From 631ecd41221c4dec51a8a650cb9dffac134ac8d5 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 27 Sep 2023 15:51:03 -0700 Subject: [PATCH] updating sutffff --- ...l => windows_executable_in_loaded_modules.yml} | 6 +++--- .../endpoint/windows_time_based_evasion.yml | 15 ++++++++++----- 2 files changed, 13 insertions(+), 8 deletions(-) rename detections/endpoint/{windows_shared_module_executable_in_loaded_modules.yml => windows_executable_in_loaded_modules.yml} (93%) diff --git a/detections/endpoint/windows_shared_module_executable_in_loaded_modules.yml b/detections/endpoint/windows_executable_in_loaded_modules.yml similarity index 93% rename from detections/endpoint/windows_shared_module_executable_in_loaded_modules.yml rename to detections/endpoint/windows_executable_in_loaded_modules.yml index 16d00138d0..092578b463 100644 --- a/detections/endpoint/windows_shared_module_executable_in_loaded_modules.yml +++ b/detections/endpoint/windows_executable_in_loaded_modules.yml @@ -1,4 +1,4 @@ -name: Windows Shared Module Executable in loaded Modules +name: Windows Executable in Loaded Modules id: 3e27af56-fcf0-4113-988d-24969b062be7 version: 1 date: '2023-09-12' @@ -18,7 +18,7 @@ search: '`sysmon` EventCode=7 ImageLoaded= *.exe | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_shared_module_executable_in_loaded_modules_filter`' + | `windows_executable_in_loaded_modules_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: unknown. @@ -30,7 +30,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: an executable as Imageloaded by $Image$ in $dest$ + message: An executable $Imageloaded$ loaded by $Image$ on $dest$ mitre_attack_id: - T1129 observable: diff --git a/detections/endpoint/windows_time_based_evasion.yml b/detections/endpoint/windows_time_based_evasion.yml index 00b5693c1e..a9dc9ec64a 100644 --- a/detections/endpoint/windows_time_based_evasion.yml +++ b/detections/endpoint/windows_time_based_evasion.yml @@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_time_based_evasion_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. known_false_positives: unknown references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat @@ -31,7 +36,7 @@ tags: asset_type: Endpoint confidence: 60 impact: 60 - message: a $process_name$ did a suspicious ping to invalid ip address in $dest$ + message: A $process_name$ did a suspicious ping to invalid IP address on $dest$ mitre_attack_id: - T1497 - T1497.003