admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Removed printout from python code. Committed detection in dist with status validation.

Browse Source
This commit is contained in:
pyth0n1c
2023-10-02 16:45:06 -07:00
parent 95f836d4f6
commit a23eb85f4f
2 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/contentctl_project/contentctl_core/domain/entities/detection.py
+2 -1
View File
@@ -148,7 +148,8 @@ class Detection(BaseModel, SecurityContentObject):
if "ssa_" not in values["file_path"]:
raise ValueError(f"The following is NOT an ssa_ detection, but has 'status: {values['status']} which may ONLY be used for ssa_ detections:' {values['file_path']}")
else:
print(f"Got an ssa validation detection: {values['file_path']}")
#This is an ssa_ validation detection
pass
return values
dist/ssa/srs/ssa___services_lolbas_execution_process_spawn.yml
Vendored
+1 -1
View File
@@ -1,7 +1,7 @@
name: Services lolbas Execution Process Spawn
id: fd40c537-53d0-4c28-9b7e-77cfd28a49c8
version: 1
status: production
status: validation
description: The following analytic identifies services.exe spawning a LOLBAS execution
process. When adversaries execute code on remote endpoints abusing the Service Control
Manager and creating a remote malicious service, the executed command is spawned