admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inMalicious Powershell Executed As A Service

Browse Source
This commit is contained in:
root
2021-04-15 07:23:08 +00:00
parent 62ed90ccbd
commit a0914ddcdd
1 changed files with 6 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/malicious_powershell_executed_as_a_service.yml
+6 -7
View File
@@ -8,13 +8,12 @@ datamodel:
- Endpoint
description: This detection is to identify the abuse the Windows SC.exe to execute
malicious commands or payloads via PowerShell.
search: ' `wineventlog_system` EventCode=7045 | eval l_Service_File_Name=lower(Service_File_Name) |
regex l_Service_File_Name="powershell[.\s]|powershell_ise[.\s]|pwsh[.\s]|psexec[.\s]" |
regex l_Service_File_Name="-nop[rofile]*|-w[indowstyle]*\s+hid[den]*|-noe[xit]*|-enc[odedcommand]*" |
stats count min(_time) as firstTime max(_time) as lastTime
by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type Service_Account
user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `malicious_powershell_executed_as_a_service_filter`'
search: ' `wineventlog_system` EventCode=7045 | eval l_Service_File_Name=lower(Service_File_Name)
| regex l_Service_File_Name="powershell[.\s]|powershell_ise[.\s]|pwsh[.\s]|psexec[.\s]"
| regex l_Service_File_Name="-nop[rofile]*|-w[indowstyle]*\s+hid[den]*|-noe[xit]*|-enc[odedcommand]*"
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name
Service_Name Service_Start_Type Service_Type Service_Account user | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `malicious_powershell_executed_as_a_service_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
Windows System logs with the Service name, Service File Name Service Start type,
and Service Type from your endpoints.