From 6d820ded74d5ae6b6d53fddd28fa3cdefb32922c Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Thu, 8 Oct 2020 14:10:37 +0200 Subject: [PATCH] updates --- ...ed_credential_dump_from_registry_via_reg_exe.yml | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/detections/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/attempted_credential_dump_from_registry_via_reg_exe.yml index 100ae8d21c..d933a94bea 100644 --- a/detections/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -11,12 +11,13 @@ how_to_implement: You must be ingesting endpoint data that tracks process activi type: ESCU references: [] author: Patrick Bareiss, Splunk -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=reg.exe - OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* - OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System*) - by Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter` ' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime + from datamodel=Endpoint.Processes where (Processes.process_name=reg.exe OR Processes.process_name=cmd.exe) + Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* + OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* + OR Processes.process=*HKLM\\SAM*) by Processes.user Processes.process_name Processes.process Processes.dest + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `attempted_credential_dump_from_registry_via_reg_exe_filter`' known_false_positives: None identified. tags: analytics_story: