admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update detect_copy_of_shadowcopy_with_script_block_logging.yml

Browse Source
This commit is contained in:
mhaag-spl
2021-07-21 15:46:49 -06:00
parent e9e56493f8
commit 28af2af96c
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
+2 -1
View File
@@ -9,7 +9,8 @@ datamodel:
description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
to identify suspicious PowerShell execution. Script Block Logging captures the command
sent to PowerShell, the full command to be executed. Upon enabling, logs will output
to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
to Windows event logs. Dependent upon volume, enable no critical endpoints or all.
\
This analytic identifies `copy` or `[System.IO.File]::Copy` being used to capture the SAM, SYSTEM or SECURITY hives identified in
script block. This will catch the most basic use cases for credentials being taken for offline cracking. \