admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

fin7

Browse Source
This commit is contained in:
tccontre
2021-09-15 13:48:22 +02:00
parent d96f70cf8e
commit d0eff26cde
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
+1 -1
View File
@@ -12,7 +12,7 @@ description: This search is to detect an anomaly event of non-firefox process ac
This SACL Event (4663) need to be enabled to tthe firefox profile directory to be eable to use this.
Since you monitoring this access to the folder a noise coming from firefox need to be filter and also sqlite db browser and explorer .exe to make this
detection more stable.
search: 'eventtype=wineventlog_security EventCode=4663
search: '`wineventlog_security` EventCode=4663
NOT (process_name IN ("*\\firefox.exe", "*\\explorer.exe", "*sql*")) Object_Name="*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles*"
| stats count min(_time) as firstTime max(_time) as lastTime
by Object_Name Object_Type process_name Access_Mask Accesses process_id EventCode dest user