admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #456 from zelienka/patch-1

Browse Source 
Fixed typo in search, search optimization
This commit is contained in:
Bhavin Patel
2020-05-18 13:07:37 -07:00
committed by GitHub
parent eb6039e449 f2fcabe907
commit 2e8f9dfee5
1 changed files with 3 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/create_local_admin_via_net.yml
+3 -4
View File
@@ -35,12 +35,11 @@ detect:
latest_time: -10m@m
search: '| tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process)
as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
where (Processs.process_name=net.exe OR Processes.process_name=net1.exe) by
where (Processes.process_name=net.exe OR Processes.process_name=net1.exe) AND (Processes.process=*localgroup* OR Processes.process=*/add* OR Processes.process=*user*) by
Processes.process Processes.process_name Processes.dest | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | search (process=*localgroup* OR
process=*/add* OR process=*user*) |`create_local_admin_via_net_filter`'
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`create_local_admin_via_net_filter`'
suppress:
suppress_fields: dest
suppress_fields: dest, process_name
suppress_period: 86400s
eli5: Net.exe is a built-in Windows command-line tool that can be used to add, display,
or modify user accounts. While Microsoft administrators use this tool to manage