admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inMalicious PowerShell Process - Encoded Command

Browse Source
This commit is contained in:
root
2020-11-04 13:58:12 +00:00
parent 4f5bcacd5a
commit 6859627fdc
1 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/malicious_powershell_process___encoded_command.yml
+7 -4
View File
@@ -15,10 +15,10 @@ references: []
author: David Dorsey, Splunk
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name = powershell.exe
(Processes.process=*-EncodedCommand* OR Processes.process=*-enc*)
by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.dest Processes.process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
| `malicious_powershell_process___encoded_command_filter`'
(Processes.process=*-EncodedCommand* OR Processes.process=*-enc*) by Processes.user
Processes.process_name Processes.process Processes.parent_process_name Processes.dest
Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)` | `malicious_powershell_process___encoded_command_filter`'
known_false_positives: System administrators may use this option, but it's not common.
tags:
analytics_story:
@@ -38,3 +38,6 @@ tags:
- PR.IP
security_domain: endpoint
asset_type: Endpoint
automated_detection_testing: passed
dataset:
- https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1027/windows-sysmon.log