admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

testing

Browse Source
This commit is contained in:
P4T12ICK
2020-10-13 19:15:56 +02:00
parent eeed5fb0b8 565c8610cd
commit c19f355fb8
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/system_information_discovery_detection.yml
+6 -6
View File
@@ -1,12 +1,13 @@
author: Patrick Bareiss, Splunk
name: System Information Discovery Detection
id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72
version: 1
date: '2020-10-12'
description: Detect system information discovery techniques used by attackers to understand
configurations of the system to further exploit it.
id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72
known_false_positives: Administrators debugging servers
name: System Information Discovery Detection
type: ESCU
references:
- https://oscp.infosecsanyam.in/priv-escalation/windows-priv-escalation
author: Patrick Bareiss, Splunk
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processes.process="*wmic* qfe*"
OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.user
@@ -15,6 +16,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
> 2 | stats values(process) min(firstTime) as firstTime max(lastTime) as lastTime
by user, dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
| `system_information_discovery_detection_filter`'
known_false_positives: Administrators debugging servers
tags:
analytics_story:
- Discovery Techniques
@@ -29,5 +31,3 @@ tags:
nist:
- DE.CM
security_domain: endpoint
type: ESCU
version: 1