Anvilogic high experimental spl

Logon Script Registry Key added [splunk-edr]

Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence.

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_edr` ((event_type IN ("childproc","netconn","proc")) 
OR (TERM(ProcessRollup2) 
OR Type=Process) 
OR TERM(DeviceProcessEvents)) (TERM(reg) 
OR "reg.exe") TERM(add) TERM(UserInitMprLogonScript)
| table _time, host, user process, process_*, singature_id, parent_*
| bin span=1s
| stats values(*) as * by _time, host

Field Validations

Loading…

Comments (0)

Loading comments...