From 01897585d8bc056022ecc2bfe8498f725b168a24 Mon Sep 17 00:00:00 2001 From: d1vious Date: Wed, 10 Nov 2021 12:40:04 -0500 Subject: [PATCH 1/5] its drunk --- .../ssa___prohibited_apps_spawning_cmdprompt.yml | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index fda3e3841c..19ae3213bd 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -1,9 +1,9 @@ name: Detect Prohibited Applications Spawning cmd exe id: c10a18cb-fd80-4ffa-a844-25026e0a0c94 -version: 1 -date: 2020-7-13 +version: 2 +date: 2021-11-10 author: Ignacio Bermudez Corrales, Splunk -type: TTP +type: Anomaly datamodel: [] description: This search looks for executions of cmd.exe spawned by a process that is often abused by attackers and that does not typically launch cmd.exe. This is @@ -36,9 +36,6 @@ references: [] tags: analytic_story: - Suspicious Command-Line Executions - - Suspicious MSHTA Activity - - Suspicious Zoom Child Processes - - Sunburst Malware cis20: - CIS 8 confidence: 80 @@ -47,7 +44,7 @@ tags: - Source:Endpoint - Stage:Command And Control - Consequence:Loss Of Control - impact: 70 + impact: 50 kill_chain_phases: - Exploitation message: Potential malicious landing to the console via unexpected programs that @@ -79,6 +76,6 @@ tags: - _time - dest_device_id - dest_user_id - risk_score: 56 + risk_score: 40 risk_severity: low security_domain: endpoint From cdabce8248c9a1e83eb1b3c1f8a7222f1c94245c Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 10 Nov 2021 10:53:55 -0700 Subject: [PATCH 2/5] :beer: --- ...a___prohibited_apps_spawning_cmdprompt.yml | 34 +++++++++---------- ...ted_applications_spawning_cmd_exe.test.yml | 6 ++-- 2 files changed, 20 insertions(+), 20 deletions(-) diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index 19ae3213bd..936607a41b 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -27,29 +27,25 @@ search: '| from read_ssa_enriched_events() | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, dest_user_id), body=create_map(["event_id", event_id, "process_name", process_name, "parent_process_name", parent_process]) | into write_ssa_detected_events();' -how_to_implement: You must be ingesting sysmon logs. This search has been modified +how_to_implement: In order to successfully implement this analytic, you will need endpoint process data from a EDR product or Sysmon. This search has been modified to process raw sysmon data from attack_range's nxlogs on DSP. known_false_positives: There are circumstances where an application may legitimately - execute and interact with the Windows command-line interface. Investigate and modify - the lookup file, as appropriate. -references: [] + execute and interact with the Windows command-line interface. +references: + - https://attack.mitre.org/techniques/T1059/ tags: analytic_story: - Suspicious Command-Line Executions cis20: - CIS 8 - confidence: 80 + confidence: 50 context: - - Source:AD - Source:Endpoint - - Stage:Command And Control - - Consequence:Loss Of Control - impact: 50 + - Stage:Defense Evasion + impact: 70 kill_chain_phases: - Exploitation - message: Potential malicious landing to the console via unexpected programs that - called cmd.exe. Operation is performed at the device $dest_device_id$, by the - account $dest_user_id$ where parent process $parent_process$ spwaned $process_name$. + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event that warrants investigating. mitre_attack_id: - T1059 nist: @@ -64,10 +60,14 @@ tags: type: Hostname role: - Victim - - name: cmd_line - type: processname + - name: parent_process_name + type: Parent Process role: - - Others + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Behavioral Analytics required_fields: @@ -76,6 +76,6 @@ tags: - _time - dest_device_id - dest_user_id - risk_score: 40 + risk_score: 35 risk_severity: low - security_domain: endpoint + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.test.yml b/tests/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.test.yml index b6455e0259..8b78331f05 100644 --- a/tests/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.test.yml +++ b/tests/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.test.yml @@ -1,10 +1,10 @@ name: Detect Prohibited Applications Spawning cmd exe Unit Test tests: - - name: Access LSASS Memory for Dump Creation + - name: Detect Prohibited Applications Spawning cmd exe file: endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml pass_condition: '@count_gt(0)' - description: Test credential dumping detections + description: Detect Prohibited Applications Spawning cmd exe attack_data: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-security.log - source: WinEventLog:Security + source: WinEventLog:Security \ No newline at end of file From 1860d878c86a29cfbb723efe1ab1fca3ea38a245 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 10 Nov 2021 10:58:06 -0700 Subject: [PATCH 3/5] :beers: --- .../endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index 936607a41b..16682de70e 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -5,10 +5,8 @@ date: 2021-11-10 author: Ignacio Bermudez Corrales, Splunk type: Anomaly datamodel: [] -description: This search looks for executions of cmd.exe spawned by a process that - is often abused by attackers and that does not typically launch cmd.exe. This is - a SPL2 implementation of the rule `Detect Prohibited Applications Spawning cmd.exe` - by @bpatel. +description: The following analytic identifies parent processes, browsers, Windows terminal applications, Office Products and Java spawning cmd.exe. By its very nature, many applications spawn cmd.exe natively or built into macros. Much of this will need to be tuned to further enhance the risk. +During triage, review parallel process execution and identify any file modifications that may have occurred. Capture any artifacts and review further. search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) From 5c2b9308517db81b98844c03134fc2afd5c45916 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 10 Nov 2021 11:01:54 -0700 Subject: [PATCH 4/5] :beers: :fish: --- .../endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index 16682de70e..16cd22c82b 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -5,8 +5,8 @@ date: 2021-11-10 author: Ignacio Bermudez Corrales, Splunk type: Anomaly datamodel: [] -description: The following analytic identifies parent processes, browsers, Windows terminal applications, Office Products and Java spawning cmd.exe. By its very nature, many applications spawn cmd.exe natively or built into macros. Much of this will need to be tuned to further enhance the risk. -During triage, review parallel process execution and identify any file modifications that may have occurred. Capture any artifacts and review further. +description: 'The following analytic identifies parent processes, browsers, Windows terminal applications, Office Products and Java spawning cmd.exe. By its very nature, many applications spawn cmd.exe natively or built into macros. Much of this will need to be tuned to further enhance the risk. +During triage, review parallel process execution and identify any file modifications that may have occurred. Capture any artifacts and review further.' search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) From f51a472f389901d86c2430ea7f14584eed8ceaa6 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 10 Nov 2021 11:13:55 -0700 Subject: [PATCH 5/5] date --- .../endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index 16cd22c82b..3c20b25cdb 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -1,7 +1,7 @@ name: Detect Prohibited Applications Spawning cmd exe id: c10a18cb-fd80-4ffa-a844-25026e0a0c94 version: 2 -date: 2021-11-10 +date: '2021-11-10' author: Ignacio Bermudez Corrales, Splunk type: Anomaly datamodel: []