admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
github-actions[bot]
2021-04-29 20:56:16 +00:00
committed by GitHub
parent c79394c5b6 0758c2da57
commit 6b741f2c84
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/office_product_spawning_bitsadmin.yml
+1 -1
View File
@@ -10,7 +10,7 @@ description: The following detection identifies the latest behavior utilized by
malware families (including TA551, IcedID). This detection identifies any Windows
Office Product spawning `bitsadmin.exe`. In malicious instances, the command-line
of `bitsadmin.exe` will contain a URL to a remote destination or similar command-line
arguments as `/transfer /Download /priority Foreground`. In addition, Threat Research
arguments as transfer, Download, priority, Foreground. In addition, Threat Research
has released a detections identifying suspicious use of `bitsadmin.exe`. In this
instance, we narrow our detection down to the Office suite as a parent process.
During triage, review all file modifications. Capture and analyze any artifacts