admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-05-16 15:08:48 -04:00
committed by GitHub
parent 1afae8974e a357b2f0bd
commit bfe605ee69
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/linux_deletion_of_ssh_key.yml → detections/endpoint/linux_deletion_of_ssh_hash_conf.yml
+2 -2
View File
@@ -1,4 +1,4 @@
name: Linux deletion Of SSH Key
name: Linux deletion Of SSH Hash Conf
id: 73a56508-1cf5-4df7-b8d9-5737fbdc27d2
version: 1
date: '2022-04-12'
@@ -23,7 +23,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
|rename process_guid as proc_guid
| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name action]
| table process_name process proc_guid file_name file_path action _time parent_process_name parent_process process_path dest user
| `linux_deletion_of_ssh_key_filter`'
| `linux_deletion_of_ssh_hash_conf_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
tests/endpoint/linux_deletion_of_ssh_key.test.yml → tests/endpoint/linux_deletion_of_ssh_hash_conf.test.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: Linux deletion Of SSH Key Unit Test
name: Linux deletion Of SSH Hash Conf Unit Test
tests:
- name: Linux deletion Of SSH Key
file: endpoint/linux_deletion_of_ssh_key.yml
- name: Linux deletion Of SSH Hash Conf
file: endpoint/linux_deletion_of_ssh_hash_conf.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now