admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

manifest errors

Browse Source
This commit is contained in:
bpatel
2021-05-13 11:38:40 -07:00
parent fbe24284be
commit 2db1f87aff
1 changed files with 0 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml
-11
View File
@@ -6,16 +6,6 @@ author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
<<<<<<< HEAD
description: This search is to detect a potential process using COM Object like CMLUA or CMSTPLUA
to bypassed UAC. This technique used by ransomware to gain administrative privileges to its running process.
search: '`sysmon` EventCode=7 ImageLoaded IN ("*\\CMLUA.dll", "*\\CMSTPLUA.dll", "*\\CMLUAUTIL.dll") NOT(process_name IN("CMSTP.exe", "CMMGR32.exe"))
NOT(Image IN("*\\windows\\*", "*\\program files\\*"))
| stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `cmlua_or_cmstplua_uac_bypass_filter`'
=======
description: This search is to detect a potential process using COM Object like CMLUA
or CMSTPLUA to bypassed UAC. This technique used by ransomware to gain administrative
privileges to its running process.
@@ -24,7 +14,6 @@ search: '`sysmon` EventCode=7 ImageLoaded IN ("*\\CMLUA.dll",
| stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded
process_name Computer EventCode Signed ProcessId | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `cmlua_or_cmstplua_uac_bypass_filter`'
>>>>>>> 82f9a5f69d687907e6c5b04ca10fcf2458fdf578
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name and imageloaded executions from your endpoints. If you
are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.