admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Forgot a lurking * in the LIKE statement

Browse Source
This commit is contained in:
David Dorsey
2021-10-29 14:51:42 -05:00
parent 8ca27ad7e7
commit 8d1b01d885
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
+1 -1
View File
@@ -23,7 +23,7 @@ search: '| from read_ssa_enriched_events()
OR ParentBaseFileName="visio.exe" OR ParentBaseFileName="mspub.exe" OR ParentBaseFileName="acrobat.exe" OR ParentBaseFileName="acrord32.exe"
OR ParentBaseFileName="iexplore.exe" OR ParentBaseFileName="opera.exe" OR ParentBaseFileName="firefox.exe"
OR ParentBaseFileName="java.exe" OR ParentBaseFileName="powershell.exe"
OR (ParentBaseFileName="chrome.exe" AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND NOT LIKE(cmd_line, "%chrome-extension*")))
OR (ParentBaseFileName="chrome.exe" AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND NOT LIKE(cmd_line, "%chrome-extension%")))
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
dest_user_id), body=create_map(["event_id", event_id, "process_name", process_name,
"parent_process_name", parent_process]) | into write_ssa_detected_events();'