name: First Time Seen Child Process of Zoom
id: e91bd102-d630-4e76-ab73-7e3ba22c5961
version: 1
date: '2020-05-20'
author: David Dorsey, Splunk
type: batch
datamodel:
- Endpoint
description: This search looks for child processes spawned by zoom.exe or zoom.us
  that has not previously been seen.
search: '| tstats `security_content_summariesonly` min(_time) as firstTime values(Processes.parent_process_name)
  as parent_process_name values(Processes.parent_process_id) as parent_process_id
  values(Processes.process_name) as process_name values(Processes.process) as process
  from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe
  OR Processes.parent_process_name=zoom.us) by Processes.process_id Processes.dest
  | `drop_dm_object_name(Processes)` | lookup zoom_first_time_child_process dest as
  dest process_name as process_name OUTPUT firstTimeSeen | where isnull(firstTimeSeen)
  OR firstTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_window`")
  | `security_content_ctime(firstTime)` | table firstTime dest, process_id, process_name,
  parent_process_id, parent_process_name |`first_time_seen_child_process_of_zoom_filter`'
how_to_implement: You must be ingesting data that records process activity from your
  hosts to populate the Endpoint data model in the Processes node. You should run
  the baseline search `Previously Seen Zoom Child Processes - Initial` to build the
  initial table of child processes and hostnames for this search to work. You should
  also schedule at the same interval as this search the second baseline search `Previously
  Seen Zoom Child Processes - Update` to keep this table up to date and to age out
  old child processes. Please update the `previously_seen_zoom_child_processes_window`
  macro to adjust the time window.
known_false_positives: A new child process of zoom isn't malicious by that fact alone.
  Further investigation of the actions of the child process is needed to verify any
  malicious behavior is taken.
references: []
tags:
  analytic_story:
  - Suspicious Zoom Child Processes
  asset_type: Endpoint
  automated_detection_testing: passed
  cis20:
  - CIS 3
  - CIS 8
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/zoom_child_process/windows-sysmon.log
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1068
  nist:
  - PR.PT
  - DE.CM
  - PR.IP
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Processes.parent_process_name
  - Processes.parent_process_id
  - Processes.process_name
  - Processes.process
  - Processes.parent_process_name
  - Processes.process_id
  - Processes.dest
  security_domain: endpoint
