admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2163 from splunk/ssa_mshta_fix

Browse Source 
MSHTA Child Process fix
This commit is contained in:
Jose Enrique Hernandez
2022-04-12 14:28:48 -04:00
committed by GitHub
parent 095210542a ec66e01b78
commit 1cc6ed2697
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___windows_mshta_child_process.yml
+5 -5
View File
@@ -1,6 +1,6 @@
name: Windows MSHTA Child Process
id: f63f7e9c-9526-11ec-9fc7-acde48001122
version: 1
version: 2
date: '2022-02-23'
author: Michael Haag, Splunk
type: TTP
@@ -14,13 +14,13 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
null), parent_process_name=lower(ucast(map_get(input_event, "parent_process_name"), "string",
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name IS NOT
NULL | where parent_process_name="mshta.exe" AND process_name="powershell.exe" OR
NULL | where like(parent_process_name, "%\\\\mshta.exe") AND (process_name="powershell.exe" OR
process_name="cmd.exe" OR process_name="scrcons.exe" OR process_name="colorcpl.exe"
OR process_name="msbuild.exe" OR process_name="microsoft.workflow.compiler.exe"
OR process_name="searchprotocolhost.exe" OR process_name="cscript.exe" OR process_name="wscript.exe"
OR process_name="searchprotocolhost.exe" OR process_name="cscript.exe" OR process_name="wscript.exe")
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",