admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

fixing lyonell

Browse Source
This commit is contained in:
d1vious
2022-03-24 10:38:53 -04:00
parent 5dbd79c43a
commit 543b04d9db
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___system_process_running_from_unexpected_location.yml
+4 -4
View File
@@ -1,8 +1,8 @@
name: System Process Running from Unexpected Location
id: 28179107-099a-464a-94d3-08301e6c055f
version: 3
date: '2020-08-25'
author: Ignacio Bermudez Corrales, Splunk
version: 4
date: '2022-03-24'
author: Jose Hernadnez, Ignacio Bermudez Corrales, Splunk
type: Anomaly
datamodel:
- Endpoint_Processes
@@ -69,7 +69,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
OR process_name="rdpsauachelper.exe" OR process_name="reagentc.exe" OR process_name="recoverydrive.exe"
OR process_name="register-cimprovider.exe" OR process_name="registeriepkeys.exe"
OR process_name="relpost.exe" OR process_name="remoteposworker.exe" OR process_name="rmclient.exe"
OR process_name="robocopy.exe" OR process_name="rpcping.exe" OR process_name="runlegacycplelevated.exe"
OR process_name="rpcping.exe" OR process_name="runlegacycplelevated.exe"
OR process_name="runtimebroker.exe" OR process_name="sihclient.exe" OR process_name="searchfilterhost.exe"
OR process_name="searchindexer.exe" OR process_name="searchprotocolhost.exe" OR
process_name="secedit.exe" OR process_name="sensordataservice.exe" OR process_name="setieinstalleddate.exe"