admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2023-01-10 13:01:56 -08:00
committed by GitHub
parent 754399c3f3 b9882eb12d
commit 96e32fdac1
2 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/msmpeng_application_dll_side_loading.yml
+3 -3
View File
@@ -1,8 +1,8 @@
name: Msmpeng Application DLL Side Loading
id: 8bb3f280-dd9b-11eb-84d5-acde48001122
version: 1
version: 2
date: '2021-07-05'
author: Teoderick Contreras, Splunk
author: Teoderick Contreras, Splunk, Sanjay Govind
type: TTP
datamodel:
- Endpoint
@@ -15,7 +15,7 @@ search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) a
file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem
where (Filesystem.file_name = "msmpeng.exe" OR Filesystem.file_name = "mpsvc.dll") AND
Filesystem.file_path != "*\\Program Files\\windows defender\\*" by Filesystem.file_create_time
Filesystem.process_id Filesystem.file_name Filesystem.user | `drop_dm_object_name(Processes)`
Filesystem.process_id Filesystem.file_name Filesystem.user | `drop_dm_object_name(Filesystem)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `msmpeng_application_dll_side_loading_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the Filesystem responsible for the changes from
detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml
+3 -3
View File
@@ -1,8 +1,8 @@
name: Remcos RAT File Creation in Remcos Folder
id: 25ae862a-1ac3-11ec-94a1-acde48001122
version: 1
version: 2
date: '2021-09-21'
author: Teoderick Contreras, Splunk
author: Teoderick Contreras, Splunk, Sanjay Govind
type: TTP
datamodel:
- Endpoint
@@ -13,7 +13,7 @@ description: This search is to detect file creation in remcos folder in appdata
search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.dat")
Filesystem.file_path = "*\\remcos\\*" by _time Filesystem.file_name Filesystem.file_path
Filesystem.dest Filesystem.file_create_time | `drop_dm_object_name(Processes)` |
Filesystem.dest Filesystem.file_create_time | `drop_dm_object_name(Filesystem)` |
`security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remcos_rat_file_creation_in_remcos_folder_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your