admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-07-07 08:12:31 -07:00
committed by GitHub
parent 012b360989 e0f43b02f4
commit 18763801cd
1 changed files with 12 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/suspicious_image_creation_in_appdata_folder.yml
+12 -9
View File
@@ -1,7 +1,7 @@
name: Suspicious Image Creation In Appdata Folder
id: f6f904c4-1ac0-11ec-806b-acde48001122
version: 1
date: '2021-09-21'
version: 2
date: '2022-07-07'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
@@ -14,14 +14,17 @@ description: This search is to detect a suspicious creation of image in appdata
not commonly created by user in this folder path.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*"
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
| `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly`
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid
| `drop_dm_object_name(Processes)`
|rename process_guid as proc_guid
|join proc_guid, _time [| tstats `security_content_summariesonly`
count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
where Filesystem.file_name IN ("*.png","*.jpg","*.bmp","*.gif","*.tiff") Filesystem.file_path
= "*\\appdata\\Roaming\\*" by _time span=1h Filesystem.dest Filesystem.file_create_time
Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` |
fields _time dest file_create_time file_name file_path process_name process_path
process] | `suspicious_image_creation_in_appdata_folder_filter`'
where Filesystem.file_name IN ("*.png","*.jpg","*.bmp","*.gif","*.tiff") Filesystem.file_path= "*\\appdata\\Roaming\\*"
by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid
| `drop_dm_object_name(Filesystem)`
|rename process_guid as proc_guid | fields _time dest file_create_time file_name file_path process_name process_path
process proc_guid]
| `suspicious_image_creation_in_appdata_folder_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the