admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

iceid_dfir_coverage

Browse Source
This commit is contained in:
tccontre
2023-05-23 15:46:58 +02:00
parent 566287f6b8
commit d667a02230
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/network_share_discovery_via_dir_command.yml
+1 -1
View File
@@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk
status: production
type: Hunting
data_source:
- - Windows Security 5140
- Windows Security 5140
description: The following analytic identifies object access on Windows administrative SMB shares (Admin$, IPC$, C$).
This represents suspicious behavior as its commonly used by tools like PsExec/PaExec and others
to stage service binaries before creating and starting a Windows service on remote