admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
Bhavin Patel
2021-09-08 12:06:02 -07:00
committed by GitHub
parent a09f3d20cd 720fb93a70
commit 511e2915a2
1 changed files with 8 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/create_local_admin_accounts_using_net_exe.yml
+8 -7
View File
@@ -1,7 +1,7 @@
name: Create local admin accounts using net exe
id: b89919ed-fe5f-492c-b139-151bb162040e
version: 5
date: '2021-08-29'
version: 6
date: '2021-09-08'
author: Bhavin Patel, Splunk
type: TTP
datamodel:
@@ -9,11 +9,12 @@ datamodel:
description: This search looks for the creation of local administrator accounts using
net.exe .
search: '| tstats `security_content_summariesonly` count values(Processes.user) as
user values(Processes.parent_process) as parent_process min(_time) as firstTime
max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe
OR Processes.process_name=net1.exe) AND (Processes.process=*localgroup* OR Processes.process=*user*) AND Processes.process=*/add* by Processes.process Processes.process_name Processes.dest
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
|`create_local_admin_accounts_using_net_exe_filter` '
user values(Processes.parent_process) as parent_process min(_time) as firstTime
max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe OR Processes.process_name=net1.exe) AND Processes.process=*/add* AND (Processes.process=*administrators* OR Processes.process=*administratoren* OR Processes.process=*administrateurs* OR Processes.process=*administrador* OR Processes.process=*amministratori* OR Processes.process=*administratorer*) by Processes.process Processes.process_name Processes.dest
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `create_local_admin_accounts_using_net_exe_filter`'
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.