admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

bhavinfix

Browse Source
This commit is contained in:
Rod Soto
2021-09-24 16:32:26 -07:00
parent cf184487ce
commit 4b3bd799cf
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/remcos_client_registry_install_entry.yml
+1 -1
View File
@@ -12,7 +12,7 @@ search: '| tstats `security_content_summariesonly` count values(Registry.registr
as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\Software\\Remcos*)|
`security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `remcos_client_registry_install_entry_filter`'
how_to_implement: In order to successfully implement this search, you need to be ingesting
logs with the TargetObject registry key, registry Details from your endpoints.
logs with the TargetObject registry keys, registry Details from your endpoints.
If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: unknown
references: