mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Nasreddine Bencherchali
9fc8942993
* new rules and updates * fix issues with ci * rename for accurate macro * update description and logic * new wbadmin rule and fix pwsh dataset * more updates for the weekend * update network rules filters * downgrade versions * Update windows_file_transfer_protocol_in_non_common_process_path.yml * add missing DS for some rules * update nirsoft lookup and add new rules * update more nirsoft stuff * update snort message * Update cisco_secure_firewall_filetype_lookup.yml * new analytic and updates / incl. fix #3730 * Update detect_new_local_admin_account.yml * add lnx dataset and fix wildcards
5 lines
387 B
YAML
5 lines
387 B
YAML
definition: (Processes.process_name IN ("cmd.exe", "powershell.exe", "powershell_ise.exe", "pwsh.exe", "sh.exe", "bash.exe", "wscript.exe","cscript.exe", "wt.exe", "WindowsTerminal.exe", "mshta.exe"))
|
|
description: customer specific splunk configurations(eg- index, source, sourcetype).
|
|
Replace the macro definition with configurations for your Splunk Environment.
|
|
name: windows_shells
|