admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inSuspicious Scheduled Task from Public Directory

Browse Source
This commit is contained in:
root
2021-03-03 19:46:18 +00:00
parent aada39ec1c
commit 169fb44249
1 changed files with 12 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
+12 -6
View File
@@ -6,18 +6,24 @@ author: Michael Haag, Splunk
type: batch
datamodel:
- Endpoint
description: The following detection identifies Scheduled Tasks registering (creating a new task) a binary or script to run from a public directory which includes users\public, \programdata\ and \windows\temp.
Upon triage, review the binary or script in the command line for legitimacy, whether an approved binary/script or not. In addition, capture the binary or script in question and analyze for further behaviors. Identify the source and contain the endpoint.
description: The following detection identifies Scheduled Tasks registering (creating
a new task) a binary or script to run from a public directory which includes users\public,
\programdata\ and \windows\temp. Upon triage, review the binary or script in the
command line for legitimacy, whether an approved binary/script or not. In addition,
capture the binary or script in question and analyze for further behaviors. Identify
the source and contain the endpoint.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe
(Processes.process=*\\users\\public\\* OR Processes.process=*\\programdata\\* OR Processes.process=*windows\\temp*) Processes.process=*/create*
by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process
(Processes.process=*\\users\\public\\* OR Processes.process=*\\programdata\\* OR
Processes.process=*windows\\temp*) Processes.process=*/create* by Processes.dest
Processes.user Processes.parent_process Processes.process_name Processes.process
Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `suspicious_scheduled_task_from_public_directory_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
known_false_positives: Limited false positives may be present. Filter as needed by parent process or command line argument.
known_false_positives: Limited false positives may be present. Filter as needed by
parent process or command line argument.
references:
- https://attack.mitre.org/techniques/T1053/005/
tags:
@@ -36,4 +42,4 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
automated_detection_testing: passed