admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1992 from splunk/tuneup

Browse Source 
update to certutil urlcache and verifyctl
This commit is contained in:
Bhavin Patel
2022-02-14 13:12:19 -08:00
committed by GitHub
parent 52ab302315 58d3d914a8
commit 0ef2035d78
2 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
+4 -4
View File
@@ -1,7 +1,7 @@
name: CertUtil Download With URLCache and Split Arguments
id: 415b4306-8bfb-11eb-85c4-acde48001122
version: 2
date: '2021-03-23'
version: 3
date: '2022-02-03'
author: Michael Haag, Splunk
type: TTP
datamodel:
@@ -14,8 +14,8 @@ description: Certutil.exe may download a file from a remote destination using `-
During triage, capture any files on disk and review. Review the reputation of the
remote IP or domain in question.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*urlcache*
Processes.process=*split* by Processes.dest Processes.user Processes.parent_process
as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*urlcache*
Processes.process=*split*) OR Processes.process=*urlcache* by Processes.dest Processes.user Processes.parent_process
Processes.process_name Processes.process Processes.process_id Processes.original_file_name
Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `certutil_download_with_urlcache_and_split_arguments_filter`'
detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml
+4 -4
View File
@@ -1,7 +1,7 @@
name: CertUtil Download With VerifyCtl and Split Arguments
id: 801ad9e4-8bfb-11eb-8b31-acde48001122
version: 2
date: '2021-03-23'
version: 3
date: '2022-02-03'
author: Michael Haag, Splunk
type: TTP
datamodel:
@@ -14,8 +14,8 @@ description: 'Certutil.exe may download a file from a remote destination using `
the remote IP or domain in question. Using `-VerifyCtl`, the file will either be
written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\<hash>`. '
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*verifyctl*
Processes.process=*split* by Processes.dest Processes.user Processes.original_file_name
as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*verifyctl*
Processes.process=*split*) OR Processes.process=*verifyctl* by Processes.dest Processes.user Processes.original_file_name
Processes.parent_process Processes.process_name Processes.process Processes.process_id
Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `certutil_download_with_verifyctl_and_split_arguments_filter`'