From 0b74cc710d30bbbd100fe9ad8ae7b9a3d3553f07 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 8 Dec 2020 09:09:37 +0000 Subject: [PATCH] Added detection testing service results inSchtasks used for forcing a reboot --- .../endpoint/schtasks_used_for_forcing_a_reboot.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml index a31a1614f0..04cb8c6246 100644 --- a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml +++ b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml @@ -12,10 +12,10 @@ references: [] author: Bhavin Patel, Splunk search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name=schtasks.exe Processes.process="*shutdown*" Processes.process="*/create *" - by Processes.process_name Processes.parent_process_name - Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `schtasks_used_for_forcing_a_reboot_filter`' + where Processes.process_name=schtasks.exe Processes.process="*shutdown*" Processes.process="*/create + *" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `schtasks_used_for_forcing_a_reboot_filter`' known_false_positives: Administrators may create jobs on systems forcing reboots to perform updates, maintenance, etc. tags: @@ -32,3 +32,6 @@ tags: - PR.IP security_domain: endpoint asset_type: Endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtask_shutdown/windows-sysmon.log