admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch '3cx' of https://github.com/splunk/security_content into 3cx

Browse Source
This commit is contained in:
Michael Haag
2023-03-30 12:30:06 -06:00
parent e61f2708cb 57178903ca
commit cb5bc94df9
1 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_vulnerable_3cx_software.yml
+2 -3
View File
@@ -4,8 +4,7 @@ version: 1
date: '2023-03-30'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
datamodel: []
description: The following analytic leverages Sysmon, a powerful system monitoring and logging tool, to pinpoint instances of the 3CXDesktopApp.exe with a FileVersion of 18.12.x.Recently, 3CX has discovered a vulnerability specifically in versions 18.12.407 and 18.12.416 of the desktop app.
search: '`sysmon` (process_name=3CXDesktopApp.exe OR OriginalFileName=3CXDesktopApp.exe) FileVersion=18.12.*
| rename Computer as dest
@@ -68,4 +67,4 @@ tags:
- Computer
- parent_process_name
risk_score: 90
security_domain: endpoint
security_domain: endpoint