admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update detect_renamed_winrar.yml

Browse Source 
Resolving #1524. Thank you!
This commit is contained in:
mhaag-spl
2021-07-22 06:19:55 -06:00
parent 0d8da0488e
commit d207154de3
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/detect_renamed_winrar.yml
+1 -1
View File
@@ -12,7 +12,7 @@ description: The following analtyic identifies renamed instances of `WinRAR.exe`
In this instance, we are using `OriginalFileName` from Sysmon to determine if the
process is WinRAR. During triage, validate additional metadata from the binary that
this is `WinRAR`. Review parallel processes and file modifications.
search: '`sysmon` EventID=1 (Product=WinRAR OR OriginalFileName=WinRAR.exe) process_name!=rar.exe
search: '`sysmon` EventID=1 (Product=WinRAR OR OriginalFileName=WinRAR.exe) process_name!=rar.exe process_name!=winrar.exe
| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product
| rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`