From 9f6ea7073b11ae5b302217da476d9077e984036e Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 9 Jul 2024 08:17:50 -0700 Subject: [PATCH] testing experiemental --- .../endpoint/3cx_supply_chain_attack_network_indicators.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/3cx_supply_chain_attack_network_indicators.yml b/detections/endpoint/3cx_supply_chain_attack_network_indicators.yml index e14aa34e3d..d775d00161 100644 --- a/detections/endpoint/3cx_supply_chain_attack_network_indicators.yml +++ b/detections/endpoint/3cx_supply_chain_attack_network_indicators.yml @@ -15,7 +15,7 @@ description: The following analytic identifies DNS queries to domains associated malicious, this activity could allow attackers to establish a foothold in the network, exfiltrate sensitive data, or further propagate malware, leading to extensive damage and data breaches. -search: '| tstats `security_content_summariesonly` values(DNS.answer) as IPs min(_time) +search: 'x| tstats `security_content_summariesonly` values(DNS.answer) as IPs min(_time) as firstTime from datamodel=Network_Resolution by DNS.src, DNS.query | `drop_dm_object_name(DNS)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | lookup 3cx_ioc_domains domain as query OUTPUT Description isIOC | search isIOC=true | `3cx_supply_chain_attack_network_indicators_filter`'