mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Ignacio Bermudez Corrales
21 lines
1.1 KiB
Plaintext
21 lines
1.1 KiB
Plaintext
| from read_ssa_enriched_events()
|
|
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
|
|
| eval process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)),
|
|
cmd_line=ucast(map_get(input_event, "process"), "string", null),
|
|
dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null),
|
|
dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null)
|
|
| where process_name="cmd.exe" OR process_name="reg.exe"
|
|
| where cmd_line != null AND
|
|
match_regex(cmd_line, /(?i)save\s+/)=true AND
|
|
( match_regex(cmd_line, /(?i)HKLM\\Security/)=true OR
|
|
match_regex(cmd_line, /(?i)HKLM\\SAM/)=true OR
|
|
match_regex(cmd_line, /(?i)HKLM\\System/)=true OR
|
|
match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR
|
|
match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR
|
|
match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true
|
|
)
|
|
| eval start_time = timestamp,
|
|
end_time = timestamp,
|
|
entities = mvappend(dest_device_id, dest_user_id),
|
|
body = "TBD"
|
|
| into write_ssa_detected_events(); |