admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
github-actions[bot]
2021-06-22 02:30:40 +00:00
committed by GitHub
parent 6d77362dff 3008438d10
commit ddaef35ab4
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
+2 -2
View File
@@ -24,8 +24,8 @@ search: '| from read_ssa_enriched_events()
OR field0="java.exe" OR field0="powershell.exe"
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
dest_user_id), body=create_map([ "process_name", process_name, "parent_process_name",
parent_process_name]) | into write_ssa_detected_events();'
dest_user_id), body=create_map([ "process_name", process_name, "parent_process",
parent_process]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting sysmon logs. This search has been modified
to process raw sysmon data from attack_range's nxlogs on DSP.
known_false_positives: There are circumstances where an application may legitimately