From e7a626bd16f9dd3a9ffd31e93fbebea67e44436b Mon Sep 17 00:00:00 2001 From: tcontreras Date: Fri, 7 May 2021 13:56:08 +0200 Subject: [PATCH] xmrig2 --- ...un_task_on_demand_.yml => schtasks_run_task_on_demand.yml} | 4 ++-- ..._demand_.test.yml => schtasks_run_task_on_demand.test.yml} | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) rename detections/endpoint/{schtasks_run_task_on_demand_.yml => schtasks_run_task_on_demand.yml} (95%) rename tests/endpoint/{schtasks_run_task_on_demand_.test.yml => schtasks_run_task_on_demand.test.yml} (81%) diff --git a/detections/endpoint/schtasks_run_task_on_demand_.yml b/detections/endpoint/schtasks_run_task_on_demand.yml similarity index 95% rename from detections/endpoint/schtasks_run_task_on_demand_.yml rename to detections/endpoint/schtasks_run_task_on_demand.yml index 89cbea53fd..a845b7e44e 100644 --- a/detections/endpoint/schtasks_run_task_on_demand_.yml +++ b/detections/endpoint/schtasks_run_task_on_demand.yml @@ -1,4 +1,4 @@ -name: Schtasks Run Task On Demand +name: Schtasks Run Task On Demand id: bb37061e-af1f-11eb-a159-acde48001122 version: 1 date: '2021-05-07' @@ -15,7 +15,7 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `schtasks_run_task_on_demand__filter`' + | `schtasks_run_task_on_demand_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/tests/endpoint/schtasks_run_task_on_demand_.test.yml b/tests/endpoint/schtasks_run_task_on_demand.test.yml similarity index 81% rename from tests/endpoint/schtasks_run_task_on_demand_.test.yml rename to tests/endpoint/schtasks_run_task_on_demand.test.yml index a7a1e950cb..3b9f3d1af9 100644 --- a/tests/endpoint/schtasks_run_task_on_demand_.test.yml +++ b/tests/endpoint/schtasks_run_task_on_demand.test.yml @@ -1,7 +1,7 @@ -name: Schtasks Run Task On Demand Unit Test +name: Schtasks Run Task On Demand Unit Test tests: - name: Schtasks Run Task On Demand - file: endpoint/schtasks_run_task_on_demand_.yml + file: endpoint/schtasks_run_task_on_demand.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now'