admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
Bhavin Patel
2024-07-09 08:18:07 -07:00
committed by GitHub
parent b8e1ece3f1 9f6ea7073b
commit fa8981acbf
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/3cx_supply_chain_attack_network_indicators.yml
+1 -1
View File
@@ -15,7 +15,7 @@ description: The following analytic identifies DNS queries to domains associated
malicious, this activity could allow attackers to establish a foothold in the network,
exfiltrate sensitive data, or further propagate malware, leading to extensive damage
and data breaches.
search: '| tstats `security_content_summariesonly` values(DNS.answer) as IPs min(_time)
search: 'x| tstats `security_content_summariesonly` values(DNS.answer) as IPs min(_time)
as firstTime from datamodel=Network_Resolution by DNS.src, DNS.query | `drop_dm_object_name(DNS)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | lookup
3cx_ioc_domains domain as query OUTPUT Description isIOC | search isIOC=true | `3cx_supply_chain_attack_network_indicators_filter`'