From 8b93c999040755ff29746e64a8d3ac677806880f Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 2 Feb 2022 08:48:26 +0100 Subject: [PATCH 1/2] trouble shooting --- .../ssa___hiding_files_and_directories_with_attrib_exe.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml index e3fa20820f..c23cfbac84 100644 --- a/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ b/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml @@ -76,3 +76,4 @@ tags: - _time risk_score: 72 security_domain: endpoint + From 634d28efe39b132386d9205fcf05781460c8c45e Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 2 Feb 2022 10:45:37 +0100 Subject: [PATCH 2/2] trouble shooting --- .../ssa___hiding_files_and_directories_with_attrib_exe.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml index c23cfbac84..9444d3e8d4 100644 --- a/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ b/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml @@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where - cmd_line IS NOT NULL AND like(cmd_line, "%+h%") AND process_name="attrib.exe" | + cmd_line IS NOT NULL AND match_regex(cmd_line, /\+h/)=true AND process_name="attrib.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",