name: Prohibited Software On Endpoint
id: a51bfe1a-94f0-48cc-b4e4-b6ae50145893
version: 2
date: '2019-10-11'
author: David Dorsey, Splunk
type: batch
datamodel:
- Endpoint
description: This search looks for applications on the endpoint that you have marked
  as prohibited.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.process_name
  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)`
  | `prohibited_softwares` | `prohibited_software_on_endpoint_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data
  that records process activity from your hosts to populate the endpoint data model
  in the processes node. This is typically populated via endpoint detection-and-response
  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
  used for this search is usually generated via logs that report process tracking
  in your Windows audit settings. In addition, you must also have only the `process_name`
  (not the entire process path) marked as "prohibited" in the Enterprise Security
  `interesting processes` table. To include the process names marked as "prohibited",
  which is included with ES Content Updates, run the included search <code>Add Prohibited
  Processes to Enterprise Security</code>.
known_false_positives: None identified
references: []
tags:
  analytic_story:
  - Monitor for Unauthorized Software
  - 'Emotet Malware  DHS Report TA18-201A '
  - SamSam Ransomware
  asset_type: Endpoint
  cis20:
  - CIS 2
  kill_chain_phases:
  - Installation
  - Command and Control
  - Actions on Objectives
  nist:
  - ID.AM
  - PR.DS
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _times
  security_domain: endpoint
