From bd0419701009a496cf1c88f26e394bc27df44954 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 13 Feb 2025 12:43:10 +0100 Subject: [PATCH] headless_bee --- detections/endpoint/windows_anonymous_pipe_activity.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_anonymous_pipe_activity.yml b/detections/endpoint/windows_anonymous_pipe_activity.yml index 1cc77db19e..6ed398ba44 100644 --- a/detections/endpoint/windows_anonymous_pipe_activity.yml +++ b/detections/endpoint/windows_anonymous_pipe_activity.yml @@ -10,7 +10,7 @@ data_source: - Sysmon EventID 17 - Sysmon EventID 18 search: '`sysmon` EventCode IN (17,18) PipeName="*Anonymous Pipe*" NOT( Image IN ("*\\Program Files\\*")) - | rename Image as process_name + | rename Image as process_name | stats min(_time) as firstTime max(_time) as lastTime count by dest user EventCode PipeName signature process_name process_id process_guid EventType | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`