name: System Processes Run From Unexpected Locations
id: a34aae96-ccf8-4aef-952c-3ea21444444d
version: 5
date: '2020-12-08'
author: David Dorsey, Splunk
type: batch
datamodel: []
description: This search looks for system processes that normally run out of C:\Windows\System32\
  or C:\Windows\SysWOW64 that are not run from that location.  This can indicate a
  malicious process that is trying to hide as a legitimate process.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path !="C:\\Windows\\System32*"
  Processes.process_path !="C:\\Windows\\SysWOW64*" by Processes.user Processes.dest
  Processes.process_name Processes.process_id Processes.process_path Processes.parent_process_name
  Processes.process_hash| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|
  `security_content_ctime(lastTime)`| `is_windows_system_file` | `system_processes_run_from_unexpected_locations_filter`'
how_to_implement: To successfully implement this search you need to ingest details
  about process execution from your hosts. Specifically, this search requires the
  process name and the full path to the process executable.
known_false_positives: None identified
references: []
tags:
  analytic_story:
  - Suspicious Command-Line Executions
  - Unusual Processes
  - Ransomware
  asset_type: Endpoint
  automated_detection_testing: passed
  cis20:
  - CIS 8
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/atomic_red_team/windows-sysmon.log
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1036.003
  nist:
  - PR.PT
  - DE.CM
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Processes.process_path
  - Processes.user
  - Processes.dest
  - Processes.process_name
  - Processes.process_id
  - Processes.parent_process_name
  - Processes.process_hash
  security_domain: endpoint
