admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-07-12 12:33:23 -07:00
committed by GitHub
parent b5d2c880b2 debf5ddda6
commit 42191ed3a9
2 changed files with 32 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/office_product_writing_cab_or_inf.yml
+17 -12
View File
@@ -1,7 +1,7 @@
name: Office Product Writing cab or inf
id: f48cd1d4-125a-11ec-a447-acde48001122
version: 1
date: '2021-09-10'
version: 2
date: '2022-07-07'
author: Michael Haag, Splunk
type: TTP
datamodel:
@@ -10,16 +10,21 @@ description: The following analytic identifies behavior related to CVE-2021-4044
Whereas the malicious document will load ActiveX and download the remote payload
(.inf, .cab). During triage, review parallel processes and further activity on endpoint
to identify additional patterns. Retrieve the file modifications and analyze further.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe")
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
| `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly`
count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
where Filesystem.file_name IN ("*.inf","*.cab") by _time span=1h Filesystem.dest
Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)`
| fields _time dest file_create_time file_name file_path process_name process_path
process] | dedup file_create_time | table dest, process_name, process, file_create_time,
file_name, file_path | `office_product_writing_cab_or_inf_filter`'
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe")
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid
| `drop_dm_object_name(Processes)`
|rename process_guid as proc_guid
| join proc_guid, _time [
| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
where Filesystem.file_name IN ("*.inf","*.cab")
by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid
| `drop_dm_object_name(Filesystem)`
|rename process_guid as proc_guid
| fields _time dest file_create_time file_name file_path process_name process_path process proc_guid]
| dedup file_create_time
| table dest, process_name, process, file_create_time, file_name, file_path, proc_guid
| `office_product_writing_cab_or_inf_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem`
detections/endpoint/suspicious_wav_file_in_appdata_folder.yml
+15 -11
View File
@@ -1,7 +1,7 @@
name: Suspicious WAV file in Appdata Folder
id: 5be109e6-1ac5-11ec-b421-acde48001122
version: 1
date: '2021-09-21'
version: 2
date: '2022-07-07'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
@@ -12,15 +12,19 @@ description: This analytic is to detect a suspicious creation of .wav file in ap
to its C2 server as part of its exfiltration to the compromised machine. creation
of wav files in this folder path is not a ussual disk place used by user to save
audio format file.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*"
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
| `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly`
count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
where Filesystem.file_name IN ("*.wav") Filesystem.file_path = "*\\appdata\\Roaming\\*"
by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name
Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields file_name file_path
process_name process_path process dest file_create_time _time ] | `suspicious_wav_file_in_appdata_folder_filter`'
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*"
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid
| `drop_dm_object_name(Processes)`
|rename process_guid as proc_guid
| join proc_guid, _time [
| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
where Filesystem.file_name IN ("*.wav") Filesystem.file_path = "*\\appdata\\Roaming\\*"
by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid
| `drop_dm_object_name(Filesystem)`
|rename process_guid as proc_guid
| fields file_name file_path process_name process_path process dest file_create_time _time proc_guid]
| `suspicious_wav_file_in_appdata_folder_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, file_name, file_path and command-line
executions from your endpoints. If you are using Sysmon, you must have at least