Skip to content

Commit be9873d

Browse files
nasbenchnasbench
committed
remove incompatible data sources
1 parent c2eb1a2 commit be9873d

9 files changed

+18
-27
lines changed

‎detections/endpoint/chcp_command_execution.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: CHCP Command Execution
22
id: 21d236ec-eec1-11eb-b23e-acde48001122
3-
version: 4
4-
date: '2024-11-13'
3+
version: 5
4+
date: '2025-02-19'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: TTP
@@ -15,7 +15,6 @@ description: The following analytic detects the execution of the chcp.exe applic
1515
system compromise and data exfiltration.
1616
data_source:
1717
- Sysmon EventID 1
18-
- Windows Event Log Security 4688
1918
- CrowdStrike ProcessRollup2
2019
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
2120
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=chcp.com

‎detections/endpoint/jscript_execution_using_cscript_app.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Jscript Execution Using Cscript App
22
id: 002f1e24-146e-11ec-a470-acde48001122
3-
version: 5
4-
date: '2025-02-10'
3+
version: 6
4+
date: '2025-02-19'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: TTP
@@ -14,7 +14,6 @@ description: The following analytic detects the execution of JScript using the c
1414
scripts, leading to code execution, data exfiltration, or further system compromise.
1515
data_source:
1616
- Sysmon EventID 1
17-
- Windows Event Log Security 4688
1817
- CrowdStrike ProcessRollup2
1918
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
2019
as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name

‎detections/endpoint/ping_sleep_batch_command.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Ping Sleep Batch Command
22
id: ce058d6c-79f2-11ec-b476-acde48001122
3-
version: 6
4-
date: '2025-02-10'
3+
version: 7
4+
date: '2025-02-19'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: Anomaly
@@ -15,7 +15,6 @@ description: The following analytic identifies the execution of ping sleep batch
1515
exfiltration.
1616
data_source:
1717
- Sysmon EventID 1
18-
- Windows Event Log Security 4688
1918
- CrowdStrike ProcessRollup2
2019
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
2120
as lastTime from datamodel=Endpoint.Processes where `process_ping` (Processes.parent_process

‎detections/endpoint/vbscript_execution_using_wscript_app.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Vbscript Execution Using Wscript App
22
id: 35159940-228f-11ec-8a49-acde48001122
3-
version: 5
4-
date: '2025-02-10'
3+
version: 6
4+
date: '2025-02-19'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: TTP
@@ -15,7 +15,6 @@ description: The following analytic detects the execution of VBScript using the
1515
data exfiltration, or further lateral movement within the network.
1616
data_source:
1717
- Sysmon EventID 1
18-
- Windows Event Log Security 4688
1918
- CrowdStrike ProcessRollup2
2019
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
2120
as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name

‎detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Windows Command Shell DCRat ForkBomb Payload
22
id: 2bb1a362-7aa8-444a-92ed-1987e8da83e1
3-
version: 6
4-
date: '2025-02-10'
3+
version: 7
4+
date: '2025-02-19'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: TTP
@@ -15,7 +15,6 @@ description: The following analytic detects the execution of a DCRat "forkbomb"
1515
disruption of services.
1616
data_source:
1717
- Sysmon EventID 1
18-
- Windows Event Log Security 4688
1918
- CrowdStrike ProcessRollup2
2019
search: '| tstats `security_content_summariesonly` values(Processes.process) as process
2120
values(Processes.parent_process) as parent_process values(Processes.parent_process_id)

‎detections/endpoint/windows_indirect_command_execution_via_forfiles.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Windows Indirect Command Execution Via forfiles
22
id: 1fdf31c9-ff4d-4c48-b799-0e8666e08787
3-
version: 4
4-
date: '2024-11-13'
3+
version: 5
4+
date: '2025-02-19'
55
author: Eric McGinnis, Splunk
66
status: production
77
type: TTP
@@ -16,7 +16,6 @@ description: The following analytic detects the execution of programs initiated
1616
compromise.
1717
data_source:
1818
- Sysmon EventID 1
19-
- Windows Event Log Security 4688
2019
- CrowdStrike ProcessRollup2
2120
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
2221
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*forfiles*

‎detections/endpoint/windows_indirect_command_execution_via_pcalua.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Windows Indirect Command Execution Via pcalua
22
id: 3428ac18-a410-4823-816c-ce697d26f7a8
3-
version: 4
4-
date: '2024-11-13'
3+
version: 5
4+
date: '2025-02-19'
55
author: Eric McGinnis, Splunk
66
status: production
77
type: TTP
@@ -15,7 +15,6 @@ description: The following analytic detects programs initiated by pcalua.exe, th
1515
environment.
1616
data_source:
1717
- Sysmon EventID 1
18-
- Windows Event Log Security 4688
1918
- CrowdStrike ProcessRollup2
2019
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
2120
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*pcalua*

‎detections/endpoint/windows_scheduled_task_service_spawned_shell.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Windows Scheduled Task Service Spawned Shell
22
id: d8120352-3b62-4e3c-8cb6-7b47584dd5e8
3-
version: 4
4-
date: '2024-11-13'
3+
version: 5
4+
date: '2025-02-19'
55
author: Steven Dick
66
status: production
77
type: TTP
@@ -15,7 +15,6 @@ description: The following analytic detects when the Task Scheduler service ("sv
1515
persistence, or escalate privileges within the environment.
1616
data_source:
1717
- Sysmon EventID 1
18-
- Windows Event Log Security 4688
1918
- CrowdStrike ProcessRollup2
2019
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
2120
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*\\system32\\svchost.exe*"

‎detections/endpoint/windows_time_based_evasion.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,12 @@
11
name: Windows Time Based Evasion
22
id: 34502357-deb1-499a-8261-ffe144abf561
3-
version: 5
4-
date: '2025-02-10'
3+
version: 6
4+
date: '2025-02-19'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: TTP
88
data_source:
99
- Sysmon EventID 1
10-
- Windows Event Log Security 4688
1110
- CrowdStrike ProcessRollup2
1211
description: The following analytic detects potentially malicious processes that initiate
1312
a ping delay using an invalid IP address. It leverages data from Endpoint Detection

0 commit comments

Comments
 (0)