admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update ssa___wbadmin_delete_system_backups.yml

Browse Source
This commit is contained in:
mhaag-spl
2022-03-18 11:57:27 -06:00
parent 45575026c2
commit 437f25d4e9
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml
Vendored
+5 -5
View File
@@ -10,8 +10,8 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
(cmd_line IS NOT NULL AND process_name IS NOT NULL) | where (process_name="wbadmin.exe")
| where like (cmd_line, "%delete%") OR like (cmd_line, "%catalog%") OR like (cmd_line, "%systemstatebackup%"))
(cmd_line IS NOT NULL AND process_name IS NOT NULL) | where process_name="wbadmin.exe"
| where like (cmd_line, "%delete%") OR like (cmd_line, "%catalog%") OR like (cmd_line, "%systemstatebackup%")
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
@@ -58,6 +58,6 @@ test:
file: endpoint/ssa___wbadmin_delete_system_backups.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: windows-sysmon.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
- file_name: windows-security_bcdedit_wbadmin.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-security_bcdedit_wbadmin.log
source: WinEventLog:Security