admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix-desc

Browse Source
This commit is contained in:
tccontre
2022-08-26 15:39:48 +02:00
parent cfaf15a916
commit 346e7000e2
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/rundll32_create_remote_thread_to_a_process.yml
+2 -2
View File
@@ -7,9 +7,9 @@ type: TTP
datamodel:
- Endpoint
description: This analytic identifies the suspicious Remote Thread execution of rundll32.exe
process to cmd.exe process. This technique was seen in IcedID malware to execute
to any process. This technique was seen in IcedID malware to execute
its malicious code in normal process for defense evasion and to steal sensitive
information the the compromised host. browser process.
information in the compromised host.
search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage = "*.exe"
| stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage
TargetProcessId SourceProcessId StartAddress EventCode Computer | `security_content_ctime(firstTime)`