admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update extraction_of_registry_hives.yml

Browse Source 
Forgot quotes and added more slashes.
Fixes for #1634
This commit is contained in:
mhaag-spl
2021-09-09 11:47:24 -06:00
parent ff6a61c8b5
commit 431171ec24
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/extraction_of_registry_hives.yml
+4 -4
View File
@@ -1,7 +1,7 @@
name: Extraction of Registry Hives
id: 8bbb7d58-b360-11eb-ba21-acde48001122
version: 1
date: '2021-05-12'
version: 2
date: '2021-09-09'
author: Michael Haag, Splunk
type: TTP
datamodel:
@@ -12,8 +12,8 @@ description: The following analytic identifies the use of `reg.exe` exporting Wi
a untrusted process or script. Upon execution, a file will be written to disk.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=reg.exe
(Processes.process=*save* OR Processes.process=*export*) AND (Processes.process=*\sam *
OR Processes.process=*system* OR Processes.process=*security*) by Processes.dest
(Processes.process=*save* OR Processes.process=*export*) AND (Processes.process="*\sam *"
OR Processes.process="*\system *" OR Processes.process="*\security *") by Processes.dest
Processes.user Processes.parent_process Processes.process_name Processes.process
Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `extraction_of_registry_hives_filter`'