From 0bcbedb99070d78acea18765f1be982014b787c6 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Fri, 5 Nov 2021 16:31:28 -0400 Subject: [PATCH] Update detect_regasm_with_no_command_line_arguments.yml --- .../endpoint/detect_regasm_with_no_command_line_arguments.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml index 8fe4eeba6b..e7e3af15e3 100644 --- a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml @@ -10,8 +10,8 @@ description: The following analytic identifies regasm.exe with no command line a This particular behavior occurs when another process injects into regasm.exe, no command line arguments will be present. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related - to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe - and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. + to credential dumping or file writes. Regasm.exe are natively found in `C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe` + and `C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe`. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_regasm` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name