admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-02-07 12:49:39 -08:00
committed by GitHub
parent 39ac22aac4 5dbd79c43a
commit 245a5d83af
2 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dist/ssa/srs/ssa___detect_dump_lsass_memory_using_comsvcs.yml
Vendored
+5 -4
View File
@@ -24,10 +24,11 @@ search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_eve
"string", null), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where process_name LIKE "%rundll32.exe%" AND match_regex(process,
/(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time =
timestamp, entities = mvappend(machine), body=create_map(["event_id", event_id,
"process_name", process_name, "process", process]) | into write_ssa_detected_events();'
"event_id"), "string", null) | where process IS NOT NULL AND process_name IS NOT
NULL AND process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true
| eval start_time = timestamp, end_time = timestamp, entities = mvappend(machine),
body=create_map(["event_id", event_id, "process_name", process_name, "process",
process]) | into write_ssa_detected_events();'
tags:
analytic_story:
- Credential Dumping
dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml
Vendored
+2 -2
View File
@@ -27,9 +27,9 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="wbadmin.exe"
(cmd_line IS NOT NULL AND process_name IS NOT NULL) AND (process_name="wbadmin.exe"
AND like (cmd_line, "%delete%") OR like (cmd_line, "%catalog%") OR like (cmd_line,
"%systemstatebackup%") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"%systemstatebackup%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])