From 3bf8cf26de9dab7bbbaf5a0117690d91963db259 Mon Sep 17 00:00:00 2001 From: bpatel Date: Tue, 21 Jan 2020 18:05:33 -0800 Subject: [PATCH 1/2] updating the manifest to reflect correct details --- ...system_processes_run_from_unexpected_locations.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/detections/system_processes_run_from_unexpected_locations.yml b/detections/system_processes_run_from_unexpected_locations.yml index 92cb5569f7..f0e62b7bc0 100644 --- a/detections/system_processes_run_from_unexpected_locations.yml +++ b/detections/system_processes_run_from_unexpected_locations.yml @@ -28,6 +28,10 @@ detect: risk_object_type: - system risk_score: 50 + macros: + - is_windows_system_file + lookups: + - system32_executables.csv schedule: cron_schedule: 0 * * * * earliest_time: -70m@m @@ -41,8 +45,7 @@ detect: suppress_fields: dest,process_name suppress_period: 86400s eli5: This search returns all the processes that are not executing out of the C:\Windows\System32 - or C:\Windows\SysWOW64 directories. It then uses a regular expression to extract - the file name of the running process. Next, it takes the filename and looks it up + or C:\Windows\SysWOW64 directories. Next, it takes the filename and looks it up in a table of files that should normally run out of the C:\Windows\System32 or C:\Windows\SysWOW64 directory. Any matches are then returned. entities: @@ -95,7 +98,7 @@ mappings: nist: - PR.PT - DE.CM -modification_date: '2019-02-28' +modification_date: '2020-01-21' name: System Processes Run From Unexpected Locations original_authors: - company: Splunk @@ -105,4 +108,4 @@ references: [] security_domain: endpoint spec_version: 2 type: splunk -version: '3.0' +version: '4.0' From 5d6ef5ce603c1b7d08c4e31e60aadff9b1a30c0f Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 22 Jan 2020 09:14:51 -0800 Subject: [PATCH 2/2] renaming files --- detections/system_processes_run_from_unexpected_locations.yml | 4 ++-- ...indows_system_file_lookup.yml => system32_executables.yml} | 2 +- macros/is_windows_system_file.yml | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) rename lookups/{is_windows_system_file_lookup.yml => system32_executables.yml} (78%) diff --git a/detections/system_processes_run_from_unexpected_locations.yml b/detections/system_processes_run_from_unexpected_locations.yml index f0e62b7bc0..a24938ea99 100644 --- a/detections/system_processes_run_from_unexpected_locations.yml +++ b/detections/system_processes_run_from_unexpected_locations.yml @@ -29,9 +29,9 @@ detect: - system risk_score: 50 macros: - - is_windows_system_file + - system32_executables lookups: - - system32_executables.csv + - system32_executables schedule: cron_schedule: 0 * * * * earliest_time: -70m@m diff --git a/lookups/is_windows_system_file_lookup.yml b/lookups/system32_executables.yml similarity index 78% rename from lookups/is_windows_system_file_lookup.yml rename to lookups/system32_executables.yml index e232fc357a..acdc769149 100644 --- a/lookups/is_windows_system_file_lookup.yml +++ b/lookups/system32_executables.yml @@ -2,4 +2,4 @@ default_match: 'false' description: A list of executable files in Windows\System32 filename: system32_executables.csv min_matches: 1 -name: is_windows_system_file_lookup +name: system32_executables diff --git a/macros/is_windows_system_file.yml b/macros/is_windows_system_file.yml index 2afb2a895a..30c4bdec8f 100644 --- a/macros/is_windows_system_file.yml +++ b/macros/is_windows_system_file.yml @@ -1,5 +1,5 @@ -definition: lookup update=true is_windows_system_file_lookup filename as process_name +definition: lookup update=true system32_executables filename as process_name OUTPUT systemFile | search systemFile=true description: This macro limits the output to process names that are in the Windows System directory -name: is_windows_system_file +name: system32_executables