From 648bf1fc6eb2cae72cc79e9dcbdec868f8d765c7 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 8 Dec 2021 13:41:04 -0500 Subject: [PATCH] minor fixes --- .../endpoint/randomly_generated_scheduled_task_name.yml | 4 ++-- .../endpoint/randomly_generated_windows_service_name.yml | 5 +++-- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml b/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml index faf9d30857..ddb0436bae 100644 --- a/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml +++ b/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml @@ -13,13 +13,13 @@ description: The following hunting analytic leverages Event ID 4698, `A schedule and obtain remote code execution. To achieve this goal, tools like Impacket or Crapmapexec, typically create a Scheduled Task with a random task name on the victim host. This hunting analytic may help defenders identify Scheduled Tasks created as part of a lateral movement attack. The entropy threshold `ut_shannon > 3` - can be customized by users. The Command field can be used to determine if the task has malicious intent or not. + should be customized by users. The Command field can be used to determine if the task has malicious intent or not. search: ' `wineventlog_security` EventCode=4698 | xmlkv Message | lookup ut_shannon_lookup word as Task_Name | where ut_shannon > 3 | table _time, dest, Task_Name, ut_shannon, Command, Author, Enabled, Hidden | `randomly_generated_scheduled_task_name_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also + Windows Security Event Logs with 4698 EventCode enabled. The Windows TA as well as the URL ToolBox application are also required. known_false_positives: Legitimate applications may use random Scheduled Task names. references: diff --git a/detections/experimental/endpoint/randomly_generated_windows_service_name.yml b/detections/experimental/endpoint/randomly_generated_windows_service_name.yml index dac69edd69..af39d3a77f 100644 --- a/detections/experimental/endpoint/randomly_generated_windows_service_name.yml +++ b/detections/experimental/endpoint/randomly_generated_windows_service_name.yml @@ -13,14 +13,15 @@ description: The following hunting analytic leverages Event ID 7045, `A new serv and obtain remote code execution. To achieve this goal, some tools like Metasploit, Cobalt Strike and Impacket, typically create a Windows Service with a random service name on the victim host. This hunting analytic may help defenders identify Windows Services installed as part of a lateral movement attack. The entropy threshold `ut_shannon > 3` - can be customized by users. The Service_File_Name field can be used to determine if the Windows Service has malicious intent or not. + should be customized by users. The Service_File_Name field can be used to determine if the Windows Service has malicious intent or not. search: ' `wineventlog_system` EventCode=7045 | lookup ut_shannon_lookup word as Service_Name | where ut_shannon > 3 | table EventCode ComputerName Service_Name ut_shannon Service_Start_Type Service_Type Service_File_Name | `randomly_generated_windows_service_name_filter` ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type - from your endpoints. + from your endpoints. The Windows TA as well as the URL ToolBox application are also + required. known_false_positives: Legitimate applications may use random Windows Service names. references: - https://attack.mitre.org/techniques/T1543/003/