admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
Bhavin Patel
2021-09-21 11:29:24 -07:00
committed by GitHub
parent e2c3932b2c 29a196f51c
commit 3e062b628b
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
+1 -1
View File
@@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_eve
"event_id"), "string", null) | where process_name LIKE "%rundll32.exe%" AND match_regex(process,
/(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time =
timestamp, entities = mvappend(machine), body=create_map(["event_id", event_id,
"process_name", process_name]) | into write_ssa_detected_events();'
"process_name", process_name, "process", process]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting endpoint data that tracks process activity,
including Windows command line logging. You can see how we test this with [Event
Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a)