updating detection

Author: patel-bhavin

detections/endpoint/windows_installutil_remote_network_connection.yml

@@ -1,6 +1,6 @@
 name: Windows InstallUtil Remote Network Connection
 id: 4fbf9270-43da-11ec-9486-acde48001122
-version: 11
+version: 11 
 date: '2025-02-22'
 author: Michael Haag, Splunk
 status: production
@@ -24,14 +24,15 @@ search: |-
   | `drop_dm_object_name(Processes)` 
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` 
-  | join process_id 
+  | join process_id dest
       [| tstats `security_content_summariesonly`
           count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port !=
-          0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port 
+          0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port All_Traffic.src
       | `drop_dm_object_name(All_Traffic)` 
-      | rename dest as C2 ] 
-  | table _time user dest parent_process_name process_name process_path process process_id dest_port C2 
-  | stats count min(_time) as firstTime max(_time) as lastTime values(process) as process values(C2) as command_and_control by user dest process_name process_id dest_port parent_process_name 
+      | rename dest as command_and_control
+      | rename src as dest] 
+  | table _time user src dest parent_process_name process_name process_path process process_id dest_port command_and_control
+  | stats count min(_time) as firstTime max(_time) as lastTime values(process) as process values(command_and_control) as command_and_control by user dest process_name process_id dest_port parent_process_name 
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`| `windows_installutil_remote_network_connection_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection
@@ -77,6 +78,8 @@ rba:
     type: parent_process_name
   - field: process_name
     type: process_name
+  - field: command_and_control
+    type: ip_address
 tags:
   analytic_story:
   - Living Off The Land