Created
October 13, 2022 19:12
-
-
Save Samirbous/fe1cbf2e776b64544452bfc7994afae4 to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| sequence by host.id, process.entity_id with maxspan=3s | |
| [process where event.type == "start" and process.name : "svchost.exe" and process.args : "appmodel"] | |
| [network where event.action == "connection_accepted" and | |
| process.name : "svchost.exe" and | |
| source.port >= 49152 and destination.port >= 49152 and source.ip != "127.0.0.1" and source.ip != "::1"] |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment