From 437f25d4e997faf8043a897517a82becaf957feb Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 18 Mar 2022 11:57:27 -0600 Subject: [PATCH] Update ssa___wbadmin_delete_system_backups.yml --- dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml index 6d11556498..12916987b5 100644 --- a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml +++ b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml @@ -10,8 +10,8 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where - (cmd_line IS NOT NULL AND process_name IS NOT NULL) | where (process_name="wbadmin.exe") - | where like (cmd_line, "%delete%") OR like (cmd_line, "%catalog%") OR like (cmd_line, "%systemstatebackup%")) + (cmd_line IS NOT NULL AND process_name IS NOT NULL) | where process_name="wbadmin.exe" + | where like (cmd_line, "%delete%") OR like (cmd_line, "%catalog%") OR like (cmd_line, "%systemstatebackup%") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", @@ -58,6 +58,6 @@ test: file: endpoint/ssa___wbadmin_delete_system_backups.yml pass_condition: '@count_gt(0)' attack_data: - - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + - file_name: windows-security_bcdedit_wbadmin.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-security_bcdedit_wbadmin.log + source: WinEventLog:Security