admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update cobalt_strike_named_pipes.yml

Browse Source
This commit is contained in:
mhaag-spl
2022-05-16 13:03:38 -06:00
parent 86391a5843
commit d265653186
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/cobalt_strike_named_pipes.yml
+5 -5
View File
@@ -1,7 +1,7 @@
name: Cobalt Strike Named Pipes
id: 5876d429-0240-4709-8b93-ea8330b411b5
version: 1
date: '2021-02-22'
version: 2
date: '2022-05-16'
author: Michael Haag, Splunk
type: TTP
datamodel: []
@@ -17,9 +17,9 @@ description: 'The following analytic identifies the use of default or publicly k
It is possible it was injected into by another process. Review recent parallel processes
to identify suspicious patterns or behaviors. A parallel process may have a network
connection, review and follow the connection back to identify any file modifications.'
search: '`sysmon` EventID=17 OR EventID=18 PipeName IN (\\msagent_*, \\wkssvc*, \\DserNamePipe*,
\\srvsvc_*, \\mojo.*, \\postex_*, \\status_*, \\MSSE-*, \\spoolss_*, \\win_svc*,
\\ntsvcs*, \\winsock*, \\UIA_PIPE*) | stats count min(_time) as firstTime max(_time)
search: '`sysmon` EventID=17 OR EventID=18 PipeName IN (\\msagent_*, \\DserNamePipe*,
\\srvsvc_*, \\postex_*, \\status_*, \\MSSE-*, \\spoolss_*, \\win_svc*,
\\ntsvcs*, \\winsock*, \\UIA_PIPE*) | stats count min(_time) as firstTime max(_time)
as lastTime by Computer, process_name, process_id process_path, PipeName | rename
Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `cobalt_strike_named_pipes_filter`'