From 2e2f4546df5362e2297144f0067ec296dbaddedc Mon Sep 17 00:00:00 2001 From: root Date: Thu, 16 Sep 2021 16:18:21 +0000 Subject: [PATCH] Added detection testing service results inBatch File Write to System32 --- detections/endpoint/batch_file_write_to_system32.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/batch_file_write_to_system32.yml b/detections/endpoint/batch_file_write_to_system32.yml index 327b38cb90..d40ff09989 100644 --- a/detections/endpoint/batch_file_write_to_system32.yml +++ b/detections/endpoint/batch_file_write_to_system32.yml @@ -13,11 +13,11 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\system32\\*", - "*\\syswow64\\*") Filesystem.file_name="*.bat" - by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name - Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time - file_name file_path process_name process_path process] | dedup file_create_time - | table dest file_create_time, file_name, file_path, process_name | `batch_file_write_to_system32_filter`' + "*\\syswow64\\*") Filesystem.file_name="*.bat" by _time span=1h Filesystem.dest + Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` + | fields _time dest file_create_time file_name file_path process_name process_path + process] | dedup file_create_time | table dest file_create_time, file_name, file_path, + process_name | `batch_file_write_to_system32_filter`' how_to_implement: You must be ingesting data that records the file-system activity from your hosts to populate the Endpoint file-system data-model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which