admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2559 from splunk/wtf_bug

Browse Source 
SPL Update
This commit is contained in:
Bhavin Patel
2023-03-03 13:30:36 -08:00
committed by GitHub
parent f3af49d922 8b0134ca68
commit 99b44fccc8
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/linux_ssh_remote_services_script_execute.yml
+2 -2
View File
@@ -1,14 +1,14 @@
name: Linux SSH Remote Services Script Execute
id: aa1748dd-4a5c-457a-9cf6-ca7b4eb711b3
version: 1
date: '2022-07-27'
date: '2023-03-03'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
description: The following analytic identifies SSH being utilized to move laterally and execute a script or file on the remote host.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=ssh Processes.process IN ("*oStrictHostKeyChecking*", "*oConnectTimeout*", "*oBatchMode*") AND CommandLine IN ("*http:*","*https:*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=ssh Processes.process IN ("*oStrictHostKeyChecking*", "*oConnectTimeout*", "*oBatchMode*") AND Processes.process IN ("*http:*","*https:*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`