admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inAttempted Credential Dump From Registry via Reg exe

Browse Source
This commit is contained in:
root
2021-05-07 08:10:42 +00:00
parent 3727ede275
commit 1310fc6d59
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
+3 -2
View File
@@ -13,8 +13,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security*
OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System*
OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*)
by Processes.user Processes.process_name Processes.process Processes.dest Processes.process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`'
by Processes.user Processes.process_name Processes.process Processes.dest Processes.process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
| `attempted_credential_dump_from_registry_via_reg_exe_filter`'
how_to_implement: You must be ingesting endpoint data that tracks process activity,
including parent-child relationships from your endpoints, to populate the Endpoint
data model in the Processes node. The command-line arguments are mapped to the "process"