admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

updates

Browse Source
This commit is contained in:
P4T12ICK
2020-10-08 14:10:37 +02:00
parent f81abbc79d
commit 6d820ded74
1 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/attempted_credential_dump_from_registry_via_reg_exe.yml
+7 -6
View File
@@ -11,12 +11,13 @@ how_to_implement: You must be ingesting endpoint data that tracks process activi
type: ESCU
references: []
author: Patrick Bareiss, Splunk
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=reg.exe
OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security*
OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System*)
by Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter` '
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
from datamodel=Endpoint.Processes where (Processes.process_name=reg.exe OR Processes.process_name=cmd.exe)
Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM*
OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System*
OR Processes.process=*HKLM\\SAM*) by Processes.user Processes.process_name Processes.process Processes.dest
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
| `attempted_credential_dump_from_registry_via_reg_exe_filter`'
known_false_positives: None identified.
tags:
analytics_story: