admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update Text of Detection

Browse Source 
Minor update to text of "Possible Browser Pass View Parameter"
This commit is contained in:
pyth0n1c
2022-01-04 08:23:36 -08:00
committed by GitHub
parent 3c6c0dc575
commit cff1c5dd74
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/possible_browser_pass_view_parameter.yml
+5 -5
View File
@@ -6,13 +6,13 @@ author: Teoderick Contreras, Splunk
type: Hunting
datamodel:
- Endpoint
description: This analytic will detect a suspicious process contains a commandline
parameter related to web browser credential dumper. This technique is used by Remcos RAT
malware where it uses the Nirsoft webbrowserpassview.exe application to dump web browser
credentials. Remcos use the "/stext" command line to dump the credential in text format.
description: This analytic will detect if a suspicious process contains a commandline
parameter related to a web browser credential dumper. This technique is used by Remcos RAT
malware which uses the Nirsoft webbrowserpassview.exe application to dump web browser
credentials. Remcos uses the "/stext" command line to dump the credentials in text format.
This Hunting query is a good indicator of hosts suffering from possible Remcos RAT infection.
Since the hunting query is based on the parameter command and the possible path where it will
save the text credential information, It may catch normal tools that are using the same command and behavior.
save the text credential information, it may catch normal tools that are using the same command and behavior.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*/stext
*", "*/shtml *", "*/LoadPasswordsIE*", "*/LoadPasswordsFirefox*", "*/LoadPasswordsChrome*",