admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update ssa___credential_extraction_fgdump_cachedump_s_option.yml

Browse Source
This commit is contained in:
Jose Enrique Hernandez
2021-04-28 13:50:45 -04:00
committed by GitHub
parent ff215bb999
commit c9953b5c8a
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml
+1 -1
View File
@@ -24,7 +24,7 @@ search: ' | from read_ssa_enriched_events()
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();'
"string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.