admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updated per customer feedback

Browse Source
This commit is contained in:
Lou Stella
2022-06-22 09:17:14 -05:00
parent 07a13ca16b
commit 52fa6467a9
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: Windows LOLBin Binary in Non Standard Path
id: 25689101-012a-324a-94d3-08301e6c065a
version: 1
date: '2022-03-18'
version: 2
date: '2022-06-22'
author: Michael Haag, Splunk
type: Anomaly
datamodel:
@@ -29,7 +29,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false AND
match_regex(process_path, /(?i)\\windows\\adws/)=false AND match_regex(process_path, /(?i)\\windows\\networkcontroller/)=false
AND match_regex(process_path, /(?i)\\windows\\systemapps/)=false AND match_regex(process_path, /(?i)\\winsxs/)=false
AND match_regex(process_path, /(?i)\\microsoft.net/)=false | eval start_time=timestamp,
AND match_regex(process_path, /(?i)\\microsoft.net/)=false AND match_regex(process_path, /(?i)\\microsoft\\windows defender\\platform/)=false | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id",
event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();'
how_to_implement: Collect endpoint data such as sysmon or 4688 events.