admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

rookie mistake

Browse Source
This commit is contained in:
mhaag-spl
2022-03-15 12:30:39 -06:00
parent ecd464907e
commit 3cb81550db
4 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml
+1 -1
View File
@@ -13,7 +13,7 @@ description: The following analytic identifies DLLHost.exe with no command line
parallel processes. Identify any suspicious module loads related to credential dumping
or file writes. DLLHost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name=dllhost.exe by _time span=1h Processes.process_guid
where Processes.process_name=dllhost.exe by _time span=1h Processes.process_id
Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| regex process="(?i)(dllhost\.exe.{0,4}$)" | join process_id [| tstats `security_content_summariesonly`
detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml
+1 -1
View File
@@ -14,7 +14,7 @@ description: The following analytic identifies gpupdate.exe with no command line
dumping or file writes. gpupdate.exe is natively found in C:\Windows\system32 and
C:\Windows\syswow64.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name=gpupdate.exe by _time span=1h Processes.process_guid
where Processes.process_name=gpupdate.exe by _time span=1h Processes.process_id
Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| regex process="(?i)(gpupdate\.exe.{0,4}$)"| join process_id [| tstats `security_content_summariesonly`
detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml
+1 -1
View File
@@ -14,7 +14,7 @@ description: The following analytic identifies rundll32.exe with no command line
dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and
C:\Windows\syswow64.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where `process_rundll32` by _time span=1h Processes.process_guid Processes.process_name
where `process_rundll32` by _time span=1h Processes.process_id Processes.process_name
Processes.dest Processes.process_path Processes.process Processes.parent_process_name
Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | regex process="(?i)(rundll32\.exe.{0,4}$)"
detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml
+1 -1
View File
@@ -14,7 +14,7 @@ description: The following analytic identifies searchprotocolhost.exe with no co
related to credential dumping or file writes. searchprotocolhost.exe is natively
found in C:\Windows\system32 and C:\Windows\syswow64.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_guid
where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_id
Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| regex process="(?i)(searchprotocolhost\.exe.{0,4}$)" | join process_id [| tstats `security_content_summariesonly`