admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

make small changes

Browse Source
This commit is contained in:
Patrick Bareiss
2020-05-14 11:30:28 +02:00
parent e9e81cd1de
commit fcfea82cd4
3 changed files with 4 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
+1 -1
View File
@@ -17,7 +17,7 @@ search: "| tstats `security_content_summariesonly` count min(_time) as firstTime
\ (Registry.registry_value_name=Unrestricted OR Registry.registry_value_name=Bypass)\
\ by Registry.registry_path Registry.registry_key_name Registry.registry_value_name\
\ Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`|\
\ `security_content_ctime(lastTime)` | `attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`\_"
\ `security_content_ctime(lastTime)` | `attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter` "
known_false_positives: Administrators may attempt to change the default execution
policy on a system for a variety of reasons. However, setting the policy to "unrestricted"
or "bypass" as this search is designed to identify, would be unusual. Hits should
detections/detect_credential_dumping_through_LSASS_access.yml
+1 -1
View File
@@ -17,7 +17,7 @@ search: '`sysmon` EventCode=10 TargetImage=*lsass.exe (GrantedAccess=0x1010 OR G
| stats count min(_time) as firstTime max(_time) as lastTime by Computer, SourceImage,
SourceProcessId, TargetImage, TargetProcessId, EventCode, GrantedAccess | rename
Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
| `detect_credential_dumping_through_LSAS`detect_credential_dumping_through_lsass_access_filter` '
| `detect_credential_dumping_through_lsass_access_filter` '
known_false_positives: The activity may be legitimate. Other tools can access lsass
for legitimate reasons, and it's possible this event could be generated in those
cases. In these cases, false positives should be fairly obvious and you may need
response_tasks/investigate_pass_the_ticket_attempts.yml
+2 -4
View File
@@ -12,10 +12,8 @@ how_to_implement: To successfully implement this search you need to be ingesting
author: Patrick Bareiss, Splunk
inputs:
- dest
search: '`wineventlog_security` EventCode=4768 OR EventCode=4769 | rex field=user
"(?<new_user>[^\@]+)" | stats count BY new_user, dest, EventCode | stats max(count)
AS max_count sum(count) AS sum_count BY new_user, dest | where sum_count/max_count!=2
| rename new_user AS user'
search: '`wineventlog_security` EventCode=4768 OR EventCode=4769 | stats count BY user, dest, EventCode | stats max(count)
AS max_count sum(count) AS sum_count BY user, dest | where sum_count/max_count!=2'
tags:
analytics_story:
- Credential Dumping