admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

updating sutffff

Browse Source
This commit is contained in:
Bhavin Patel
2023-09-27 15:51:03 -07:00
parent 0bde5c7afe
commit 631ecd4122
2 changed files with 13 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_shared_module_executable_in_loaded_modules.yml → detections/endpoint/windows_executable_in_loaded_modules.yml
+3 -3
View File
@@ -1,4 +1,4 @@
name: Windows Shared Module Executable in loaded Modules
name: Windows Executable in Loaded Modules
id: 3e27af56-fcf0-4113-988d-24969b062be7
version: 1
date: '2023-09-12'
@@ -18,7 +18,7 @@ search: '`sysmon` EventCode=7 ImageLoaded= *.exe
| rename Computer as dest
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_shared_module_executable_in_loaded_modules_filter`'
| `windows_executable_in_loaded_modules_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints.
If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: unknown.
@@ -30,7 +30,7 @@ tags:
asset_type: Endpoint
confidence: 80
impact: 80
message: an executable as Imageloaded by $Image$ in $dest$
message: An executable $Imageloaded$ loaded by $Image$ on $dest$
mitre_attack_id:
- T1129
observable:
detections/endpoint/windows_time_based_evasion.yml
+10 -5
View File
@@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_time_based_evasion_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
how_to_implement: The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
you must ingest logs that contain the process GUID, process name, and parent process.
Additionally, you must ingest complete command-line executions. These logs must
be processed using the appropriate Splunk Technology Add-ons that are specific to
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
data model. Use the Splunk Common Information Model (CIM) to normalize the field
names and speed up the data modeling process.
known_false_positives: unknown
references:
- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat
@@ -31,7 +36,7 @@ tags:
asset_type: Endpoint
confidence: 60
impact: 60
message: a $process_name$ did a suspicious ping to invalid ip address in $dest$
message: A $process_name$ did a suspicious ping to invalid IP address on $dest$
mitre_attack_id:
- T1497
- T1497.003