admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed missing paren, sourcetype

Browse Source
This commit is contained in:
Lou Stella
2022-07-19 09:05:19 -05:00
parent f52137cb8f
commit 2ca7679c84
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml
+3 -3
View File
@@ -10,11 +10,11 @@ description: The following analytic identifies usage of the MPCmdRun utility tha
search: ' from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process_name IS NOT NULL AND process_name="mpcmdrun.exe" | where process_path IS NOT NULL AND match_regex(process_path, /(?i)\\microsoft\\windows defender\\platform/)=false AND match_regex(process_path, /(?i)\\windows defender/)=false | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id",
event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events(); '
event_id, "process_path", process_path, "process_name", process_name, "cmd_line", cmd_line]) | into write_ssa_detected_events(); '
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
known_false_positives: False positives may be present and filtering may be required.
references:
tests/endpoint/ssa___windows_defender_tools_in_non_standard_path.test.yml
+1 -1
View File
@@ -8,6 +8,6 @@ tests:
attack_data:
- file_name: UPDATE
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/mpcmdrun/windows-security.log
source: XmlWinEventLog:Security
source: XmlWinEventLog
sourcetype: XmlWinEventLog
update_timestamp: true