admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix SPL in the Mimikatz module detection

Browse Source
This commit is contained in:
Stanislav Miskovic
2020-11-04 09:28:38 -08:00
parent 18c66b9959
commit b46acc0d4f
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
+1 -1
View File
@@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events()
match_regex(cmd_line, /(?i)kerberos::ptt/)=true OR
match_regex(cmd_line, /(?i)kerberos::golden/)=true OR
match_regex(cmd_line, /(?i)kerberos::silver/)=true OR
match_regex(cmd_line, /(?i)token::elevate/)=true OR
match_regex(cmd_line, /(?i)token::elevate/)=true
)
| eval start_time = timestamp,