From 089e2c09d1fc0b95c6fc71c20acbf76dc9532baa Mon Sep 17 00:00:00 2001 From: root Date: Mon, 22 Mar 2021 17:43:09 +0000 Subject: [PATCH] Added detection testing service results inCreate Service In Suspicious File Path --- ...create_service_in_suspicious_file_path.yml | 23 +++++++++++-------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/create_service_in_suspicious_file_path.yml b/detections/endpoint/create_service_in_suspicious_file_path.yml index 5acda780b0..6787d6592d 100644 --- a/detections/endpoint/create_service_in_suspicious_file_path.yml +++ b/detections/endpoint/create_service_in_suspicious_file_path.yml @@ -6,16 +6,16 @@ author: Teoderick Contreras type: batch datamodel: - Endpoint -description: This detection is to identify a creation of "user mode service" where the service file path is located in non-common service folder in windows. -search: ' `wineventlog_system` EventCode=7045 Service_File_Name = "*\.exe" - NOT (Service_File_Name IN ("C:\\Windows\\*", "C:\\Program File*", "C:\\Programdata\\*", "%systemroot%\\*")) - Service_Type = "user mode service" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `create_service_in_suspicious_file_path_filter`' +description: This detection is to identify a creation of "user mode service" where + the service file path is located in non-common service folder in windows. +search: ' `wineventlog_system` EventCode=7045 Service_File_Name = "*\.exe" NOT (Service_File_Name + IN ("C:\\Windows\\*", "C:\\Program File*", "C:\\Programdata\\*", "%systemroot%\\*")) + Service_Type = "user mode service" | stats count min(_time) as firstTime max(_time) + as lastTime by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `create_service_in_suspicious_file_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the Service name, Service File Name Service Start type, and Service Type from your - endpoints. + logs with the Service name, Service File Name Service Start type, and Service Type + from your endpoints. known_false_positives: unknown references: - https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html @@ -38,4 +38,7 @@ tags: - _time - Service_Name - Service_Start_Type - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-system.log