admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
Bhavin Patel
2024-07-09 11:09:37 -07:00
committed by GitHub
parent 154c502060 9174d5125d
commit b87188eb74
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/7zip_commandline_to_smb_share_path.yml
+2 -2
View File
@@ -1,6 +1,6 @@
name: 7zip CommandLine To SMB Share Path
id: 01d29b48-ff6f-11eb-b81e-acde48001123
version: 2
version: 3
date: '2024-05-17'
author: Teoderick Contreras, Splunk
status: production
@@ -14,7 +14,7 @@ description: The following analytic detects the execution of 7z or 7za processes
sensitive information and potentially aiding further attacks.
data_source:
- Sysmon EventID 1
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
search: 'x| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processes.process_name ="7z.exe"
OR Processes.process_name = "7za.exe" OR Processes.original_file_name = "7z.exe"
OR Processes.original_file_name = "7za.exe") AND (Processes.process="*\\C$\\*"