name: Suspicious SearchProtocolHost no Command Line Arguments
id: f52d2db8-31f9-4aa7-a176-25779effe55c
version: 1
date: '2021-02-23'
author: Michael Haag, Splunk
type: batch
datamodel: []
description: The following analytic identifies searchprotocolhost.exe with no command
  line arguments. It is unusual for searchprotocolhost.exe to execute with no command
  line arguments present. This particular behavior is common with malicious software,
  including Cobalt Strike. During investigation, identify any network connections
  and parallel processes. Identify any suspicious module loads related to credential
  dumping or file writes. searchprotocolhost.exe is natively found in C:\Windows\system32
  and C:\Windows\syswow64.
search: '`sysmon` EventID=1 (process_name=searchprotocolhost.exe OR OriginalFileName=SearchProtocolHost.exe)
  | regex CommandLine="(searchprotocolhost\.exe.{0,4}$)" | stats count min(_time)
  as firstTime max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine,
  process_name, OriginalFileName, process_path, CommandLine | rename Computer as dest
  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_searchprotocolhost_no_command_line_arguments_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name, parent process, and command-line executions from your
  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
  Sysmon TA.
known_false_positives: Limited false positives may be present in small environments.
  Tuning may be required based on parent process.
references:
- https://github.com/fireeye/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc
tags:
  analytic_story:
  - Cobalt Strike
  automated_detection_testing: passed
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
  kill_chain_phases:
  - Exploitation
  mitre_attack_id:
  - T1055
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - EventID
  - process_name
  - OriginalFileName
  - CommandLine
  - dest
  - User
  - ParentImage
  - ParentCommandLine
  - process_path
  security_domain: endpoint
