junk/spl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update splunk_alert.md

Browse Source
This commit is contained in:
Matthew Iverson
2024-12-04 17:17:42 -05:00
parent faf0fae6b2
commit 865b58dd3e
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
splunk_alert.md
View File

@ -1,5 +1,5 @@
```
`indextime` `sysmon` RuleName="technique_id=T1027,technique_name=Obfuscated Files or Information"
`indextime` `sysmon` <SEARCH>
| eval hash_sha256= lower(hash_sha256),
hunting_trigger="",
mitre_category="Defense_Evasion",
@ -10,8 +10,8 @@ mitre_subtechnique_id="",
apt="",
mitre_link="https://attack.mitre.org/techniques/T1027/",
creator="Cpl Iverson",
upload_date="2024/12/03",
last_modify_date="2024/12/03",
upload_date="FIRSTDATE",
last_modify_date="CURRENTDATE",
mitre_version="v16",
priority=""
| `process_create_whitelist`