From 9f71b88e6c2b980f60eb12d8d2598210b71e4e99 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 11 Aug 2021 11:24:14 -0700 Subject: [PATCH] duplicate --- detections/endpoint/revil_common_exec_parameter.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/revil_common_exec_parameter.yml b/detections/endpoint/revil_common_exec_parameter.yml index 9cf55d8066..a25e85e7e5 100644 --- a/detections/endpoint/revil_common_exec_parameter.yml +++ b/detections/endpoint/revil_common_exec_parameter.yml @@ -1,6 +1,6 @@ name: Revil Common Exec Parameter id: 85facebe-c382-11eb-9c3e-acde48001122 -version: 1 +version: 2 date: '2021-06-02' author: Teoderick Contreras, Splunk type: batch @@ -9,9 +9,9 @@ datamodel: description: This analytic identifies suspicious commandline parameter that are commonly used by REVIL ransomware to encrypts the compromise machine. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process = "*-nolan*" - OR Processes.process = "*-nolocal*" OR Processes.process = "*-fast*" OR Processes.process - = "*-full*" by Processes.process_name Processes.process Processes.parent_process_name + as lastTime from datamodel=Endpoint.Processes where Processes.process = "* -nolan *" + OR Processes.process = "* -nolocal *" OR Processes.process = "* -fast *" OR Processes.process + = "* -full *" by Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `revil_common_exec_parameter_filter`'