admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

updating detection base on feedback from mschilt in issue 1527

Browse Source
This commit is contained in:
divious1
2021-09-07 21:51:20 -04:00
parent 384fa8b281
commit a32955b985
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/system_information_discovery_detection.yml
+5 -5
View File
@@ -1,7 +1,7 @@
name: System Information Discovery Detection
id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72
version: 1
date: '2020-10-12'
version: 2
date: '2021-09-07'
author: Patrick Bareiss, Splunk
type: TTP
datamodel:
@@ -11,10 +11,10 @@ description: Detect system information discovery techniques used by attackers to
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processes.process="*wmic* qfe*"
OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.user
Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)`
Processes.process_name Processes.process Processes.dest Process.parent_process | `drop_dm_object_name(Processes)`
| eventstats dc(process) as dc_processes_by_dest by dest | where dc_processes_by_dest
> 2 | stats values(process) min(firstTime) as firstTime max(lastTime) as lastTime
by user, dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
> 2 | stats values(process) as processes min(firstTime) as firstTime max(lastTime) as lastTime
by user, dest, parent_process | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
| `system_information_discovery_detection_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from