From bfa0daabd41d1af54d685162c0588c2d7ce6f3a7 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Wed, 16 Jun 2021 15:50:19 -0400 Subject: [PATCH] fixe dv --- .../endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index 33377bd2ce..52d4a25641 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -24,8 +24,8 @@ search: '| from read_ssa_enriched_events() OR field0="java.exe" OR field0="powershell.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, - dest_user_id), body=create_map([ "process_name", process_name, "parent_process_name", - parent_process_name]) | into write_ssa_detected_events();' + dest_user_id), body=create_map([ "process_name", process_name, "parent_process", + parent_process]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting sysmon logs. This search has been modified to process raw sysmon data from attack_range's nxlogs on DSP. known_false_positives: There are circumstances where an application may legitimately