admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

generated detection

Browse Source
This commit is contained in:
Lou Stella
2023-08-16 13:38:03 -05:00
parent 868bf4984a
commit ffed36c532
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
+2 -2
View File
@@ -34,8 +34,8 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe"
OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe"
OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true
OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe")
AND match_regex(process_cmd_line, /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+h(i*d*d*e*n*)\\s+/)=true
--finding_report--'
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be