admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1540 from splunk/git-fix

Browse Source 
The Haag Continuum
This commit is contained in:
Bhavin Patel
2021-07-22 09:42:41 -07:00
committed by GitHub
parent 0d8da0488e 9acd9f32f7
commit 225afaa035
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/detect_renamed_psexec.yml
+1 -1
View File
@@ -12,7 +12,7 @@ description: The following analytic identifies renamed instances of `PsExec.exe`
In this instance, we are using `OriginalFileName` from Sysmon to identify `PsExec`
usage. During triage, validate this is the legitimate version of `PsExec` by review
the PE metadata. In addition, review parallel processes for further suspicious behavior.
search: '`sysmon` EventID=1 (OriginalFileName=psexec.c process_name!=psexec.exe) |
search: '`sysmon` EventID=1 (OriginalFileName=psexec.c process_name!=psexec.exe process_name!=PsExec64.exe) |
stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name,
process_name, OriginalFileName, process_path, CommandLine Product | rename Computer
as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
detections/endpoint/detect_renamed_winrar.yml
+1 -1
View File
@@ -12,7 +12,7 @@ description: The following analtyic identifies renamed instances of `WinRAR.exe`
In this instance, we are using `OriginalFileName` from Sysmon to determine if the
process is WinRAR. During triage, validate additional metadata from the binary that
this is `WinRAR`. Review parallel processes and file modifications.
search: '`sysmon` EventID=1 (Product=WinRAR OR OriginalFileName=WinRAR.exe) process_name!=rar.exe
search: '`sysmon` EventID=1 (Product=WinRAR OR OriginalFileName=WinRAR.exe) process_name!=rar.exe process_name!=winrar.exe
| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product
| rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`