From 4b3bd799cfb652abce61f0f0a4bb52258f42e3ff Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Fri, 24 Sep 2021 16:32:26 -0700 Subject: [PATCH] bhavinfix --- detections/endpoint/remcos_client_registry_install_entry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index fdb4ca0e23..655edce236 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -12,7 +12,7 @@ search: '| tstats `security_content_summariesonly` count values(Registry.registr as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\Software\\Remcos*)| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `remcos_client_registry_install_entry_filter`' how_to_implement: In order to successfully implement this search, you need to be ingesting - logs with the TargetObject registry key, registry Details from your endpoints. + logs with the TargetObject registry keys, registry Details from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: unknown references: