name: Monitor for Unauthorized Software
id: 8892a655-6205-43f7-abba-06460e38c8ae
version: 1
date: '2017-09-15'
author: David Dorsey, Splunk
type: batch
description: 'Identify and investigate prohibited/unauthorized software or processes
  that may be concealing malicious behavior within your environment. '
narrative: 'It is critical to identify unauthorized software and processes running
  on enterprise endpoints and determine whether they are likely to be malicious. This
  Analytic Story requires the user to populate the Interesting Processes table within
  Enterprise Security with prohibited processes. An included support search will augment
  this data, adding information on processes thought to be malicious. This search
  requires data from endpoint detection-and-response solutions, endpoint data sources
  (such as Sysmon), or Windows Event Logs--assuming that the Active Directory administrator
  has enabled process tracking within the System Event Audit Logs.\

  It is important to investigate any software identified as suspicious, in order to
  understand how it was installed or executed. Analyzing authentication logs or any
  historic notable events might elicit additional investigative leads of interest.
  For best results, schedule the search to run every two weeks. '
references:
- https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
tags:
  analytic_story: Monitor for Unauthorized Software
  category:
  - Best Practices
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  usecase: Compliance
