admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
github-actions[bot]
2021-05-06 17:03:42 +00:00
committed by GitHub
parent 625ba0ceba 475adb687c
commit 82db5dccd5
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/registry_keys_used_for_persistence.yml
+2 -1
View File
@@ -4,7 +4,8 @@ version: 5
date: '2020-11-27'
author: David Dorsey, Splunk
type: batch
datamodel: []
datamodel:
- Endpoint
description: The search looks for modifications to registry keys that can be used
to launch an application or service at system startup.
search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)