name: Suspicious writes to windows Recycle Bin
id: b5541828-8ffd-4070-9d95-b3da4de924cb
version: 4
date: '2020-07-22'
author: Rico Valdez, Splunk
type: batch
datamodel: []
description: This search detects writes to the recycle bin by a process other than
  explorer.exe.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime values(Filesystem.file_path) as file_path values(Filesystem.file_name)
  as file_name FROM datamodel=Endpoint.Filesystem where Filesystem.file_path = "*$Recycle.Bin*"
  by Filesystem.process_id Filesystem.dest | `drop_dm_object_name("Filesystem")`|
  search [| tstats `security_content_summariesonly` values(Processes.user) as user
  values(Processes.process_name) as process_name values(Processes.parent_process_name)
  as parent_process_name FROM datamodel=Endpoint.Processes where Processes.process_name
  != "explorer.exe" by Processes.process_id Processes.dest| `drop_dm_object_name("Processes")`
  | table process_id dest] | `suspicious_writes_to_windows_recycle_bin_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
  on filesystem and process logs responsible for the changes from your endpoints into
  the `Endpoint` datamodel in the `Processes` and `Filesystem` nodes.
known_false_positives: Because the Recycle Bin is a hidden folder in modern versions
  of Windows, it would be unusual for a process other than explorer.exe to write to
  it. Incidents should be investigated as appropriate.
references: []
tags:
  analytic_story:
  - Collection and Staging
  asset_type: Windows
  automated_detection_testing: passed
  cis20:
  - CIS 8
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/write_to_recycle_bin/windows-sysmon.log
  mitre_attack_id:
  - T1036
  nist:
  - DE.CM
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Filesystem.file_path
  - Filesystem.file_name
  - Filesystem.process_id
  - Filesystem.dest
  - Processes.user
  - Processes.process_name
  - Processes.parent_process_name
  - Processes.process_id
  - Processes.dest
  security_domain: endpoint
