admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'ransom_ttp2' of https://github.com/splunk/security_content into ransom_ttp2

Browse Source
This commit is contained in:
Detection Testing Service
2021-06-24 10:23:34 +00:00
parent d894ebbafa 1a3f0a8bd0
commit 366ad3ba5d
1 changed files with 14 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/execute_javascript_with_jscript_com_clsid.yml
+14 -10
View File
@@ -6,15 +6,16 @@ author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: This analytic will identify suspicious process of cscript.exe where it tries to execute javascript using jscript.encode CLSID (COM OBJ).
This technique was seen in ransomware (reddot ransomware) where it execute javascript with this com object with combination of amsi disabling technique.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
from datamodel=Endpoint.Processes where Processes.process_name = "cscript.exe" Processes.process="*-e:{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}*"
by Processes.parent_process_name Processes.process_name Processes.process Processes.parent_process Processes.process_id Processes.dest Processes.user
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `execute_javascript_with_jscript_com_clsid_filter`'
description: This analytic will identify suspicious process of cscript.exe where it
tries to execute javascript using jscript.encode CLSID (COM OBJ). This technique
was seen in ransomware (reddot ransomware) where it execute javascript with this
com object with combination of amsi disabling technique.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "cscript.exe"
Processes.process="*-e:{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}*" by Processes.parent_process_name
Processes.process_name Processes.process Processes.parent_process Processes.process_id
Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `execute_javascript_with_jscript_com_clsid_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the Filesystem responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
@@ -41,4 +42,7 @@ tags:
- Processes.process_id
- Processes.dest
- Processes.user
security_domain: endpoint
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log