admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

testing

Browse Source
This commit is contained in:
mhaag-spl
2021-09-15 10:36:10 -06:00
parent 1fde288203
commit e44c3c4be7
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/office_product_writing_cab_or_inf.yml
+1 -1
View File
@@ -15,7 +15,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
| `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly`
count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
where Filesystem.file_name IN ("*.inf","*.cab") by _time span=1h Filesystem.dest
where Filesystem.file_name IN ("*.exe","*.dll","*.pif","*.scr","*.js","*.vbs","*.vbe","*.ps1") by _time span=1h Filesystem.dest
Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)`
| fields _time dest file_create_time file_name file_path process_name process_path
process] | dedup file_create_time | table dest, process_name, process, file_create_time,
tests/endpoint/office_product_writing_cab_or_inf.test.yml
+2 -2
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: '-24h'
latest_time: 'now'
attack_data:
- file_name: windows-sysmon_control.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_cabinf.log
- file_name: sysmon.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog