admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update nltest_domain_trust_discovery.yml

Browse Source
This commit is contained in:
mhaag-spl
2022-04-18 10:01:25 -06:00
parent 5d8d3c0613
commit 12350f451e
1 changed files with 3 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/nltest_domain_trust_discovery.yml
+3 -4
View File
@@ -1,7 +1,7 @@
name: NLTest Domain Trust Discovery
id: c3e05466-5f22-11eb-ae93-0242ac130002
version: 1
date: '2021-01-25'
version: 2
date: '2022-04-18'
author: Michael Haag, Splunk
type: TTP
datamodel:
@@ -12,8 +12,7 @@ description: This search looks for the execution of `nltest.exe` with command-li
domains. Red Teams and adversaries alike use NLTest.exe to enumerate the current
domain to assist with further understanding where to pivot next.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=nltest.exe
OR Processes.process_name!=nltest.exe) (Processes.process=*/domain_trusts* OR Processes.process=*/all_trusts*)
as lastTime from datamodel=Endpoint.Processes where `process_nltest` (Processes.process=*/domain_trusts* OR Processes.process=*/all_trusts*)
by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `nltest_domain_trust_discovery_filter`'