From 5a93a95a75298073d3a252ad9ca6aee9127e33df Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 17 Nov 2021 11:16:54 +0100 Subject: [PATCH 01/10] ssa_sdelete --- .../ssa__sdelete_application_execution.yml | 84 +++++++++++++++++++ stories/information_sabotage.yml | 23 +++++ ...ssa_sdelete_application_execution.test.yml | 10 +++ 3 files changed, 117 insertions(+) create mode 100644 detections/endpoint/ssa__sdelete_application_execution.yml create mode 100644 stories/information_sabotage.yml create mode 100644 tests/endpoint/ssa_sdelete_application_execution.test.yml diff --git a/detections/endpoint/ssa__sdelete_application_execution.yml b/detections/endpoint/ssa__sdelete_application_execution.yml new file mode 100644 index 0000000000..d7a11cbffb --- /dev/null +++ b/detections/endpoint/ssa__sdelete_application_execution.yml @@ -0,0 +1,84 @@ +name: Sdelete Application Execution +id: fcc52b9a-4616-11ec-8454-acde48001122 +version: 1 +date: '2021-11-15' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic is to detect the execution of sdelete.exe sysinternal + tools to secure delete some important document files that may related to insider to destroy evidence or information sabotage. + This tool is one of the most use tool to clear tracks and artifact in the targetted host. This tool is designed + to delete securely a file/files in a file system that remove the forensic evidence on the + machine. This is a good anomaly analytic to check why user execute this application which is not + a common practice in a corporate network. +search: '| from read_ssa_enriched_events() + | eval timestamp=parse_long(ucast(map_get(input_event,"_time"), "string", null)), + cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), + process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), + process_path=ucast(map_get(input_event, "process_path"), "string", null), + parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), + parent_cmd_line=ucast(map_get(input_event, "parent_process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND like(process_name, "%sdelete%") + AND (like (cmd_line, "% -c %") OR like (cmd_line, "% -f %")OR like (cmd_line, "% -p %") OR like (cmd_line, "% -r %") + OR like (cmd_line, "% -s %") OR like (cmd_line, "% -z %") OR like (cmd_line, "%/accepteula%") + OR like (cmd_line, "%-nobanner%")OR like (cmd_line, "%.doc%")OR like (cmd_line, "%.xls%") + OR like (cmd_line, "%.ppt%")OR like (cmd_line, "%.rtf%") OR like (cmd_line, "%.pdf%") + OR like (cmd_line, "%.key%")OR like (cmd_line, "%.log%") OR like (cmd_line, "%.txt%") + OR like (cmd_line, "%.jpg%") OR like (cmd_line, "%.png%") OR like (cmd_line, "%.gif%") + OR like (cmd_line, "%.bmp%") OR like (cmd_line, "%.7z%") OR like (cmd_line, "%.zip%") + OR like (cmd_line, "%.rar%") OR like (cmd_line, "%.tar%") OR like (cmd_line, "%.gz%") OR like (cmd_line, "%.xls%")) + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "process_path", process_path, "parent_process_name", parent_process_name, "parent_cmd_line", parent_cmd_line]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: user may execute and use this application +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - Information Sabotage + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1485 + - T1070.004 + - T1070 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - user + - parent_process_name + - parent_process + - process_name + - process + - process_id + - process_path + security_domain: endpoint + impact: 60 + confidence: 70 + # (impact * confidence)/100 + risk_score: 42 + context: + - Source:Endpoint + - Stage:Execution + message: sdelete process $process_name$ executed in $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim \ No newline at end of file diff --git a/stories/information_sabotage.yml b/stories/information_sabotage.yml new file mode 100644 index 0000000000..6bb2b5ab25 --- /dev/null +++ b/stories/information_sabotage.yml @@ -0,0 +1,23 @@ +name: Information Sabotage +id: b71ba595-ef80-4e39-8b66-887578a7a71b +version: 1 +date: '2021-11-17' +author: Teoderick Contreras, Splunk +type: Anomaly +description: Leverage searches that allow you to detect and investigate unusual activities + that might correlate to insider threat specially in terms of information sabotage. +narrative: Information sabotage is the type of crime many people associate with insider threat. + Where the current or former employees, contractors, or business partners intentionally exceeded + or misused an authorized level of access to networks, systems, or data with the intention of harming a specific individual, + the organization, or the organization's data, systems, and/or daily business operations. +references: +- https://insights.sei.cmu.edu/blog/insider-threat-deep-dive-it-sabotage/ +tags: + analytic_story: Information Sabotage + category: + - Abuse + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Security Monitoring \ No newline at end of file diff --git a/tests/endpoint/ssa_sdelete_application_execution.test.yml b/tests/endpoint/ssa_sdelete_application_execution.test.yml new file mode 100644 index 0000000000..2157607179 --- /dev/null +++ b/tests/endpoint/ssa_sdelete_application_execution.test.yml @@ -0,0 +1,10 @@ +name: Sdelete Application Execution Unit Test +tests: + - name: Sdelete Application Execution + file: endpoint/ssa_sdelete_application_execution.yml + pass_condition: '@count_gt(0)' + description: Test for sdelete execution command + attack_data: + - file_name: security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log + source: WinEventLog:Security From e2bbcdb9b9dd6cd38ee275b279e90561660a7233 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 17 Nov 2021 11:20:05 +0100 Subject: [PATCH 02/10] ssa_sdelete --- tests/endpoint/ssa_sdelete_application_execution.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/ssa_sdelete_application_execution.test.yml b/tests/endpoint/ssa_sdelete_application_execution.test.yml index 2157607179..cabb0667f4 100644 --- a/tests/endpoint/ssa_sdelete_application_execution.test.yml +++ b/tests/endpoint/ssa_sdelete_application_execution.test.yml @@ -1,7 +1,7 @@ name: Sdelete Application Execution Unit Test tests: - name: Sdelete Application Execution - file: endpoint/ssa_sdelete_application_execution.yml + file: endpoint/ssa__sdelete_application_execution.yml pass_condition: '@count_gt(0)' description: Test for sdelete execution command attack_data: From 49d0042b191a8ed9a8a58550172b3d586a8f653d Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 17 Nov 2021 11:25:01 +0100 Subject: [PATCH 03/10] ssa_sdelete --- ...on_execution.yml => ssa___sdelete_application_execution.yml} | 0 ...on.test.yml => ssa___sdelete_application_execution.test.yml} | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) rename detections/endpoint/{ssa__sdelete_application_execution.yml => ssa___sdelete_application_execution.yml} (100%) rename tests/endpoint/{ssa_sdelete_application_execution.test.yml => ssa___sdelete_application_execution.test.yml} (87%) diff --git a/detections/endpoint/ssa__sdelete_application_execution.yml b/detections/endpoint/ssa___sdelete_application_execution.yml similarity index 100% rename from detections/endpoint/ssa__sdelete_application_execution.yml rename to detections/endpoint/ssa___sdelete_application_execution.yml diff --git a/tests/endpoint/ssa_sdelete_application_execution.test.yml b/tests/endpoint/ssa___sdelete_application_execution.test.yml similarity index 87% rename from tests/endpoint/ssa_sdelete_application_execution.test.yml rename to tests/endpoint/ssa___sdelete_application_execution.test.yml index cabb0667f4..dd067e0575 100644 --- a/tests/endpoint/ssa_sdelete_application_execution.test.yml +++ b/tests/endpoint/ssa___sdelete_application_execution.test.yml @@ -1,7 +1,7 @@ name: Sdelete Application Execution Unit Test tests: - name: Sdelete Application Execution - file: endpoint/ssa__sdelete_application_execution.yml + file: endpoint/ssa___sdelete_application_execution.yml pass_condition: '@count_gt(0)' description: Test for sdelete execution command attack_data: From 3411e3dd945fb76a12d108c2e399692014b41d74 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 17 Nov 2021 11:52:43 +0100 Subject: [PATCH 04/10] ssa_sdelete --- detections/endpoint/ssa___sdelete_application_execution.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/detections/endpoint/ssa___sdelete_application_execution.yml b/detections/endpoint/ssa___sdelete_application_execution.yml index d7a11cbffb..b1132c0219 100644 --- a/detections/endpoint/ssa___sdelete_application_execution.yml +++ b/detections/endpoint/ssa___sdelete_application_execution.yml @@ -51,9 +51,7 @@ tags: - T1070.004 - T1070 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Behavioral Analytics required_fields: - _time - dest From 095bf01565c6342496309e38070027d8d18ce9e8 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 17 Nov 2021 12:02:33 +0100 Subject: [PATCH 05/10] ssa_sdelete --- stories/information_sabotage.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/stories/information_sabotage.yml b/stories/information_sabotage.yml index 6bb2b5ab25..6c04f66fb4 100644 --- a/stories/information_sabotage.yml +++ b/stories/information_sabotage.yml @@ -20,4 +20,5 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - Splunk Behavioral Analytics usecase: Security Monitoring \ No newline at end of file From d7b23700eff2a294ce5e01e59f6c3e618b29e132 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 18 Nov 2021 12:10:21 +0100 Subject: [PATCH 06/10] Update information_sabotage.yml --- stories/information_sabotage.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/stories/information_sabotage.yml b/stories/information_sabotage.yml index 6c04f66fb4..1011076b09 100644 --- a/stories/information_sabotage.yml +++ b/stories/information_sabotage.yml @@ -21,4 +21,5 @@ tags: - Splunk Enterprise Security - Splunk Cloud - Splunk Behavioral Analytics - usecase: Security Monitoring \ No newline at end of file + usecase: Security Monitoring + From dab01c7d47bd1a7547983d5196c53d9df55d091f Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 19 Nov 2021 14:29:11 -0700 Subject: [PATCH 07/10] Update ssa___sdelete_application_execution.yml --- .../ssa___sdelete_application_execution.yml | 31 ++++++++----------- 1 file changed, 13 insertions(+), 18 deletions(-) diff --git a/detections/endpoint/ssa___sdelete_application_execution.yml b/detections/endpoint/ssa___sdelete_application_execution.yml index b1132c0219..a4ed28129f 100644 --- a/detections/endpoint/ssa___sdelete_application_execution.yml +++ b/detections/endpoint/ssa___sdelete_application_execution.yml @@ -6,12 +6,8 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic is to detect the execution of sdelete.exe sysinternal - tools to secure delete some important document files that may related to insider to destroy evidence or information sabotage. - This tool is one of the most use tool to clear tracks and artifact in the targetted host. This tool is designed - to delete securely a file/files in a file system that remove the forensic evidence on the - machine. This is a good anomaly analytic to check why user execute this application which is not - a common practice in a corporate network. +description: This analytic will detect the execution of sdelete.exe attempting to delete potentially important files that may related to adversary or insider threats to destroy evidence or information sabotage. Sdelete is a SysInternals utility + meant to securely delete files on disk. This tool is commonly used to clear tracks and artifact on the targetted host. search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), @@ -20,14 +16,8 @@ search: '| from read_ssa_enriched_events() parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), parent_cmd_line=ucast(map_get(input_event, "parent_process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND like(process_name, "%sdelete%") - AND (like (cmd_line, "% -c %") OR like (cmd_line, "% -f %")OR like (cmd_line, "% -p %") OR like (cmd_line, "% -r %") - OR like (cmd_line, "% -s %") OR like (cmd_line, "% -z %") OR like (cmd_line, "%/accepteula%") - OR like (cmd_line, "%-nobanner%")OR like (cmd_line, "%.doc%")OR like (cmd_line, "%.xls%") - OR like (cmd_line, "%.ppt%")OR like (cmd_line, "%.rtf%") OR like (cmd_line, "%.pdf%") - OR like (cmd_line, "%.key%")OR like (cmd_line, "%.log%") OR like (cmd_line, "%.txt%") - OR like (cmd_line, "%.jpg%") OR like (cmd_line, "%.png%") OR like (cmd_line, "%.gif%") - OR like (cmd_line, "%.bmp%") OR like (cmd_line, "%.7z%") OR like (cmd_line, "%.zip%") - OR like (cmd_line, "%.rar%") OR like (cmd_line, "%.tar%") OR like (cmd_line, "%.gz%") OR like (cmd_line, "%.xls%")) + AND (like (cmd_line, "%-c %") OR like (cmd_line, "%-f %") OR like (cmd_line, "%-p %") OR like (cmd_line, "%-r %") OR like (cmd_line, "%-s %") OR like (cmd_line, "%-z %") OR like (cmd_line, "%accepteula%") OR like (cmd_line, "%-nobanner%")) + AND (like (cmd_line, "%.doc%")OR like (cmd_line, "%.xls%") OR like (cmd_line, "%.ppt%")OR like (cmd_line, "%.rtf%") OR like (cmd_line, "%.pdf%") OR like (cmd_line, "%.key%")OR like (cmd_line, "%.log%") OR like (cmd_line, "%.txt%") OR like (cmd_line, "%.jpg%") OR like (cmd_line, "%.png%") OR like (cmd_line, "%.gif%") OR like (cmd_line, "%.bmp%") OR like (cmd_line, "%.7z%") OR like (cmd_line, "%.zip%") OR like (cmd_line, "%.rar%") OR like (cmd_line, "%.tar%") OR like (cmd_line, "%.gz%") OR like (cmd_line, "%.xls%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "process_path", process_path, "parent_process_name", parent_process_name, "parent_cmd_line", parent_cmd_line]) | into write_ssa_detected_events();' @@ -36,9 +26,10 @@ how_to_implement: To successfully implement this search you need to be ingesting your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: user may execute and use this application +known_false_positives: False positives should be limited, filter as needed. references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ + - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md tags: analytic_story: - Information Sabotage @@ -70,7 +61,7 @@ tags: context: - Source:Endpoint - Stage:Execution - message: sdelete process $process_name$ executed in $dest$ + message: sdelete process $process_name$ executed on $dest$ attempting to permanently delete files. observable: - name: dest type: Endpoint @@ -79,4 +70,8 @@ tags: - name: user type: User role: - - Victim \ No newline at end of file + - Victim + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file From d679eeef45cb824afaa68af7b3601aa1ce9441f0 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 19 Nov 2021 14:54:26 -0700 Subject: [PATCH 08/10] Update ssa___sdelete_application_execution.yml --- detections/endpoint/ssa___sdelete_application_execution.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___sdelete_application_execution.yml b/detections/endpoint/ssa___sdelete_application_execution.yml index a4ed28129f..60eaacb1c7 100644 --- a/detections/endpoint/ssa___sdelete_application_execution.yml +++ b/detections/endpoint/ssa___sdelete_application_execution.yml @@ -7,7 +7,7 @@ type: Anomaly datamodel: - Endpoint description: This analytic will detect the execution of sdelete.exe attempting to delete potentially important files that may related to adversary or insider threats to destroy evidence or information sabotage. Sdelete is a SysInternals utility - meant to securely delete files on disk. This tool is commonly used to clear tracks and artifact on the targetted host. + meant to securely delete files on disk. This tool is commonly used to clear tracks and artifact on the targeted host. search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), From 45e691bd0d450aed6c5f5f0f9aa098f5ceaa5b47 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 22 Nov 2021 10:39:45 +0100 Subject: [PATCH 09/10] ssa_sdelete --- .../ssa___sdelete_application_execution.yml | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/ssa___sdelete_application_execution.yml b/detections/endpoint/ssa___sdelete_application_execution.yml index 60eaacb1c7..249597a7e6 100644 --- a/detections/endpoint/ssa___sdelete_application_execution.yml +++ b/detections/endpoint/ssa___sdelete_application_execution.yml @@ -6,7 +6,8 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic will detect the execution of sdelete.exe attempting to delete potentially important files that may related to adversary or insider threats to destroy evidence or information sabotage. Sdelete is a SysInternals utility +description: This analytic will detect the execution of sdelete.exe attempting to delete potentially important files + that may related to adversary or insider threats to destroy evidence or information sabotage. Sdelete is a SysInternals utility meant to securely delete files on disk. This tool is commonly used to clear tracks and artifact on the targeted host. search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"), "string", null)), @@ -15,9 +16,16 @@ search: '| from read_ssa_enriched_events() process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), parent_cmd_line=ucast(map_get(input_event, "parent_process"), "string", null), - event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND like(process_name, "%sdelete%") - AND (like (cmd_line, "%-c %") OR like (cmd_line, "%-f %") OR like (cmd_line, "%-p %") OR like (cmd_line, "%-r %") OR like (cmd_line, "%-s %") OR like (cmd_line, "%-z %") OR like (cmd_line, "%accepteula%") OR like (cmd_line, "%-nobanner%")) - AND (like (cmd_line, "%.doc%")OR like (cmd_line, "%.xls%") OR like (cmd_line, "%.ppt%")OR like (cmd_line, "%.rtf%") OR like (cmd_line, "%.pdf%") OR like (cmd_line, "%.key%")OR like (cmd_line, "%.log%") OR like (cmd_line, "%.txt%") OR like (cmd_line, "%.jpg%") OR like (cmd_line, "%.png%") OR like (cmd_line, "%.gif%") OR like (cmd_line, "%.bmp%") OR like (cmd_line, "%.7z%") OR like (cmd_line, "%.zip%") OR like (cmd_line, "%.rar%") OR like (cmd_line, "%.tar%") OR like (cmd_line, "%.gz%") OR like (cmd_line, "%.xls%")) + event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND like(process_name, "%sdelete%") + AND (like (cmd_line, "%-c %") OR like (cmd_line, "%-f %")OR like (cmd_line, "%-p %") OR like (cmd_line, "%-r %") OR like (cmd_line, "%-q %") + OR like (cmd_line, "%-s %") OR like (cmd_line, "%-z %") OR like (cmd_line, "%/accepteula%") + OR like (cmd_line, "%-nobanner%")OR like (cmd_line, "%.doc%")OR like (cmd_line, "%.xls%") + OR like (cmd_line, "%.ppt%")OR like (cmd_line, "%.rtf%") OR like (cmd_line, "%.pdf%") + OR like (cmd_line, "%.key%")OR like (cmd_line, "%.log%") OR like (cmd_line, "%.txt%") + OR like (cmd_line, "%.jpg%") OR like (cmd_line, "%.png%") OR like (cmd_line, "%.gif%") + OR like (cmd_line, "%.bmp%") OR like (cmd_line, "%.7z%") OR like (cmd_line, "%.zip%") + OR like (cmd_line, "%.rar%") OR like (cmd_line, "%.tar%") OR like (cmd_line, "%.gz%") OR like (cmd_line, "%.xls%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "process_path", process_path, "parent_process_name", parent_process_name, "parent_cmd_line", parent_cmd_line]) | into write_ssa_detected_events();' From 8b174b99679a27880c00a48788ecc0f5b141cfdb Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 22 Nov 2021 11:07:10 +0100 Subject: [PATCH 10/10] small change --- detections/endpoint/ssa___sdelete_application_execution.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___sdelete_application_execution.yml b/detections/endpoint/ssa___sdelete_application_execution.yml index 249597a7e6..d86c3b6f60 100644 --- a/detections/endpoint/ssa___sdelete_application_execution.yml +++ b/detections/endpoint/ssa___sdelete_application_execution.yml @@ -82,4 +82,5 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + \ No newline at end of file