diff --git a/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml index 96e9e04f15..20db8405eb 100644 --- a/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml +++ b/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml @@ -17,7 +17,7 @@ search: "| tstats `security_content_summariesonly` count min(_time) as firstTime \ (Registry.registry_value_name=Unrestricted OR Registry.registry_value_name=Bypass)\ \ by Registry.registry_path Registry.registry_key_name Registry.registry_value_name\ \ Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`|\ - \ `security_content_ctime(lastTime)` | `attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`\_" + \ `security_content_ctime(lastTime)` | `attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter` " known_false_positives: Administrators may attempt to change the default execution policy on a system for a variety of reasons. However, setting the policy to "unrestricted" or "bypass" as this search is designed to identify, would be unusual. Hits should diff --git a/detections/detect_credential_dumping_through_LSASS_access.yml b/detections/detect_credential_dumping_through_LSASS_access.yml index 42f7ba29a1..bcff7da23a 100644 --- a/detections/detect_credential_dumping_through_LSASS_access.yml +++ b/detections/detect_credential_dumping_through_LSASS_access.yml @@ -17,7 +17,7 @@ search: '`sysmon` EventCode=10 TargetImage=*lsass.exe (GrantedAccess=0x1010 OR G | stats count min(_time) as firstTime max(_time) as lastTime by Computer, SourceImage, SourceProcessId, TargetImage, TargetProcessId, EventCode, GrantedAccess | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` - | `detect_credential_dumping_through_LSAS`detect_credential_dumping_through_lsass_access_filter` ' + | `detect_credential_dumping_through_lsass_access_filter` ' known_false_positives: The activity may be legitimate. Other tools can access lsass for legitimate reasons, and it's possible this event could be generated in those cases. In these cases, false positives should be fairly obvious and you may need diff --git a/response_tasks/investigate_pass_the_ticket_attempts.yml b/response_tasks/investigate_pass_the_ticket_attempts.yml index 7ca5f470c9..e6de16dd57 100644 --- a/response_tasks/investigate_pass_the_ticket_attempts.yml +++ b/response_tasks/investigate_pass_the_ticket_attempts.yml @@ -12,10 +12,8 @@ how_to_implement: To successfully implement this search you need to be ingesting author: Patrick Bareiss, Splunk inputs: - dest -search: '`wineventlog_security` EventCode=4768 OR EventCode=4769 | rex field=user - "(?[^\@]+)" | stats count BY new_user, dest, EventCode | stats max(count) - AS max_count sum(count) AS sum_count BY new_user, dest | where sum_count/max_count!=2 - | rename new_user AS user' +search: '`wineventlog_security` EventCode=4768 OR EventCode=4769 | stats count BY user, dest, EventCode | stats max(count) + AS max_count sum(count) AS sum_count BY user, dest | where sum_count/max_count!=2' tags: analytics_story: - Credential Dumping