diff --git a/detections/endpoint/first_time_seen_cmd_line___ssa.yml b/detections/endpoint/first_time_seen_cmd_line___ssa.yml index 3cbdcd6724..cea30c3771 100644 --- a/detections/endpoint/first_time_seen_cmd_line___ssa.yml +++ b/detections/endpoint/first_time_seen_cmd_line___ssa.yml @@ -5,8 +5,7 @@ date: '2020-6-25' description: "This search looks for command-line arguments that use a `/c` parameter to execute a command that has not previously been seen. This is an implementation on SPL2 of the rule `First time seen command line argument` by @bpatel." -how_to_implement: "You must be ingesting sysmon logs. -This search has been modified to process raw sysmon data from attack_range's nxlogs on DSP." +how_to_implement: "You must be populating the endpoint data model for SSA and specifically the process_name and the process fields" author: Ignacio Bermudez Corrales, Splunk type: SSA search: '| from read_ssa_enriched_events() diff --git a/notebooks/unit_test_prohibited_apps_spawning_cmdprompt.ipynb b/notebooks/unit_test_prohibited_apps_spawning_cmdprompt.ipynb new file mode 100644 index 0000000000..94160fe672 --- /dev/null +++ b/notebooks/unit_test_prohibited_apps_spawning_cmdprompt.ipynb @@ -0,0 +1,204 @@ +{ + "cells": [ + { + "cell_type": "markdown", + "metadata": {}, + "source": [ + "# Detect Prohibited Applications Spawning cmd exe Unit Test\n", + "\n", + "#### This search looks for executions of cmd.exe spawned by a process that is often abused by attackers and that does not typically launch cmd.exe. This is a SPL2 implementation of the rule `Detect Prohibited Applications Spawning cmd.exe`\n", + "\n", + "Source: https://github.com/splunk/security-content/blob/develop/detections/endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml" + ] + }, + { + "cell_type": "code", + "execution_count": 92, + "metadata": { + "execution": { + "iopub.execute_input": "2020-10-15T00:21:43.611728Z", + "iopub.status.busy": "2020-10-15T00:21:43.611411Z", + "iopub.status.idle": "2020-10-15T00:21:43.615239Z", + "shell.execute_reply": "2020-10-15T00:21:43.614712Z", + "shell.execute_reply.started": "2020-10-15T00:21:43.611700Z" + } + }, + "outputs": [], + "source": [ + "import json\n", + "data='{\"process_path\":\"c:\\\\\\windows\\\\\\system32\",\"process_name\":\"cmd.exe\",\"process\":\"C:\\\\\\Windows\\\\\\system32\\\\\\cmd.exe\",\"parent_process_name\":\"C:\\\\\\Program Files\\\\\\Microsoft Office\\\\\\winword.exe\",\"dest_user_id\":\"eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZmFjdCI6ImFkbWluaXN0cmF0b3IiLCJwcmltYXJ5QXJ0aWZhY3RUeXBlIjoiV0lORE9XU19BQ0NPVU5UX05BTUUifQ\",\"dest_device_id\":\"eyJlbnRpdHlUeXBlIjoiREVWSUNFIiwicHJpbWFyeUFydGlmYWN0Ijoid2luLWRjLTY1NjUwNzEiLCJwcmltYXJ5QXJ0aWZhY3RUeXBlIjoiRE5TIn0\",\"_time\":\"1602004409000\"}'\n", + "json.loads(data)\n", + "with open(\"detect_prohibited_applications_spawning_cmd_exe.json\", \"w\") as outfile:\n", + " outfile.write(data)" + ] + }, + { + "cell_type": "code", + "execution_count": 94, + "metadata": { + "execution": { + "iopub.execute_input": "2020-10-15T00:22:58.225618Z", + "iopub.status.busy": "2020-10-15T00:22:58.225357Z", + "iopub.status.idle": "2020-10-15T00:22:59.362013Z", + "shell.execute_reply": "2020-10-15T00:22:59.361508Z", + "shell.execute_reply.started": "2020-10-15T00:22:58.225596Z" + } + }, + "outputs": [ + { + "data": { + "application/vnd.jupyter.widget-view+json": { + "model_id": "c2d2b32468a04f8a8bb7eafd174e5c5d", + "version_major": 2, + "version_minor": 0 + }, + "text/plain": [ + "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + " Finished. " + ] + }, + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
start_timedest_device_idfield0entitiesprocess_nameend_timedest_user_idparent_processbodyvalueinput_eventtimestamp
02020-10-06 17:13:29eyJlbnRpdHlUeXBlIjoiREVWSUNFIiwicHJpbWFyeUFydG...winword.exe[eyJlbnRpdHlUeXBlIjoiREVWSUNFIiwicHJpbWFyeUFyd...cmd.exe2020-10-06 17:13:29eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZm...c:\\program files\\microsoft office\\winword.exeTBD{\"process_path\":\"c:\\\\windows\\\\system32\",\"proce...{'process_path': 'c:\\windows\\system32', 'proce...2020-10-06 17:13:29
\n", + "
" + ], + "text/plain": [ + " start_time ... timestamp\n", + "0 2020-10-06 17:13:29 ... 2020-10-06 17:13:29\n", + "\n", + "[1 rows x 12 columns]" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + "\n" + ] + }, + { + "data": { + "text/plain": [ + "" + ] + }, + "execution_count": 94, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "| from read_text(\"s3://smle-experiments/datasets/ssa/detect_prohibited_applications_spawning_cmd_exe.json\")\n", + "| eval input_event=from_json_object(value)\n", + "\n", + "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null))\n", + "| eval process_name=ucast(map_get(input_event, \"process_name\"), \"string\", null),\n", + "parent_process=lower(ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)),\n", + "dest_user_id=ucast(map_get(input_event, \"dest_user_id\"), \"string\", null),\n", + "dest_device_id=ucast(map_get(input_event, \"dest_device_id\"), \"string\", null)\n", + "| where process_name=\"cmd.exe\"\n", + "| rex field=parent_process \"(?[^\\\\\\\\]+)$\"\n", + "| where field0=\"winword.exe\" OR\n", + " field0=\"excel.exe\" OR\n", + " field0=\"outlook.exe\" OR\n", + " field0=\"powerpnt.exe\" OR\n", + " field0=\"visio.exe\" OR\n", + " field0=\"mspub.exe\" OR\n", + " field0=\"acrobat.exe\" OR\n", + " field0=\"acrord32.exe\" OR\n", + " field0=\"chrome.exe\" OR\n", + " field0=\"iexplore.exe\" OR\n", + " field0=\"opera.exe\" OR\n", + " field0=\"firefox.exe\" OR\n", + " field0=\"java.exe\" OR\n", + " field0=\"powershell.exe\"\n", + "| eval start_time=timestamp,\n", + "end_time=timestamp,\n", + "entities=mvappend(dest_device_id, dest_user_id),\n", + "body=\"TBD\";" + ] + }, + { + "cell_type": "code", + "execution_count": null, + "metadata": {}, + "outputs": [], + "source": [] + } + ], + "metadata": { + "kernelspec": { + "display_name": "SPL2", + "language": "SPL", + "name": "spl2" + }, + "language_info": { + "mimetype": "text/spl", + "name": "SPL" + } + }, + "nbformat": 4, + "nbformat_minor": 4 +} diff --git a/tests/unit_detect_prohibited_applications_spawning_cmd_exe.yml b/tests/unit_detect_prohibited_applications_spawning_cmd_exe.yml new file mode 100644 index 0000000000..937c7fa094 --- /dev/null +++ b/tests/unit_detect_prohibited_applications_spawning_cmd_exe.yml @@ -0,0 +1,10 @@ +name: Detect Prohibited Applications Spawning cmd exe Unit Test +detections: + - name: Access LSASS Memory for Dump Creation + file: endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml + pass_condition: '| stats count | where count > 0' +description: Test credential dumping detections +attack_data: + - file_name: unit_test_detect_prohibited_applications_spawning_cmd_exe.json + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unit_test_detect_prohibited_applications_spawning_cmd_exe.json +