admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

formatting

Browse Source
This commit is contained in:
mhaag-spl
2021-06-09 14:41:09 -06:00
parent d8e3e4c2f7
commit f78ddd6777
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/powershell_fileless_process_injection___getprocaddress.yml → detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml
+2 -2
View File
@@ -1,4 +1,4 @@
name: Powershell Fileless Process Injection - GetProcAddress
name: Powershell Fileless Process Injection via GetProcAddress
id: a26d9db4-c883-11eb-9d75-acde48001122
version: 1
date: '2021-06-08'
@@ -19,7 +19,7 @@ search: '`powershell` EventCode=4104
| where getproc = 1
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `powershell_fileless_process_injection_(getprocaddress)_filter`'
| `powershell_fileless_process_injection_via_getprocaddress_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: Limited false positives. Filter as needed.
references:
tests/endpoint/powershell_fileless_process_injection___getprocaddress.test.yml → tests/endpoint/powershell_fileless_process_injection_via_getprocaddress.test.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: Powershell Fileless Process Injection (GetProcAddress) Unit Test
name: Powershell Fileless Process Injection via GetProcAddress Unit Test
tests:
- name: Powershell Fileless Process Injection (GetProcAddress)
file: endpoint/powershell_fileless_process_injection___getprocaddress.yml
- name: Powershell Fileless Process Injection via GetProcAddress
file: endpoint/powershell_fileless_process_injection_via_getprocaddress.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-24h'
latest_time: 'now'