From a32955b9858a8d5ca7e5e41d600d697aa19d8f0c Mon Sep 17 00:00:00 2001 From: divious1 Date: Tue, 7 Sep 2021 21:51:20 -0400 Subject: [PATCH 1/2] updating detection base on feedback from mschilt in issue 1527 --- .../system_information_discovery_detection.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/system_information_discovery_detection.yml b/detections/endpoint/system_information_discovery_detection.yml index f1191ab224..ed90c3cbf4 100644 --- a/detections/endpoint/system_information_discovery_detection.yml +++ b/detections/endpoint/system_information_discovery_detection.yml @@ -1,7 +1,7 @@ name: System Information Discovery Detection id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72 -version: 1 -date: '2020-10-12' +version: 2 +date: '2021-09-07' author: Patrick Bareiss, Splunk type: TTP datamodel: @@ -11,10 +11,10 @@ description: Detect system information discovery techniques used by attackers to search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="*wmic* qfe*" OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.user - Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` +Processes.process_name Processes.process Processes.dest Process.parent_process | `drop_dm_object_name(Processes)` | eventstats dc(process) as dc_processes_by_dest by dest | where dc_processes_by_dest - > 2 | stats values(process) min(firstTime) as firstTime max(lastTime) as lastTime - by user, dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + > 2 | stats values(process) as processes min(firstTime) as firstTime max(lastTime) as lastTime + by user, dest, parent_process | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `system_information_discovery_detection_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from From 8d9d1c1580f277ee093131bfc0244c411cdd6c96 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 8 Sep 2021 12:57:27 -0700 Subject: [PATCH 2/2] Update system_information_discovery_detection.yml SPL logic update --- ...system_information_discovery_detection.yml | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/system_information_discovery_detection.yml b/detections/endpoint/system_information_discovery_detection.yml index ed90c3cbf4..2cbc3e5720 100644 --- a/detections/endpoint/system_information_discovery_detection.yml +++ b/detections/endpoint/system_information_discovery_detection.yml @@ -9,13 +9,18 @@ datamodel: description: Detect system information discovery techniques used by attackers to understand configurations of the system to further exploit it. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process="*wmic* qfe*" - OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.user -Processes.process_name Processes.process Processes.dest Process.parent_process | `drop_dm_object_name(Processes)` - | eventstats dc(process) as dc_processes_by_dest by dest | where dc_processes_by_dest - > 2 | stats values(process) as processes min(firstTime) as firstTime max(lastTime) as lastTime - by user, dest, parent_process | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` - | `system_information_discovery_detection_filter`' + as lastTime from datamodel=Endpoint.Processes where (Processes.process="*wmic* qfe*" + OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.user + Processes.process_name Processes.process Processes.dest Processes.parent_process_name +| `drop_dm_object_name(Processes)` +| eventstats dc(process) as dc_processes_by_dest by dest +| where dc_processes_by_dest + > 2 +| stats values(process) as processes min(firstTime) as firstTime max(lastTime) as lastTime + by user, dest parent_process_name +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `system_information_discovery_detection_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.