From 82e7c1ef645c242e960a6363d8a4f2fdd73003d4 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 23 May 2023 15:49:48 +0200 Subject: [PATCH] iceid_dfir_coverage --- .../executable_file_written_in_administrative_smb_share.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml index dda16fcd52..5a001336d5 100644 --- a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml +++ b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml @@ -13,7 +13,7 @@ description: The following analytic identifies executable files (.exe or .dll) b movement and remote code execution. The Trickbot malware family also implements this behavior to try to infect other machines in the infected network. data_source: -- - Windows Security 5145 +- Windows Security 5145 search: '`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.exe","*.dll") Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask= "0x2" | stats min(_time) as firstTime max(_time) as lastTime count by EventCode