From c40a88ad66ebf8a2ee4e86da68acfc33b301adb3 Mon Sep 17 00:00:00 2001 From: bpatel Date: Mon, 2 Mar 2020 14:10:10 -0800 Subject: [PATCH] spl update to use parent_process_name --- detections/cscript_via_cmd.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cscript_via_cmd.yml b/detections/cscript_via_cmd.yml index d1756b28c4..f779fa04b3 100644 --- a/detections/cscript_via_cmd.yml +++ b/detections/cscript_via_cmd.yml @@ -34,7 +34,7 @@ detect: latest_time: -10m@m search: '| tstats `security_content_summariesonly` count values(Processes.process) min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where - Processes.parent_process="*cmd.exe" (Processes.process_name=cscript.exe OR + Processes.parent_process_name="cmd.exe" (Processes.process_name=cscript.exe OR Processes.process_name =wscript.exe) by Processes.parent_process Processes.process_name Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`' suppress: