admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-08-09 16:57:21 -07:00
committed by GitHub
parent 5bc4cb46b4 a47086080b
commit bfafa24522
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/potential_password_in_username.yml
+4 -4
View File
@@ -19,7 +19,7 @@ search: '| tstats `security_content_summariesonly` earliest(_time) AS starttime
| lookup ut_shannon_lookup word AS user
| where ut_shannon>3 AND len(user)>=8 AND mvcount(src) == 1
| sort count, - ut_shannon
| eval incorrect_password=user
| eval incorrect_cred=user
| eval endtime=endtime+1000
| map maxsearches=70 search="| tstats `security_content_summariesonly`
earliest(_time) AS starttime latest(_time) AS endtime latest(sourcetype) AS sourcetype
@@ -29,10 +29,10 @@ search: '| tstats `security_content_summariesonly` earliest(_time) AS starttime
earliest=\"$starttime$\" latest=\"$endtime$\" BY \"Authentication.user\"
| `drop_dm_object_name(\"Authentication\")`
| `potential_password_in_username_false_positive_reduction`
| eval incorrect_password=\"$incorrect_password$\"
| eval incorrect_cred=\"$incorrect_cred$\"
| eval ut_shannon=\"$ut_shannon$\"
| sort count"
| where user!=incorrect_password
| where user!=incorrect_cred
| outlier action=RM count
| `potential_password_in_username_filter`'
how_to_implement: To successfully implement this search, you need to have relevant
@@ -92,4 +92,4 @@ tags:
- Authentication.dest
- sourcetype
risk_score: 21
security_domain: access
security_domain: access