Branch was auto-updated.

detections/endpoint/linux_ssh_remote_services_script_execute.yml

@@ -1,14 +1,14 @@
 name: Linux SSH Remote Services Script Execute
 id: aa1748dd-4a5c-457a-9cf6-ca7b4eb711b3
 version: 1
-date: '2022-07-27'
+date: '2023-03-03'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
 description: The following analytic identifies SSH being utilized to move laterally and execute a script or file on the remote host.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where  Processes.process_name=ssh Processes.process IN ("*oStrictHostKeyChecking*", "*oConnectTimeout*", "*oBatchMode*") AND CommandLine IN ("*http:*","*https:*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  as lastTime from datamodel=Endpoint.Processes where  Processes.process_name=ssh Processes.process IN ("*oStrictHostKeyChecking*", "*oConnectTimeout*", "*oBatchMode*") AND Processes.process IN ("*http:*","*https:*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` 
   | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`

requirements.txt

@@ -12,7 +12,7 @@ PyYAML==5.4.1
 questionary==1.10.0
 requests==2.28.2
 six==1.16.0
-splunk-appinspect==2.32.0
+splunk-appinspect==2.33.0
 splunk-sdk==1.7.3
 wrapt-timeout-decorator==1.3.12.2
 xmltodict==0.13.0