admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-05-18 19:10:02 -04:00
committed by GitHub
parent f5ebfc44d1 4e5ac84cae
commit f768f72c9c
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml
+3 -3
View File
@@ -1,8 +1,8 @@
name: Windows Rundll32 Comsvcs Memory Dump
id: 76bb9e35-f314-4c3d-a385-83c72a13ce4e
version: 4
version: 5
date: '2022-04-14'
author: Jose Hernandez, Splunk
author: Jose Hernandez, Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint_Processes
@@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_eve
null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where process IS NOT NULL AND process_name IS NOT
NULL AND process_name LIKE "%rundll32.exe%"
AND match_regex(process, /(?i)MiniDump[\s;]+/)=true
AND match_regex(process, /(?i)minidump\s+/)=true
AND match_regex(process, /(?i)comsvcs.dll\s+/)=true
| eval start_time = timestamp, end_time = timestamp, entities = mvappend(machine),
body=create_map(["event_id", event_id, "process_name", process_name, "process",