admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
github-actions[bot]
2021-06-24 02:50:00 +00:00
committed by GitHub
parent 3cd66f1c00 e06699b50d
commit 41cd46f480
1 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/office_document_spawned_child_process_to_download.yml
+7 -5
View File
@@ -1,7 +1,7 @@
name: Office Document Spawned Child Process To Download
id: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3
version: 1
date: '2021-04-16'
version: 2
date: '2021-06-23'
author: Teoderick Contreras, Splunk
type: batch
datamodel:
@@ -12,10 +12,12 @@ description: this search is to detect potential malicious office document execut
blend it to the normal noise in the infected machine to cover its track.
search: '`sysmon` EventCode=1 parent_process_name IN ("powerpnt.exe", "winword.exe",
"excel.exe", "visio.exe") process_name = "*.exe" cmdline IN ("*http:*","*https:*") NOT(OriginalFileName
IN("*\\firefox.exe", "*\\chrome.exe","*\\iexplore.exe","*\\msedge.exe")) | stats
min(_time) as firstTime max(_time) as lastTime count by parent_process_name process_name
IN("firefox.exe", "chrome.exe","iexplore.exe","msedge.exe"))
| stats min(_time) as firstTime max(_time) as lastTime count by parent_process_name process_name
parent_process cmdline process_id OriginalFileName ProcessGuid Computer EventCode
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_spawned_child_process_to_download_filter`'
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `office_document_spawned_child_process_to_download_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the