admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update ssa___windows_script_host_spawn_msbuild.yml

Browse Source
This commit is contained in:
mhaag-spl
2022-03-03 13:24:35 -07:00
parent fbb5c6ab70
commit 545c3dabc5
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml
+1 -1
View File
@@ -18,7 +18,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name IS NOT NULL | where parent_process_name="wscript.exe" OR parent_process_name="cscript.exe" AND process_name="msbuild.exe"
cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name IS NOT NULL | where (parent_process_name LIKE "%wscript.exe" OR parent_process_name LIKE "%cscript.exe%") AND process_name="msbuild.exe"
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",