admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'detection_testing_part_one' of github.com:splunk/security-content into detection_testing_part_one

Browse Source
This commit is contained in:
P4T12ICK
2020-11-09 10:38:50 +01:00
parent 079742338b fbccb2412c
commit ff910fa590
2 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/common_ransomware_extensions.yml
+3
View File
@@ -48,3 +48,6 @@ tags:
- DE.CM
security_domain: endpoint
asset_type: Endpoint
automated_detection_testing: passed
dataset:
- https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1485_custom_215ee4f9-c027-4ea1-a882-d97b887d233d/windows-sysmon.log
detections/endpoint/common_ransomware_notes.yml
+5 -2
View File
@@ -15,8 +15,8 @@ author: David Dorsey, Splunk
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path)
as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name | `drop_dm_object_name(Filesystem)`
| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `ransomware_notes` |
`common_ransomware_notes_filter`'
| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `ransomware_notes`
| `common_ransomware_notes_filter`'
known_false_positives: It's possible that a legitimate file could be created with
the same name used by ransomware note files.
tags:
@@ -34,3 +34,6 @@ tags:
- DE.CM
security_domain: endpoint
asset_type: Endpoint
automated_detection_testing: passed
dataset:
- https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1485_custom_cc81aa13-3899-4d33-b5c5-8a6e30eca28b/windows-sysmon.log