admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

minor update to include DM closes issue #1357

Browse Source
This commit is contained in:
divious1
2021-05-06 12:58:40 -04:00
parent 82dea3c467
commit 375a824d40
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/registry_keys_used_for_persistence.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 5
date: '2020-11-27'
author: David Dorsey, Splunk
type: batch
datamodel: []
datamodel:
- Endpoint
description: The search looks for modifications to registry keys that can be used
to launch an application or service at system startup.
search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)