search

olafhartong / ThreatHunting

A Splunk app mapped to MITRE ATT&CK to guide your threat hunts
MIT License
1.12k stars 177 forks source link

Bug in Process Create whitelist editor #26

Closed 70bb3 closed 5 years ago

70bb3 commented 5 years ago

In the Process Create whitelist editor, when leaving the field "process_command_line" empty it will not automatically be filled with a "*". Not sure about the impact of this, but it might result in unexpected behaviour.

olafhartong commented 5 years ago

Thanks for letting me know! I'll take care of this. Not having data in the field might give undesired results

olafhartong commented 5 years ago

There was something why I didn't do this by default because it was causing me some issues, I'll look into it again to see whether I can fix it

olafhartong commented 5 years ago

I think I can solve it by adding a default and initial value, unless someone removes it, but can't deal with it in the same fashion otherwise some commands with special characters will not be added to the whitelist