mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
tccontre
4 lines
567 B
YAML
4 lines
567 B
YAML
definition: 'EventCode=7036 | spath input=EventData_Xml path="Binary" output=binary_data | eval trimmed_hexbytes = mvjoin(split(trim(binary_data, "0"), "00"), "") | eval normalized_service_name = if(match(trimmed_hexbytes,"^[0-9A-F]+$"),urldecode(replace(trimmed_hexbytes,"([0-9A-F]{2})","%\1")),trimmed_hexbytes)'
|
|
description: customer specific splunk configurations to normalized Windows Event Log System 7036 to recover actual services execution.
|
|
Replace the macro definition with configurations for your Splunk Environment.
|
|
name: normalized_service_binary_field |