From 1132d0d4ec989ae72bd438ea3f88bfc460469f5a Mon Sep 17 00:00:00 2001 From: sventec <18218761+sventec@users.noreply.github.com> Date: Thu, 3 Jul 2025 10:37:56 -0400 Subject: [PATCH 1/2] refactor: attacker_tools_on_endpoint performance refactor attacker_tools_on_endpoint to improve search performance, using the same paradigm as detect_remote_access_software_usage_process. --- detections/endpoint/attacker_tools_on_endpoint.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml index 4776b63799..2e31cd3fed 100644 --- a/detections/endpoint/attacker_tools_on_endpoint.yml +++ b/detections/endpoint/attacker_tools_on_endpoint.yml @@ -1,7 +1,7 @@ name: Attacker Tools On Endpoint id: a51bfe1a-94f0-48cc-b4e4-16a110145893 -version: 11 -date: '2025-05-02' +version: 12 +date: '2025-07-03' author: Bhavin Patel, Splunk status: production type: TTP @@ -19,8 +19,9 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process) as process values(Processes.parent_process) - as parent_process from datamodel=Endpoint.Processes where Processes.dest!=unknown - Processes.user!=unknown by Processes.action Processes.dest Processes.original_file_name + as parent_process from datamodel=Endpoint.Processes where + [| inputlookup attacker_tools | rename attacker_tool_names AS Processes.process_name | fields Processes.process_name] AND + Processes.dest!=unknown AND Processes.user!=unknown by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash From 7723704e1793f14f3c74053f5d08c16d62df5d27 Mon Sep 17 00:00:00 2001 From: sventec <18218761+sventec@users.noreply.github.com> Date: Thu, 3 Jul 2025 19:32:26 -0400 Subject: [PATCH 2/2] add author tag --- detections/endpoint/attacker_tools_on_endpoint.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml index 2e31cd3fed..d236d55423 100644 --- a/detections/endpoint/attacker_tools_on_endpoint.yml +++ b/detections/endpoint/attacker_tools_on_endpoint.yml @@ -2,7 +2,7 @@ name: Attacker Tools On Endpoint id: a51bfe1a-94f0-48cc-b4e4-16a110145893 version: 12 date: '2025-07-03' -author: Bhavin Patel, Splunk +author: Bhavin Patel, Splunk, sventec, Github Community status: production type: TTP description: The following analytic detects the execution of tools commonly exploited