From 0b74cc710d30bbbd100fe9ad8ae7b9a3d3553f07 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 8 Dec 2020 09:09:37 +0000 Subject: [PATCH 1/2] Added detection testing service results inSchtasks used for forcing a reboot --- .../endpoint/schtasks_used_for_forcing_a_reboot.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml index a31a1614f0..04cb8c6246 100644 --- a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml +++ b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml @@ -12,10 +12,10 @@ references: [] author: Bhavin Patel, Splunk search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name=schtasks.exe Processes.process="*shutdown*" Processes.process="*/create *" - by Processes.process_name Processes.parent_process_name - Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `schtasks_used_for_forcing_a_reboot_filter`' + where Processes.process_name=schtasks.exe Processes.process="*shutdown*" Processes.process="*/create + *" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `schtasks_used_for_forcing_a_reboot_filter`' known_false_positives: Administrators may create jobs on systems forcing reboots to perform updates, maintenance, etc. tags: @@ -32,3 +32,6 @@ tags: - PR.IP security_domain: endpoint asset_type: Endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtask_shutdown/windows-sysmon.log From 927e09bf1ff629bdc6337b04a26c7f3a45af085a Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 8 Dec 2020 10:12:15 +0100 Subject: [PATCH 2/2] new test file --- .../endpoint/single_letter_process_on_endpoint.yml | 6 ++++-- .../single_letter_process_on_endpoint.test.yml | 12 ++++++++++++ 2 files changed, 16 insertions(+), 2 deletions(-) create mode 100644 tests/endpoint/single_letter_process_on_endpoint.test.yml diff --git a/detections/endpoint/single_letter_process_on_endpoint.yml b/detections/endpoint/single_letter_process_on_endpoint.yml index 0083898f8e..7e285c912c 100644 --- a/detections/endpoint/single_letter_process_on_endpoint.yml +++ b/detections/endpoint/single_letter_process_on_endpoint.yml @@ -1,7 +1,7 @@ name: Single Letter Process On Endpoint id: a4214f0b-e01c-41bc-8cc4-d2b71e3056b4 -version: 2 -date: '2019-04-01' +version: 3 +date: '2020-12-08' description: This search looks for process names that consist only of a single letter. how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be @@ -23,6 +23,8 @@ known_false_positives: Single-letter executables are not always malicious. Inves tags: analytics_story: - DHS Report TA18-074A + mitre_attack_id: + - T1204.002 kill_chain_phases: - Actions on Objectives cis20: diff --git a/tests/endpoint/single_letter_process_on_endpoint.test.yml b/tests/endpoint/single_letter_process_on_endpoint.test.yml new file mode 100644 index 0000000000..6b28930c74 --- /dev/null +++ b/tests/endpoint/single_letter_process_on_endpoint.test.yml @@ -0,0 +1,12 @@ +name: Single Letter Process On Endpoint Unit Test +tests: +- name: Single Letter Process On Endpoint + file: endpoint/single_letter_process_on_endpoint.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.002/single_letter_exe/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog