mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
48 lines
1.6 KiB
JSON
48 lines
1.6 KiB
JSON
{
|
|
"channel": "ESCU",
|
|
"creation_date": "2017-04-18",
|
|
"data_metadata": {
|
|
"data_models": [
|
|
"Application_State"
|
|
],
|
|
"data_source": [
|
|
"Endpoint Intel"
|
|
],
|
|
"providing_technologies": [
|
|
"Carbon Black Response",
|
|
"CrowdStrike Falcon",
|
|
"Sysmon",
|
|
"Tanium",
|
|
"Ziften"
|
|
]
|
|
},
|
|
"eli5": "This search counts the numbers of times the remote desktop process, mstsc.exe, has run on each system. It does this by looking for the process in the Application_State data model.",
|
|
"how_to_implement": "To successfully implement this search you must be ingesting endpoint data that records process activity.",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "davidd@splunk.com",
|
|
"name": "David Dorsey"
|
|
}
|
|
],
|
|
"modification_date": "2017-09-15",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "davidd@splunk.com",
|
|
"name": "David Dorsey"
|
|
}
|
|
],
|
|
"scheduling": {
|
|
"earliest_time": "-30d@d",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "| tstats `summariesonly` count from datamodel=Application_State where All_Application_State.process=\"*mstsc.exe*\" by All_Application_State.dest All_Application_State.process | `drop_dm_object_name(\"All_Application_State\")` | sort - count",
|
|
"search_description": "This search counts the numbers of times the remote desktop process, mstsc.exe, has run on each system.",
|
|
"search_id": "063dfe9f-b1d7-4254-a16d-1e2e7eadd6a8",
|
|
"search_name": "Identify Systems Using Remote Desktop",
|
|
"search_type": "support",
|
|
"spec_version": 1,
|
|
"version": "1.0"
|
|
}
|