admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix for TR-763

Browse Source
This commit is contained in:
David Dorsey
2021-06-21 13:21:30 -05:00
parent 68ee41c11e
commit 812cc46e65
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___system_process_running_unexpected_location.yml
+1 -1
View File
@@ -224,7 +224,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
OR process_name="xcopy.exe" OR process_name="xpsrchvw.exe" OR process_name="xwizard.exe";
| from $cond_1 | union $cond_2 | union $cond_3 | union $cond_4 | union $cond_5 |
union $cond_6 | where process_path NOT LIKE "%\\windows\\system32%" OR process_path
union $cond_6 | where process_path NOT LIKE "%\\windows\\system32%" AND process_path
NOT LIKE "%\\windows\\syswow64%" | eval start_time=timestamp, end_time=timestamp,
entities=mvappend(device, user), body=create_map(["process_path", process_path,
"process_name", process_name]) | into write_ssa_detected_events();'