admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

iceid_dfir_coverage

Browse Source
This commit is contained in:
tccontre
2023-05-23 15:49:48 +02:00
parent d667a02230
commit 82e7c1ef64
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/executable_file_written_in_administrative_smb_share.yml
+1 -1
View File
@@ -13,7 +13,7 @@ description: The following analytic identifies executable files (.exe or .dll) b
movement and remote code execution. The Trickbot malware family also implements
this behavior to try to infect other machines in the infected network.
data_source:
- - Windows Security 5145
- Windows Security 5145
search: '`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.exe","*.dll")
Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask=
"0x2" | stats min(_time) as firstTime max(_time) as lastTime count by EventCode