admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1648 from splunk/issue_1519

Browse Source 
fixed and tested
This commit is contained in:
pyth0n1c
2021-09-08 12:05:37 -07:00
committed by GitHub
parent 8e303e410c 3ab0a902c6
commit 720fb93a70
1 changed files with 8 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/create_local_admin_accounts_using_net_exe.yml
+8 -7
View File
@@ -1,7 +1,7 @@
name: Create local admin accounts using net exe
id: b89919ed-fe5f-492c-b139-151bb162040e
version: 5
date: '2021-08-29'
version: 6
date: '2021-09-08'
author: Bhavin Patel, Splunk
type: TTP
datamodel:
@@ -9,11 +9,12 @@ datamodel:
description: This search looks for the creation of local administrator accounts using
net.exe .
search: '| tstats `security_content_summariesonly` count values(Processes.user) as
user values(Processes.parent_process) as parent_process min(_time) as firstTime
max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe
OR Processes.process_name=net1.exe) AND (Processes.process=*localgroup* OR Processes.process=*user*) AND Processes.process=*/add* by Processes.process Processes.process_name Processes.dest
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
|`create_local_admin_accounts_using_net_exe_filter` '
user values(Processes.parent_process) as parent_process min(_time) as firstTime
max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe OR Processes.process_name=net1.exe) AND Processes.process=*/add* AND (Processes.process=*administrators* OR Processes.process=*administratoren* OR Processes.process=*administrateurs* OR Processes.process=*administrador* OR Processes.process=*amministratori* OR Processes.process=*administratorer*) by Processes.process Processes.process_name Processes.dest
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `create_local_admin_accounts_using_net_exe_filter`'
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.