name: System Information Discovery Detection
id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72
version: 1
date: '2020-10-12'
author: Patrick Bareiss, Splunk
type: batch
datamodel:
- Endpoint
description: Detect system information discovery techniques used by attackers to understand
  configurations of the system to further exploit it.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where (Processes.process="*wmic* qfe*"
  OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.user
  Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)`
  | eventstats dc(process) as dc_processes_by_dest by dest | where dc_processes_by_dest
  > 2 | stats values(process) min(firstTime) as firstTime max(lastTime) as lastTime
  by user, dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
  | `system_information_discovery_detection_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node.
known_false_positives: Administrators debugging servers
references:
- https://oscp.infosecsanyam.in/priv-escalation/windows-priv-escalation
tags:
  analytic_story:
  - Discovery Techniques
  asset_type: Windows
  automated_detection_testing: passed
  cis20:
  - CIS 6
  - CIS 8
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1082/atomic_red_team/windows-sysmon.log
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1082
  nist:
  - DE.CM
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Processes.process
  - Processes.user
  - Processes.process_name
  - Processes.dest
  security_domain: endpoint
