admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1685 from splunk/ssa_lolbas_spike

Browse Source 
Adding some basic body info for unusual lolbas count
This commit is contained in:
peter
2021-09-24 16:53:58 -05:00
committed by GitHub
parent ff890647b5 3512cb812c
commit 2944cbb6fa
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml
+1 -1
View File
@@ -41,7 +41,7 @@ search: ' | from read_ssa_enriched_events() | eval device=ucast(map_get(input_ev
as timestamp | adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device"
window=2419200000L | where label AND quantile>0.99 | eval start_time = window_start,
end_time = timestamp, entities = mvappend(device), body=create_map(["lolbas_counter",
lolbas_counter]) | into write_null();'
lolbas_counter, "quantile", quantile, "device", device]) | into write_ssa_detected_events();'
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
known_false_positives: 'Some administrative tasks may involve multiple use of LOLBAS
applications in a short period of time. This might trigger false positives at the