From a1e0195d508d1c47039bc272403b60d58a1cd33a Mon Sep 17 00:00:00 2001 From: Eric McGinnis Date: Thu, 8 Oct 2026 22:33:04 -0500 Subject: [PATCH 1/6] Image was missing from two fields but referneced in findings/intermediate findings. caused integration tests to fail --- ...indows_cloud_files_filter_loaded_by_uncommon_process.yml | 6 +++--- ...indows_non_system_process_querying_definition_update.yml | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml b/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml index f15a3995463..4f69e61e36f 100644 --- a/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml +++ b/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml @@ -1,8 +1,8 @@ name: Windows Cloud Files Filter Loaded by Uncommon Process id: 77b85062-274e-43a5-9dab-c25862b85291 -version: 1 +version: 2 creation_date: '2026-05-18' -modification_date: '2026-05-18' +modification_date: '2026-10-08' author: Raven Tait, Splunk status: production type: Anomaly @@ -28,7 +28,7 @@ search: |- ) | stats count min(_time) as firstTime max(_time) as lastTime - by Computer ImageLoaded EventID dest loaded_file loaded_file_path process_exec + by Computer ImageLoaded Image EventID dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature_id user_id vendor_product diff --git a/detections/endpoint/windows_non_system_process_querying_definition_update.yml b/detections/endpoint/windows_non_system_process_querying_definition_update.yml index f2a81e01160..4a01e015225 100644 --- a/detections/endpoint/windows_non_system_process_querying_definition_update.yml +++ b/detections/endpoint/windows_non_system_process_querying_definition_update.yml @@ -1,8 +1,8 @@ name: Windows Non-System Process Querying Definition Update id: 9d375cfd-c9a5-48ff-b875-9bcaf6b63265 -version: 1 +version: 2 creation_date: '2026-04-27' -modification_date: '2026-04-27' +modification_date: '2026-10-08' author: Raven Tait, Splunk status: production type: Anomaly @@ -21,7 +21,7 @@ search: |- "*:\\Windows\\System32\\*", "*:\\Windows\\SysWOW64\\*" ) - | stats count min(_time) as firstTime max(_time) as lastTime BY answer answer_count dvc Computer process_exec process_guid process_name query query_count reply_code_id signature signature_id src user_id vendor_product QueryName QueryResults QueryStatus + | stats count min(_time) as firstTime max(_time) as lastTime BY answer answer_count dvc Computer Image process_exec process_guid process_name query query_count reply_code_id signature signature_id src user_id vendor_product QueryName QueryResults QueryStatus | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rename Computer as dest From 58d8ee2b51a771eb306c585eefd2e77e29799e23 Mon Sep 17 00:00:00 2001 From: Eric McGinnis Date: Mon, 12 Oct 2026 14:33:57 -0700 Subject: [PATCH 2/6] Search was missing user field --- .../windows_wermgr_alternate_data_stream_in_temp_dir.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml b/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml index 54fd1c50a9b..aa757782a8b 100644 --- a/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml +++ b/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml @@ -1,8 +1,8 @@ name: Windows Wermgr Alternate Data Stream in Temp Dir id: 65222e9b-9d0b-4bfe-8da1-199b98e1d44a -version: 2 +version: 3 creation_date: '2026-06-11' -modification_date: '2026-09-08' +modification_date: '2026-10-12' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -22,7 +22,7 @@ search: |- max(_time) as lastTime by dest dvc file_hash file_name file_path process_exec process_guid process_id process_name process_path - signature signature_id user_id vendor_product Contents Image + signature signature_id user_id user vendor_product Contents Image | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From 4537b81313df65989f7f2e173a612e4d814f2beb Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Tue, 13 Oct 2026 20:42:44 +0200 Subject: [PATCH 3/6] small updates --- ..._aws_ecr_container_upload_unknown_user.yml | 48 +++++++++++++------ ...iles_filter_loaded_by_uncommon_process.yml | 36 ++++++++------ ...tem_process_querying_definition_update.yml | 29 +++++++---- ...rmgr_alternate_data_stream_in_temp_dir.yml | 7 +-- 4 files changed, 79 insertions(+), 41 deletions(-) diff --git a/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml b/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml index 404144c034e..52c53235b76 100644 --- a/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml +++ b/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml @@ -6,22 +6,42 @@ modification_date: '2026-05-13' author: Patrick Bareiss, Splunk status: production type: Anomaly -description: The following analytic detects unauthorized container uploads to AWS Elastic Container Service (ECR) by monitoring AWS CloudTrail events. It identifies instances where a new container is uploaded by a user not previously recognized as authorized. This detection is crucial for a SOC as it can indicate a potential compromise or misuse of AWS ECR, which could lead to unauthorized access to sensitive data or the deployment of malicious containers. By identifying and investigating these events, organizations can mitigate the risk of data breaches or other security incidents resulting from unauthorized container uploads. The impact of such an attack could be significant, compromising the integrity and security of the organization's cloud environment. +description: |- + The following analytic detects unauthorized container uploads to AWS Elastic Container Service (ECR) by monitoring AWS CloudTrail events. + It identifies instances where a new container is uploaded by a user not previously recognized as authorized. data_source: - ASL AWS CloudTrail search: |- - `amazon_security_lake` api.operation=PutImage NOT `aws_ecr_users_asl` - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime - BY actor.user.uid api.operation api.service.name - http_request.user_agent src_endpoint.ip actor.user.account.uid - cloud.provider cloud.region - | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `asl_aws_ecr_container_upload_unknown_user_filter` -how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App. -known_false_positives: No false positives have been identified at this time. + `amazon_security_lake` + api.operation=PutImage + NOT `aws_ecr_users_asl` + + | fillnull + + | stats count min(_time) as firstTime + max(_time) as lastTime + + by actor.user.uid api.operation api.service.name + http_request.user_agent + src_endpoint.ip actor.user.account.uid + cloud.provider cloud.region + + | rename actor.user.account.uid as vendor_account + actor.user.uid as user + api.operation as action + api.service.name as dest + cloud.provider as vendor_product + cloud.region as vendor_region + http_request.user_agent as user_agent + src_endpoint.ip as src + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `asl_aws_ecr_container_upload_unknown_user_filter` +how_to_implement: |- + The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App. +known_false_positives: |- + No false positives have been identified at this time. references: - https://attack.mitre.org/techniques/T1204/003/ drilldown_searches: @@ -38,7 +58,7 @@ intermediate_findings: - field: user type: user score: 20 - message: Container uploaded from unknown user $user$ + message: Container uploaded from unknown user [$user$]. threat_objects: - field: src type: ip_address diff --git a/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml b/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml index 4f69e61e36f..11cad4f781c 100644 --- a/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml +++ b/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml @@ -7,7 +7,7 @@ author: Raven Tait, Splunk status: production type: Anomaly description: |- - The following analytic detects cldapi.dll being loaded by a process not associated with legitimate cloud sync activity. + The following analytic detects "cldapi.dll" being loaded by a process not associated with legitimate cloud sync activity. The Windows Cloud Files API (cldapi.dll) is abused by several local privilege escalation exploits. data_source: - Sysmon EventID 7 @@ -16,22 +16,25 @@ search: |- EventID=7 ImageLoaded="*\\cldapi.dll" NOT Image IN ( - "*\\box.exe", - "*\\dropbox.exe", - "*\\googledrivefs.exe", - "*\\icloud.exe", - "*\\onedrive*.exe", - "*\\Windows\\explorer.exe" - "*\\Windows\\System32\\*", - "*\\Windows\\Syswow64\\*", - "*\\Windows\\WinSxS\\*" + "*\\box.exe", + "*\\dropbox.exe", + "*\\googledrivefs.exe", + "*\\icloud.exe", + "*\\onedrive*.exe", + "*C:\\Windows\\explorer.exe", + "*C:\\Windows\\System32\\*", + "*C:\\Windows\\Syswow64\\*", + "*C:\\Windows\\WinSxS\\*" ) + | stats count min(_time) as firstTime max(_time) as lastTime - by Computer ImageLoaded Image EventID dest loaded_file loaded_file_path process_exec - process_guid process_hash process_id process_name process_path - service_dll_signature_exists service_dll_signature_verified signature_id user_id - vendor_product + + by dest loaded_file_path loaded_file + process_path process_name process_exec process_guid process_hash process_id + service_dll_signature_exists service_dll_signature_verified + signature signature_id user_id vendor_product + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cloud_files_filter_loaded_by_uncommon_process_filter` @@ -57,7 +60,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: Cloud Files Filter ($ImageLoaded$) loaded by suspicious process $Image$ on $dest$ + message: Cloud Files Filter [$loaded_file_path$] loaded by suspicious process [$process_path$] on [$dest$] +threat_objects: + - field: loaded_file_path + type: loaded_file analytic_story: - RedSun - BlueHammer diff --git a/detections/endpoint/windows_non_system_process_querying_definition_update.yml b/detections/endpoint/windows_non_system_process_querying_definition_update.yml index 4a01e015225..a2c6a65e8be 100644 --- a/detections/endpoint/windows_non_system_process_querying_definition_update.yml +++ b/detections/endpoint/windows_non_system_process_querying_definition_update.yml @@ -7,7 +7,8 @@ author: Raven Tait, Splunk status: production type: Anomaly description: |- - Detects DNS queries to definitionupdates.microsoft.com or the go.microsoft.com fwlink redirect used for WD update downloads, when the querying process is not a Windows system component. BlueHammer utilizes these definition updates as part of its exploit chain. + Detects DNS queries to definitionupdates.microsoft.com or the go.microsoft.com fwlink redirect used for WD update downloads, when the querying process is not a Windows system component. + BlueHammer utilizes these definition updates as part of its exploit chain. data_source: - Sysmon EventID 22 search: |- @@ -15,16 +16,26 @@ search: |- EventID="22" QueryName="*definitionupdates.microsoft.com*" NOT Image IN ( - "*:\\Program Files\\Microsoft Office\\*", - "*:\\Program Files\\Windows Defender\\*", - "*:\\ProgramData\\Microsoft\\Windows Defender\\*", - "*:\\Windows\\System32\\*", - "*:\\Windows\\SysWOW64\\*" + "C:\\Program Files\\Microsoft Office\\*", + "C:\\Program Files\\Windows Defender\\*", + "C:\\ProgramData\\Microsoft\\Windows Defender\\*", + "C:\\Windows\\System32\\*", + "C:\\Windows\\SysWOW64\\*" ) - | stats count min(_time) as firstTime max(_time) as lastTime BY answer answer_count dvc Computer Image process_exec process_guid process_name query query_count reply_code_id signature signature_id src user_id vendor_product QueryName QueryResults QueryStatus + + | rename Computer as dest + + | stats count min(_time) as firstTime + max(_time) as lastTime + + by src dest answer answer_count + process_path process_name process_exec process_guid + query query_count QueryResults record_type reply_code_id + signature signature_id user_id vendor_product + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | rename Computer as dest + | `windows_non_system_process_querying_definition_update_filter` how_to_implement: |- The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. @@ -46,7 +57,7 @@ intermediate_findings: - field: dest type: system score: 20 - message: Non-System process $Image$ queried Windows Defender Definition Updates domain $QueryName$ on $dest$. + message: Non-System process [$process_path$] queried Windows Defender Definition Updates domain [$query$] on [$dest$]. threat_objects: - field: process_name type: process_name diff --git a/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml b/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml index aa757782a8b..7f894ff9bfa 100644 --- a/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml +++ b/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml @@ -20,9 +20,10 @@ search: |- | stats count min(_time) as firstTime max(_time) as lastTime - by dest dvc file_hash file_name file_path process_exec - process_guid process_id process_name process_path - signature signature_id user_id user vendor_product Contents Image + by dest file_hash file_name file_path + process_path process_name process_exec process_guid process_id + user_id user Contents + signature signature_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From 146652013ee72388e39f9f261211c7ec0b2127f8 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Tue, 13 Oct 2026 20:47:55 +0200 Subject: [PATCH 4/6] Update asl_aws_ecr_container_upload_unknown_user.yml --- detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml b/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml index 52c53235b76..6831869df1e 100644 --- a/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml +++ b/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml @@ -1,6 +1,6 @@ name: ASL AWS ECR Container Upload Unknown User id: 886a8f46-d7e2-4439-b9ba-aec238e31732 -version: 12 +version: 13 creation_date: '2024-05-22' modification_date: '2026-05-13' author: Patrick Bareiss, Splunk From e8b4e1be6c1657712ebd326069fe830715f4d05c Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Tue, 13 Oct 2026 20:55:38 +0200 Subject: [PATCH 5/6] update ds and remove unnecessary wildcard --- data_sources/sysmon_eventid_15.yml | 72 ++++++++++--------- data_sources/sysmon_eventid_22.yml | 66 ++++++++--------- ...iles_filter_loaded_by_uncommon_process.yml | 8 +-- 3 files changed, 75 insertions(+), 71 deletions(-) diff --git a/data_sources/sysmon_eventid_15.yml b/data_sources/sysmon_eventid_15.yml index 45aa929ea73..26bc8419fad 100644 --- a/data_sources/sysmon_eventid_15.yml +++ b/data_sources/sysmon_eventid_15.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 15 id: 95785e02-93b4-47e2-81f1-be326295348e -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-13' author: Patrick Bareiss, Splunk description: Logs the creation of a new file stream, including details about the file stream's hash, path, and associated process metadata. mitre_components: @@ -22,43 +22,11 @@ supported_TA: version: 5.0.1 fields: - _time + - action - Channel - Computer - Contents - CreationUtcTime - - EventChannel - - EventCode - - EventData_Xml - - EventDescription - - EventID - - EventRecordID - - Guid - - Hash - - IMPHASH - - Image - - Keywords - - Level - - MD5 - - Name - - Opcode - - ProcessGuid - - ProcessID - - ProcessId - - RecordID - - RecordNumber - - RuleName - - SHA256 - - SecurityID - - SystemTime - - System_Props_Xml - - TargetFilename - - Task - - ThreadID - - TimeCreated - - UserID - - UtcTime - - Version - - action - date_hour - date_mday - date_minute @@ -70,33 +38,66 @@ fields: - dest - dvc_nt_host - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID - eventtype - file_create_time - file_hash - file_name - file_path + - Guid + - Hash - host - id + - Image + - IMPHASH - index + - Keywords + - Level - linecount + - MD5 + - Name + - Opcode - os - process_exec - process_guid - process_id - process_name - process_path + - ProcessGuid + - ProcessId + - ProcessID - punct + - RecordID + - RecordNumber + - RuleName + - SecurityID + - SHA256 - signature - signature_id - source - sourcetype - splunk_server + - System_Props_Xml + - SystemTime - tag - tag::eventtype + - TargetFilename + - Task + - ThreadID + - TimeCreated - timeendpos - timestartpos + - user - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - dest - dvc @@ -110,6 +111,7 @@ output_fields: - process_path - signature - signature_id + - user - user_id - vendor_product example_log: 15241500x8000000000000000667860Microsoft-Windows-Sysmon/Operationalproject-mumbai-host-2021-04-28 20:11:34.709{ED2ECF8A-C154-6089-F967-00000000BB01}7000C:\Users\DefaultAccount\AppData\Roaming\Telegram Desktop\Telegram.exeC:\Users\DefaultAccount\Downloads\Telegram Desktop\Good(NLA).txt:Zone.Identifier2021-04-28 20:11:33.238MD5=C785C55D5FA3443A11B8417209C4B524,SHA256=D07777E0DC36EBECCE3FA9644F0F44DC4A0B7EDE0CBC1F5D33E8D6CB07AF5B5C,IMPHASH=00000000000000000000000000000000[ZoneTransfer] ZoneId=3 diff --git a/data_sources/sysmon_eventid_22.yml b/data_sources/sysmon_eventid_22.yml index fdaa49c1460..408d161a81e 100644 --- a/data_sources/sysmon_eventid_22.yml +++ b/data_sources/sysmon_eventid_22.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 22 id: 911538b2-eba7-4d3e-85e8-d82d380c37bf -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-13' author: Patrick Bareiss, Splunk description: Logs DNS query events, including details about the queried domain, source IP, query type, and response data. mitre_components: @@ -24,36 +24,6 @@ fields: - _time - Channel - Computer - - EventChannel - - EventCode - - EventData_Xml - - EventDescription - - EventID - - EventRecordID - - Guid - - Image - - Keywords - - Level - - Name - - Opcode - - ProcessGuid - - ProcessID - - ProcessId - - QueryName - - QueryResults - - QueryStatus - - RecordID - - RecordNumber - - RuleName - - SecurityID - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - TimeCreated - - UserID - - UtcTime - - Version - date_hour - date_mday - date_minute @@ -64,30 +34,62 @@ fields: - date_zone - dvc_nt_host - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID - eventtype + - Guid - host - id + - Image - index + - Keywords + - Level - linecount + - Name + - Opcode - process_exec - process_guid - process_name + - process_path + - ProcessGuid + - ProcessId + - ProcessID - punct - query - query_count + - QueryName + - QueryResults + - QueryStatus + - record_type + - RecordID + - RecordNumber - reply_code_id + - RuleName + - SecurityID - signature - signature_id - source - sourcetype - splunk_server - src + - System_Props_Xml + - SystemTime - tag - tag::eventtype + - Task + - ThreadID + - TimeCreated - timeendpos - timestartpos - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - answer - answer_count diff --git a/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml b/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml index 11cad4f781c..8e6bd9a38d5 100644 --- a/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml +++ b/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml @@ -21,10 +21,10 @@ search: |- "*\\googledrivefs.exe", "*\\icloud.exe", "*\\onedrive*.exe", - "*C:\\Windows\\explorer.exe", - "*C:\\Windows\\System32\\*", - "*C:\\Windows\\Syswow64\\*", - "*C:\\Windows\\WinSxS\\*" + "C:\\Windows\\explorer.exe", + "C:\\Windows\\System32\\*", + "C:\\Windows\\Syswow64\\*", + "C:\\Windows\\WinSxS\\*" ) | stats count min(_time) as firstTime From 70f4ccb7aa275052e14d7d6d4999ac0409ea1ec5 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Wed, 14 Oct 2026 02:17:31 +0200 Subject: [PATCH 6/6] add missing rename --- data_sources/sysmon_eventid_22.yml | 1 - .../windows_non_system_process_querying_definition_update.yml | 3 ++- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/data_sources/sysmon_eventid_22.yml b/data_sources/sysmon_eventid_22.yml index 408d161a81e..2a53a749620 100644 --- a/data_sources/sysmon_eventid_22.yml +++ b/data_sources/sysmon_eventid_22.yml @@ -54,7 +54,6 @@ fields: - process_exec - process_guid - process_name - - process_path - ProcessGuid - ProcessId - ProcessID diff --git a/detections/endpoint/windows_non_system_process_querying_definition_update.yml b/detections/endpoint/windows_non_system_process_querying_definition_update.yml index a2c6a65e8be..b428d437a8c 100644 --- a/detections/endpoint/windows_non_system_process_querying_definition_update.yml +++ b/detections/endpoint/windows_non_system_process_querying_definition_update.yml @@ -23,7 +23,8 @@ search: |- "C:\\Windows\\SysWOW64\\*" ) - | rename Computer as dest + | rename Computer as dest, + Image as process_path | stats count min(_time) as firstTime max(_time) as lastTime