From 05474921dba203c1478a2b06c30055ee7ecd3342 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Thu, 17 Feb 2022 11:59:25 -0500 Subject: [PATCH] Update system_information_discovery_detection.yml --- detections/endpoint/system_information_discovery_detection.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/system_information_discovery_detection.yml b/detections/endpoint/system_information_discovery_detection.yml index b7d0bd81a8..72c25ff187 100644 --- a/detections/endpoint/system_information_discovery_detection.yml +++ b/detections/endpoint/system_information_discovery_detection.yml @@ -13,7 +13,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.user Processes.process_name Processes.process Processes.dest Processes.parent_process_name | `drop_dm_object_name(Processes)` | eventstats dc(process) as dc_processes_by_dest - by dest | where dc_processes_by_dest > 2 | stats values(process) as processes min(firstTime) + by dest | where dc_processes_by_dest > 2 | stats values(process) as process min(firstTime) as firstTime max(lastTime) as lastTime by user, dest parent_process_name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `system_information_discovery_detection_filter`' how_to_implement: To successfully implement this search you need to be ingesting information