admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2033 from splunk/pasc_fix

Browse Source 
Changed syntax for special case for java
This commit is contained in:
trogdorsey
2022-02-23 13:24:39 -06:00
committed by GitHub
parent c52900e041 e2a0daccfb
commit 267fd2d007
1 changed files with 1 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
+1 -2
View File
@@ -11,7 +11,6 @@ description: The following analytic identifies parent processes, browsers, Windo
many applications spawn cmd.exe natively or built into macros. Much of this will
need to be tuned to further enhance the risk.
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
| eval process_name=ucast(map_get(input_event, "process_name"), "string", null),
parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string",
@@ -23,7 +22,7 @@ search: '| from read_ssa_enriched_events()
OR ParentBaseFileName="powerpnt.exe" OR ParentBaseFileName="visio.exe" OR ParentBaseFileName="mspub.exe"
OR ParentBaseFileName="acrobat.exe" OR ParentBaseFileName="acrord32.exe" OR ParentBaseFileName="iexplore.exe"
OR ParentBaseFileName="opera.exe" OR ParentBaseFileName="firefox.exe" OR (ParentBaseFileName="java.exe"
AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND NOT like(cmd_line, "%patch1-Hotfix1a%"))))
AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)patch1-Hotfix1a/)=false)))
OR ParentBaseFileName="powershell.exe" OR (ParentBaseFileName="chrome.exe" AND (cmd_line
IS NULL OR (cmd_line IS NOT NULL AND NOT like(cmd_line, "%chrome-extension%"))))
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,