admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
github-actions[bot]
2021-04-15 07:31:09 +00:00
committed by GitHub
parent 3b09117d62 274e5f1b43
commit cf0ea3ca61
1 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/malicious_powershell_executed_as_a_service.yml
+6 -5
View File
@@ -8,11 +8,12 @@ datamodel:
- Endpoint
description: This detection is to identify the abuse the Windows SC.exe to execute
malicious commands or payloads via PowerShell.
search: ' `wineventlog_system` EventCode=7045 Service_File_Name IN ("*powershell.exe*",
"*-nop*", "*hid*") | stats count min(_time) as firstTime max(_time) as lastTime
by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type Service_Account
user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `malicious_powershell_executed_as_a_service_filter`'
search: ' `wineventlog_system` EventCode=7045 | eval l_Service_File_Name=lower(Service_File_Name)
| regex l_Service_File_Name="powershell[.\s]|powershell_ise[.\s]|pwsh[.\s]|psexec[.\s]"
| regex l_Service_File_Name="-nop[rofile]*|-w[indowstyle]*\s+hid[den]*|-noe[xit]*|-enc[odedcommand]*"
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name
Service_Name Service_Start_Type Service_Type Service_Account user | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `malicious_powershell_executed_as_a_service_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
Windows System logs with the Service name, Service File Name Service Start type,
and Service Type from your endpoints.