admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inAttempt To Add Certificate To Untrusted Store

Browse Source
This commit is contained in:
root
2020-11-03 16:29:27 +00:00
parent 15d866e2fa
commit 0cee900ae3
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml
+6 -3
View File
@@ -13,9 +13,9 @@ references: []
author: Patrick Bareiss, Rico Valdez, Splunk
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process)
as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=*certutil*
(Processes.process=*-addstore*) by Processes.parent_process Processes.process_name Processes.user
| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
| `attempt_to_add_certificate_to_untrusted_store_filter`'
(Processes.process=*-addstore*) by Processes.parent_process Processes.process_name
Processes.user | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
|`security_content_ctime(lastTime)` | `attempt_to_add_certificate_to_untrusted_store_filter`'
known_false_positives: There may be legitimate reasons for administrators to add a
certificate to the untrusted certificate store. In such cases, this will typically
be done on a large number of systems.
@@ -37,3 +37,6 @@ tags:
- PR.IP
security_domain: endpoint
asset_type: Endpoint
automated_detection_testing: passed
dataset:
- https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1553.004/windows-sysmon.log