From 6bf8b82877eb2bcbb3812f671dc6272d4ef8a355 Mon Sep 17 00:00:00 2001 From: divious1 Date: Fri, 19 Mar 2021 14:08:26 -0400 Subject: [PATCH] added write to null --- .../endpoint/ssa___rare_parent_process_relationship_lolbas.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml index 1fa1d784df..2168b8e1ef 100644 --- a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml +++ b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml @@ -47,7 +47,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map OR process_name="pcalua.exe" OR process_name="cmdkey.exe" OR process_name="msconfig.exe") | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, - dest_user_id), body = "TBD"' + dest_user_id), body = "TBD" | into write_null();' how_to_implement: Collect endpoint data such as sysmon or 4688 events. known_false_positives: 'Some custom tools used by admins could be used rarely to launch remotely applications. This might trigger false positives at the beginning when