Anvilogic high experimental spl

Net.exe Use with URL [splunk-edr]

This use case detects net share commands mapping a drive to a URL as observed by the BumbleBee loader.

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_edr` TERM(net) TERM(use) "://"
| regex process="://"
| table _time, host, user process, process_*
| bin span=1s
| stats values(*) as * by _time, host

Field Validations

Loading…

Comments (0)

Loading comments...