Update processes_launching_netsh.yml

detections/endpoint/processes_launching_netsh.yml

@@ -1,8 +1,8 @@
 name: Processes launching netsh
 id: b89919ed-fe5f-492c-b139-95dbb162040e
-version: 3
-date: '2020-07-10'
-author: Josef Kuepker, Splunk
+version: 4
+date: '2021-09-16'
+author: Michael Haag, Josef Kuepker, Splunk
 type: TTP
 datamodel:
 - Endpoint
@@ -14,11 +14,10 @@ description: This search looks for processes launching netsh.exe. Netsh is a com
   executing commands via the command line.
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   AS Processes.process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.process=*netsh* by Processes.parent_process_name Processes.parent_process
+  where `process_netsh` by Processes.parent_process_name Processes.parent_process Processes.original_file_name
   Processes.process_name Processes.user Processes.dest |`drop_dm_object_name("Processes")`
   |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` |`processes_launching_netsh_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records process activity from your hosts to populate the endpoint data model
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Some VPN applications are known to launch netsh.exe. Outside
   of these instances, it is unusual for an executable to launch netsh.exe and run
   commands.