admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2018 from splunk/duplicate_2011

Browse Source 
PR 2011- duplicate
This commit is contained in:
Bhavin Patel
2022-02-15 10:39:43 -08:00
committed by GitHub
parent 7972577016 33ab1741f6
commit 9bb0b3a43e
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml
+2 -2
View File
@@ -10,8 +10,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
parameter leverages WMI to query for all domain computers. Red Teams and adversaries
may leverage this commandlet to enumerate domain computers for situational awareness
and Active Directory Discovery.
search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"namespace
root\\directory\\ldap"* AND Message=*"class ds_computer"*) | stats count min(_time)
search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message="*namespace
root\\directory\\ldap*" AND Message="*class ds_computer*") | stats count min(_time)
as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
| `getwmiobject_ds_computer_with_powershell_script_block_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml
+2 -2
View File
@@ -10,8 +10,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
. The `DS_Group` parameter leverages WMI to query for all domain groups. Red Teams
and adversaries may leverage this commandlet to enumerate domain groups for situational
awareness and Active Directory Discovery.
search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"namespace
root\\directory\\ldap"* AND Message=*"class ds_group"*) | stats count min(_time)
search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message="*namespace
root\\directory\\ldap*" AND Message="*class ds_group*") | stats count min(_time)
as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
| `getwmiobject_ds_group_with_powershell_script_block_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable