From a0336d013a34dcf2565f85b4ebffe8a25164349b Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 29 Jul 2022 10:12:22 +0200 Subject: [PATCH] dcrat-analytics3 --- .../endpoint/windows_gather_victim_host_information_camera.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_gather_victim_host_information_camera.yml b/detections/endpoint/windows_gather_victim_host_information_camera.yml index 022ce44500..42c18734d4 100644 --- a/detections/endpoint/windows_gather_victim_host_information_camera.yml +++ b/detections/endpoint/windows_gather_victim_host_information_camera.yml @@ -7,7 +7,7 @@ type: Anomaly datamodel: - Endpoint description: UPDATE_DESCRIPTION -search: '`powershell` EventCode=4104 ScriptBlockText= "* Win32_PnPEntity *" ScriptBlockText= "*SELECT*" ScriptBlockText= "*WHERE*" ScriptBlockText IN ("*PNPClass = 'Image'*", "*PNPClass = 'Camera'*") +search: '`powershell` EventCode=4104 ScriptBlockText= "* Win32_PnPEntity *" ScriptBlockText= "*SELECT*" ScriptBlockText= "*WHERE*" ScriptBlockText = "*PNPClass*" ScriptBlockText IN ("*Image*", "*Camera*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`