admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

cisa_coverage

Browse Source
This commit is contained in:
tccontre
2022-11-11 15:20:55 +01:00
parent f05df4e446
commit 4bceed9746
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/office_product_spawning_windows_script_host.yml
+2
View File
@@ -18,9 +18,11 @@ how_to_implement: To successfully implement this search you need to be ingesting
known_false_positives: False positives may be present based on macro based approved documents in the organization. Filtering may be needed.
references:
- https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/
- https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing
tags:
analytic_story:
- Spearphishing Attachments
- Remcos
confidence: 90
context:
- Source:Endpoint