admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

removing a broken detection

Browse Source
This commit is contained in:
divious1
2020-11-17 16:32:59 -05:00
parent f174ac7475
commit b5dfe4450f
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_connhost_exe_force_flag.yml → detections/deprecated/windows_connhost_exe_force_flag.yml
+4 -1
View File
@@ -3,7 +3,10 @@ id: c114aaca-68ee-41c2-ad8c-32bf21db8769
version: 1
date: '2020-11-06'
description: 'The search looks for the Console Window Host process (connhost.exe) executed using the force flag -ForceV1.
This is not regular behavior in the Windows OS and is often seen executed by the Ryuk Ransomware.'
This is not regular behavior in the Windows OS and is often seen executed by the Ryuk Ransomware.
DEPRECATED
This event is actually seen in the windows 10 client of attack_range_local. After further testing we realized this is not specific to Ryuk.
'
how_to_implement: You must be ingesting data that records the process-system activity
from your hosts to populate the Endpoint Processes data-model object. If you are
using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which