mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
delgado-jacob
23 lines
734 B
YAML
23 lines
734 B
YAML
name: CrushFTP
|
|
id: 8a42ace5-e4c8-4653-80cf-1b8e7e6024ef
|
|
version: 2
|
|
date: '2025-01-23'
|
|
author: Patrick Bareiss, Splunk
|
|
description: Logs activities related to file transfers and user interactions in CrushFTP,
|
|
including file uploads, downloads, user authentication, and session details.
|
|
mitre_components:
|
|
- File Access
|
|
- File Metadata
|
|
- User Account Authentication
|
|
- Logon Session Metadata
|
|
- Network Traffic Content
|
|
source: crushftp
|
|
sourcetype: crushftp:sessionlogs
|
|
supported_TA: []
|
|
fields:
|
|
- _time
|
|
- _raw
|
|
example_log: 'SESSION|05/14/2024 17:36:21.859|[HTTPS:169_52326_sMa:anonymous:10.0.1.30]
|
|
READ: *POST /WebInterface/function/?c2f=CmF1&command=zip&path=%3CINCLUDE%3Eusers/MainUsers/groups.XML%3C/INCLUDE%3E&names=/a
|
|
HTTP/1.1*'
|