admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
github-actions[bot]
2021-06-23 20:37:27 +00:00
committed by GitHub
parent 66eac3fad2 c6a33a8af4
commit 8e4e36893e
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/malicious_powershell_executed_as_a_service.yml
+1 -1
View File
@@ -10,7 +10,7 @@ description: This detection is to identify the abuse the Windows SC.exe to execu
malicious commands or payloads via PowerShell.
search: ' `wineventlog_system` EventCode=7045 | eval l_Service_File_Name=lower(Service_File_Name)
| regex l_Service_File_Name="powershell[.\s]|powershell_ise[.\s]|pwsh[.\s]|psexec[.\s]"
| regex l_Service_File_Name="-nop[rofile]*|-w[indowstyle]*\s+hid[den]*|-noe[xit]*|-enc[odedcommand]*"
| regex l_Service_File_Name="-nop[rofile\s]+|-w[indowstyle]*\s+hid[den]*|-noe[xit\s]+|-enc[odedcommand\s]+"
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name
Service_Name Service_Start_Type Service_Type Service_Account user | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `malicious_powershell_executed_as_a_service_filter`'