admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update create_local_admin_accounts_using_net_exe.yml

Browse Source 
Added parent_process_name into the query, as the rest of the yaml wanted it.
This commit is contained in:
TheLawsOfChaos
2023-02-02 16:10:33 -05:00
committed by GitHub
parent 330a31e9f2
commit e8cd643c40
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/create_local_admin_accounts_using_net_exe.yml
+1 -1
View File
@@ -9,7 +9,7 @@ datamodel:
description: This search looks for the creation of local administrator accounts using
net.exe .
search: '| tstats `security_content_summariesonly` count values(Processes.user) as
user values(Processes.parent_process) as parent_process min(_time) as firstTime
user values(Processes.parent_process) as parent_process values(parent_process_name) as parent_process_name min(_time) as firstTime
max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe
OR Processes.process_name=net1.exe) AND Processes.process=*/add* AND (Processes.process=*administrators*
OR Processes.process=*administratoren* OR Processes.process=*administrateurs* OR