admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

dcrat-analytics3

Browse Source
This commit is contained in:
tccontre
2022-07-29 10:12:22 +02:00
parent bcb5aab4ee
commit a0336d013a
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_gather_victim_host_information_camera.yml
+1 -1
View File
@@ -7,7 +7,7 @@ type: Anomaly
datamodel:
- Endpoint
description: UPDATE_DESCRIPTION
search: '`powershell` EventCode=4104 ScriptBlockText= "* Win32_PnPEntity *" ScriptBlockText= "*SELECT*" ScriptBlockText= "*WHERE*" ScriptBlockText IN ("*PNPClass = 'Image'*", "*PNPClass = 'Camera'*")
search: '`powershell` EventCode=4104 ScriptBlockText= "* Win32_PnPEntity *" ScriptBlockText= "*SELECT*" ScriptBlockText= "*WHERE*" ScriptBlockText = "*PNPClass*" ScriptBlockText IN ("*Image*", "*Camera*")
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`