junk/spl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update splunk_alert.md

Browse Source
This commit is contained in:
junk
2024-12-03 11:21:09 -05:00
parent f9bec1c803
commit b51508db2f
1 changed files with 1 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
splunk_alert.md
View File

@ -6,7 +6,7 @@ mitre_technique="Create or Modify System Process",
mitre_subtechnique_id="T1543.001", mitre_subtechnique_id="T1543.001",
mitre_subtechnique="Launch Agent", mitre_subtechnique="Launch Agent",
mitre_category="Persistence", mitre_category="Persistence",
apt=mvappend("APT28", "APT29"), apt=mvappend("APT28", ""),
hunting_trigger="Look for unusual modifications to system processes.", hunting_trigger="Look for unusual modifications to system processes.",
mitre_link="https://attack.mitre.org/techniques/T1543/", mitre_link="https://attack.mitre.org/techniques/T1543/",
creator="Cpl Iverson", creator="Cpl Iverson",
@ -17,7 +17,5 @@ priority="High"
| `process_create_whitelist` | `process_create_whitelist`
| eval indextime = _indextime | eval indextime = _indextime
| convert ctime(indextime) | convert ctime(indextime)
| eval indextime = _indextime
| convert ctime(indextime)
| table _time indextime event_description hash_sha256 host_fqdn user_name original_file_name process_path process_guid process_parent_path process_id process_parent_id process_command_line process_parent_command_line process_parent_guid mitre_category mitre_technique mitre_technique_id mitre_subtechnique_id mitre_subtechnique apt hunting_trigger mitre_link upload_date last_modify_date mitre_version priority | table _time indextime event_description hash_sha256 host_fqdn user_name original_file_name process_path process_guid process_parent_path process_id process_parent_id process_command_line process_parent_command_line process_parent_guid mitre_category mitre_technique mitre_technique_id mitre_subtechnique_id mitre_subtechnique apt hunting_trigger mitre_link upload_date last_modify_date mitre_version priority
``` ```