admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

removing space

Browse Source
This commit is contained in:
mvelazco
2022-03-10 14:30:20 -05:00
parent 5c6fbad1c2
commit 47cc440d9a
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/unknown_process_using_the_kerberos_protocol.yml
+1 -1
View File
@@ -10,7 +10,7 @@ datamodel:
description: The following analytic identifies a process performing an outbound connection on port 88 used by default by the network authentication protocol
Kerberos. Typically, on a regular Windows endpoint, only the lsass.exe process is the one tasked with connecting to the Kerberos Distribution Center
to obtain Kerberos tickets. Identifying an unknown process using this protocol may be evidence of an adversary abusing the Kerberos protocol.
search: ' | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name!=lsass.exe by _time Processes.process_id
Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`