admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Temporary fix to outstanding, known

Browse Source 
issue with field naming
This commit is contained in:
pyth0n1c
2022-07-29 14:23:49 -07:00
committed by GitHub
parent 07d72ad142
commit aafee44783
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/mshtml_module_load_in_office_product.yml
+1 -1
View File
@@ -11,7 +11,7 @@ description: The following detection identifies the module load of mshtml.dll in
malicious document will load ActiveX, which activates the MSHTML component. The
vulnerability resides in the MSHTML component. During triage, identify parallel
processes and capture any file modifications for analysis.
search: '`sysmon` EventID=7 process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe")
search: '`sysmon` EventID=7 parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe")
ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll")
| stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name,
ImageLoaded, OriginalFileName, ProcessGuid | rename Computer as dest | `security_content_ctime(firstTime)`