From e8cd643c407cf36fc7df16c3c9c189f7009df4ed Mon Sep 17 00:00:00 2001 From: TheLawsOfChaos Date: Thu, 2 Feb 2023 16:10:33 -0500 Subject: [PATCH] Update create_local_admin_accounts_using_net_exe.yml Added parent_process_name into the query, as the rest of the yaml wanted it. --- .../endpoint/create_local_admin_accounts_using_net_exe.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml index f7d2a8d1fd..6e8026e954 100644 --- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml +++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml @@ -9,7 +9,7 @@ datamodel: description: This search looks for the creation of local administrator accounts using net.exe . search: '| tstats `security_content_summariesonly` count values(Processes.user) as - user values(Processes.parent_process) as parent_process min(_time) as firstTime + user values(Processes.parent_process) as parent_process values(parent_process_name) as parent_process_name min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe OR Processes.process_name=net1.exe) AND Processes.process=*/add* AND (Processes.process=*administrators* OR Processes.process=*administratoren* OR Processes.process=*administrateurs* OR