admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2023-04-03 09:23:39 -07:00
committed by GitHub
parent 96bcef5b5e 4dc1702486
commit bedc6ca0ae
3 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml
+2 -1
View File
@@ -12,7 +12,7 @@ description: This search is to detect an anomaly event of a non-chrome process a
the RAT, trojan spy as well as FIN7 jssloader try to parse the those sqlite database
to collect information on the compromised host. This SACL Event (4663) need to be
enabled to tthe firefox profile directory to be eable to use this. Since you monitoring
this access to the folder a noise coming from firefox need to be filter and also
this access to the folder, we observed noise that needs to be filter out and hence added
sqlite db browser and explorer .exe to make this detection more stable.
search: '`wineventlog_security` EventCode=4663 NOT (process_name IN ("*\\chrome.exe",
"*\\explorer.exe", "*sql*")) Object_Name="*\\Google\\Chrome\\User Data\\Default*"
@@ -30,6 +30,7 @@ tags:
- FIN7
- Remcos
- AgentTesla
- 3CX Supply Chain Attack
confidence: 70
context:
- Source:Endpoint
detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
+5 -4
View File
@@ -10,10 +10,10 @@ description: This search is to detect an anomaly event of a non-firefox process
the files in the profile folder. This folder contains all the sqlite database of the
firefox browser related to users login, history, cookies and etc. Most of the RAT,
trojan spy as well as FIN7 jssloader try to parse the those sqlite database to collect
information on the compromised host. This SACL Event (4663) need to be enabled to
tthe firefox profile directory to be eable to use this. Since you monitoring this
access to the folder a noise coming from firefox need to be filter and also sqlite
db browser and explorer .exe to make this detection more stable.
information on the compromised host. This SACL Event (4663) needs to be enabled to
the firefox profile directory to use this. Since this is monitoring the
access to the folder, we have obsevered noise and hence added `sqlite
db browser` and `explorer.exe` to make this detection more stable.
search: '`wineventlog_security` EventCode=4663 NOT (process_name IN ("*\\firefox.exe",
"*\\explorer.exe", "*sql*")) Object_Name="*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles*"
| stats count min(_time) as firstTime max(_time) as lastTime by Object_Name Object_Type
@@ -31,6 +31,7 @@ tags:
- Remcos
- Azorult
- AgentTesla
- 3CX Supply Chain Attack
confidence: 70
context:
- Source:Endpoint
requirements.txt
+1 -1
View File
@@ -7,7 +7,7 @@ mock==4.0.3
psutil==5.9.4
pycvesearch==1.2
pydantic==1.10.7
pytest==7.2.1
pytest==7.2.2
PyYAML==5.4.1
questionary==1.10.0
requests==2.28.2