From 8bce0fb358ed66096221d125fc7d39d6e5e2955f Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 24 May 2023 13:02:14 -0500 Subject: [PATCH 1/3] updated base rule --- ...a___detect_prohibited_applications_spawning_cmd_exe.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/dev_ssa/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/dev_ssa/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml index a506cb395b..45343cacbf 100644 --- a/dev_ssa/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ b/dev_ssa/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -1,6 +1,6 @@ name: Detect Prohibited Applications Spawning cmd exe id: c10a18cb-fd80-4ffa-a844-25026e0a0c94 -version: 3 +version: 4 date: '2022-03-01' author: Ignacio Bermudez Corrales, Splunk status: production @@ -31,8 +31,9 @@ search: actor.process.file.name: chrome.exe selection5: process.cmd_line: chrome-extension - condition: selection1 or (selection2 and not selection3) or (selection4 and not - selection5) + selection6: + process.file.name: cmd.exe + condition: ((selection1) or (selection2 and not selection3) or (selection4 and not selection5)) and selection6 how_to_implement: In order to successfully implement this analytic, you will need endpoint process data from a EDR product or Sysmon. This search has been modified to process raw sysmon data from attack_range's nxlogs on DSP. From 0db1b8faf4b9f5687250b817ba341f28a9fc5f8a Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 24 May 2023 13:18:38 -0500 Subject: [PATCH 2/3] converted --- ...a___detect_prohibited_applications_spawning_cmd_exe.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml index ebec5b0d61..5b8c1e4f57 100644 --- a/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ b/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -1,6 +1,6 @@ name: Detect Prohibited Applications Spawning cmd exe id: c10a18cb-fd80-4ffa-a844-25026e0a0c94 -version: 3 +version: 4 date: '2022-03-01' author: Ignacio Bermudez Corrales, Splunk type: Anomaly @@ -28,13 +28,14 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (actor_process_file_name="winword.exe" OR actor_process_file_name="excel.exe" + null) | where ((actor_process_file_name="winword.exe" OR actor_process_file_name="excel.exe" OR actor_process_file_name="outlook.exe" OR actor_process_file_name="acrobat.exe" OR actor_process_file_name="acrord32.exe" OR actor_process_file_name="iexplore.exe" OR actor_process_file_name="opera.exe" OR actor_process_file_name="firefox.exe" OR actor_process_file_name="powershell.exe") OR (actor_process_file_name="java.exe" AND (NOT match_regex(actor_process_file_name, /(?i)patch1-Hotfix1a/)=true)) OR (actor_process_file_name="chrome.exe" - AND (NOT process_cmd_line="chrome-extension")) --finding_report--' + AND (NOT process_cmd_line="chrome-extension"))) AND process_file_name="cmd.exe" + --finding_report--' how_to_implement: In order to successfully implement this analytic, you will need endpoint process data from a EDR product or Sysmon. This search has been modified to process raw sysmon data from attack_range's nxlogs on DSP. From 395923d3f8f1c65dc897129c4c9618ba4a76ebbd Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 24 May 2023 17:54:15 -0500 Subject: [PATCH 3/3] Generated output --- ...a___detect_prohibited_applications_spawning_cmd_exe.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml index 1b1cde45ee..66f8616fc8 100644 --- a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -1,6 +1,6 @@ name: Detect Prohibited Applications Spawning cmd exe id: c10a18cb-fd80-4ffa-a844-25026e0a0c94 -version: 3 +version: 4 description: The following analytic identifies parent processes, browsers, Windows terminal applications, Office Products and Java spawning cmd.exe. By its very nature, many applications spawn cmd.exe natively or built into macros. Much of this will @@ -22,13 +22,14 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (actor_process_file_name="winword.exe" OR actor_process_file_name="excel.exe" + null) | where ((actor_process_file_name="winword.exe" OR actor_process_file_name="excel.exe" OR actor_process_file_name="outlook.exe" OR actor_process_file_name="acrobat.exe" OR actor_process_file_name="acrord32.exe" OR actor_process_file_name="iexplore.exe" OR actor_process_file_name="opera.exe" OR actor_process_file_name="firefox.exe" OR actor_process_file_name="powershell.exe") OR (actor_process_file_name="java.exe" AND (NOT match_regex(actor_process_file_name, /(?i)patch1-Hotfix1a/)=true)) OR (actor_process_file_name="chrome.exe" - AND (NOT process_cmd_line="chrome-extension")) + AND (NOT process_cmd_line="chrome-extension"))) AND process_file_name="cmd.exe" + | eval body=create_map( "devices", [ create_map(