admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

headless_bee

Browse Source
This commit is contained in:
tccontre
2025-02-14 14:15:20 +01:00
parent 831743d550
commit e2ea10c2d2
1 changed files with 1 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_anonymous_pipe_activity.yml
+1 -4
View File
@@ -10,7 +10,7 @@ data_source:
- Sysmon EventID 17
- Sysmon EventID 18
search: '`sysmon` EventCode IN (17,18) EventType IN ( "CreatePipe", "ConnectPipe") PipeName="*Anonymous Pipe*" NOT( Image IN ("*\\Program Files\\*"))
| stats min(_time) as firstTime max(_time) as lastTime count by dest user EventCode PipeName process_id process_guid Image EventType
| stats min(_time) as firstTime max(_time) as lastTime count by dest EventCode PipeName ProcessGuid ProcessId Image EventType
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_anonymous_pipe_activity_filter`'
@@ -40,9 +40,6 @@ rba:
- field: dest
type: system
score: 30
- field: user
type: user
score: 30
threat_objects: []
tags:
analytic_story: