From 680db63bd5cdfd0a833d53df91d22e71d5faec69 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 10 Aug 2021 16:03:22 +0200 Subject: [PATCH] conti_leak --- detections/endpoint/powershell_execute_com_object.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/powershell_execute_com_object.yml b/detections/endpoint/powershell_execute_com_object.yml index 79c945e82f..bc46e9cb8f 100644 --- a/detections/endpoint/powershell_execute_com_object.yml +++ b/detections/endpoint/powershell_execute_com_object.yml @@ -15,7 +15,7 @@ search: '`powershell` EventCode=4104 Message = "*CreateInstance([type]::GetTypeF as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `execute_com_object_in_powershell_filter`' + | `powershell_execute_com_object_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the