From f18c6e587f652051bb98d85ee0048591064d82cf Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 3 Mar 2022 15:03:56 -0700 Subject: [PATCH] fix --- detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml | 2 +- detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml b/detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml index 126120fd65..4c5b3c4244 100644 --- a/detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml +++ b/detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml @@ -5,7 +5,7 @@ date: '2022-03-03' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint_Processes description: This analytic is to detect a suspicious child process of MSBuild spawned by Windows Script Host - cscript or wscript. This behavior or event are commonly seen and used by malware or adversaries to execute malicious msbuild process using diff --git a/detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml b/detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml index 86cc54f482..e7149574e8 100644 --- a/detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml +++ b/detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml @@ -5,7 +5,7 @@ date: '2022-03-03' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint_Processes description: The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavior is indicative of a COM object being utilized to spawn msbuild from wmiprvse.exe. It is common for MSBuild.exe to be spawned from devenv.exe while using