From 0dffcb450f673133a63745aa0da129c3bc72aa61 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 2 Mar 2023 15:52:15 -0800 Subject: [PATCH 1/3] checking --- .../endpoint/linux_ssh_remote_services_script_execute.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/linux_ssh_remote_services_script_execute.yml b/detections/endpoint/linux_ssh_remote_services_script_execute.yml index 4a91a2e78f..6fd54ba78b 100644 --- a/detections/endpoint/linux_ssh_remote_services_script_execute.yml +++ b/detections/endpoint/linux_ssh_remote_services_script_execute.yml @@ -1,7 +1,7 @@ name: Linux SSH Remote Services Script Execute id: aa1748dd-4a5c-457a-9cf6-ca7b4eb711b3 version: 1 -date: '2022-07-27' +date: '2023-03-01' author: Michael Haag, Splunk type: TTP datamodel: From f891a64533d8695cfcb629f797aa205eb855b5cc Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 2 Mar 2023 16:55:23 -0800 Subject: [PATCH 2/3] update spl errror --- .../endpoint/linux_ssh_remote_services_script_execute.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/linux_ssh_remote_services_script_execute.yml b/detections/endpoint/linux_ssh_remote_services_script_execute.yml index 6fd54ba78b..58a16d3f0e 100644 --- a/detections/endpoint/linux_ssh_remote_services_script_execute.yml +++ b/detections/endpoint/linux_ssh_remote_services_script_execute.yml @@ -8,7 +8,7 @@ datamodel: - Endpoint description: The following analytic identifies SSH being utilized to move laterally and execute a script or file on the remote host. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name=ssh Processes.process IN ("*oStrictHostKeyChecking*", "*oConnectTimeout*", "*oBatchMode*") AND CommandLine IN ("*http:*","*https:*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=ssh Processes.process IN ("*oStrictHostKeyChecking*", "*oConnectTimeout*", "*oBatchMode*") AND Processes.process IN ("*http:*","*https:*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From cdf125520ffe460434f87a42a6b2d5a8d0f63c9f Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 3 Mar 2023 12:03:45 -0800 Subject: [PATCH 3/3] Updating the date of the detection and kicking off cicd again --- .../endpoint/linux_ssh_remote_services_script_execute.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/linux_ssh_remote_services_script_execute.yml b/detections/endpoint/linux_ssh_remote_services_script_execute.yml index 58a16d3f0e..b201e03e22 100644 --- a/detections/endpoint/linux_ssh_remote_services_script_execute.yml +++ b/detections/endpoint/linux_ssh_remote_services_script_execute.yml @@ -1,7 +1,7 @@ name: Linux SSH Remote Services Script Execute id: aa1748dd-4a5c-457a-9cf6-ca7b4eb711b3 version: 1 -date: '2023-03-01' +date: '2023-03-03' author: Michael Haag, Splunk type: TTP datamodel: