admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

r+ttp2

Browse Source
This commit is contained in:
tccontre
2021-06-23 12:44:19 +02:00
parent 2cf1d164d5
commit fd156a28bb
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml
+2 -1
View File
@@ -6,7 +6,8 @@ author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: UPDATE_DESCRIPTION
description: This search is to detect a suspicious modification of firewall to allow file and printer sharing.
This technique was seen in ransomware to be able to discover more machine connected to the compromised host to encrypt more files
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe Processes.process= "*firewall*" Processes.process= "*group=\"File and Printer Sharing\"*" Processes.process="*enable=Yes*"
by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name