admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
Bhavin Patel
2021-11-09 05:52:13 -08:00
committed by GitHub
parent f18561b7e9 6e165762ce
commit c6f714e855
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/detect_regasm_with_no_command_line_arguments.yml
+2 -2
View File
@@ -10,8 +10,8 @@ description: The following analytic identifies regasm.exe with no command line a
This particular behavior occurs when another process injects into regasm.exe, no
command line arguments will be present. During investigation, identify any network
connections and parallel processes. Identify any suspicious module loads related
to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe
and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.
to credential dumping or file writes. Regasm.exe are natively found in `C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe`
and `C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe`.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where `process_regasm` by _time span=1h Processes.process_id Processes.process_name
Processes.dest Processes.process_path Processes.process Processes.parent_process_name