admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix_issues

Browse Source
This commit is contained in:
tccontre
2021-11-09 16:47:05 +01:00
parent fdecebc8b5
commit 97da96df03
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml
+3 -3
View File
@@ -11,9 +11,9 @@ description: this search is to detect a suspicious regsvr32 commandline "-s" to
dll that will download the 2nd stage loader that will download and decrypt the config
payload.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_regsvr32`
(Processes.process="*/i*" AND Processes.process="*/s*") OR Processes.process="*/si*" OR Processes.process="*-si*" by Processes.dest Processes.parent_process
Processes.process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.user
as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` AND Processes.process=*-s*
by Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name
Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest Processes.user
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`