admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix more datamodel quoting conflicts

Browse Source
This commit is contained in:
pyth0n1c
2022-07-28 14:58:49 -07:00
parent 0bc4b38406
commit c91c29bc75
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ryuk_test_files_detected.yml
+2 -2
View File
@@ -9,8 +9,8 @@ datamodel:
description: The search looks for files that contain the key word *Ryuk* under any
folder in the C drive, which is consistent with Ryuk propagation.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Filesystem WHERE "Filesystem.file_path"=C:\\*Ryuk*
BY "Filesystem.dest", "Filesystem.user", "Filesystem.file_path" | `drop_dm_object_name(Filesystem)`
as lastTime FROM datamodel=Endpoint.Filesystem WHERE Filesystem.file_path = "C:\\*Ryuk*"
BY Filesystem.dest, Filesystem.user, Filesystem.file_path | `drop_dm_object_name(Filesystem)`
| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `ryuk_test_files_detected_filter`'
how_to_implement: You must be ingesting data that records the filesystem activity
from your hosts to populate the Endpoint Filesystem data-model object. If you are
detections/endpoint/windows_security_account_manager_stopped.yml
+3 -3
View File
@@ -4,13 +4,13 @@ version: 1
date: '2020-11-06'
author: Rod Soto, Jose Hernandez, Splunk
type: TTP
datamodel:
datamodel:
- Endpoint
description: The search looks for a Windows Security Account Manager (SAM) was stopped
via command-line. This is consistent with Ryuk infections across a fleet of endpoints.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Processes WHERE ("Processes.process_name"="net*.exe"
"Processes.process"="*stop \"samss\"*") BY "Processes.dest", "Processes.user", "Processes.process"
as lastTime FROM datamodel=Endpoint.Processes WHERE (Processes.process_name="net*.exe"
Processes.process="*stop \"samss\"*") BY Processes.dest, Processes.user, Processes.process
| `drop_dm_object_name(Processes)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
| `windows_security_account_manager_stopped_filter`'
how_to_implement: You must be ingesting data that records the process-system activity