admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-02-02 13:00:34 -08:00
committed by GitHub
parent fc9568f1f4 cecf9482e7
commit 0d778ce62d
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/powershell_remove_windows_defender_directory.yml
+1 -1
View File
@@ -11,7 +11,7 @@ description: This analytic will identify a suspicious PowerShell command used to
campaign where it used Nirsofts advancedrun.exe to gain administrative privileges
to then execute a PowerShell command to delete the Windows Defender folder. This
is a good indicator the offending process is trying corrupt a Windows Defender installation.
search: '`powershell` EventCode=4104 Message = "* rmdir *" OR Message = "*\\Microsoft\\Windows
search: '`powershell` EventCode=4104 Message = "* rmdir *" AND Message = "*\\Microsoft\\Windows
Defender*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode
Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `powershell_remove_windows_defender_directory_filter`'