From 41fb7257cd57d5122d04cce3cc530377bbfa42e2 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 28 Feb 2023 10:49:16 +0100 Subject: [PATCH 1/7] Update suspicious_process_file_path.yml minor fix for wrong name in observable fields. --- detections/endpoint/suspicious_process_file_path.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 4c86863b05..66ff71c302 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -73,7 +73,7 @@ tags: type: Endpoint role: - Victim - - name: Processes.process_path.file_path + - name: Processes.process_path type: File Name role: - Attacker From a21deeb7a0277c99fee4eeab056fa285bcff9b38 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 1 Mar 2023 14:05:31 +0100 Subject: [PATCH 2/7] Update suspicious_process_file_path.yml --- detections/endpoint/suspicious_process_file_path.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 66ff71c302..54754fa371 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -14,9 +14,9 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_path = "*\\windows\\fonts\\*" OR Processes.process_path = "*\\windows\\temp\\*" OR Processes.process_path = "*\\users\\public\\*" - OR Processes.process_path = "*\\windows\\debug\\*" OR Processes.process_path.file_path - = "*\\Users\\Administrator\\Music\\*" OR Processes.process_path.file_path = "*\\Windows\\servicing\\*" - OR Processes.process_path.file_path = "*\\Users\\Default\\*" OR Processes.process_path.file_path + OR Processes.process_path = "*\\windows\\debug\\*" OR Processes.process_path + = "*\\Users\\Administrator\\Music\\*" OR Processes.process_path = "*\\Windows\\servicing\\*" + OR Processes.process_path = "*\\Users\\Default\\*" OR Processes.process_path = "*Recycle.bin*" OR Processes.process_path = "*\\Windows\\Media\\*" OR Processes.process_path = "\\Windows\\repair\\*" OR Processes.process_path = "*\\temp\\*" OR Processes.process_path = "*\\PerfLogs\\*" by Processes.parent_process_name Processes.parent_process Processes.process_path From 0de5be903072d22f31511dd3dbc407716a48f323 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 1 Mar 2023 14:05:56 +0100 Subject: [PATCH 3/7] Update suspicious_process_file_path.yml --- detections/endpoint/suspicious_process_file_path.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 54754fa371..ecbbf1ddad 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -64,7 +64,7 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Suspicioues process $Processes.process_path.file_path$ running from suspicious + message: Suspicioues process $Processes.process_path$ running from suspicious location mitre_attack_id: - T1543 From bbb9b5a421bb69c4e39ba029278770242e02cd7e Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 1 Mar 2023 10:53:03 -0800 Subject: [PATCH 4/7] Update suspicious_process_file_path.yml --- detections/endpoint/suspicious_process_file_path.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index ecbbf1ddad..7bc4fe9bca 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -64,7 +64,7 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Suspicioues process $Processes.process_path$ running from suspicious + message: Suspicious process $process_name$ running from a suspicious proces path: $process_path$ on host:$dest$ location mitre_attack_id: - T1543 From 4aaa2424c3caafd4405489be6e93314325207be9 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 1 Mar 2023 11:04:11 -0800 Subject: [PATCH 5/7] Update suspicious_process_file_path.yml --- detections/endpoint/suspicious_process_file_path.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 7bc4fe9bca..8b764c53f3 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -64,8 +64,7 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Suspicious process $process_name$ running from a suspicious proces path: $process_path$ on host:$dest$ - location + message: Suspicious process $process_name$ running from a suspicious process path- $process_path$ on host- $dest$ mitre_attack_id: - T1543 observable: From e904ff4e1ecde0be3177d53771430a67d97a1f3d Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 1 Mar 2023 11:08:40 -0800 Subject: [PATCH 6/7] Update suspicious_process_file_path.yml --- detections/endpoint/suspicious_process_file_path.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 8b764c53f3..ec7e8118c2 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -73,7 +73,7 @@ tags: role: - Victim - name: Processes.process_path - type: File Name + type: Location role: - Attacker product: From ae3ef32e0ab565cb6ad0279fb1eee6901d52fcba Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 1 Mar 2023 12:38:01 -0800 Subject: [PATCH 7/7] Update suspicious_process_file_path.yml --- detections/endpoint/suspicious_process_file_path.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index ec7e8118c2..215f45378a 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -72,7 +72,7 @@ tags: type: Endpoint role: - Victim - - name: Processes.process_path + - name: process_path type: Location role: - Attacker