From f6dda32dd2c2be5d535aab17c8f217813b0d53fc Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 1 Jun 2022 15:38:29 -0600 Subject: [PATCH] Update windows_command_and_scripting_interpreter_hunting_path_traversal.yml --- ...command_and_scripting_interpreter_hunting_path_traversal.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml index 441b05763f..ff4c9749ac 100644 --- a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml +++ b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Michael Haag, Splunk type: Hunting datamodel: - Endpoint -description: The following analytic identifies path traversal command-line execution. This technique was seen in malicious document that execute malicious code +description: The following analytic identifies path traversal command-line execution and should be used to tune and driver other more higher fidelity analytics. This technique was seen in malicious document that execute malicious code using msdt.exe and path traversal technique that serve as defense evasion. This Hunting query is a good pivot to look for possible suspicious process and command-line that runs execute path traversal technique to run malicious code. This may help you to find possible downloaded malware or other lolbin execution. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)