admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Revert "Update searchprotocolhost_with_no_command_line_with_network.yml"

Browse Source 
This reverts commit 958e195593.
This commit is contained in:
mhaag-spl
2021-09-22 14:11:27 -06:00
parent 639534c61b
commit 38ee2f9319
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml
+5 -5
View File
@@ -14,14 +14,14 @@ description: The following analytic identifies searchprotocolhost.exe with no co
related to credential dumping or file writes. searchprotocolhost.exe is natively
found in C:\Windows\system32 and C:\Windows\syswow64.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_guid
Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_id
Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| regex process="(searchprotocolhost\.exe.{0,4}$)" | join process_guid [| tstats
| regex process="(searchprotocolhost\.exe.{0,4}$)" | join process_id [| tstats
`security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port
!="0" by Ports.process_guid Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)`
!="0" by Ports.process_id Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)`
| rename dest as connection_to_CNC] | table _time dest parent_process_name process_name
process_path process process_guid connection_to_CNC dest_port | `searchprotocolhost_with_no_command_line_with_network_filter`'
process_path process process_id connection_to_CNC dest_port | `searchprotocolhost_with_no_command_line_with_network_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` and `ports` node.