admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1455 from splunk/ssa_fixes_for_jud

Browse Source 
Ssa fixes for jud
This commit is contained in:
jzsplunk
2021-06-23 13:41:36 -07:00
committed by GitHub
parent c6a33a8af4 8e4e36893e
commit 999cd439f0
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
+1 -1
View File
@@ -24,7 +24,7 @@ search: '| from read_ssa_enriched_events()
OR field0="java.exe" OR field0="powershell.exe"
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
dest_user_id), body=create_map([ "process_name", process_name, "parent_process",
dest_user_id), body=create_map([ "process_name", process_name, "parent_process_name",
parent_process]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting sysmon logs. This search has been modified
to process raw sysmon data from attack_range's nxlogs on DSP.
detections/endpoint/ssa___system_process_running_unexpected_location.yml
+1 -1
View File
@@ -224,7 +224,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
OR process_name="xcopy.exe" OR process_name="xpsrchvw.exe" OR process_name="xwizard.exe";
| from $cond_1 | union $cond_2 | union $cond_3 | union $cond_4 | union $cond_5 |
union $cond_6 | where process_path NOT LIKE "%\\windows\\system32%" OR process_path
union $cond_6 | where process_path NOT LIKE "%\\windows\\system32%" AND process_path
NOT LIKE "%\\windows\\syswow64%" | eval start_time=timestamp, end_time=timestamp,
entities=mvappend(device, user), body=create_map(["process_path", process_path,
"process_name", process_name]) | into write_ssa_detected_events();'