admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2023-10-03 15:22:05 -07:00
committed by GitHub
parent 1441547f53 fe821f3328
commit d15ea176a8
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/system_processes_run_from_unexpected_locations.yml
+1 -1
View File
@@ -20,7 +20,7 @@ data_source:
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path !="C:\\Windows\\System32*"
Processes.process_path !="C:\\Windows\\SysWOW64*" by Processes.dest Processes.user
Processes.parent_process Processes.process_name Processes.process Processes.process_id
Processes.parent_process Processes.process_path Processes.process_name Processes.process Processes.process_id
Processes.parent_process_id Processes.process_hash | `drop_dm_object_name("Processes")`
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `is_windows_system_file`
| `system_processes_run_from_unexpected_locations_filter`'