admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update windows_moveit_transfer_writing_aspx.yml

Browse Source
This commit is contained in:
Michael Haag
2023-06-06 07:36:03 -06:00
committed by GitHub
parent 189278fd57
commit 195db41ce0
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_moveit_transfer_writing_aspx.yml
+1 -1
View File
@@ -13,7 +13,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [|
tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\MOVEitTransfer\\wwwroot\\*") Filesystem.file_name
IN("*.aspx", "*.ashx", "*.asp*") OR Filesystem.file_name IN (human2.aspx) by _time span=1h Filesystem.dest Filesystem.file_create_time
IN("*.aspx", "*.ashx", "*.asp*") OR Filesystem.file_name IN ("human2.aspx","_human2.aspx") by _time span=1h Filesystem.dest Filesystem.file_create_time
Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` |
fields _time dest file_create_time file_name file_path process_name process_path
process] | dedup file_create_time | table dest file_create_time, file_name, file_path,