junk/spl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update splunk_alert.md

Browse Source
This commit is contained in:
Matthew Iverson
2024-12-04 17:17:42 -05:00
parent faf0fae6b2
commit 865b58dd3e
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
splunk_alert.md
View File

@ -1,5 +1,5 @@
``` ```
`indextime` `sysmon` RuleName="technique_id=T1027,technique_name=Obfuscated Files or Information" `indextime` `sysmon` <SEARCH>
| eval hash_sha256= lower(hash_sha256), | eval hash_sha256= lower(hash_sha256),
hunting_trigger="", hunting_trigger="",
mitre_category="Defense_Evasion", mitre_category="Defense_Evasion",
@ -10,8 +10,8 @@ mitre_subtechnique_id="",
apt="", apt="",
mitre_link="https://attack.mitre.org/techniques/T1027/", mitre_link="https://attack.mitre.org/techniques/T1027/",
creator="Cpl Iverson", creator="Cpl Iverson",
upload_date="2024/12/03", upload_date="FIRSTDATE",
last_modify_date="2024/12/03", last_modify_date="CURRENTDATE",
mitre_version="v16", mitre_version="v16",
priority="" priority=""
| `process_create_whitelist` | `process_create_whitelist`