Anvilogic low experimental spl
CSVDE Export Active Directory [splunk-edr]
Detects the administration tool csvde.exe attempting to export Active Directory data in an APT scenario. -- Threat Actor Association: Volt Typhoon
Detection Logic
`get_endpoint_data` `get_endpoint_data_edr` ("csvde.exe"
AND TERM(-f))
| table _time, host, user parent_*, process_*, process
| bin span=30s
| stats values(*) as * by _time, hostField Validations
Loading…
Comments (0)
Loading comments...