mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
48 lines
1.4 KiB
YAML
48 lines
1.4 KiB
YAML
name: Add Prohibited Processes to Enterprise Security
|
|
id: 251930a5-1451-4428-bb13-eed5775be0ce
|
|
version: 1
|
|
date: '2017-09-15'
|
|
author: David Dorsey, Splunk
|
|
type: Baseline
|
|
datamodel: []
|
|
description: This search takes the existing interesting process table from ES, filters
|
|
out any existing additions added by ESCU and then updates the table with processes
|
|
identified by ESCU that should be prohibited on your endpoints.
|
|
search: '| inputlookup prohibited_processes | search note!=ESCU* | inputlookup append=T
|
|
prohibited_processes | fillnull value=* dest dest_pci_domain | fillnull value=false
|
|
is_required is_secure | fillnull value=true is_prohibited | outputlookup prohibited_processes
|
|
| stats count'
|
|
how_to_implement: This search should be run on each new install of ESCU.
|
|
known_false_positives: none
|
|
references: []
|
|
tags:
|
|
analytic_story:
|
|
- 'Emotet Malware DHS Report TA18-201A '
|
|
- Monitor for Unauthorized Software
|
|
- SamSam Ransomware
|
|
asset_type: Endpoint
|
|
deployments:
|
|
- Daily Cache Updates
|
|
detections:
|
|
- Prohibited Software On Endpoint
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
security_domain: endpoint
|
|
kill_chain_phases:
|
|
- Exploitation
|
|
confidence: 50
|
|
impact: 50
|
|
risk_score: 25
|
|
context:
|
|
- Unknown
|
|
message: tbd
|
|
observable:
|
|
- name: field
|
|
type: Unknown
|
|
role:
|
|
- Unknown
|