admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inAny Powershell DownloadString

Browse Source
This commit is contained in:
root
2021-09-21 19:28:58 +00:00
parent f257545630
commit 2ea88aac2a
1 changed files with 13 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/any_powershell_downloadstring.yml
+13 -10
View File
@@ -12,12 +12,15 @@ description: The following analytic identifies the use of PowerShell downloading
(IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell
transaction logs are available, review for further details of the implant.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_powershell`
Processes.process=*.DownloadString* by Processes.dest Processes.user Processes.parent_process
Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
`any_powershell_downloadstring_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process=*.DownloadString* by
Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name
Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `any_powershell_downloadstring_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: False positives may be present and filtering will need to occur
by parent process or command line argument. It may be required to modify this query
to an EDR product for more granular coverage.
@@ -67,11 +70,11 @@ tags:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name #parent process name
- Processes.parent_process #parent cmdline
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name #process name
- Processes.process #process cmdline
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path