admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inDeleting Shadow Copies

Browse Source
This commit is contained in:
root
2020-11-09 09:56:18 +00:00
parent ff910fa590
commit 1e5bbadd2b
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/deleting_shadow_copies.yml
+7 -3
View File
@@ -15,9 +15,10 @@ author: David Dorsey, Splunk
search: '| tstats `security_content_summariesonly` count values(Processes.process)
as process values(Processes.parent_process) as parent_process min(_time) as firstTime
max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=vssadmin.exe
OR Processes.process_name=wmic.exe) Processes.process=*delete* Processes.process=*shadow* by Processes.user Processes.process_name Processes.parent_process_name
Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)` | `deleting_shadow_copies_filter`'
OR Processes.process_name=wmic.exe) Processes.process=*delete* Processes.process=*shadow*
by Processes.user Processes.process_name Processes.parent_process_name Processes.dest |
`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
| `deleting_shadow_copies_filter`'
known_false_positives: vssadmin.exe and wmic.exe are standard applications shipped
with modern versions of windows. They may be used by administrators to legitimately
delete old backup copies, although this is typically rare.
@@ -39,3 +40,6 @@ tags:
- PR.IP
security_domain: endpoint
asset_type: Endpoint
automated_detection_testing: passed
dataset:
- https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1490/windows-sysmon.log