From 177ed8339f46415d699abaceb5d21cfd53a98f96 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 24 Jun 2021 10:19:05 +0000 Subject: [PATCH] Added detection testing service results inExecute Javascript With Jscript COM CLSID --- ...cute_javascript_with_jscript_com_clsid.yml | 24 +++++++++++-------- 1 file changed, 14 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml index 8f8cec627c..b44f56efbd 100644 --- a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml +++ b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml @@ -6,15 +6,16 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This analytic will identify suspicious process of cscript.exe where it tries to execute javascript using jscript.encode CLSID (COM OBJ). - This technique was seen in ransomware (reddot ransomware) where it execute javascript with this com object with combination of amsi disabling technique. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime - from datamodel=Endpoint.Processes where Processes.process_name = "cscript.exe" Processes.process="*-e:{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}*" - by Processes.parent_process_name Processes.process_name Processes.process Processes.parent_process Processes.process_id Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `execute_javascript_with_jscript_com_clsid_filter`' +description: This analytic will identify suspicious process of cscript.exe where it + tries to execute javascript using jscript.encode CLSID (COM OBJ). This technique + was seen in ransomware (reddot ransomware) where it execute javascript with this + com object with combination of amsi disabling technique. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "cscript.exe" + Processes.process="*-e:{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}*" by Processes.parent_process_name + Processes.process_name Processes.process Processes.parent_process Processes.process_id + Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `execute_javascript_with_jscript_com_clsid_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. @@ -41,4 +42,7 @@ tags: - Processes.process_id - Processes.dest - Processes.user - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log