admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updated logic & fixed pathing

Browse Source
This commit is contained in:
Lou Stella
2022-04-12 12:01:48 -05:00
parent 63968601d2
commit da5eb1be3a
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___windows_mshta_child_process.yml
+4 -4
View File
@@ -1,6 +1,6 @@
name: Windows MSHTA Child Process
id: f63f7e9c-9526-11ec-9fc7-acde48001122
version: 1
version: 2
date: '2022-02-23'
author: Michael Haag, Splunk
type: TTP
@@ -14,10 +14,10 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
null), parent_process_name=lower(ucast(map_get(input_event, "parent_process_name"), "string",
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name IS NOT
NULL | where parent_process_name="mshta.exe" AND ( process_name="powershell.exe" OR
NULL | where like(parent_process_name, "%\\\\mshta.exe") AND ( process_name="powershell.exe" OR
process_name="cmd.exe" OR process_name="scrcons.exe" OR process_name="colorcpl.exe"
OR process_name="msbuild.exe" OR process_name="microsoft.workflow.compiler.exe"
OR process_name="searchprotocolhost.exe" OR process_name="cscript.exe" OR process_name="wscript.exe")