admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
Bhavin Patel
2021-09-09 11:33:19 -07:00
committed by GitHub
parent 1745719852 42907bc6ad
commit 193adb5833
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/extraction_of_registry_hives.yml
+4 -4
View File
@@ -1,7 +1,7 @@
name: Extraction of Registry Hives
id: 8bbb7d58-b360-11eb-ba21-acde48001122
version: 1
date: '2021-05-12'
version: 2
date: '2021-09-09'
author: Michael Haag, Splunk
type: TTP
datamodel:
@@ -12,8 +12,8 @@ description: The following analytic identifies the use of `reg.exe` exporting Wi
a untrusted process or script. Upon execution, a file will be written to disk.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=reg.exe
(Processes.process=*save* OR Processes.process=*export*) AND (Processes.process=*\sam
* OR Processes.process=*system* OR Processes.process=*security*) by Processes.dest
(Processes.process=*save* OR Processes.process=*export*) AND (Processes.process="*\sam
*" OR Processes.process="*\system *" OR Processes.process="*\security *") by Processes.dest
Processes.user Processes.parent_process Processes.process_name Processes.process
Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `extraction_of_registry_hives_filter`'