admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

fixes

Browse Source
This commit is contained in:
mhaag-spl
2021-09-07 15:30:42 -06:00
parent b5600e1d0b
commit e7da16d133
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/get_domaintrust_with_powershell_script_block.yml
+1 -1
View File
@@ -11,7 +11,7 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
search: '`powershell` EventCode=4104 Message = "*get-domaintrust*" | stats count min(_time)
as firstTime max(_time) as lastTime by Path Message OpCode ComputerName User EventCode| `security_content_ctime(firstTime)`
as firstTime max(_time) as lastTime by Message OpCode ComputerName User EventCode| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `get_domaintrust_with_powershell_script_block_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: It is possible certain system management frameworks utilize this command to gather trust information.
detections/endpoint/get_foresttrust_with_powershell_script_block.yml
+1 -1
View File
@@ -12,7 +12,7 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
search: '`powershell` EventCode=4104 Message = "*get-foresttrust*"
| stats count min(_time) as firstTime max(_time) as lastTime by Path Message OpCode ComputerName User EventCode
| stats count min(_time) as firstTime max(_time) as lastTime by Message OpCode ComputerName User EventCode
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `get_foresttrust_with_powershell_script_block_filter`'