admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

rename

Browse Source
This commit is contained in:
mhaag-spl
2022-04-06 08:39:34 -06:00
parent bdfa26a0ed
commit ebb920f47d
2 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/linux_java_writing_jsp_file.yml → detections/endpoint/java_writing_jsp_file.yml
+3 -3
View File
@@ -1,4 +1,4 @@
name: Linux Java Writing JSP File
name: Java Writing JSP File
id: eb65619c-4f8d-4383-a975-d352765d344b
version: 1
date: '2022-04-05'
@@ -7,7 +7,7 @@ type: TTP
datamodel:
- Endpoint
description: The following analytic identifies the process java writing a .jsp to disk. This is potentially indicative of a web shell being written to disk.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=java
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name IN ("java","java.exe", "javaw.exe")
by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid
Processes.user | `drop_dm_object_name(Processes)` | join process_guid [| tstats
`security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where
@@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
| `drop_dm_object_name(Filesystem)` | fields _time process_guid file_path file_name
file_create_time user dest process_name] | stats count min(_time) as firstTime max(_time)
as lastTime by dest process_name process_guid file_name file_path file_create_time
user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_java_writing_jsp_file_filter`'
user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `java_writing_jsp_file_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: False positives are possible and filtering may be required. Restrict by assets or filter known jsp files that are common for the environment.
references:
tests/endpoint/linux_java_writing_jsp_file.test.yml → tests/endpoint/java_writing_jsp_file.test.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: Linux Java Writing JSP File Unit Test
name: Java Writing JSP File Unit Test
tests:
- name: Linux Java Writing JSP File
file: endpoint/linux_java_writing_jsp_file.yml
- name: Java Writing JSP File
file: endpoint/java_writing_jsp_file.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now