admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update suspicious_process_file_path.yml

Browse Source
This commit is contained in:
tccontre
2023-03-01 14:05:31 +01:00
committed by GitHub
parent 41fb7257cd
commit a21deeb7a0
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/suspicious_process_file_path.yml
+3 -3
View File
@@ -14,9 +14,9 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_path = "*\\windows\\fonts\\*"
OR Processes.process_path = "*\\windows\\temp\\*" OR Processes.process_path = "*\\users\\public\\*"
OR Processes.process_path = "*\\windows\\debug\\*" OR Processes.process_path.file_path
= "*\\Users\\Administrator\\Music\\*" OR Processes.process_path.file_path = "*\\Windows\\servicing\\*"
OR Processes.process_path.file_path = "*\\Users\\Default\\*" OR Processes.process_path.file_path
OR Processes.process_path = "*\\windows\\debug\\*" OR Processes.process_path
= "*\\Users\\Administrator\\Music\\*" OR Processes.process_path = "*\\Windows\\servicing\\*"
OR Processes.process_path = "*\\Users\\Default\\*" OR Processes.process_path
= "*Recycle.bin*" OR Processes.process_path = "*\\Windows\\Media\\*" OR Processes.process_path
= "\\Windows\\repair\\*" OR Processes.process_path = "*\\temp\\*" OR Processes.process_path
= "*\\PerfLogs\\*" by Processes.parent_process_name Processes.parent_process Processes.process_path