admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

generated detection

Browse Source
This commit is contained in:
d1vious
2022-03-24 10:47:52 -04:00
parent 543b04d9db
commit 19ecc83b3b
1 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml
Vendored
+9 -9
View File
@@ -1,7 +1,7 @@
author: Ignacio Bermudez Corrales, Splunk
author: Jose Hernadnez, Ignacio Bermudez Corrales, Splunk
datamodel:
- Endpoint_Processes
date: '2020-08-25'
date: '2022-03-24'
description: An attacker tries might try to use different version of a system command
without overriding original, or they might try to avoid some detection running the
process from a different folder. This detection checks that a list of system processes
@@ -74,12 +74,12 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
OR process_name="rdpsauachelper.exe" OR process_name="reagentc.exe" OR process_name="recoverydrive.exe"
OR process_name="register-cimprovider.exe" OR process_name="registeriepkeys.exe"
OR process_name="relpost.exe" OR process_name="remoteposworker.exe" OR process_name="rmclient.exe"
OR process_name="robocopy.exe" OR process_name="rpcping.exe" OR process_name="runlegacycplelevated.exe"
OR process_name="runtimebroker.exe" OR process_name="sihclient.exe" OR process_name="searchfilterhost.exe"
OR process_name="searchindexer.exe" OR process_name="searchprotocolhost.exe" OR
process_name="secedit.exe" OR process_name="sensordataservice.exe" OR process_name="setieinstalleddate.exe"
OR process_name="settingsynchost.exe" OR process_name="slidetoshutdown.exe" OR process_name="smartscreensettings.exe"
OR process_name="sndvol.exe" OR process_name="snippingtool.exe" OR process_name="soundrecorder.exe"
OR process_name="rpcping.exe" OR process_name="runlegacycplelevated.exe" OR process_name="runtimebroker.exe"
OR process_name="sihclient.exe" OR process_name="searchfilterhost.exe" OR process_name="searchindexer.exe"
OR process_name="searchprotocolhost.exe" OR process_name="secedit.exe" OR process_name="sensordataservice.exe"
OR process_name="setieinstalleddate.exe" OR process_name="settingsynchost.exe" OR
process_name="slidetoshutdown.exe" OR process_name="smartscreensettings.exe" OR
process_name="sndvol.exe" OR process_name="snippingtool.exe" OR process_name="soundrecorder.exe"
OR process_name="spaceagent.exe" OR process_name="sppextcomobj.exe" OR process_name="srtasks.exe"
OR process_name="stikynot.exe" OR process_name="synchost.exe" OR process_name="sysreseterr.exe"
OR process_name="systempropertiesadvanced.exe" OR process_name="systempropertiescomputername.exe"
@@ -288,4 +288,4 @@ test:
name: System Process Running from Unexpected Location
pass_condition: '@count_eq(1)'
type: Anomaly
version: 3
version: 4