_net_exe.yml

Browse Source 
Fixing up query, related to #1636
This commit is contained in:
mhaag-spl
2021-09-08 08:16:57 -06:00
parent 2f330f4084
commit 080e8d3f14
1 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
+8 -6
View File
@@ -8,12 +8,14 @@ datamodel:
- Endpoint
description: This search looks for the creation or deletion of hidden shares using
net.exe.
search: '| tstats `security_content_summariesonly` count values(Processes.user) as
user values(Processes.parent_process) as parent_process min(_time) as firstTime
max(_time) as lastTime from datamodel=Endpoint.Processes where (Processs.process_name=net.exe
OR Processes.process_name=net1.exe) by Processes.process Processes.process_name
Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)` | search process=*share* | `create_or_delete_windows_shares_using_net_exe_filter` '
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processs.process_name=net.exe OR Processes.process_name=net1.exe)
AND (Processes.process="* share *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `create_or_delete_windows_shares_using_net_exe_filter`'
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.