From c9953b5c8a249cde5db253d4f366bfcf706b8362 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Wed, 28 Apr 2021 13:50:45 -0400 Subject: [PATCH] Update ssa___credential_extraction_fgdump_cachedump_s_option.yml --- .../ssa___credential_extraction_fgdump_cachedump_s_option.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml index 083aa5014b..4b0cec8774 100644 --- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml +++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml @@ -24,7 +24,7 @@ search: ' | from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified.