admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
Bhavin Patel
2021-11-05 10:07:46 -07:00
committed by GitHub
parent 8d374db598 45ed7cf564
commit 61a921d193
2 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml
+3 -3
View File
@@ -11,9 +11,9 @@ description: This detection identifies potential Pass the Token or Pass the Hash
by a detination device.
search: '| from read_ssa_enriched_events() | eval timestamp= parse_long(ucast(map_get(input_event,
"_time"), "string", null)), dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"),
"string", null)), dest_user_id= lower(ucast(map_get(input_event, "dest_user_id"),
"string", null)), dest_device_id= lower(ucast(map_get(input_event, "dest_device_id"),
"string", null)), signature_id= lower(ucast(map_get(input_event, "signature_id"),
"string", null)), dest_user_id= ucast(map_get(input_event, "dest_user_id"),
"string", null), dest_device_id= ucast(map_get(input_event, "dest_device_id"),
"string", null), signature_id= lower(ucast(map_get(input_event, "signature_id"),
"string", null)), authentication_method= lower(ucast(map_get(input_event, "authentication_method"),
"string", null))
detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml
+3 -3
View File
@@ -12,9 +12,9 @@ description: This detection identifies potential Pass the Token or Pass the Hash
destination).
search: '| from read_ssa_enriched_events() | eval timestamp= parse_long(ucast(map_get(input_event,
"_time"), "string", null)), dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"),
"string", null)), dest_user_id= lower(ucast(map_get(input_event, "dest_user_id"),
"string", null)), origin_device_id= lower(ucast(map_get(input_event, "origin_device_id"),
"string", null)), signature_id= lower(ucast(map_get(input_event, "signature_id"),
"string", null)), dest_user_id= ucast(map_get(input_event, "dest_user_id"),
"string", null), origin_device_id= ucast(map_get(input_event, "origin_device_id"),
"string", null), signature_id= lower(ucast(map_get(input_event, "signature_id"),
"string", null)), authentication_method= lower(ucast(map_get(input_event, "authentication_method"),
"string", null))