From e538e8138b7ff0d5f6de4559bb2d63ae7899caae Mon Sep 17 00:00:00 2001 From: tcontreras Date: Tue, 30 Mar 2021 16:10:51 +0200 Subject: [PATCH] minor_modificatio_add_process_check --- detections/endpoint/clop_common_exec_parameter.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/clop_common_exec_parameter.yml b/detections/endpoint/clop_common_exec_parameter.yml index d9455c76a3..432b3f5187 100644 --- a/detections/endpoint/clop_common_exec_parameter.yml +++ b/detections/endpoint/clop_common_exec_parameter.yml @@ -16,7 +16,7 @@ description: The following analytics are designed to identifies some CLOP ransom search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline values(Processes.parent_process_name) as parent_process values(Processes.process_name) count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process = "*runrun*" OR Processes.process = "*temp.dat*" by Processes.parent_process_name + where Processes.process_name != "*temp.dat*" Processes.process = "*runrun*" OR Processes.process = "*temp.dat*" by Processes.parent_process_name Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `clop_common_exec_parameter_filter`'