admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'hpot_ttp' of https://github.com/splunk/security_content into hpot_ttp

Browse Source
This commit is contained in:
Detection Testing Service
2021-06-15 15:40:49 +00:00
parent 0ca1e7f708 58fd2b6756
commit 1f65e24932
1 changed files with 3 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/powershell_using_memory_as_backing_store.yml
+3 -4
View File
@@ -10,10 +10,9 @@ description: this search is to detect suspicious powershell script that using me
stream as new object backstore. This technique is commonly seen in malicious powershell
contain a stream flate data and will be decompressed in memory to run or drop the
actual payload to the compromise machine.
search: '`powershell` EventCode=4104 Message = "*New-Object IO.MemoryStream*"
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
search: '`powershell` EventCode=4104 Message = "*New-Object IO.MemoryStream*" | stats
count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName
User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `powershell_using_memory_as_backing_store_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the powershell logs from your endpoints. make sure you enable needed