admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
Bhavin Patel
2021-09-08 15:40:16 -07:00
committed by GitHub
parent c8e1c24b87 73595632f0
commit 80ddec9b5d
1 changed files with 14 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/system_information_discovery_detection.yml
+14 -9
View File
@@ -1,7 +1,7 @@
name: System Information Discovery Detection
id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72
version: 1
date: '2020-10-12'
version: 2
date: '2021-09-07'
author: Patrick Bareiss, Splunk
type: TTP
datamodel:
@@ -9,13 +9,18 @@ datamodel:
description: Detect system information discovery techniques used by attackers to understand
configurations of the system to further exploit it.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processes.process="*wmic* qfe*"
OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.user
Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)`
| eventstats dc(process) as dc_processes_by_dest by dest | where dc_processes_by_dest
> 2 | stats values(process) min(firstTime) as firstTime max(lastTime) as lastTime
by user, dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
| `system_information_discovery_detection_filter`'
as lastTime from datamodel=Endpoint.Processes where (Processes.process="*wmic* qfe*"
OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.user
Processes.process_name Processes.process Processes.dest Processes.parent_process_name
| `drop_dm_object_name(Processes)`
| eventstats dc(process) as dc_processes_by_dest by dest
| where dc_processes_by_dest
> 2
| stats values(process) as processes min(firstTime) as firstTime max(lastTime) as lastTime
by user, dest parent_process_name
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `system_information_discovery_detection_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.