From ebb920f47de86d30751564e84b4e2ebe39ddd9c9 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 6 Apr 2022 08:39:34 -0600
Subject: [PATCH] rename

---
 ..._java_writing_jsp_file.yml => java_writing_jsp_file.yml} | 6 +++---
 ...ing_jsp_file.test.yml => java_writing_jsp_file.test.yml} | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)
 rename detections/endpoint/{linux_java_writing_jsp_file.yml => java_writing_jsp_file.yml} (95%)
 rename tests/endpoint/{linux_java_writing_jsp_file.test.yml => java_writing_jsp_file.test.yml} (75%)

diff --git a/detections/endpoint/linux_java_writing_jsp_file.yml b/detections/endpoint/java_writing_jsp_file.yml
similarity index 95%
rename from detections/endpoint/linux_java_writing_jsp_file.yml
rename to detections/endpoint/java_writing_jsp_file.yml
index 724aa7bb5b..924dfe03bd 100644
--- a/detections/endpoint/linux_java_writing_jsp_file.yml
+++ b/detections/endpoint/java_writing_jsp_file.yml
@@ -1,4 +1,4 @@
-name: Linux Java Writing JSP File
+name: Java Writing JSP File
 id: eb65619c-4f8d-4383-a975-d352765d344b
 version: 1
 date: '2022-04-05'
@@ -7,7 +7,7 @@ type: TTP
 datamodel:
 - Endpoint
 description: The following analytic identifies the process java writing a .jsp to disk. This is potentially indicative of a web shell being written to disk. 
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=java
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name IN ("java","java.exe", "javaw.exe")
   by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid
   Processes.user | `drop_dm_object_name(Processes)` | join process_guid [| tstats
   `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where
@@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   | `drop_dm_object_name(Filesystem)` | fields _time process_guid file_path file_name
   file_create_time user dest process_name] | stats count min(_time) as firstTime max(_time)
   as lastTime by dest process_name process_guid file_name file_path file_create_time
-  user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_java_writing_jsp_file_filter`'
+  user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `java_writing_jsp_file_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives are possible and filtering may be required. Restrict by assets or filter known jsp files that are common for the environment.
 references:
diff --git a/tests/endpoint/linux_java_writing_jsp_file.test.yml b/tests/endpoint/java_writing_jsp_file.test.yml
similarity index 75%
rename from tests/endpoint/linux_java_writing_jsp_file.test.yml
rename to tests/endpoint/java_writing_jsp_file.test.yml
index 9374429a2c..47af9067d1 100644
--- a/tests/endpoint/linux_java_writing_jsp_file.test.yml
+++ b/tests/endpoint/java_writing_jsp_file.test.yml
@@ -1,7 +1,7 @@
-name: Linux Java Writing JSP File Unit Test
+name: Java Writing JSP File Unit Test
 tests:
-- name: Linux Java Writing JSP File
-  file: endpoint/linux_java_writing_jsp_file.yml
+- name: Java Writing JSP File
+  file: endpoint/java_writing_jsp_file.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: -24h
   latest_time: now