Anvilogic high experimental spl

Logon Script Registry Key added [splunk-powershell]

Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence.

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4104) (TERM(reg) 
OR "reg.exe") TERM(add) TERM(UserInitMprLogonScript)
| table _time, host, user process, process_*, singature_id
| bin span=1s
| stats values(*) as * by _time, host

Field Validations

Loading…

Comments (0)

Loading comments...