mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
48 lines
1.5 KiB
JSON
48 lines
1.5 KiB
JSON
{
|
|
"channel": "ESCU",
|
|
"creation_date": "2017-04-18",
|
|
"data_metadata": {
|
|
"data_models": [
|
|
"Endpoint"
|
|
],
|
|
"data_source": [
|
|
"Endpoint Intel"
|
|
],
|
|
"providing_technologies": [
|
|
"Carbon Black Response",
|
|
"CrowdStrike Falcon",
|
|
"Sysmon",
|
|
"Tanium",
|
|
"Ziften"
|
|
]
|
|
},
|
|
"eli5": "This search counts the numbers of times the remote desktop process, mstsc.exe, has run on each system. It does this by looking for the process name in the Endpoint data model.",
|
|
"how_to_implement": "To successfully implement this search you must be ingesting endpoint data that records process activity.",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "davidd@splunk.com",
|
|
"name": "David Dorsey"
|
|
}
|
|
],
|
|
"modification_date": "2019-04-01",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "davidd@splunk.com",
|
|
"name": "David Dorsey"
|
|
}
|
|
],
|
|
"scheduling": {
|
|
"earliest_time": "-30d@d",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "| tstats `summariesonly` count from datamodel=Endpoint.Processes where Processes.process_name=\"*mstsc.exe*\" by Processes.dest Processes.process_name | `drop_dm_object_name(Processes)` | sort - count",
|
|
"search_description": "This search counts the numbers of times the remote desktop process, mstsc.exe, has run on each system.",
|
|
"search_id": "063dfe9f-b1d7-4254-a16d-1e2e7eadd6a8",
|
|
"search_name": "Identify Systems Using Remote Desktop",
|
|
"search_type": "support",
|
|
"spec_version": 1,
|
|
"version": "1.0"
|
|
}
|