admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inEnable RDP In Other Port Number

Browse Source
This commit is contained in:
root
2021-05-26 15:07:28 +00:00
parent e824025040
commit affae55ecf
1 changed files with 12 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/enable_rdp_in_other_port_number.yml
+12 -9
View File
@@ -6,16 +6,16 @@ author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: This search is to detect a modification to registry to enable rdp to a machine with different port number.
This technique was seen in some atttacker tries to do lateral movement and remote access to a compromised machine to gain control of it.
description: This search is to detect a modification to registry to enable rdp to
a machine with different port number. This technique was seen in some atttacker
tries to do lateral movement and remote access to a compromised machine to gain
control of it.
search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
as registry_key_name values(Registry.registry_path) as registry_path min(_time)
as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp*"
Registry.registry_key_name = "PortNumber" by Registry.dest Registry.user Registry.registry_value_name
| `security_content_ctime(lastTime)`
| `security_content_ctime(firstTime)`
| `drop_dm_object_name(Registry)`
| `enable_rdp_in_other_port_number_filter`'
as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal
Server\\WinStations\\RDP-Tcp*" Registry.registry_key_name = "PortNumber" by Registry.dest
Registry.user Registry.registry_value_name | `security_content_ctime(lastTime)`
| `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `enable_rdp_in_other_port_number_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -40,4 +40,7 @@ tags:
- Registry.dest
- Registry.user
- Registry.registry_value_name
security_domain: endpoint
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log