From 8d1b01d885ec15d4affa12c24bda9e523fce304e Mon Sep 17 00:00:00 2001 From: David Dorsey Date: Fri, 29 Oct 2021 14:51:42 -0500 Subject: [PATCH] Forgot a lurking * in the LIKE statement --- .../endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index 8c8a527844..4e6048b148 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -23,7 +23,7 @@ search: '| from read_ssa_enriched_events() OR ParentBaseFileName="visio.exe" OR ParentBaseFileName="mspub.exe" OR ParentBaseFileName="acrobat.exe" OR ParentBaseFileName="acrord32.exe" OR ParentBaseFileName="iexplore.exe" OR ParentBaseFileName="opera.exe" OR ParentBaseFileName="firefox.exe" OR ParentBaseFileName="java.exe" OR ParentBaseFileName="powershell.exe" - OR (ParentBaseFileName="chrome.exe" AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND NOT LIKE(cmd_line, "%chrome-extension*"))) + OR (ParentBaseFileName="chrome.exe" AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND NOT LIKE(cmd_line, "%chrome-extension%"))) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, dest_user_id), body=create_map(["event_id", event_id, "process_name", process_name, "parent_process_name", parent_process]) | into write_ssa_detected_events();'