admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update windows_phishing_recent_iso_exec_registry.yml

Browse Source
This commit is contained in:
tccontre
2022-09-05 10:56:24 +02:00
committed by GitHub
parent 2dc78584a0
commit 385bc45c5d
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_phishing_recent_iso_exec_registry.yml
+1 -1
View File
@@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk
type: Hunting
datamodel:
- Endpoint
description: The following hunting analytic identifies registry artifacts when a ISO container is opened, clicked or mounted on the Windows operating system.
description: The following hunting analytic identifies registry artifacts when an ISO container is opened, clicked or mounted on the Windows operating system.
As Microsoft makes changes to macro based document execution, adversaries have begun to utilize container based initial access based phishing campaigns to evade preventative controls.
Once the ISO is clicked or mounted it will create a registry artifact related to this event as a recent application executed or opened.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry