diff --git a/detections/attrib_to_hide_files.yml b/detections/attrib_to_hide_files.yml index 4eab84f815..68ab374d86 100644 --- a/detections/attrib_to_hide_files.yml +++ b/detections/attrib_to_hide_files.yml @@ -30,6 +30,8 @@ detect: risk_object_type: - system risk_score: 50 + macros: + - attrib_to_hide_files_filter schedule: cron_schedule: 30 * * * * earliest_time: -70m@m @@ -38,7 +40,7 @@ detect: as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=attrib.exe (Processes.process=*+h*) by Processes.parent_process Processes.process_name Processes.user | `drop_dm_object_name("Processes")` - | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`' + | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`| `attrib_to_hide_files_filter`' suppress: suppress_fields: dest, process suppress_period: 86400s diff --git a/detections/change_file_association.yml b/detections/change_file_association.yml index c9c61c32bf..396277b2fa 100644 --- a/detections/change_file_association.yml +++ b/detections/change_file_association.yml @@ -27,6 +27,8 @@ detect: risk_object_type: - system risk_score: 40 + macros: + - change_file_association_filter schedule: cron_schedule: 0 * * * * earliest_time: -70m@m @@ -39,7 +41,7 @@ detect: | join [| tstats `security_content_summariesonly` values(Registry.registry_path) as registry_path count FROM datamodel=Endpoint.Registry where Registry.registry_path=*\\Explorer\\FileExts* by Registry.process_id Registry.dest | `drop_dm_object_name("Registry")` | - table process_id dest registry_path]' + table process_id dest registry_path]| `change_file_association_filter`' suppress: suppress_fields: dest,user suppress_period: 28800s diff --git a/detections/children_of_spoolsv.yml b/detections/children_of_spoolsv.yml index 881d322e76..4acb01ea67 100644 --- a/detections/children_of_spoolsv.yml +++ b/detections/children_of_spoolsv.yml @@ -28,6 +28,8 @@ detect: risk_object_type: - system risk_score: 60 + macros: + - children_of_spoolsv_filter schedule: cron_schedule: 0 * * * * earliest_time: -70m@m @@ -36,7 +38,7 @@ detect: values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=spoolsv.exe AND Processes.process_name!=regsvr32.exe by Processes.dest Processes.parent_process - Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `children_of_spoolsv_filter`' suppress: suppress_fields: dest, parent_process_name suppress_period: 86400s @@ -50,7 +52,7 @@ entities: how_to_implement: You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" - field in the Endpoint data model. + field in the Endpoint data model. Update the `children_of_spoolsv_filter` macro to filter out legitimate child processes spawned by spoolsv.exe. id: aa0c4aeb-5b18-41c4-8c07-f1442d7599df investigations: - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd76 @@ -97,7 +99,7 @@ mappings: - PR.AC - PR.PT - DE.CM -modification_date: '2018-12-03' +modification_date: '2020-07-03' name: Child Processes of Spoolsv.exe original_authors: - company: Splunk diff --git a/detections/common_ransomware_extensions.yml b/detections/common_ransomware_extensions.yml index 504fe4e5b6..eaf7f66351 100644 --- a/detections/common_ransomware_extensions.yml +++ b/detections/common_ransomware_extensions.yml @@ -25,6 +25,8 @@ detect: risk_object_type: - system risk_score: 80 + macros: + - common_ransomware_extensions_filter schedule: cron_schedule: 0 * * * * earliest_time: -70m@m @@ -33,7 +35,7 @@ detect: lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`| - rex field=file_name "(?\.[^\.]+)$" | `ransomware_extensions`' + rex field=file_name "(?\.[^\.]+)$" | `ransomware_extensions` | `common_ransomware_extensions_filter`' suppress: suppress_fields: dest,file_name suppress_period: 14400s diff --git a/detections/common_ransomware_notes.yml b/detections/common_ransomware_notes.yml index f7b59dc904..15f3137b52 100644 --- a/detections/common_ransomware_notes.yml +++ b/detections/common_ransomware_notes.yml @@ -25,6 +25,9 @@ detect: risk_object_type: - system risk_score: 80 + macros: + - common_ransomware_notes_filter + - ransomware_notes schedule: cron_schedule: 0 * * * * earliest_time: -70m@m @@ -32,7 +35,7 @@ detect: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name | - `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`|`ransomware_notes`' + `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`|`ransomware_notes`| `common_ransomware_notes_filter`' suppress: suppress_fields: dest,file_name suppress_period: 14400s diff --git a/detections/create_local_admin_via_net.yml b/detections/create_local_admin_via_net.yml index 5aacf025dd..c9cef4d0f5 100644 --- a/detections/create_local_admin_via_net.yml +++ b/detections/create_local_admin_via_net.yml @@ -27,6 +27,8 @@ detect: risk_object_type: - system risk_score: 50 + macros: + - create_local_admin_via_net_filter schedule: cron_schedule: 0 8 * * * earliest_time: -1440m@m @@ -36,7 +38,7 @@ detect: where (Processs.process_name=net.exe OR Processes.process_name=net1.exe) by Processes.process Processes.process_name Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | search (process=*localgroup* OR - process=*/add* OR process=*user*)' + process=*/add* OR process=*user*) |`create_local_admin_via_net_filter`' suppress: suppress_fields: dest suppress_period: 86400s diff --git a/detections/dragonfly_schtasks.yml b/detections/dragonfly_schtasks.yml index 1481554d35..85aee43bdd 100644 --- a/detections/dragonfly_schtasks.yml +++ b/detections/dragonfly_schtasks.yml @@ -29,6 +29,8 @@ detect: risk_object_type: - system risk_score: 80 + macros: + - dragonfly_schtasks_filter schedule: cron_schedule: 0 * * * * earliest_time: -70m@m @@ -38,7 +40,7 @@ detect: max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | - search (process=*delete* OR process=*create*) process=*reset*' + search (process=*delete* OR process=*create*) process=*reset* | `dragonfly_schtasks_filter`' suppress: suppress_fields: dest, process_name, process suppress_period: 28800s diff --git a/detections/file_write_spikes.yml b/detections/file_write_spikes.yml index ebacd53139..bce910283f 100644 --- a/detections/file_write_spikes.yml +++ b/detections/file_write_spikes.yml @@ -26,6 +26,8 @@ detect: risk_object_type: - system risk_score: 30 + macros: + - file_write_spikes_filter schedule: cron_schedule: 0 * * * * earliest_time: -7d@d @@ -37,7 +39,7 @@ detect: "-1d@d"), count,null))) as avg stdev(eval(if(_time upperBound) AND num_data_samples >=20, 1, 0) | search - isOutlier=1' + isOutlier=1 | `file_write_spikes_filter`' suppress: suppress_fields: dest suppress_period: 7200s diff --git a/detections/lnk_executing_a_process.yml b/detections/lnk_executing_a_process.yml index 0250d7eff3..a10a666df6 100644 --- a/detections/lnk_executing_a_process.yml +++ b/detections/lnk_executing_a_process.yml @@ -28,6 +28,8 @@ detect: risk_object_type: - system risk_score: 40 + macros: + - lnk_executing_a_process_filter schedule: cron_schedule: 0 * * * * earliest_time: -70m@m @@ -44,7 +46,7 @@ detect: | rename parent_process_id as lnk_pid | fields _time lnk_pid process_id dest process_name process_path process] | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table firstTime, lastTime, lnk_pid, process_id, user, dest, file_name, file_path, - process_name, process, process_path, file_hash' + process_name, process, process_path, file_hash | `lnk_executing_a_process_filter`' suppress: suppress_fields: dest,file_name suppress_period: 86400s diff --git a/detections/outlook_writing_zip.yml b/detections/outlook_writing_zip.yml index e46d6aac93..55fa6ae78b 100644 --- a/detections/outlook_writing_zip.yml +++ b/detections/outlook_writing_zip.yml @@ -27,6 +27,8 @@ detect: risk_object_type: - system risk_score: 20 + macros: + - outlook_writing_zip_filter schedule: cron_schedule: 0 * * * * earliest_time: -70m@m @@ -45,7 +47,7 @@ detect: | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rename process_id as malicious_id| fields malicious_id outlook_id dest file_path file_name file_hash count file_id] | table firstTime lastTime user malicious_id outlook_id process_name parent_process_name - file_name file_path | where file_name != ""' + file_name file_path | where file_name != "" | `outlook_writing_zip_filter`' suppress: suppress_fields: dest,file_name suppress_period: 86400s diff --git a/detections/rare_executables_on_endpoint.yml b/detections/rare_executables_on_endpoint.yml index 3e2a042624..541d99d101 100644 --- a/detections/rare_executables_on_endpoint.yml +++ b/detections/rare_executables_on_endpoint.yml @@ -27,6 +27,8 @@ detect: risk_object_type: - system risk_score: 20 + macros: + - rare_executables_on_endpoint_filter schedule: cron_schedule: 10 * * * * earliest_time: -70m@m @@ -38,7 +40,7 @@ detect: `security_content_ctime(lastTime)`| search [| tstats count from datamodel=Endpoint.Processes by Processes.process_name | rare Processes.process_name limit=30 | rename Processes.process_name as process| `filter_rare_process_whitelist`| table - process ]' + process ] | `rare_executables_on_endpoint_filter`' suppress: suppress_fields: dest, process suppress_period: 86400s diff --git a/detections/suspicious_reg_process.yml b/detections/suspicious_reg_process.yml index 6853c5c977..7d0c80da4b 100644 --- a/detections/suspicious_reg_process.yml +++ b/detections/suspicious_reg_process.yml @@ -28,6 +28,8 @@ detect: risk_object_type: - system risk_score: 80 + macros: + - suspicious_reg_process_filter schedule: cron_schedule: 0 * * * * earliest_time: -70m@m @@ -41,7 +43,7 @@ detect: where Processes.parent_process_name=cmd.exe Processes.process_name= reg.exe by Processes.parent_process_id Processes.dest Processes.process_name | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rename parent_process_id as process_id - |dedup process_id| table process_id dest]' + |dedup process_id| table process_id dest] | `suspicious_reg_process_filter`' suppress: suppress_fields: dest, user suppress_period: 14400s diff --git a/detections/uncommon_processes.yml b/detections/uncommon_processes.yml index 69c36ee6e1..5fc33b44ca 100644 --- a/detections/uncommon_processes.yml +++ b/detections/uncommon_processes.yml @@ -27,6 +27,8 @@ detect: risk_object_type: - system risk_score: 50 + macros: + - uncommon_processes_filter schedule: cron_schedule: 0 * * * * earliest_time: -70m@m @@ -34,7 +36,7 @@ detect: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.process Processes.process_name | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` - | `drop_dm_object_name(Processes)` | `uncommon_processes`' + | `drop_dm_object_name(Processes)` | `uncommon_processes` |`uncommon_processes_filter`' suppress: suppress_fields: dest, user suppress_period: 86400s diff --git a/detections/unusually_long_commandlines.yml b/detections/unusually_long_commandlines.yml index 703b9b2d0a..4a91ce70a9 100644 --- a/detections/unusually_long_commandlines.yml +++ b/detections/unusually_long_commandlines.yml @@ -26,6 +26,8 @@ detect: risk_object_type: - system risk_score: 50 + macros: + - unusually_long_commandlines_filter schedule: cron_schedule: 0 * * * * earliest_time: -1d@d @@ -36,7 +38,7 @@ detect: | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| eval processlen=len(process) | eventstats stdev(processlen) as stdev, avg(processlen) as avg by dest | stats max(processlen) as maxlen, values(stdev) as stdevperhost, values(avg) as avgperhost by dest, - user, process_name, process| eval threshold = 10 | where maxlen > ((threshold*stdevperhost) + user, process_name, process| `unusually_long_commandlines_filter`| eval threshold = 10 | where maxlen > ((threshold*stdevperhost) + avgperhost)' suppress: suppress_fields: dest,user,process diff --git a/detections/wmi_process_launch.yml b/detections/wmi_process_launch.yml index 474b4403d4..d710abde5f 100644 --- a/detections/wmi_process_launch.yml +++ b/detections/wmi_process_launch.yml @@ -25,6 +25,8 @@ detect: risk_object_type: - system risk_score: 70 + macros: + - wmi_process_launch_filter schedule: cron_schedule: 0 * * * * earliest_time: -70m@m @@ -33,7 +35,7 @@ detect: min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name = *WmiPrvSE.exe by Processes.user Processes.dest Processes.process_name | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)`' + `security_content_ctime(lastTime)`| `wmi_process_launch_filter`' suppress: suppress_fields: dest, user suppress_period: 28800s diff --git a/detections/wmi_script_execution.yml b/detections/wmi_script_execution.yml index b2afbc8015..25a855643f 100644 --- a/detections/wmi_script_execution.yml +++ b/detections/wmi_script_execution.yml @@ -25,6 +25,8 @@ detect: risk_object_type: - system risk_score: 70 + macros: + - wmi_script_execution_filter schedule: cron_schedule: 0 * * * * earliest_time: -70m@m @@ -33,7 +35,7 @@ detect: min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name = "scrcons.exe" by Processes.user Processes.dest Processes.process_name | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)`' + `security_content_ctime(lastTime)`| `wmi_script_execution_filter`' suppress: suppress_fields: dest,process suppress_period: 28800s diff --git a/macros/attrib_to_hide_files_filter.yml b/macros/attrib_to_hide_files_filter.yml new file mode 100644 index 0000000000..7151ae3088 --- /dev/null +++ b/macros/attrib_to_hide_files_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Update this macro to limit the output results to filter out false positives. +name: attrib_to_hide_files_filter \ No newline at end of file diff --git a/macros/change_file_association_filter.yml b/macros/change_file_association_filter.yml new file mode 100644 index 0000000000..4b55678675 --- /dev/null +++ b/macros/change_file_association_filter.yml @@ -0,0 +1,4 @@ + +definition: search * +description: Update this macro to limit the output results to filter out false positives. +name: change_file_association_filter \ No newline at end of file diff --git a/macros/children_of_spoolsv_filter.yml b/macros/children_of_spoolsv_filter.yml new file mode 100644 index 0000000000..c7a8f0f943 --- /dev/null +++ b/macros/children_of_spoolsv_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Update this macro to limit the output results to filter out false positives. +name: children_of_spoolsv_filter \ No newline at end of file diff --git a/macros/common_ransomware_extensions_filter.yml b/macros/common_ransomware_extensions_filter.yml new file mode 100644 index 0000000000..6a450e8a58 --- /dev/null +++ b/macros/common_ransomware_extensions_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Update this macro to limit the output results to filter out false positives. +name: common_ransomware_extensions_filter \ No newline at end of file diff --git a/macros/common_ransomware_notes_filter.yml b/macros/common_ransomware_notes_filter.yml new file mode 100644 index 0000000000..ef33343820 --- /dev/null +++ b/macros/common_ransomware_notes_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Update this macro to limit the output results to filter out false positives. +name: common_ransomware_notes_filter \ No newline at end of file diff --git a/macros/create_local_admin_via_net_filter.yml b/macros/create_local_admin_via_net_filter.yml new file mode 100644 index 0000000000..e3a215d554 --- /dev/null +++ b/macros/create_local_admin_via_net_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Update this macro to limit the output results to filter out false positives. +name: create_local_admin_via_net_filter \ No newline at end of file diff --git a/macros/dragonfly_schtasks_filter.yml b/macros/dragonfly_schtasks_filter.yml new file mode 100644 index 0000000000..c5dfd45827 --- /dev/null +++ b/macros/dragonfly_schtasks_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Update this macro to limit the output results to filter out false positives. +name: dragonfly_schtasks_filter \ No newline at end of file diff --git a/macros/file_write_spikes_filter.yml b/macros/file_write_spikes_filter.yml new file mode 100644 index 0000000000..b9ccc594b1 --- /dev/null +++ b/macros/file_write_spikes_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Update this macro to limit the output results to filter out false positives. +name: file_write_spikes_filter \ No newline at end of file diff --git a/macros/lnk_executing_a_process_filter.yml b/macros/lnk_executing_a_process_filter.yml new file mode 100644 index 0000000000..346ce4fdca --- /dev/null +++ b/macros/lnk_executing_a_process_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Update this macro to limit the output results to filter out false positives. +name: lnk_executing_a_process_filter \ No newline at end of file diff --git a/macros/outlook_writing_zip_filter.yml b/macros/outlook_writing_zip_filter.yml new file mode 100644 index 0000000000..fa70d5dfc0 --- /dev/null +++ b/macros/outlook_writing_zip_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Update this macro to limit the output results to filter out false positives. +name: outlook_writing_zip_filter \ No newline at end of file diff --git a/macros/rare_executables_on_endpoint_filter.yml b/macros/rare_executables_on_endpoint_filter.yml new file mode 100644 index 0000000000..816438def9 --- /dev/null +++ b/macros/rare_executables_on_endpoint_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Update this macro to filter out false positives +name: rare_executables_on_endpoint_filter diff --git a/macros/suspicious_reg_process_filter.yml b/macros/suspicious_reg_process_filter.yml new file mode 100644 index 0000000000..c4007321e2 --- /dev/null +++ b/macros/suspicious_reg_process_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Update this macro to limit the output results to filter out false positives. +name: suspicious_reg_process_filter \ No newline at end of file diff --git a/macros/uncommon_processes_filter.yml b/macros/uncommon_processes_filter.yml new file mode 100644 index 0000000000..5a2cd7d62e --- /dev/null +++ b/macros/uncommon_processes_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Update this macro to limit the output results to filter out false positives. +name: uncommon_processes_filter \ No newline at end of file diff --git a/macros/unusually_long_commandlines_filter.yml b/macros/unusually_long_commandlines_filter.yml new file mode 100644 index 0000000000..4d3b22ce29 --- /dev/null +++ b/macros/unusually_long_commandlines_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Update this macro to limit the output results to filter out false positives. +name: unusually_long_commandlines_filter \ No newline at end of file diff --git a/macros/wmi_process_launch_filter.yml b/macros/wmi_process_launch_filter.yml new file mode 100644 index 0000000000..eb93b54cb5 --- /dev/null +++ b/macros/wmi_process_launch_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Update this macro to limit the output results to filter out false positives. +name: wmi_process_launch_filter \ No newline at end of file diff --git a/macros/wmi_script_execution_filter.yml b/macros/wmi_script_execution_filter.yml new file mode 100644 index 0000000000..08ad0f61b4 --- /dev/null +++ b/macros/wmi_script_execution_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Update this macro to limit the output results to filter out false positives. +name: wmi_script_execution_filter \ No newline at end of file