From 73bfbd74827c02866d4f72a7a88f1ec0cd2270db Mon Sep 17 00:00:00 2001 From: tcontreras Date: Fri, 7 May 2021 16:04:59 +0200 Subject: [PATCH] xmrig4 --- detections/endpoint/excessive_usage_of_net_app.yml | 2 +- detections/endpoint/process_kill_base_on_file_path.yml | 7 ++----- 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/excessive_usage_of_net_app.yml b/detections/endpoint/excessive_usage_of_net_app.yml index 8f36e3214a..f39c598c35 100644 --- a/detections/endpoint/excessive_usage_of_net_app.yml +++ b/detections/endpoint/excessive_usage_of_net_app.yml @@ -13,7 +13,7 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "net.exe" OR Processes.process_name = "net1.exe" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user _time span=1m - | where count >=30 + | where count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/process_kill_base_on_file_path.yml b/detections/endpoint/process_kill_base_on_file_path.yml index 3c3278320c..5083206849 100644 --- a/detections/endpoint/process_kill_base_on_file_path.yml +++ b/detections/endpoint/process_kill_base_on_file_path.yml @@ -6,12 +6,11 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to look for execessive series of process kill attempt using wmic.exe. +description: This search is to look for process kill attempt using wmic.exe base on file path. search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "wmic.exe" AND Processes.process="*process*" AND Processes.process="*executablepath*" AND Processes.process="*delete*" - by Processes.parent_process_name Processes.process_name Processes.dest Processes.user _time span=1m - | where count >=10 + by Processes.parent_process_name Processes.process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -26,8 +25,6 @@ references: tags: analytic_story: - xmrig - dataset: - - UPDATE_DATASET_URL kill_chain_phases: - Exploitation mitre_attack_id: