Skip to content

refactor: attacker_tools_on_endpoint performance #3589

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
patel-bhavin merged 3 commits into from
Jul 7, 2025
Merged

refactor: attacker_tools_on_endpoint performance #3589

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1132d0d
refactor: attacker_tools_on_endpoint performance
sventec Jul 3, 2025
7723704
add author tag
sventec Jul 3, 2025
b67fb01
Merge branch 'develop' into refactor-attacker_tools_on_endpoint
patel-bhavin Jul 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 6 additions & 5 deletions detections/endpoint/attacker_tools_on_endpoint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
name: Attacker Tools On Endpoint
id: a51bfe1a-94f0-48cc-b4e4-16a110145893
version: 11
date: '2025-05-02'
author: Bhavin Patel, Splunk
version: 12
date: '2025-07-03'
author: Bhavin Patel, Splunk, sventec, Github Community
status: production
type: TTP
description: The following analytic detects the execution of tools commonly exploited
Expand All @@ -19,8 +19,9 @@ data_source:
- CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime values(Processes.process) as process values(Processes.parent_process)
as parent_process from datamodel=Endpoint.Processes where Processes.dest!=unknown
Processes.user!=unknown by Processes.action Processes.dest Processes.original_file_name
as parent_process from datamodel=Endpoint.Processes where
[| inputlookup attacker_tools | rename attacker_tool_names AS Processes.process_name | fields Processes.process_name] AND
Processes.dest!=unknown AND Processes.user!=unknown by Processes.action Processes.dest Processes.original_file_name
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
Expand Down
Loading