name: Rare Parent-Child Process Relationship
id: e03aa905-6549-4e34-b304-7a922185b2c4
version: 1
date: '2020-08-13'
author: Ignacio Bermudez Corrales, Splunk
type: streaming
datamodel: []
description: An attacker may use LOLBAS tools spawned from vulnerable applications
  not typically used by system administrators. This search leverages the Splunk Streaming
  ML DSP plugin to find rare parent/child relationships. The list of application has
  been extracted from https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
  "_time"), "string", null)) | eval parent_process=lower(ucast(map_get(input_event,
  "parent_process_name"), "string", null)), parent_process_name=mvindex(split(parent_process,
  "\\"), -1), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
  null)), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null),
  dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) | where
  parent_process_name!=null | select parent_process_name, process_name, timestamp,
  dest_device_id, dest_user_id | conditional_anomaly conditional="parent_process_name"
  target="process_name" | rename output as input | where input < 1 | adaptive_threshold
  algorithm="quantile" entity="parent_process_name" window=604800000L | where label
  AND quantile<0.1 AND (process_name="powershell.exe" OR process_name="regsvcs.exe"
  OR process_name="ftp.exe" OR process_name="dfsvc.exe" OR process_name="rasautou.exe"
  OR process_name="schtasks.exe" OR process_name="xwizard.exe" OR process_name="findstr.exe"
  OR process_name="esentutl.exe" OR process_name="cscript.exe" OR process_name="reg.exe"
  OR process_name="csc.exe" OR process_name="atbroker.exe" OR process_name="print.exe"
  OR process_name="pcwrun.exe" OR process_name="vbc.exe" OR process_name="rpcping.exe"
  OR process_name="wsreset.exe" OR process_name="ilasm.exe" OR process_name="certutil.exe"
  OR process_name="replace.exe" OR process_name="mshta.exe" OR process_name="bitsadmin.exe"
  OR process_name="wscript.exe" OR process_name="ieexec.exe" OR process_name="cmd.exe"
  OR process_name="microsoft.workflow.compiler.exe" OR process_name="runscripthelper.exe"
  OR process_name="makecab.exe" OR process_name="forfiles.exe" OR process_name="desktopimgdownldr.exe"
  OR process_name="control.exe" OR process_name="msbuild.exe" OR process_name="register-cimprovider.exe"
  OR process_name="tttracer.exe" OR process_name="ie4uinit.exe" OR process_name="sc.exe"
  OR process_name="bash.exe" OR process_name="hh.exe" OR process_name="cmstp.exe"
  OR process_name="mmc.exe" OR process_name="jsc.exe" OR process_name="scriptrunner.exe"
  OR process_name="odbcconf.exe" OR process_name="extexport.exe" OR process_name="msdt.exe"
  OR process_name="diskshadow.exe" OR process_name="extrac32.exe" OR process_name="eventvwr.exe"
  OR process_name="mavinject.exe" OR process_name="regasm.exe" OR process_name="gpscript.exe"
  OR process_name="rundll32.exe" OR process_name="regsvr32.exe" OR process_name="regedit.exe"
  OR process_name="msiexec.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="presentationhost.exe"
  OR process_name="regini.exe" OR process_name="wmic.exe" OR process_name="runonce.exe"
  OR process_name="syncappvpublishingserver.exe" OR process_name="verclsid.exe" OR
  process_name="psr.exe" OR process_name="infdefaultinstall.exe" OR process_name="explorer.exe"
  OR process_name="expand.exe" OR process_name="installutil.exe" OR process_name="netsh.exe"
  OR process_name="wab.exe" OR process_name="dnscmd.exe" OR process_name="at.exe"
  OR process_name="pcalua.exe" OR process_name="cmdkey.exe" OR process_name="msconfig.exe")

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id,
  dest_user_id), body = "TBD" | into write_ssa_detected_events();'
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
known_false_positives: 'Some custom tools used by admins could be used rarely to launch
  remotely applications. This might trigger false positives at the beginning when
  it hasn''t collected yet enough data to construct the baseline.

  '
references: []
tags:
  analytic_story:
  - Unusual Processes
  cis20:
  - CIS 8
  kill_chain_phases:
  - Exploitation
  mitre_attack_id:
  - T1203
  - T1059
  - T1053
  - T1072
  nist:
  - PR.PT
  - DE.CM
  product:
  - UEBA for Security Cloud
  required_fields:
  - process_name
  - parent_process_name
  - _time
  - dest_device_id
  - dest_user_id
  risk_severity: low
  security_domain: endpoint
