From 330a31e9f244bd6087c3bc73ca64129f6cb588fc Mon Sep 17 00:00:00 2001 From: TheLawsOfChaos Date: Thu, 2 Feb 2023 12:32:23 -0500 Subject: [PATCH] Update windows_service_created_with_suspicious_service_path.yml Updated field names to match, and added dest and user_id to the query for investigation purposes. --- ...e_created_with_suspicious_service_path.yml | 25 +++++++++++-------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml index 259310edec..acdd3f8638 100644 --- a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml +++ b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml @@ -11,10 +11,10 @@ description: The following analytics uses Windows Event Id 7045, `New Service Wa alike may create malicious Services for lateral movement or remote code execution as well as persistence and execution. The Clop ransomware has also been seen in the wild abusing Windows services. -search: ' `wineventlog_system` EventCode=7045 Service_File_Name = "*.exe" NOT (Service_File_Name +search: ' `wineventlog_system` EventCode=7045 ImagePath = "*.exe" NOT (ImagePath IN ("*:\\Windows\\*", "*:\\Program File*", "*:\\Programdata\\*", "*%systemroot%\\*")) - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name - Service_Name Service_Start_Type Service_Type | `security_content_ctime(firstTime)` + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ImagePath + ServiceName StartType ServiceType dest user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_created_with_suspicious_service_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type @@ -40,13 +40,17 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: A service $Service_File_Name$ was created from a non-standard path using - $Service_Name$ + message: A service $ImagePath$ was created from a non-standard path using + $ServiceName$ mitre_attack_id: - T1569 - T1569.002 observable: - - name: Service_File_Name + - name: dest + type: Hostname + role: + - Victim + - name: ImagePath type: Other role: - Other @@ -60,11 +64,12 @@ tags: - Splunk Cloud required_fields: - EventCode - - Service_File_Name - - Service_Type + - ImagePath + - ServiceType - _time - - Service_Name - - Service_Start_Type + - ServiceName + - StartType + - dest risk_score: 56 security_domain: endpoint asset_type: Endpoint