admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
Bhavin Patel
2024-12-10 09:52:49 -08:00
committed by GitHub
parent 5543dc4538 8400a3619d
commit 0fcc71e3bb
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/known_services_killed_by_ransomware.yml
+4 -4
View File
@@ -1,7 +1,7 @@
name: Known Services Killed by Ransomware
id: 3070f8e0-c528-11eb-b2a0-acde48001122
version: '6'
date: '2024-11-28'
version: 7
date: '2024-12-09'
author: Teoderick Contreras, Splunk
status: production
type: TTP
@@ -18,8 +18,8 @@ data_source:
search: '`wineventlog_system` EventCode=7036 param1 IN ("*Volume Shadow Copy*","*VSS*",
"*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*", "DefWatch",
"ccEvtMgr", "ccSetMgr", "SavRoam", "RTVscan", "QBFCService", "QBIDPService", "Intuit.QuickBooks.FCS",
"QBCFMonitorService" "YooBackup", "YooIT", "*Veeam*", "PDVFSService", "BackupExecVSSProvider",
"BackupExecAgentAccelerator", "BackupExec*", "WdBoot", "WdFilter", "WdNisDrv", "WdNisSvc",
"QBCFMonitorService", "YooBackup", "YooIT", "*Veeam*", "PDVFSService", "BackupExec*",
"WdBoot", "WdFilter", "WdNisDrv", "WdNisSvc",
"WinDefend", "wscsvc", "Sense", "sppsvc", "SecurityHealthService") param2="stopped"
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode param1
dest | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`