admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #173 from splunk/endpoint_bugfix

Browse Source 
fixes for 2 broken searches - CRL-1586 & 1587
This commit is contained in:
Bhavin Patel
2019-07-26 13:06:12 -07:00
committed by GitHub
parent fab3eea2b4 4687636a53
commit 2e4418bbfe
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/sc_manipulating_services.json
+1 -1
View File
@@ -84,7 +84,7 @@
"earliest_time": "-70m@m",
"latest_time": "-10m@m"
},
"search": "| tstats `summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = sc.exe Processes.process=\"* create *\" Processes.process=\"* config *\" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `ctime(firstTime)` | `ctime(lastTime)`",
"search": "| tstats `summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = sc.exe (Processes.process=\"* create *\" OR Processes.process=\"* config *\") by Processes.process_name Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `ctime(firstTime)` | `ctime(lastTime)`",
"search_description": "This search looks for arguments to sc.exe indicating the creation or modification of a Windows service.",
"search_id": "f0c693d8-2a89-4ce7-80b4-98fea4c3ea6d",
"search_name": "Sc.exe Manipulating Windows Services",
detections/wmi_process_launch.json
+1 -1
View File
@@ -77,7 +77,7 @@
"earliest_time": "-70m@m",
"latest_time": "-10m@m"
},
"search": "| tstats `summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name = \"scrcons.exe\" by Processes.user Processes.dest Processes.process_name | `drop_dm_object_name(\"Processes\")` | `ctime(firstTime)`| `ctime(lastTime)`",
"search": "| tstats `summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name = *WmiPrvSE.exe by Processes.user Processes.dest Processes.process_name | `drop_dm_object_name(\"Processes\")` | `ctime(firstTime)`| `ctime(lastTime)`",
"search_description": "This search looks for processes launched via WMI.",
"search_id": "24869767-8579-485d-9a4f-d9ddfd8f0cac",
"search_name": "Process Execution via WMI",