admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Cover xml winevents

Browse Source
This commit is contained in:
Michael Radka
2022-04-13 17:44:41 -04:00
parent cb363eb47a
commit 11d6905b01
1 changed files with 13 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/executable_file_written_in_administrative_smb_share.yml
+13 -5
View File
@@ -12,11 +12,18 @@ description: The following analytic identifies executable files (.exe or .dll) b
endpoints. Red Teams and adversaries alike may abuse administrative shares for lateral
movement and remote code execution. The Trickbot malware family also implements
this behavior to try to infect other machines in the infected network.
search: '`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.exe","*.dll")
Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask=
"0x2" | stats min(_time) as firstTime max(_time) as lastTime count by EventCode
Share_Name Relative_Target_Name Object_Type Access_Mask user src_port Source_Address
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `executable_file_written_in_administrative_smb_share_filter`'
search: '`wineventlog_security`
EventCode=5145
(Relative_Target_Name IN ("*.exe","*.dll") OR RelativeTargetName IN ("*.exe","*.dll"))
(Object_Type=File OR ObjectType=File)
(Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") OR ShareName IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$"))
(Access_Mask= "0x2" OR AccessMask= "0x2")
| eval Relative_Target_Name=coalesce("Relative_Target_Name", "RelativeTargetName"),
Object_Type=coalesce(Object_Type, ObjectType),
Share_Name=coalesce(Share_Name, ShareName),
Access_Mask=coalesce(Access_Mask, AccessMask),
Source_Address=coalesce(Source_Address, IpAddress)
| stats min(_time) as firstTime max(_time) as lastTime count by EventCode Share_Name Relative_Target_Name Object_Type Access_Mask src_user src_port Source_Address'
how_to_implement: To successfully implement this search, you need to be ingesting
Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also
required. Also enable the object Audit access success/failure in your group policy.
@@ -41,6 +48,7 @@ tags:
- Stage:Lateral Movement
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/exe_smbshare/windows-security.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/exe_smbshare/windows-security-xml.log
impact: 70
kill_chain_phases:
- Exploitation