admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

headless_bee

Browse Source
This commit is contained in:
tccontre
2025-02-13 12:43:10 +01:00
parent 6f4026bc7d
commit bd04197010
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_anonymous_pipe_activity.yml
+1 -1
View File
@@ -10,7 +10,7 @@ data_source:
- Sysmon EventID 17
- Sysmon EventID 18
search: '`sysmon` EventCode IN (17,18) PipeName="*Anonymous Pipe*" NOT( Image IN ("*\\Program Files\\*"))
| rename Image as process_name
| rename Image as process_name
| stats min(_time) as firstTime max(_time) as lastTime count by dest user EventCode PipeName signature process_name process_id process_guid EventType
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`