From fd156a28bb3cd173a0d38d27a08f4aa21a7b59df Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 23 Jun 2021 12:44:19 +0200 Subject: [PATCH] r+ttp2 --- .../endpoint/allow_file_and_printing_sharing_in_firewall.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml index 765ef5e42c..57ee467a08 100644 --- a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml +++ b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml @@ -6,7 +6,8 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: UPDATE_DESCRIPTION +description: This search is to detect a suspicious modification of firewall to allow file and printer sharing. + This technique was seen in ransomware to be able to discover more machine connected to the compromised host to encrypt more files search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe Processes.process= "*firewall*" Processes.process= "*group=\"File and Printer Sharing\"*" Processes.process="*enable=Yes*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name