Anvilogic high experimental spl

Logon Script Registry Key added [splunk-winevent]

Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence.

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) 
OR "<EventID>4688<") (TERM(reg) 
OR "reg.exe") TERM(add) TERM(UserInitMprLogonScript)
| table _time, host, user process, process_*, singature_id, parent_*
| bin span=1s
| stats values(*) as * by _time, host

Field Validations

Loading…

Comments (0)

Loading comments...