admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update windows_raw_access_to_master_boot_record_drive.yml

Browse Source
This commit is contained in:
tccontre
2022-02-25 15:23:46 +01:00
committed by GitHub
parent 393d25ad6a
commit 3255b012ef
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml
+1 -1
View File
@@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
description: This analytic is to look for suspicious raw access read to drive where master boot record is place.
description: This analytic is to look for suspicious raw access read to drive where the master boot record is placed.
This technique was seen in several attacks by adversaries or threat actor to wipe, encrypt or overwrite the master boot record code
as part of their impact payload. This detection is a good indicator that there is a process try to read or write on MBR sector.
search: '`sysmon` EventCode=9 Device = \\Device\\Harddisk0\\DR0 NOT (Image IN("*\\Windows\\System32\\*", "*\\Windows\\SysWOW64\\*"))