admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'develop' into ssa_testing_user_doc

Browse Source
This commit is contained in:
Jose Enrique Hernandez
2021-04-26 12:32:08 -04:00
committed by GitHub
parent 3afbc4432d 0f401dd3bf
commit 02728eec00
2 changed files with 10 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___system_process_running_unexpected_location.yml
+6 -4
View File
@@ -223,16 +223,18 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
OR process_name="wuapp.exe" OR process_name="wuauclt.exe" OR process_name="wusa.exe"
OR process_name="xcopy.exe" OR process_name="xpsrchvw.exe" OR process_name="xwizard.exe";
| from $cond_1 | union $cond_2 | union $cond_3 | union $cond_4 | union $cond_5 |
union $cond_6 | where process_path!="c:\\windows\\system32" AND process_path!="c:\\windows\\syswow64"
| eval start_time = timestamp, end_time = timestamp, entities = mvappend(device,
user), body = "TBD" | into write_ssa_detected_events();'
| from $cond_1 | union $cond_2 | union $cond_3 | union $cond_4 | union $cond_5 | union $cond_6
| | where process_path NOT LIKE "%\\windows\\system32%" OR process_path NOT LIKE "%\\windows\\syswow64%"
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(device, user), body=create_map(["process_path", process_path, "process_name", process_name])
| into write_ssa_detected_events();'
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
known_false_positives: None
references: []
tags:
analytic_story:
- Windows Defense Evasion Tactics
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/windows-security.log
cis20:
- CIS 8
kill_chain_phases:
tests/endpoint/ssa___system_process_running_unexpected_location.test.yml
+4 -5
View File
@@ -1,10 +1,9 @@
name: System Process Running from Unexpected Location - SSA Unit Test
tests:
- name: System Process Running from Unexpected Location - SSA
- name: System Process Running from Unexpected Location
file: endpoint/ssa___system_process_running_unexpected_location.yml
pass_condition: '@count_gt(0)'
description: Test process running from other locations
pass_condition: '@count_eq(0)'
description: Test System Process Running from an unexpected location
attack_data:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/atomic_red_team/windows-security.log
source: WinEventLog:Security
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/windows-security.log