From 9174d5125d540e0ea3379332fd71cd460da3e5ad Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 9 Jul 2024 11:09:19 -0700 Subject: [PATCH] final updates - real test2 --- detections/endpoint/7zip_commandline_to_smb_share_path.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/7zip_commandline_to_smb_share_path.yml b/detections/endpoint/7zip_commandline_to_smb_share_path.yml index 76c046406f..496dee8b71 100644 --- a/detections/endpoint/7zip_commandline_to_smb_share_path.yml +++ b/detections/endpoint/7zip_commandline_to_smb_share_path.yml @@ -1,6 +1,6 @@ name: 7zip CommandLine To SMB Share Path id: 01d29b48-ff6f-11eb-b81e-acde48001123 -version: 2 +version: 3 date: '2024-05-17' author: Teoderick Contreras, Splunk status: production @@ -14,7 +14,7 @@ description: The following analytic detects the execution of 7z or 7za processes sensitive information and potentially aiding further attacks. data_source: - Sysmon EventID 1 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) +search: 'x| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name ="7z.exe" OR Processes.process_name = "7za.exe" OR Processes.original_file_name = "7z.exe" OR Processes.original_file_name = "7za.exe") AND (Processes.process="*\\C$\\*"