admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-02-02 09:54:15 -08:00
committed by GitHub
parent 1fbb68e64c 5250d280c0
commit 26713d7777
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml
Vendored
+2 -2
View File
@@ -27,8 +27,8 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND like(cmd_line, "%+h%") AND process_name="attrib.exe" |
eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
cmd_line IS NOT NULL AND match_regex(cmd_line, /\+h/)=true AND process_name="attrib.exe"
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])