admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inSchtasks used for forcing a reboot

Browse Source
This commit is contained in:
root
2020-12-08 09:09:37 +00:00
parent e1518258d6
commit 0b74cc710d
1 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/schtasks_used_for_forcing_a_reboot.yml
+7 -4
View File
@@ -12,10 +12,10 @@ references: []
author: Bhavin Patel, Splunk
search: '| tstats `security_content_summariesonly` values(Processes.process) as process
min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
where Processes.process_name=schtasks.exe Processes.process="*shutdown*" Processes.process="*/create *"
by Processes.process_name Processes.parent_process_name
Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `schtasks_used_for_forcing_a_reboot_filter`'
where Processes.process_name=schtasks.exe Processes.process="*shutdown*" Processes.process="*/create
*" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `schtasks_used_for_forcing_a_reboot_filter`'
known_false_positives: Administrators may create jobs on systems forcing reboots to
perform updates, maintenance, etc.
tags:
@@ -32,3 +32,6 @@ tags:
- PR.IP
security_domain: endpoint
asset_type: Endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtask_shutdown/windows-sysmon.log