name: Detect Prohibited Applications Spawning cmd exe
id: dcfd6b40-42f9-469d-a433-2e53f7486664
version: 5
date: '2020-11-10'
author: Bhavin Patel, Splunk
type: batch
datamodel:
- Endpoint
description: This search looks for executions of cmd.exe spawned by a process that
  is often abused by attackers and that does not typically launch cmd.exe.
search: '| tstats `security_content_summariesonly` count values(Processes.process)
  as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
  where Processes.process_name=cmd.exe by Processes.parent_process_name Processes.process_name
  Processes.dest Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
  `security_content_ctime(lastTime)` |search [`prohibited_apps_launching_cmd`] | `detect_prohibited_applications_spawning_cmd_exe_filter`'
how_to_implement: You must be ingesting data that records process activity from your
  hosts and populates the Endpoint data model with the resultant dataset. This search
  includes a lookup file, `prohibited_apps_launching_cmd.csv`, that contains a list
  of processes that should not be spawning cmd.exe. You can modify this lookup to
  better suit your environment.
known_false_positives: There are circumstances where an application may legitimately
  execute and interact with the Windows command-line interface. Investigate and modify
  the lookup file, as appropriate.
references: []
tags:
  analytic_story:
  - Suspicious Command-Line Executions
  - Suspicious MSHTA Activity
  - Suspicious Zoom Child Processes
  - NOBELIUM Group
  asset_type: Endpoint
  automated_detection_testing: passed
  cis20:
  - CIS 8
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-sysmon.log
  kill_chain_phases:
  - Exploitation
  mitre_attack_id:
  - T1059.003
  nist:
  - PR.PT
  - DE.CM
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Processes.process
  - Processes.process_name
  - Processes.parent_process_name
  - Processes.dest
  - Processes.user
  security_domain: endpoint
