admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update suspicious_process_file_path.yml

Browse Source
This commit is contained in:
tccontre
2023-06-22 14:41:28 +02:00
committed by GitHub
parent a26b5e40c9
commit aba4d78285
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/suspicious_process_file_path.yml
+1 -1
View File
@@ -5,7 +5,7 @@ date: '2023-04-25'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: This analytic will indentifies a suspicious processes running in file paths
description: This analytic identifies a suspicious processes running in file paths
that are not typically associated with legitimate software. Adversaries often employ this technique
to drop and execute malicious executables in accessible locations that do not require administrative privileges.
By monitoring for processes running in such unconventional file paths, we can identify potential indicators of