mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
49 lines
1.9 KiB
YAML
49 lines
1.9 KiB
YAML
baseline:
|
|
splunk:
|
|
schedule:
|
|
cron_schedule: ''
|
|
earliest_time: -30d@d
|
|
latest_time: -10m@m
|
|
search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime
|
|
from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe AND Processes.process="*
|
|
/c *" by Processes.process | `drop_dm_object_name(Processes)`'
|
|
creation_date: '2018-04-09'
|
|
data_metadata:
|
|
data_models:
|
|
- Endpoint
|
|
data_source:
|
|
- Endpoint Intel
|
|
providing_technologies:
|
|
- Carbon Black Response
|
|
- CrowdStrike Falcon
|
|
- Sysmon
|
|
- Tanium
|
|
- Ziften
|
|
description: This search looks for command-line arguments where `cmd.exe /c` is used
|
|
to execute a program, then creates a baseline of the earliest and latest times we
|
|
have encountered this command-line argument in our dataset within the last 30 days.
|
|
eli5: In this support search, we look for command-line arguments using the parameter
|
|
`/c` to execute processes and create an initial baseline cache for the previous
|
|
30 days. This will include the earliest and latest times a particular command-line
|
|
argument is seen in our dataset, grouped by the command-line value.
|
|
how_to_implement: You must be ingesting data that records process activity from your
|
|
hosts to populate the Endpoint data model in the Processes node. You must be ingesting
|
|
logs with both the process name and command line from your endpoints. The complete
|
|
process name with command-line arguments are mapped to the "process" field in the
|
|
Endpoint data model.
|
|
id: fc0edc95-ff2b-48b0-9f6f-63da3789fd23
|
|
known_false_positives: ''
|
|
maintainers:
|
|
- company: Splunk
|
|
email: bpatel@splunk.com
|
|
name: Bhavin Patel
|
|
modification_date: '2019-03-01'
|
|
name: Previously seen command line arguments
|
|
original_authors:
|
|
- company: Splunk
|
|
email: bpatel@splunk.com
|
|
name: Bhavin Patel
|
|
spec_version: 2
|
|
type: splunk
|
|
version: '2.0'
|