admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed SearchProtocolHost with

Browse Source 
no Command Line with Network
This commit is contained in:
pyth0n1c
2022-02-22 16:54:08 -08:00
committed by GitHub
parent f1661d8ad8
commit 74f3cee9e2
1 changed files with 18 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml
+18 -11
View File
@@ -1,11 +1,12 @@
name: SearchProtocolHost with no Command Line with Network
id: b690df8c-a145-11eb-a38b-acde48001122
version: 2
date: '2021-10-13'
version: 3
date: '2022-02-22'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
- Network_Traffic
description: The following analytic identifies searchprotocolhost.exe with no command
line arguments and with a network connection. It is unusual for searchprotocolhost.exe
to execute with no command line arguments present. This particular behavior is common
@@ -13,15 +14,21 @@ description: The following analytic identifies searchprotocolhost.exe with no co
any network connections and parallel processes. Identify any suspicious module loads
related to credential dumping or file writes. searchprotocolhost.exe is natively
found in C:\Windows\system32 and C:\Windows\syswow64.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_guid
Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| regex process="(searchprotocolhost\.exe.{0,4}$)" | join process_guid [| tstats
`security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port
!="0" by Ports.process_guid Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)`
| rename dest as connection_to_CNC] | table _time dest parent_process_name process_name
process_path process process_guid connection_to_CNC dest_port | `searchprotocolhost_with_no_command_line_with_network_filter`'
search: '| tstats `security_content_summariesonly` count FROM
datamodel=Endpoint.Processes where Processes.process_name=searchprotocolhost.exe
by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| regex process="(searchprotocolhost\.exe.{0,4}$)"
| join process_guid
[ | tstats `security_content_summariesonly` count FROM
datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port !="0"
by All_Traffic.process_guid All_Traffic.dest All_Traffic.dest_port
| `drop_dm_object_name(All_Traffic)`
| rename dest as connection_to_CNC ]
| table _time dest parent_process_name process_name process_path process process_guid connection_to_CNC dest_port
| `searchprotocolhost_with_no_command_line_with_network_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` and `ports` node.