admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

fixing wrong field name

Browse Source
This commit is contained in:
mvelazco
2022-06-01 13:40:06 -04:00
parent e3b816088b
commit f4cd60d8b5
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_installutil_credential_theft.yml
+4 -4
View File
@@ -1,8 +1,8 @@
name: Windows InstallUtil Credential Theft
id: ccfeddec-43ec-11ec-b494-acde48001122
version: 1
date: '2021-11-12'
author: Michael Haag, Splunk
version: 2
date: '2022-06-01'
author: Michael Haag, Mauricio Velazo, Splunk
type: TTP
datamodel:
- Endpoint
@@ -23,7 +23,7 @@ description: 'The following analytic identifies the Windows InstallUtil.exe bina
processes. Capture any artifacts and review further.'
search: '`sysmon` EventCode=7 process_name=installutil.exe ImageLoaded IN ("*\\samlib.dll",
"*\\vaultcli.dll") | stats count min(_time) as firstTime max(_time) as lastTime
by Computer, process_name, ImageLoaded, OriginalFileName, process_id | rename Computer
by Computer, process_name, ImageLoaded, OriginalFileName, ProcessId | rename Computer
as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_installutil_credential_theft_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting