From 033bf7468fe19d3ce2107b6794aad55bea74a37a Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 8 Sep 2021 11:41:03 -0700 Subject: [PATCH] fixed and tested --- .../create_local_admin_accounts_using_net_exe.yml | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml index 44d1cf8a46..78bfb1b545 100644 --- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml +++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml @@ -1,7 +1,7 @@ name: Create local admin accounts using net exe id: b89919ed-fe5f-492c-b139-151bb162040e -version: 5 -date: '2021-08-29' +version: 6 +date: '2021-09-08' author: Bhavin Patel, Splunk type: TTP datamodel: @@ -9,11 +9,12 @@ datamodel: description: This search looks for the creation of local administrator accounts using net.exe . search: '| tstats `security_content_summariesonly` count values(Processes.user) as - user values(Processes.parent_process) as parent_process min(_time) as firstTime - max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe - OR Processes.process_name=net1.exe) AND (Processes.process=*localgroup* OR Processes.process=*user*) AND Processes.process=*/add* by Processes.process Processes.process_name Processes.dest - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` - |`create_local_admin_accounts_using_net_exe_filter` ' + user values(Processes.parent_process) as parent_process min(_time) as firstTime + max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe OR Processes.process_name=net1.exe) AND Processes.process=*/add* AND (Processes.process=*administrators* OR Processes.process=*administratoren* OR Processes.process=*administrateurs* OR Processes.process=*administrador* OR Processes.process=*amministratori* OR Processes.process=*administratorer*) by Processes.process Processes.process_name Processes.dest +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `create_local_admin_accounts_using_net_exe_filter`' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints.