admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

dcrat-analytics3

Browse Source
This commit is contained in:
tccontre
2022-08-02 13:31:49 +02:00
parent e189299cf2
commit da230f6ed6
3 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_system_logoff_commandline.yml
+1 -1
View File
@@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
description: The following analytic identifies Windows commandlined to logoff a windows host machine.
description: The following analytic identifies Windows commandline to logoff a windows host machine.
This technique was seen in several APT, RAT like dcrat and other commodity malware to shutdown the machine to add more impact,
interrupt access, aid destruction of the system like wiping disk or inhibit system recovery.
This TTP is a good pivot to check why application trigger this commandline which is not so common way to logoff a machine.
detections/endpoint/windows_system_reboot_commandline.yml
+1 -1
View File
@@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
description: The following analytic identifies Windows commandlined to reboot a windows host machine.
description: The following analytic identifies Windows commandline to reboot a windows host machine.
This technique was seen in several APT, RAT like dcrat and other commodity malware to shutdown the machine to add more impact,
interrupt access, aid destruction of the system like wiping disk or inhibit system recovery.
This TTP is a good pivot to check why application trigger this commandline which is not so common way to reboot a machine.
detections/endpoint/windows_system_shutdown_commandline.yml
+1 -1
View File
@@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
description: The following analytic identifies Windows commandlined to shutdown a windows host machine.
description: The following analytic identifies Windows commandline to shutdown a windows host machine.
This technique was seen in several APT, RAT like dcrat and other commodity malware to shutdown the machine to add more impact,
interrupt access, aid destruction of the system like wiping disk or inhibit system recovery.
This TTP is a good pivot to check why application trigger this commandline which is not so common way to shutdown a machine.