From 8b653259b061565b0f8b71f6e4d60e7398c066e5 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Tue, 21 Sep 2021 11:35:19 -0400 Subject: [PATCH] Update ssa___detect_dump_lsass_memory_using_comsvcs.yml --- .../endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml index e7679a5f4f..6d0887e9a3 100644 --- a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml +++ b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml @@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_eve "event_id"), "string", null) | where process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time = timestamp, entities = mvappend(machine), body=create_map(["event_id", event_id, - "process_name", process_name]) | into write_ssa_detected_events();' + "process_name", process_name, "process", process]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting endpoint data that tracks process activity, including Windows command line logging. You can see how we test this with [Event Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a)