admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
Bhavin Patel
2021-09-24 14:54:20 -07:00
committed by GitHub
parent 9822a592de 2944cbb6fa
commit b06a42c815
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml
+1 -1
View File
@@ -41,7 +41,7 @@ search: ' | from read_ssa_enriched_events() | eval device=ucast(map_get(input_ev
as timestamp | adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device"
window=2419200000L | where label AND quantile>0.99 | eval start_time = window_start,
end_time = timestamp, entities = mvappend(device), body=create_map(["lolbas_counter",
lolbas_counter]) | into write_null();'
lolbas_counter, "quantile", quantile, "device", device]) | into write_ssa_detected_events();'
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
known_false_positives: 'Some administrative tasks may involve multiple use of LOLBAS
applications in a short period of time. This might trigger false positives at the