admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update detections/endpoint/windows_rdp_file_execution.yml

Browse Source 
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
This commit is contained in:
Michael Haag
2024-11-25 15:48:05 -07:00
committed by GitHub
parent 9084ddcff4
commit 245bd2ac03
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_rdp_file_execution.yml
+1
View File
@@ -20,6 +20,7 @@ search: '| tstats count min(_time) as firstTime max(_time) as lastTime from data
match(process, "\\\\Downloads\\\\"), "downloads_execution",
match(process, "\\\\Temp\\\\"), "temp_execution",
match(process, "\\\\Microsoft\\\\Outlook\\\\"), "outlook_execution",
match(process, "\\\\Olk\\\\Attachments\\\\"), "outlook_execution",
match(process, "\\\\Content.Outlook\\\\"), "outlook_execution",
true(), "other"
),