admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add output fields, tighten up outputs

Browse Source
This commit is contained in:
ljstella
2025-04-10 11:05:36 -05:00
parent 31deacc6bd
commit 8020e90e6d
1 changed files with 3 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_runmru_command_execution.yml
+3 -7
View File
@@ -16,13 +16,7 @@ description: The following analytic detects modifications to the Windows RunMRU
If confirmed malicious, this could indicate an attacker using indirect command execution
techniques for defense evasion or persistence. The detection excludes MRUList value
changes to focus on actual command entries.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where Registry.registry_key_name="*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU*"
NOT Registry.registry_key_name="*\\MRUList" by Registry.action Registry.dest Registry.process_guid
Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name
Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type
Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_runmru_command_execution_filter`'
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU*" NOT Registry.registry_value_name="MRUList" NOT Registry.registry_value_data="unknown" by Registry.dest Registry.registry_value_data Registry.action Registry.process_guid Registry.process_id Registry.registry_key_name Registry.user Registry.registry_hive Registry.registry_value_name Registry.status Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_runmru_command_execution_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
@@ -81,6 +75,8 @@ tags:
- Splunk Cloud
security_domain: endpoint
cve: []
atomic_guid:
- de323a93-2f18-4bd5-ba60-d6fca6aeff76
tests:
- name: True Positive Test
attack_data: