From f4cd60d8b509534eeccaf3d8d3358d660cd00321 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 1 Jun 2022 13:40:06 -0400 Subject: [PATCH] fixing wrong field name --- .../endpoint/windows_installutil_credential_theft.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_installutil_credential_theft.yml b/detections/endpoint/windows_installutil_credential_theft.yml index d2bf537944..d0c6050e63 100644 --- a/detections/endpoint/windows_installutil_credential_theft.yml +++ b/detections/endpoint/windows_installutil_credential_theft.yml @@ -1,8 +1,8 @@ name: Windows InstallUtil Credential Theft id: ccfeddec-43ec-11ec-b494-acde48001122 -version: 1 -date: '2021-11-12' -author: Michael Haag, Splunk +version: 2 +date: '2022-06-01' +author: Michael Haag, Mauricio Velazo, Splunk type: TTP datamodel: - Endpoint @@ -23,7 +23,7 @@ description: 'The following analytic identifies the Windows InstallUtil.exe bina processes. Capture any artifacts and review further.' search: '`sysmon` EventCode=7 process_name=installutil.exe ImageLoaded IN ("*\\samlib.dll", "*\\vaultcli.dll") | stats count min(_time) as firstTime max(_time) as lastTime - by Computer, process_name, ImageLoaded, OriginalFileName, process_id | rename Computer + by Computer, process_name, ImageLoaded, OriginalFileName, ProcessId | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_installutil_credential_theft_filter`' how_to_implement: To successfully implement this search, you need to be ingesting