admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #386 from splunk/CRL-1734

Browse Source 
CRL-1734: updating spl with escape chars and better output
This commit is contained in:
rvaldez617
2020-03-16 13:14:47 -06:00
committed by GitHub
parent d624d4b563 f3963c97be
commit eefbae66a9
1 changed files with 7 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/netsh_launching_process.yml
+7 -11
View File
@@ -36,18 +36,14 @@ detect:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
search: '| tstats `security_content_summariesonly` count values(Processes.process) min(_time)
as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where
Processes.parent_process="C:\Windows\System32\
etsh.exe" by Processes.parent_process Processes.process_name Processes.user
Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`'
search: '| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*C:\\Windows\\System32\\netsh.exe*" by Processes.user Processes.dest Processes.parent_process Processes.parent_process_name Processes.process_name
| `drop_dm_object_name("Processes")`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
suppress:
suppress_fields: dest, process
suppress_period: 86400s
eli5: 'This search looks for all processes with the parent process "c:\Windows\System32\
etsh.exe" and returns the process, the command line used to execute it, the host
eli5: 'This search looks for all processes with the parent process "c:\Windows\System32\netsh.exe" and returns the process, the command line used to execute it, the host
name, and the user context under which it ran.'
entities:
- dest
@@ -99,7 +95,7 @@ mappings:
nist:
- PR.PT
- DE.CM
modification_date: '2018-11-02'
modification_date: '2020-03-02'
name: Processes created by netsh
original_authors:
- company: Splunk
@@ -109,4 +105,4 @@ references: []
security_domain: endpoint
spec_version: 2
type: splunk
version: '2.0'
version: '3.0'