From f78ddd677756059c8a504a5ba76b23aebe288480 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 9 Jun 2021 14:41:09 -0600 Subject: [PATCH] formatting --- ...shell_fileless_process_injection_via_getprocaddress.yml} | 4 ++-- ..._fileless_process_injection_via_getprocaddress.test.yml} | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) rename detections/endpoint/{powershell_fileless_process_injection___getprocaddress.yml => powershell_fileless_process_injection_via_getprocaddress.yml} (95%) rename tests/endpoint/{powershell_fileless_process_injection___getprocaddress.test.yml => powershell_fileless_process_injection_via_getprocaddress.test.yml} (65%) diff --git a/detections/endpoint/powershell_fileless_process_injection___getprocaddress.yml b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml similarity index 95% rename from detections/endpoint/powershell_fileless_process_injection___getprocaddress.yml rename to detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml index 96485a65f1..9f725d5cd5 100644 --- a/detections/endpoint/powershell_fileless_process_injection___getprocaddress.yml +++ b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml @@ -1,4 +1,4 @@ -name: Powershell Fileless Process Injection - GetProcAddress +name: Powershell Fileless Process Injection via GetProcAddress id: a26d9db4-c883-11eb-9d75-acde48001122 version: 1 date: '2021-06-08' @@ -19,7 +19,7 @@ search: '`powershell` EventCode=4104 | where getproc = 1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `powershell_fileless_process_injection_(getprocaddress)_filter`' + | `powershell_fileless_process_injection_via_getprocaddress_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. known_false_positives: Limited false positives. Filter as needed. references: diff --git a/tests/endpoint/powershell_fileless_process_injection___getprocaddress.test.yml b/tests/endpoint/powershell_fileless_process_injection_via_getprocaddress.test.yml similarity index 65% rename from tests/endpoint/powershell_fileless_process_injection___getprocaddress.test.yml rename to tests/endpoint/powershell_fileless_process_injection_via_getprocaddress.test.yml index 38abd78fd1..4622c2090a 100644 --- a/tests/endpoint/powershell_fileless_process_injection___getprocaddress.test.yml +++ b/tests/endpoint/powershell_fileless_process_injection_via_getprocaddress.test.yml @@ -1,7 +1,7 @@ -name: Powershell Fileless Process Injection (GetProcAddress) Unit Test +name: Powershell Fileless Process Injection via GetProcAddress Unit Test tests: -- name: Powershell Fileless Process Injection (GetProcAddress) - file: endpoint/powershell_fileless_process_injection___getprocaddress.yml +- name: Powershell Fileless Process Injection via GetProcAddress + file: endpoint/powershell_fileless_process_injection_via_getprocaddress.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now'