admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

dcrat-analytics3

Browse Source
This commit is contained in:
tccontre
2022-08-04 09:44:22 +02:00
parent ca11a32aeb
commit 7422fb3eda
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml
+5 -4
View File
@@ -18,10 +18,11 @@ search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_ingress_tool_transfer_using_explorer_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: unknown
references:
- https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor