admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update windows_scheduled_task_with_suspicious_command.yml

Browse Source 
Task_Name to TaskName swap
This commit is contained in:
Steven Dick
2025-02-19 16:55:30 -05:00
committed by GitHub
parent 8a3308895b
commit 569d453b49
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_scheduled_task_with_suspicious_command.yml
+3 -3
View File
@@ -14,10 +14,10 @@ search: |-
`wineventlog_security` EventCode IN (4698,4700,4702)
| eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent)
| xmlkv TaskContent
| stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, Caller_User_Name, Task_Name, Command, Enabled, Hidden, EventCode
| stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, Caller_User_Name, TaskName, Command, Enabled, Hidden, EventCode
| lookup windows_suspicious_tasks task_command as Command
| where tool == "shell command use" OR tool == "suspicious paths"
| eval command=Task_Name, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer, signature_id = EventCode
| eval command=TaskName, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer, signature_id = EventCode
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_scheduled_task_with_suspicious_command_filter`
@@ -42,7 +42,7 @@ drilldown_searches:
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: A suspicious windows scheduled task named [$Task_Name$] was detected on $dest$, this may be an indicator of [$tool$]
message: A suspicious windows scheduled task named [$TaskName$] was detected on $dest$, this may be an indicator of [$tool$]
risk_objects:
- field: dest
type: system