From 4dec3deb52207b015ff780e2f1edd4d72389670e Mon Sep 17 00:00:00 2001 From: root Date: Tue, 11 May 2021 09:31:01 +0000 Subject: [PATCH] Added detection testing service results inModify ACL permission To Files Or Folder --- ...dify_acl_permission_to_files_or_folder.yml | 23 +++++++++++-------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml index e0dcd262e9..0c71d1498d 100644 --- a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml +++ b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml @@ -6,16 +6,18 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious modification of ACL permission to a files or folder to make it available to everyone. - This technique may use by adversarie to evade ACLs or protected files access. This changes is commonly configured by the file or directory owner - with appropriate permission. So this is a good indicator if this command seen in machine with no permission to do so. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime - from datamodel=Endpoint.Processes where Processes.process_name = "cacls.exe" OR Processes.process_name = "icacls.exe" OR Processes.process_name = "xcacls.exe" +description: This search is to detect a suspicious modification of ACL permission + to a files or folder to make it available to everyone. This technique may use by + adversarie to evade ACLs or protected files access. This changes is commonly configured + by the file or directory owner with appropriate permission. So this is a good indicator + if this command seen in machine with no permission to do so. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "cacls.exe" + OR Processes.process_name = "icacls.exe" OR Processes.process_name = "xcacls.exe" AND (Processes.process = "*/G everyone:*" OR Processes.process = "*/G SYSTEM:*") by Processes.parent_process_name Processes.process_name Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `modify_acl_permission_to_files_or_folder_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -43,4 +45,7 @@ tags: - Processes.user - Processes.process - Processes.process_id - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log