admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

spl update to use parent_process_name

Browse Source
This commit is contained in:
bpatel
2020-03-02 14:10:10 -08:00
parent 7c4258999a
commit c40a88ad66
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cscript_via_cmd.yml
+1 -1
View File
@@ -34,7 +34,7 @@ detect:
latest_time: -10m@m
search: '| tstats `security_content_summariesonly` count values(Processes.process) min(_time)
as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where
Processes.parent_process="*cmd.exe" (Processes.process_name=cscript.exe OR
Processes.parent_process_name="cmd.exe" (Processes.process_name=cscript.exe OR
Processes.process_name =wscript.exe) by Processes.parent_process Processes.process_name
Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`'
suppress: