admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed known outstanding issue with process_name

Browse Source 
and parent_process_name
This commit is contained in:
pyth0n1c
2022-07-31 16:49:35 -07:00
committed by GitHub
parent cdbdc51033
commit 1b3707932b
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/office_document_creating_schedule_task.yml
+2 -2
View File
@@ -19,9 +19,9 @@ description: this search detects a potential malicious office document that crea
source. Was it schtasks.exe or via TaskService? Review the job created and the Command
to be executed. Capture any artifacts on disk and review. Identify any parallel
processes within the same timeframe to identify source.'
search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE")
search: '`sysmon` EventCode=7 parent_process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE")
ImageLoaded = "*\\taskschd.dll" | stats min(_time) as firstTime max(_time) as lastTime
values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name
values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image parent_process_name
ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `office_document_creating_schedule_task_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting