mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Merge pull request #769 from splunk/unit_test_prohibited_apps_spawning_cmdprompt
Unit test prohibited apps spawning cmdprompt
This commit is contained in:
jzsplunk
@@ -5,8 +5,7 @@ date: '2020-6-25'
|
||||
description: "This search looks for command-line arguments that use a `/c` parameter
|
||||
to execute a command that has not previously been seen.
|
||||
This is an implementation on SPL2 of the rule `First time seen command line argument` by @bpatel."
|
||||
how_to_implement: "You must be ingesting sysmon logs.
|
||||
This search has been modified to process raw sysmon data from attack_range's nxlogs on DSP."
|
||||
how_to_implement: "You must be populating the endpoint data model for SSA and specifically the process_name and the process fields"
|
||||
author: Ignacio Bermudez Corrales, Splunk
|
||||
type: SSA
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
@@ -0,0 +1,204 @@
|
||||
{
|
||||
"cells": [
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"metadata": {},
|
||||
"source": [
|
||||
"# Detect Prohibited Applications Spawning cmd exe Unit Test\n",
|
||||
"\n",
|
||||
"#### This search looks for executions of cmd.exe spawned by a process that is often abused by attackers and that does not typically launch cmd.exe. This is a SPL2 implementation of the rule `Detect Prohibited Applications Spawning cmd.exe`\n",
|
||||
"\n",
|
||||
"Source: https://github.com/splunk/security-content/blob/develop/detections/endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": 92,
|
||||
"metadata": {
|
||||
"execution": {
|
||||
"iopub.execute_input": "2020-10-15T00:21:43.611728Z",
|
||||
"iopub.status.busy": "2020-10-15T00:21:43.611411Z",
|
||||
"iopub.status.idle": "2020-10-15T00:21:43.615239Z",
|
||||
"shell.execute_reply": "2020-10-15T00:21:43.614712Z",
|
||||
"shell.execute_reply.started": "2020-10-15T00:21:43.611700Z"
|
||||
}
|
||||
},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"import json\n",
|
||||
"data='{\"process_path\":\"c:\\\\\\windows\\\\\\system32\",\"process_name\":\"cmd.exe\",\"process\":\"C:\\\\\\Windows\\\\\\system32\\\\\\cmd.exe\",\"parent_process_name\":\"C:\\\\\\Program Files\\\\\\Microsoft Office\\\\\\winword.exe\",\"dest_user_id\":\"eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZmFjdCI6ImFkbWluaXN0cmF0b3IiLCJwcmltYXJ5QXJ0aWZhY3RUeXBlIjoiV0lORE9XU19BQ0NPVU5UX05BTUUifQ\",\"dest_device_id\":\"eyJlbnRpdHlUeXBlIjoiREVWSUNFIiwicHJpbWFyeUFydGlmYWN0Ijoid2luLWRjLTY1NjUwNzEiLCJwcmltYXJ5QXJ0aWZhY3RUeXBlIjoiRE5TIn0\",\"_time\":\"1602004409000\"}'\n",
|
||||
"json.loads(data)\n",
|
||||
"with open(\"detect_prohibited_applications_spawning_cmd_exe.json\", \"w\") as outfile:\n",
|
||||
" outfile.write(data)"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": 94,
|
||||
"metadata": {
|
||||
"execution": {
|
||||
"iopub.execute_input": "2020-10-15T00:22:58.225618Z",
|
||||
"iopub.status.busy": "2020-10-15T00:22:58.225357Z",
|
||||
"iopub.status.idle": "2020-10-15T00:22:59.362013Z",
|
||||
"shell.execute_reply": "2020-10-15T00:22:59.361508Z",
|
||||
"shell.execute_reply.started": "2020-10-15T00:22:58.225596Z"
|
||||
}
|
||||
},
|
||||
"outputs": [
|
||||
{
|
||||
"data": {
|
||||
"application/vnd.jupyter.widget-view+json": {
|
||||
"model_id": "c2d2b32468a04f8a8bb7eafd174e5c5d",
|
||||
"version_major": 2,
|
||||
"version_minor": 0
|
||||
},
|
||||
"text/plain": [
|
||||
"HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))"
|
||||
]
|
||||
},
|
||||
"metadata": {},
|
||||
"output_type": "display_data"
|
||||
},
|
||||
{
|
||||
"name": "stdout",
|
||||
"output_type": "stream",
|
||||
"text": [
|
||||
" Finished. "
|
||||
]
|
||||
},
|
||||
{
|
||||
"data": {
|
||||
"text/html": [
|
||||
"<div>\n",
|
||||
"<style scoped>\n",
|
||||
" .dataframe tbody tr th:only-of-type {\n",
|
||||
" vertical-align: middle;\n",
|
||||
" }\n",
|
||||
"\n",
|
||||
" .dataframe tbody tr th {\n",
|
||||
" vertical-align: top;\n",
|
||||
" }\n",
|
||||
"\n",
|
||||
" .dataframe thead th {\n",
|
||||
" text-align: right;\n",
|
||||
" }\n",
|
||||
"</style>\n",
|
||||
"<table border=\"1\" class=\"dataframe\">\n",
|
||||
" <thead>\n",
|
||||
" <tr style=\"text-align: right;\">\n",
|
||||
" <th></th>\n",
|
||||
" <th>start_time</th>\n",
|
||||
" <th>dest_device_id</th>\n",
|
||||
" <th>field0</th>\n",
|
||||
" <th>entities</th>\n",
|
||||
" <th>process_name</th>\n",
|
||||
" <th>end_time</th>\n",
|
||||
" <th>dest_user_id</th>\n",
|
||||
" <th>parent_process</th>\n",
|
||||
" <th>body</th>\n",
|
||||
" <th>value</th>\n",
|
||||
" <th>input_event</th>\n",
|
||||
" <th>timestamp</th>\n",
|
||||
" </tr>\n",
|
||||
" </thead>\n",
|
||||
" <tbody>\n",
|
||||
" <tr>\n",
|
||||
" <th>0</th>\n",
|
||||
" <td>2020-10-06 17:13:29</td>\n",
|
||||
" <td>eyJlbnRpdHlUeXBlIjoiREVWSUNFIiwicHJpbWFyeUFydG...</td>\n",
|
||||
" <td>winword.exe</td>\n",
|
||||
" <td>[eyJlbnRpdHlUeXBlIjoiREVWSUNFIiwicHJpbWFyeUFyd...</td>\n",
|
||||
" <td>cmd.exe</td>\n",
|
||||
" <td>2020-10-06 17:13:29</td>\n",
|
||||
" <td>eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZm...</td>\n",
|
||||
" <td>c:\\program files\\microsoft office\\winword.exe</td>\n",
|
||||
" <td>TBD</td>\n",
|
||||
" <td>{\"process_path\":\"c:\\\\windows\\\\system32\",\"proce...</td>\n",
|
||||
" <td>{'process_path': 'c:\\windows\\system32', 'proce...</td>\n",
|
||||
" <td>2020-10-06 17:13:29</td>\n",
|
||||
" </tr>\n",
|
||||
" </tbody>\n",
|
||||
"</table>\n",
|
||||
"</div>"
|
||||
],
|
||||
"text/plain": [
|
||||
" start_time ... timestamp\n",
|
||||
"0 2020-10-06 17:13:29 ... 2020-10-06 17:13:29\n",
|
||||
"\n",
|
||||
"[1 rows x 12 columns]"
|
||||
]
|
||||
},
|
||||
"metadata": {},
|
||||
"output_type": "display_data"
|
||||
},
|
||||
{
|
||||
"name": "stdout",
|
||||
"output_type": "stream",
|
||||
"text": [
|
||||
"\n"
|
||||
]
|
||||
},
|
||||
{
|
||||
"data": {
|
||||
"text/plain": [
|
||||
"<spl2_kernel.spl2_runner.SPL2Job at 0x7fd58e124e50>"
|
||||
]
|
||||
},
|
||||
"execution_count": 94,
|
||||
"metadata": {},
|
||||
"output_type": "execute_result"
|
||||
}
|
||||
],
|
||||
"source": [
|
||||
"| from read_text(\"s3://smle-experiments/datasets/ssa/detect_prohibited_applications_spawning_cmd_exe.json\")\n",
|
||||
"| eval input_event=from_json_object(value)\n",
|
||||
"\n",
|
||||
"| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null))\n",
|
||||
"| eval process_name=ucast(map_get(input_event, \"process_name\"), \"string\", null),\n",
|
||||
"parent_process=lower(ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)),\n",
|
||||
"dest_user_id=ucast(map_get(input_event, \"dest_user_id\"), \"string\", null),\n",
|
||||
"dest_device_id=ucast(map_get(input_event, \"dest_device_id\"), \"string\", null)\n",
|
||||
"| where process_name=\"cmd.exe\"\n",
|
||||
"| rex field=parent_process \"(?<field0>[^\\\\\\\\]+)$\"\n",
|
||||
"| where field0=\"winword.exe\" OR\n",
|
||||
" field0=\"excel.exe\" OR\n",
|
||||
" field0=\"outlook.exe\" OR\n",
|
||||
" field0=\"powerpnt.exe\" OR\n",
|
||||
" field0=\"visio.exe\" OR\n",
|
||||
" field0=\"mspub.exe\" OR\n",
|
||||
" field0=\"acrobat.exe\" OR\n",
|
||||
" field0=\"acrord32.exe\" OR\n",
|
||||
" field0=\"chrome.exe\" OR\n",
|
||||
" field0=\"iexplore.exe\" OR\n",
|
||||
" field0=\"opera.exe\" OR\n",
|
||||
" field0=\"firefox.exe\" OR\n",
|
||||
" field0=\"java.exe\" OR\n",
|
||||
" field0=\"powershell.exe\"\n",
|
||||
"| eval start_time=timestamp,\n",
|
||||
"end_time=timestamp,\n",
|
||||
"entities=mvappend(dest_device_id, dest_user_id),\n",
|
||||
"body=\"TBD\";"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": []
|
||||
}
|
||||
],
|
||||
"metadata": {
|
||||
"kernelspec": {
|
||||
"display_name": "SPL2",
|
||||
"language": "SPL",
|
||||
"name": "spl2"
|
||||
},
|
||||
"language_info": {
|
||||
"mimetype": "text/spl",
|
||||
"name": "SPL"
|
||||
}
|
||||
},
|
||||
"nbformat": 4,
|
||||
"nbformat_minor": 4
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
name: Detect Prohibited Applications Spawning cmd exe Unit Test
|
||||
detections:
|
||||
- name: Access LSASS Memory for Dump Creation
|
||||
file: endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
description: Test credential dumping detections
|
||||
attack_data:
|
||||
- file_name: unit_test_detect_prohibited_applications_spawning_cmd_exe.json
|
||||
data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unit_test_detect_prohibited_applications_spawning_cmd_exe.json
|
||||
|
||||
Reference in New Issue
Block a user