From 4687636a53ec77d713d795d0823c612989beaa0c Mon Sep 17 00:00:00 2001 From: Rico Valdez Date: Fri, 26 Jul 2019 14:01:27 -0600 Subject: [PATCH] fixes for 2 broken searches - CRL-1586 & 1587 --- detections/sc_manipulating_services.json | 2 +- detections/wmi_process_launch.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/sc_manipulating_services.json b/detections/sc_manipulating_services.json index 3e8f8d54b5..7bf84b435a 100644 --- a/detections/sc_manipulating_services.json +++ b/detections/sc_manipulating_services.json @@ -84,7 +84,7 @@ "earliest_time": "-70m@m", "latest_time": "-10m@m" }, - "search": "| tstats `summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = sc.exe Processes.process=\"* create *\" Processes.process=\"* config *\" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `ctime(firstTime)` | `ctime(lastTime)`", + "search": "| tstats `summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = sc.exe (Processes.process=\"* create *\" OR Processes.process=\"* config *\") by Processes.process_name Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `ctime(firstTime)` | `ctime(lastTime)`", "search_description": "This search looks for arguments to sc.exe indicating the creation or modification of a Windows service.", "search_id": "f0c693d8-2a89-4ce7-80b4-98fea4c3ea6d", "search_name": "Sc.exe Manipulating Windows Services", diff --git a/detections/wmi_process_launch.json b/detections/wmi_process_launch.json index 47145fcfc2..7de087e7a9 100644 --- a/detections/wmi_process_launch.json +++ b/detections/wmi_process_launch.json @@ -77,7 +77,7 @@ "earliest_time": "-70m@m", "latest_time": "-10m@m" }, - "search": "| tstats `summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name = \"scrcons.exe\" by Processes.user Processes.dest Processes.process_name | `drop_dm_object_name(\"Processes\")` | `ctime(firstTime)`| `ctime(lastTime)`", + "search": "| tstats `summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name = *WmiPrvSE.exe by Processes.user Processes.dest Processes.process_name | `drop_dm_object_name(\"Processes\")` | `ctime(firstTime)`| `ctime(lastTime)`", "search_description": "This search looks for processes launched via WMI.", "search_id": "24869767-8579-485d-9a4f-d9ddfd8f0cac", "search_name": "Process Execution via WMI",