admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

conti_leak

Browse Source
This commit is contained in:
tccontre
2021-08-10 16:03:22 +02:00
parent 25917a36d6
commit 680db63bd5
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/powershell_execute_com_object.yml
+1 -1
View File
@@ -15,7 +15,7 @@ search: '`powershell` EventCode=4104 Message = "*CreateInstance([type]::GetTypeF
as firstTime max(_time) as lastTime by EventCode Message ComputerName User
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `execute_com_object_in_powershell_filter`'
| `powershell_execute_com_object_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the