mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Branch was auto-updated.
This commit is contained in:
srv-rr-gh-researchbt
@@ -66,13 +66,13 @@ jobs:
|
||||
#Previous config chose which branch/tag to operate on.
|
||||
#I think Github is smart enough to choose based on whether it's a pull request or push + other info?
|
||||
- name: Check out the repository code
|
||||
uses: actions/checkout@v2
|
||||
uses: actions/checkout@v3
|
||||
#with:
|
||||
# repository: splunk/security-content #check out https://github.com/mitre/cti.git, defaults to HEAD
|
||||
# path: "security-content"
|
||||
|
||||
|
||||
- uses: actions/setup-python@v2
|
||||
- uses: actions/setup-python@v4
|
||||
with:
|
||||
python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy
|
||||
architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
|
||||
@@ -101,10 +101,6 @@ jobs:
|
||||
python contentctl.py -p . ${{ steps.vars.outputs.skip_enrichment_var }} validate -pr SSA
|
||||
|
||||
|
||||
#Now generate the documentation (uses Node)
|
||||
- uses: actions/setup-node@v2
|
||||
with:
|
||||
node-version: '14' #can easily be changed to a different version
|
||||
|
||||
- name: contentctl generate
|
||||
run: |
|
||||
@@ -112,6 +108,7 @@ jobs:
|
||||
rm -rf dist/escu/default/data/ui/panels/*.xml
|
||||
python contentctl.py --path . ${{ steps.vars.outputs.skip_enrichment_var }} generate --product ESCU --output dist/escu
|
||||
python contentctl.py --path . ${{ steps.vars.outputs.skip_enrichment_var }} generate --product SSA --output dist/ssa
|
||||
python contentctl.py --path . ${{ steps.vars.outputs.skip_enrichment_var }} generate --product API --output dist/api
|
||||
|
||||
- name: Copy lookups .mlmodel files
|
||||
run: |
|
||||
@@ -143,6 +140,7 @@ jobs:
|
||||
tar -czf build/content-pack-build-escu.tar.gz dist/escu/*
|
||||
# update build number and version for ssa
|
||||
tar -czf build/content-pack-build-ssa.tar.gz dist/ssa/*
|
||||
tar -czf build/content-pack-build-api.tar.gz dist/api/*
|
||||
|
||||
|
||||
- name: Build ESCU
|
||||
@@ -151,8 +149,10 @@ jobs:
|
||||
cd build
|
||||
tar -zxf content-pack-build-escu.tar.gz
|
||||
tar -zxf content-pack-build-ssa.tar.gz
|
||||
tar -zxf content-pack-build-api.tar.gz
|
||||
mv dist/escu DA-ESS-ContentUpdate
|
||||
mv dist/ssa SSA_Content
|
||||
mv dist/api API_Content
|
||||
|
||||
#Build ESCU Content
|
||||
#Do not use slim for speed, simplicity, and compatability
|
||||
@@ -164,14 +164,19 @@ jobs:
|
||||
tar -zcf SSA_Content-latest.tar.gz SSA_Content
|
||||
sha256sum SSA_Content-latest.tar.gz >> checksum.txt
|
||||
|
||||
#Package the API Content
|
||||
tar -zcf API_Content-latest.tar.gz API_Content
|
||||
sha256sum API_Content-latest.tar.gz >> checksum.txt
|
||||
|
||||
|
||||
- name: store_artifacts
|
||||
uses: actions/upload-artifact@v2
|
||||
uses: actions/upload-artifact@v3
|
||||
with:
|
||||
name: content-latest
|
||||
path: |
|
||||
build/DA-ESS-ContentUpdate-latest.tar.gz
|
||||
build/SSA_Content-latest.tar.gz
|
||||
build/API_Content-latest.tar.gz
|
||||
build/checksum.txt
|
||||
|
||||
|
||||
@@ -185,12 +190,12 @@ jobs:
|
||||
steps:
|
||||
|
||||
- name: Checkout Repo
|
||||
uses: actions/checkout@v2
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
ref: 'develop'
|
||||
|
||||
#Download the artifacts we want to check
|
||||
- uses: actions/download-artifact@v2
|
||||
- uses: actions/download-artifact@v3
|
||||
with:
|
||||
name: content-latest
|
||||
path: build/
|
||||
@@ -217,7 +222,7 @@ jobs:
|
||||
tar -cvzf report.tar.gz report/
|
||||
|
||||
- name: store_artifacts
|
||||
uses: actions/upload-artifact@v2
|
||||
uses: actions/upload-artifact@v3
|
||||
with:
|
||||
name: appinspect_reports
|
||||
path: |
|
||||
@@ -225,7 +230,7 @@ jobs:
|
||||
|
||||
#Still store the report, even if we have failed (otherwise we don't know why/how we failed)
|
||||
- name: store_artifacts_on_failure
|
||||
uses: actions/upload-artifact@v2
|
||||
uses: actions/upload-artifact@v3
|
||||
if: failure()
|
||||
with:
|
||||
name: appinspect_reports_failure
|
||||
@@ -240,7 +245,7 @@ jobs:
|
||||
if: startsWith(github.ref, 'refs/tags/')
|
||||
steps:
|
||||
- name: Checkout Repo
|
||||
uses: actions/checkout@v2
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
ref: 'develop'
|
||||
|
||||
@@ -249,7 +254,7 @@ jobs:
|
||||
sudo apt update -qq
|
||||
sudo apt install jq -qq
|
||||
|
||||
- uses: actions/setup-python@v2
|
||||
- uses: actions/setup-python@v4
|
||||
with:
|
||||
python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy
|
||||
architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
|
||||
@@ -289,17 +294,17 @@ jobs:
|
||||
steps:
|
||||
|
||||
- name: Checkout Repo
|
||||
uses: actions/checkout@v2
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
token: ${{ secrets.SECURITY_CONTENT_ADMIN_TASKS }}
|
||||
ref: 'develop'
|
||||
|
||||
- uses: actions/setup-python@v2
|
||||
- uses: actions/setup-python@v4
|
||||
with:
|
||||
python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy
|
||||
architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
|
||||
|
||||
- uses: actions/download-artifact@v2
|
||||
- uses: actions/download-artifact@v3
|
||||
with:
|
||||
name: content-latest
|
||||
|
||||
@@ -307,8 +312,12 @@ jobs:
|
||||
run: |
|
||||
mkdir latest-escu
|
||||
tar -zxf DA-ESS-ContentUpdate-latest.tar.gz -C latest-escu --strip-components=1
|
||||
|
||||
mkdir latest-ssa
|
||||
tar -zxf SSA_Content-latest.tar.gz -C latest-ssa --strip-components=1
|
||||
|
||||
mkdir latest-api
|
||||
tar -zxf API_Content-latest.tar.gz -C latest-api --strip-components=1
|
||||
|
||||
- name: Install Python Dependencies
|
||||
run: |
|
||||
@@ -336,6 +345,7 @@ jobs:
|
||||
mkdir dist
|
||||
mv latest-escu dist/escu
|
||||
mv latest-ssa dist/ssa
|
||||
mv latest-api dist/api
|
||||
# configure git to prep for commit
|
||||
git config user.email "research@splunk.com"
|
||||
git config user.name "research bot"
|
||||
@@ -343,7 +353,7 @@ jobs:
|
||||
git add dist/*
|
||||
git add docs/*
|
||||
git add detections/*
|
||||
git commit --allow-empty -m "updating docs and package bits [ci skip]"
|
||||
git commit --allow-empty -m "Update dist/escu, dist/ssa, and dist/api folders with the latest content associated with this tag "
|
||||
# Push quietly to prevent showing the token in log
|
||||
#No need to provide any credentials
|
||||
git push
|
||||
@@ -358,11 +368,11 @@ jobs:
|
||||
steps:
|
||||
|
||||
#Get the artifacts that we need
|
||||
- uses: actions/download-artifact@v2
|
||||
- uses: actions/download-artifact@v3
|
||||
with:
|
||||
name: content-latest
|
||||
|
||||
- uses: actions/download-artifact@v2
|
||||
- uses: actions/download-artifact@v3
|
||||
with:
|
||||
name: appinspect_reports
|
||||
|
||||
@@ -375,6 +385,8 @@ jobs:
|
||||
run: |
|
||||
cp DA-ESS-ContentUpdate-latest.tar.gz DA-ESS-ContentUpdate-${{ steps.vars.outputs.tag }}.tar.gz
|
||||
cp SSA_Content-latest.tar.gz SSA_Content-${{ steps.vars.outputs.tag }}.tar.gz
|
||||
cp API_Content-latest.tar.gz API_Content-${{ steps.vars.outputs.tag }}.tar.gz
|
||||
|
||||
#No checksum on the reports
|
||||
cp report.tar.gz report-${{ steps.vars.outputs.tag }}.tar.gz
|
||||
cp checksum.txt checksum-${{ steps.vars.outputs.tag }}.txt
|
||||
@@ -387,6 +399,7 @@ jobs:
|
||||
files: |
|
||||
DA-ESS-ContentUpdate-${{ steps.vars.outputs.tag }}.tar.gz
|
||||
SSA_Content-${{ steps.vars.outputs.tag }}.tar.gz
|
||||
API_Content-${{ steps.vars.outputs.tag }}.tar.gz
|
||||
report-${{ steps.vars.outputs.tag }}.tar.gz
|
||||
checksum-${{ steps.vars.outputs.tag }}.txt
|
||||
|
||||
@@ -398,7 +411,7 @@ jobs:
|
||||
steps:
|
||||
|
||||
#Get the artifacts that we need
|
||||
- uses: actions/download-artifact@v2
|
||||
- uses: actions/download-artifact@v3
|
||||
with:
|
||||
name: content-latest
|
||||
|
||||
@@ -423,12 +436,12 @@ jobs:
|
||||
if: startsWith(github.ref, 'refs/tags/')
|
||||
steps:
|
||||
- name: Checkout Repo
|
||||
uses: actions/checkout@v2
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
ref: 'develop'
|
||||
|
||||
|
||||
- uses: actions/setup-python@v2
|
||||
- uses: actions/setup-python@v4
|
||||
with:
|
||||
python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy
|
||||
architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
|
||||
|
||||
+7
-1
@@ -15,13 +15,19 @@ from bin.contentctl_project.contentctl_infrastructure.builder.yml_reader import
|
||||
class SecurityContentStoryBuilder(StoryBuilder):
|
||||
story: Story
|
||||
check_references: bool
|
||||
app_name: str
|
||||
|
||||
def __init__(self, output_path:Union[str,None]=None, check_references: bool = False):
|
||||
self.check_references = check_references
|
||||
self.app_name = self.get_app_name_from_manifest(output_path)
|
||||
|
||||
def get_app_name_from_manifest(self, output_path:Union[str,None])->str:
|
||||
if output_path is None:
|
||||
|
||||
if output_path is None:
|
||||
return "ESCU"
|
||||
|
||||
elif "dist/api" in output_path:
|
||||
print("API does not have an 'app.manifest' file - assuming app is ESCU")
|
||||
return "ESCU"
|
||||
|
||||
try:
|
||||
|
||||
@@ -89,8 +89,13 @@
|
||||
"app_number": 3110,
|
||||
"app_version": "4.5.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_450.tgz"
|
||||
}
|
||||
},
|
||||
},
|
||||
"SPLUNK_TA_FOR_IIS": {
|
||||
"app_number": 3185,
|
||||
"app_version": "1.2.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-iis_120.tgz"
|
||||
}
|
||||
},
|
||||
"branch": "BRANCH_DOES_NOT_EXIST_USE_CLI_ARGUMENT",
|
||||
"commit_hash": null,
|
||||
"container_tag": "latest",
|
||||
|
||||
Submodule
+1
Submodule bin/lolba_enrichment/LOLBAS added at 6f2135e173
@@ -0,0 +1,63 @@
|
||||
name: Windows LOLBin Binary in Non Standard Path
|
||||
id: 25689101-012a-324a-94d3-08301e6c065a
|
||||
version: 1
|
||||
date: '2022-07-19'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies xxx which is a native living off the land binary or script (LOLBAS) within the Windows
|
||||
operating system that may be abused by adversaries by moving it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io site.
|
||||
search: 'xxx'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
@@ -0,0 +1,10 @@
|
||||
name: Windows LOLBin Binary in Non Standard Path Unit Test
|
||||
tests:
|
||||
- name: Windows LOLBin Binary in Non Standard Path
|
||||
file: endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: Test Windows LOLBin Binary in Non Standard Path
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
@@ -0,0 +1,244 @@
|
||||
from pydoc import describe
|
||||
import yaml
|
||||
import argparse
|
||||
import sys
|
||||
import re
|
||||
import json
|
||||
import csv
|
||||
import uuid
|
||||
from os import path, walk
|
||||
from tqdm import tqdm
|
||||
from datetime import datetime
|
||||
|
||||
|
||||
def read_lolbas(LOLBAS_PATH, VERBOSE):
|
||||
types = ["OSBinaries", "OSLibraries", "OSScripts", "OtherMSBinaries"]
|
||||
manifest_files = []
|
||||
for t in types:
|
||||
for root, dirs, files in walk(LOLBAS_PATH + '/yml/' + t):
|
||||
for file in files:
|
||||
if file.endswith(".yml"):
|
||||
manifest_files.append((path.join(root, file)))
|
||||
|
||||
lolbas = []
|
||||
for manifest_file in tqdm(manifest_files):
|
||||
lolba_yaml = dict()
|
||||
if VERBOSE:
|
||||
print("processing lolba yaml {0}".format(manifest_file))
|
||||
|
||||
with open(manifest_file, 'r') as stream:
|
||||
try:
|
||||
object = list(yaml.safe_load_all(stream))[0]
|
||||
object['file_path'] = manifest_file
|
||||
except yaml.YAMLError as exc:
|
||||
print(exc)
|
||||
print("Error reading {0}".format(manifest_file))
|
||||
sys.exit(1)
|
||||
lolba_yaml = object
|
||||
lolbas.append(lolba_yaml)
|
||||
return lolbas
|
||||
|
||||
def get_lolbas_paths(lolba):
|
||||
lolbas_paths = []
|
||||
if 'Full_Path' in lolba:
|
||||
for fullpath in lolba['Full_Path']:
|
||||
# check path is not none
|
||||
if fullpath['Path']:
|
||||
# check path is in c:\ there are some entries with N/A, No fixed path etc. . we should skip those
|
||||
if re.findall('c:', fullpath['Path'], re.IGNORECASE):
|
||||
lolbas_paths.append(fullpath['Path'])
|
||||
return lolbas_paths
|
||||
|
||||
|
||||
def write_ba_detections(lolbas, TEMPLATE_PATH, VERBOSE, OUTPUT_PATH):
|
||||
|
||||
for lolba in lolbas:
|
||||
lolbas_path_strings = ''
|
||||
full_ssa_search = ''
|
||||
# windows_lolbin_binary_in_non_standard_path auto search generation
|
||||
# first process SSA search
|
||||
ssa_base_search = '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"), "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)'
|
||||
ssa_end_search ='| eval start_time=timestamp,end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();'
|
||||
condition_1 = '| where process_name IS NOT NULL AND '
|
||||
condition_2 = '| where process_path IS NOT NULL AND '
|
||||
if get_lolbas_paths(lolba):
|
||||
full_paths = get_lolbas_paths(lolba)
|
||||
for full_path in full_paths:
|
||||
# grab the exe name
|
||||
lolbas_exe = 'process_name="' + lolba['Name'].lower() + '"'
|
||||
|
||||
# drop the drive letter
|
||||
full_path = full_path[2:]
|
||||
|
||||
# drop the exe at the end
|
||||
full_path = full_path.split("\\")[:-1]
|
||||
|
||||
# rejoin to a path
|
||||
full_path = "\\".join(full_path)
|
||||
|
||||
# adds a slash for regex at the end
|
||||
full_path = full_path.lower() + '/'
|
||||
# add path escapes
|
||||
full_path = full_path.replace("\\", "\\\\").lower()
|
||||
lolbas_path_strings = 'match_regex(process_path, /(?i)' + full_path + ')=false AND '
|
||||
#print("lolbas: " + lolba['Name'].lower() + " - full_path: " + lolbas_path_strings)
|
||||
|
||||
# remove trailing OR and merge with condition
|
||||
condition_1 = condition_1 + lolbas_exe
|
||||
# remove trailing AND nd merge with condition
|
||||
condition_2 = condition_2 + lolbas_path_strings[:-4]
|
||||
full_ssa_search = ssa_base_search + condition_1 + condition_2 + ssa_end_search
|
||||
lolba['full_ssa_search'] = full_ssa_search
|
||||
write_yaml(lolba, OUTPUT_PATH, TEMPLATE_PATH, VERBOSE)
|
||||
else:
|
||||
continue
|
||||
|
||||
def write_ba_tests(lolbas, TEMPLATE_PATH, VERBOSE, OUTPUT_PATH):
|
||||
for lolba in lolbas:
|
||||
# READ test template
|
||||
with open(TEMPLATE_PATH, 'r') as stream:
|
||||
try:
|
||||
object = list(yaml.safe_load_all(stream))[0]
|
||||
object['file_path'] = TEMPLATE_PATH
|
||||
except yaml.YAMLError as exc:
|
||||
print(exc)
|
||||
print("Error reading {0}".format(TEMPLATE_PATH))
|
||||
sys.exit(1)
|
||||
test_yaml_template = object
|
||||
|
||||
|
||||
# BA filename
|
||||
ba_test_path = OUTPUT_PATH + "/" + "ssa___" + lolba['Name'].lower().replace(".", "_") + ".test.yml"
|
||||
|
||||
# Build the BA test objects
|
||||
test_yaml = test_yaml_template
|
||||
# change file path
|
||||
test_yaml['file'] = "endpoint/" + "ssa___" + lolba['Name'].lower().replace(".", "_") + ".yml"
|
||||
# change name
|
||||
test_yaml['name'] = "Windows Rename System Utilities " + lolba['Name'].replace(".", " ").capitalize() + " LOLBAS in Non Standard Path Unit Test"
|
||||
# change test name
|
||||
test_yaml['tests'][0]['name'] = "Windows Rename System Utilities " + lolba['Name'].replace(".", " ").capitalize() + " LOLBAS in Non Standard Path"
|
||||
# change test file path
|
||||
test_yaml['tests'][0]['file'] = "endpoint/" + "ssa___" + lolba['Name'].lower().replace(".", "_") + ".yml"
|
||||
# change test description
|
||||
test_yaml['tests'][0]['description'] = " Test Windows Rename System Utilities " + lolba['Name'].replace(".", " ").capitalize() + " LOLBAS in Non Standard Path"
|
||||
|
||||
with open(ba_test_path, 'w', newline='') as yamlfile:
|
||||
if VERBOSE:
|
||||
print("writing BA test: {0}".format(ba_test_path))
|
||||
yaml.safe_dump(test_yaml, yamlfile, default_flow_style=False, sort_keys=False)
|
||||
|
||||
def write_dataset_file(lolbas, VERBOSE, OUTPUT_PATH):
|
||||
|
||||
test_datasets = []
|
||||
for lolba in lolbas:
|
||||
# READ test template
|
||||
with open('test_dataset_template.log', 'r') as file:
|
||||
test_dataset_template = file.read()
|
||||
|
||||
lolba_exe = lolba['Name'].lower().replace('(', '').replace(')', '')
|
||||
replaced = test_dataset_template.replace("xxx", lolba_exe)
|
||||
test_datasets.append(replaced)
|
||||
|
||||
with open(OUTPUT_PATH + '/lolbas_dataset.log', 'wt', encoding='utf-8') as file:
|
||||
if VERBOSE:
|
||||
print("writing Attack Dataset: {0}".format( OUTPUT_PATH + '/lolbas_dataset.log'))
|
||||
file.write('\n'.join(test_datasets))
|
||||
|
||||
|
||||
def write_yaml(lolba, OUTPUT_PATH, TEMPLATE_PATH, VERBOSE):
|
||||
# READ detection template
|
||||
|
||||
with open(TEMPLATE_PATH, 'r') as stream:
|
||||
try:
|
||||
object = list(yaml.safe_load_all(stream))[0]
|
||||
object['file_path'] = TEMPLATE_PATH
|
||||
except yaml.YAMLError as exc:
|
||||
print(exc)
|
||||
print("Error reading {0}".format(TEMPLATE_PATH))
|
||||
sys.exit(1)
|
||||
detection_yaml_template = object
|
||||
|
||||
|
||||
# BA filename
|
||||
ba_detection_path = OUTPUT_PATH + "/" + "ssa___" + lolba['Name'].lower().replace(".", "_") + ".yml"
|
||||
|
||||
# Build the BA objects
|
||||
detection_yaml = detection_yaml_template
|
||||
# change search
|
||||
detection_yaml['search'] = lolba['full_ssa_search']
|
||||
# change name
|
||||
detection_yaml['name'] = "Windows Rename System Utilities " + lolba['Name'].replace(".", " ").capitalize() + " LOLBAS in Non Standard Path"
|
||||
# generate a UUID per detection
|
||||
detection_yaml['id'] = str(uuid.uuid4())
|
||||
# generate a timestamp
|
||||
detection_yaml['date'] = datetime.today().strftime('%Y-%m-%d')
|
||||
# update description
|
||||
detection_yaml['description'] = detection_yaml_template['description'].replace("xxx", lolba['Name'])
|
||||
|
||||
with open(ba_detection_path, 'w', newline='') as yamlfile:
|
||||
if VERBOSE:
|
||||
print("writing BA detection: {0}".format(ba_detection_path))
|
||||
yaml.safe_dump(detection_yaml, yamlfile, default_flow_style=False, sort_keys=False)
|
||||
|
||||
|
||||
def write_csv(lolbas, OUTPUT_PATH):
|
||||
with open(OUTPUT_PATH + '/' + 'lolbas_file_path.csv', 'w', newline='') as csvfile:
|
||||
fieldnames = ['lolbas_file_name', 'lolbas_file_path', 'description']
|
||||
writer = csv.DictWriter(csvfile, fieldnames=fieldnames)
|
||||
writer.writeheader()
|
||||
for lolba in lolbas:
|
||||
parent_paths = []
|
||||
if get_lolbas_paths(lolba):
|
||||
full_paths = get_lolbas_paths(lolba)
|
||||
for full_path in full_paths:
|
||||
# drop the exe at the end
|
||||
parent_path_split = full_path.split("\\")[:-1]
|
||||
# rejoin to a path
|
||||
parent_path = "\\".join(parent_path_split)
|
||||
# adds a asterisk at the end
|
||||
parent_path = parent_path + '\\*'
|
||||
if parent_path not in parent_paths:
|
||||
parent_paths.append(parent_path)
|
||||
lolba_file_name = lolba['Name'].lower()
|
||||
lolba_description = lolba['Description']
|
||||
writer.writerow({'lolbas_file_name': lolba_file_name, 'lolbas_file_path': parent_path.lower(), 'description': lolba_description})
|
||||
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
|
||||
# grab arguments
|
||||
parser = argparse.ArgumentParser(description="Generates Updates Splunk detections with latest LOLBAS")
|
||||
parser.add_argument("--lolbas_path", required=False, default='LOLBAS', help="path to the lolbas repo")
|
||||
parser.add_argument("-o", "--output_path", required=False, default='output', help="path to results")
|
||||
parser.add_argument("--ba_template_path", required=False, default='ba_detection_template.yml', help="path to BA detection template")
|
||||
parser.add_argument("--ba_test_template_path", required=False, default='ba_test_template.yml', help="path to BA test template")
|
||||
parser.add_argument("-v", "--verbose", required=False, default=False, action='store_true', help="prints verbose output")
|
||||
|
||||
# parse them
|
||||
args = parser.parse_args()
|
||||
LOLBAS_PATH = args.lolbas_path
|
||||
VERBOSE = args.verbose
|
||||
OUTPUT_PATH = args.output_path
|
||||
BA_TEMPLATE_PATH = args.ba_template_path
|
||||
BA_TEST_PATH = args.ba_test_template_path
|
||||
|
||||
if not (path.isdir(OUTPUT_PATH) or path.isdir(OUTPUT_PATH)):
|
||||
print("error: {0} is not a directory".format(OUTPUT_PATH))
|
||||
sys.exit(1)
|
||||
|
||||
print("processing lolbas")
|
||||
lolbas = read_lolbas(LOLBAS_PATH, VERBOSE)
|
||||
|
||||
print("writing BA lolbas detections to: {0}/".format(OUTPUT_PATH))
|
||||
write_ba_detections(lolbas, BA_TEMPLATE_PATH, VERBOSE, OUTPUT_PATH)
|
||||
|
||||
print("writing BA lolbas test files to: {0}/".format(OUTPUT_PATH))
|
||||
write_ba_tests(lolbas, BA_TEST_PATH, VERBOSE, OUTPUT_PATH)
|
||||
|
||||
print("writing Attack Data logs to: {0}".format(OUTPUT_PATH + '/' + 'lolbas_dataset.log'))
|
||||
write_dataset_file(lolbas, VERBOSE, OUTPUT_PATH)
|
||||
|
||||
print("writing ESCU lolbas_file_path lookup to: {0}".format(OUTPUT_PATH + '/' + 'lolbas_file_path.csv'))
|
||||
write_csv(lolbas, OUTPUT_PATH)
|
||||
@@ -0,0 +1,480 @@
|
||||
lolbas_file_name,lolbas_file_path,description
|
||||
eventvwr.exe,c:\windows\system32\*,Displays Windows Event Logs in a GUI window.
|
||||
eventvwr.exe,c:\windows\syswow64\*,Displays Windows Event Logs in a GUI window.
|
||||
rasautou.exe,c:\windows\system32\*,Windows Remote Access Dialer
|
||||
regedit.exe,c:\windows\system32\*,Used by Windows to manipulate registry
|
||||
regedit.exe,c:\windows\syswow64\*,Used by Windows to manipulate registry
|
||||
regsvr32.exe,c:\windows\system32\*,Used by Windows to register dlls
|
||||
regsvr32.exe,c:\windows\syswow64\*,Used by Windows to register dlls
|
||||
control.exe,c:\windows\system32\*,Binary used to launch controlpanel items in Windows
|
||||
control.exe,c:\windows\syswow64\*,Binary used to launch controlpanel items in Windows
|
||||
configsecuritypolicy.exe,c:\programdata\microsoft\windows defender\platform\4.18.2008.9-0\*,Binary part of Windows Defender. Used to manage settings in Windows Defender. you can configure different pilot collections for each of the co-management workloads. Being able to use different pilot collections allows you to take a more granular approach when shifting workloads.
|
||||
scriptrunner.exe,c:\windows\system32\*,Execute binary through proxy binary to evade defensive counter measures
|
||||
scriptrunner.exe,c:\windows\syswow64\*,Execute binary through proxy binary to evade defensive counter measures
|
||||
offlinescannershell.exe,c:\program files\windows defender\offline\*,Windows Defender Offline Shell
|
||||
atbroker.exe,c:\windows\system32\*,Helper binary for Assistive Technology (AT)
|
||||
atbroker.exe,c:\windows\syswow64\*,Helper binary for Assistive Technology (AT)
|
||||
mmc.exe,c:\windows\system32\*,Load snap-ins to locally and remotely manage Windows systems
|
||||
mmc.exe,c:\windows\syswow64\*,Load snap-ins to locally and remotely manage Windows systems
|
||||
mavinject.exe,c:\windows\system32\*,Used by App-v in Windows
|
||||
mavinject.exe,c:\windows\syswow64\*,Used by App-v in Windows
|
||||
ftp.exe,c:\windows\system32\*,A binary designed for connecting to FTP servers
|
||||
ftp.exe,c:\windows\syswow64\*,A binary designed for connecting to FTP servers
|
||||
ttdinject.exe,c:\windows\system32\*,Used by Windows 1809 and newer to Debug Time Travel (Underlying call of tttracer.exe)
|
||||
ttdinject.exe,c:\windows\syswow64\*,Used by Windows 1809 and newer to Debug Time Travel (Underlying call of tttracer.exe)
|
||||
certoc.exe,c:\windows\system32\*,Used for installing certificates
|
||||
certoc.exe,c:\windows\syswow64\*,Used for installing certificates
|
||||
at.exe,c:\windows\system32\*,Schedule periodic tasks
|
||||
at.exe,c:\windows\syswow64\*,Schedule periodic tasks
|
||||
netsh.exe,c:\windows\system32\*,Netsh is a Windows tool used to manipulate network interface settings.
|
||||
netsh.exe,c:\windows\syswow64\*,Netsh is a Windows tool used to manipulate network interface settings.
|
||||
pnputil.exe,c:\windows\system32\*,Used for installing drivers
|
||||
ie4uinit.exe,c:\windows\system32\*,Executes commands from a specially prepared ie4uinit.inf file.
|
||||
ie4uinit.exe,c:\windows\syswow64\*,Executes commands from a specially prepared ie4uinit.inf file.
|
||||
infdefaultinstall.exe,c:\windows\system32\*,Binary used to perform installation based on content inside inf files
|
||||
infdefaultinstall.exe,c:\windows\syswow64\*,Binary used to perform installation based on content inside inf files
|
||||
forfiles.exe,c:\windows\system32\*,Selects and executes a command on a file or set of files. This command is useful for batch processing.
|
||||
forfiles.exe,c:\windows\syswow64\*,Selects and executes a command on a file or set of files. This command is useful for batch processing.
|
||||
register-cimprovider.exe,c:\windows\system32\*,Used to register new wmi providers
|
||||
register-cimprovider.exe,c:\windows\syswow64\*,Used to register new wmi providers
|
||||
tttracer.exe,c:\windows\system32\*,Used by Windows 1809 and newer to Debug Time Travel
|
||||
tttracer.exe,c:\windows\syswow64\*,Used by Windows 1809 and newer to Debug Time Travel
|
||||
xwizard.exe,c:\windows\system32\*,Execute custom class that has been added to the registry or download a file with Xwizard.exe
|
||||
xwizard.exe,c:\windows\syswow64\*,Execute custom class that has been added to the registry or download a file with Xwizard.exe
|
||||
pcalua.exe,c:\windows\system32\*,Program Compatibility Assistant
|
||||
print.exe,c:\windows\system32\*,Used by Windows to send files to the printer
|
||||
print.exe,c:\windows\syswow64\*,Used by Windows to send files to the printer
|
||||
runscripthelper.exe,c:\windows\winsxs\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.16299.15_none_c2df1bba78111118\*,Execute target PowerShell script
|
||||
runscripthelper.exe,c:\windows\winsxs\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.16299.192_none_ad4699b571e00c4a\*,Execute target PowerShell script
|
||||
regasm.exe,c:\windows\microsoft.net\framework\v2.0.50727\*,Part of .NET
|
||||
regasm.exe,c:\windows\microsoft.net\framework64\v2.0.50727\*,Part of .NET
|
||||
regasm.exe,c:\windows\microsoft.net\framework\v4.0.30319\*,Part of .NET
|
||||
regasm.exe,c:\windows\microsoft.net\framework64\v4.0.30319\*,Part of .NET
|
||||
cmd.exe,c:\windows\system32\*,The command-line interpreter in Windows
|
||||
cmd.exe,c:\windows\syswow64\*,The command-line interpreter in Windows
|
||||
msbuild.exe,c:\windows\microsoft.net\framework\v2.0.50727\*,Used to compile and execute code
|
||||
msbuild.exe,c:\windows\microsoft.net\framework64\v2.0.50727\*,Used to compile and execute code
|
||||
msbuild.exe,c:\windows\microsoft.net\framework\v3.5\*,Used to compile and execute code
|
||||
msbuild.exe,c:\windows\microsoft.net\framework64\v3.5\*,Used to compile and execute code
|
||||
msbuild.exe,c:\windows\microsoft.net\framework\v4.0.30319\*,Used to compile and execute code
|
||||
msbuild.exe,c:\windows\microsoft.net\framework64\v4.0.30319\*,Used to compile and execute code
|
||||
msbuild.exe,c:\program files (x86)\msbuild\14.0\bin\*,Used to compile and execute code
|
||||
certutil.exe,c:\windows\system32\*,Windows binary used for handling certificates
|
||||
certutil.exe,c:\windows\syswow64\*,Windows binary used for handling certificates
|
||||
vbc.exe,c:\windows\microsoft.net\framework64\v4.0.30319\*,Binary file used for compile vbs code
|
||||
vbc.exe,c:\windows\microsoft.net\framework64\v3.5\*,Binary file used for compile vbs code
|
||||
psr.exe,c:\windows\system32\*,"Windows Problem Steps Recorder, used to record screen and clicks."
|
||||
psr.exe,c:\windows\syswow64\*,"Windows Problem Steps Recorder, used to record screen and clicks."
|
||||
extexport.exe,c:\program files\internet explorer\*,Load a DLL located in the c:\test folder with a specific name.
|
||||
extexport.exe,c:\program files (x86)\internet explorer\*,Load a DLL located in the c:\test folder with a specific name.
|
||||
rpcping.exe,c:\windows\system32\*,Used to verify rpc connection
|
||||
rpcping.exe,c:\windows\syswow64\*,Used to verify rpc connection
|
||||
msdt.exe,c:\windows\system32\*,Microsoft diagnostics tool
|
||||
msdt.exe,c:\windows\syswow64\*,Microsoft diagnostics tool
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\64kb6472.inf_amd64_3daef03bbe98572b\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_comp.inf_amd64_0e9c57ae3396e055\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_comp.inf_amd64_209bd95d56b1ac2d\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_comp.inf_amd64_3fa2a843f8b7f16d\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_comp.inf_amd64_85c860f05274baa0\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_comp.inf_amd64_f7412e3e3404de80\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_comp.inf_amd64_feb9f1cf05b0de58\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_component.inf_amd64_0219cc1c7085a93f\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_component.inf_amd64_df4f60b1cae9b14a\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dc_comp.inf_amd64_16eb18b0e2526e57\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dc_comp.inf_amd64_1c77f1231c19bc72\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dc_comp.inf_amd64_31c60cc38cfcca28\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dc_comp.inf_amd64_82f69cea8b2d928f\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dc_comp.inf_amd64_b4d94f3e41ceb839\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_0606619cc97463de\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_0e95edab338ad669\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_22aac1442d387216\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_2461d914696db722\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_29d727269a34edf5\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_2caf76dbce56546d\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_353320edb98da643\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_4ea0ed0af1507894\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_56a48f4f1c2da7a7\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_64f23fdadb76a511\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_668dd0c6d3f9fa0e\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_6be8e5b7f731a6e5\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_6dad7e4e9a8fa889\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_6df442103a1937a4\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_767e7683f9ad126c\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_8644298f665a12c4\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_868acf86149aef5d\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_92cf9d9d84f1d3db\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_93239c65f222d453\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_9de8154b682af864\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_a7428663aca90897\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_ad7cb5e55a410add\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_afbf41cf8ab202d7\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_d193c96475eaa96e\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_db953c52208ada71\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_e7523682cc7528cc\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_e9f341319ca84274\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_f3a64c75ee4defb7\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_f51939e52b944f4b\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch_comp.inf_amd64_4938423c9b9639d7\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch_comp.inf_amd64_c8e108d4a62c59d5\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch_comp.inf_amd64_deecec7d232ced2b\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_01ee1299f4982efe\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_02edfc87000937e4\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_0541b698fc6e40b0\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_0707757077710fff\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_0b3e3ed3ace9602a\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_0cff362f9dff4228\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_16ed7d82b93e4f68\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_1a33d2f73651d989\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_1aca2a92a37fce23\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_1af2dd3e4df5fd61\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_1d571527c7083952\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_23f7302c2b9ee813\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_24de78387e6208e4\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_250db833a1cd577e\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_25e7c5a58c052bc5\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_28d80681d3523b1c\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_2dda3b1147a3a572\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_31ba00ea6900d67d\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_329877a66f240808\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_42af9f4718aa1395\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_4645af5c659ae51a\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_48c2e68e54c92258\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_48e7e903a369eae2\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_491d20003583dabe\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_4b34c18659561116\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_51ce968bf19942c2\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_555cfc07a674ecdd\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_561bd21d54545ed3\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_579a75f602cc2dce\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_57f66a4f0a97f1a3\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_587befb80671fb38\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_62f096fe77e085c0\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_6ae0ddbb4a38e23c\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_6bb02522ea3fdb0d\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_6d34ac0763025a06\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_712b6a0adbaabc0a\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_78b09d9681a2400f\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_842874489af34daa\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_88084eb1fe7cebc3\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_89033455cb08186f\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_8a9535cd18c90bc3\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_8c1fc948b5a01c52\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_9088b61921a6ff9f\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_90f68cd0dc48b625\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_95cb371d046d4b4c\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_a58de0cf5f3e9dca\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_abe9d37302f8b1ae\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_acb3edda7b82982f\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_aebc5a8535dd3184\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_b5d4c82c67b39358\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_b846bbf1e81ea3cf\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_babb2e8b8072ff3b\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_bc75cebf5edbbc50\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_be91293cf20d4372\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_c11f4d5f0bc4c592\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_c4e5173126d31cf0\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_c4f600ffe34acc7b\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_c8634ed19e331cda\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_c9081e50bcffa972\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_ceddadac8a2b489e\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_d4406f0ad6ec2581\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_d5877a2e0e6374b6\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_d8ca5f86add535ef\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_e8abe176c7b553b5\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_eabb3ac2c517211f\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_f8d8be8fea71e1a0\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_fe5e116bb07c0629\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_fe73d2ebaa05fb95\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64_kbl_kit127397.inf_amd64_e1da8ee9e92ccadb\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\k127153.inf_amd64_364f43f2a27f7bd7\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\k127153.inf_amd64_3f3936d8dec668b8\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\k127793.inf_amd64_3ab7883eddccbf0f\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki129523.inf_amd64_32947eecf8f3e231\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki126950.inf_amd64_fa7f56314967630d\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki126951.inf_amd64_94804e3918169543\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki126973.inf_amd64_06dde156632145e3\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki126974.inf_amd64_9168fc04b8275db9\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki127005.inf_amd64_753576c4406c1193\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki127018.inf_amd64_0f67ff47e9e30716\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki127021.inf_amd64_0d68af55c12c7c17\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki127171.inf_amd64_368f8c7337214025\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki127176.inf_amd64_86c658cabfb17c9c\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki127390.inf_amd64_e1ccb879ece8f084\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki127678.inf_amd64_8427d3a09f47dfc1\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki127727.inf_amd64_cf8e31692f82192e\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki127807.inf_amd64_fc915899816dbc5d\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki127850.inf_amd64_6ad8d99023b59fd5\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki128602.inf_amd64_6ff790822fd674ab\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki128916.inf_amd64_3509e1eb83b83cfb\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki129407.inf_amd64_f26f36ac54ce3076\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki129633.inf_amd64_d9b8af875f664a8c\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki129866.inf_amd64_e7cdca9882c16f55\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki130274.inf_amd64_bafd2440fa1ffdd6\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki130350.inf_amd64_696b7c6764071b63\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki130409.inf_amd64_0d8d61270dfb4560\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki130471.inf_amd64_26ad6921447aa568\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki130624.inf_amd64_d85487143eec5e1a\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki130825.inf_amd64_ee3ba427c553f15f\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki130871.inf_amd64_382f7c369d4bf777\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki131064.inf_amd64_5d13f27a9a9843fa\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki131176.inf_amd64_fb4fe914575fdd15\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki131191.inf_amd64_d668106cb6f2eae0\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki131622.inf_amd64_0058d71ace34db73\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki132032.inf_amd64_f29660d80998e019\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki132337.inf_amd64_223d6831ffa64ab1\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki132535.inf_amd64_7875dff189ab2fa2\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki132544.inf_amd64_b8c1f31373153db4\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki132574.inf_amd64_54c9b905b975ee55\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki132869.inf_amd64_052eb72d070df60f\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\kit126731.inf_amd64_1905c9d5f38631d9\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
dnscmd.exe,c:\windows\system32\*,A command-line interface for managing DNS servers
|
||||
dnscmd.exe,c:\windows\syswow64\*,A command-line interface for managing DNS servers
|
||||
wab.exe,c:\program files\windows mail\*,Windows address book manager
|
||||
wab.exe,c:\program files (x86)\windows mail\*,Windows address book manager
|
||||
msconfig.exe,c:\windows\system32\*,"MSConfig is a troubleshooting tool which is used to temporarily disable or re-enable software, device drivers or Windows services that run during startup process to help the user determine the cause of a problem with Windows"
|
||||
wscript.exe,c:\windows\system32\*,Used by Windows to execute scripts
|
||||
wscript.exe,c:\windows\syswow64\*,Used by Windows to execute scripts
|
||||
makecab.exe,c:\windows\system32\*,Binary to package existing files into a cabinet (.cab) file
|
||||
makecab.exe,c:\windows\syswow64\*,Binary to package existing files into a cabinet (.cab) file
|
||||
datasvcutil.exe,c:\windows\microsoft.net\framework64\v3.5\*,DataSvcUtil.exe is a command-line tool provided by WCF Data Services that consumes an Open Data Protocol (OData) feed and generates the client data service classes that are needed to access a data service from a .NET Framework client application.
|
||||
cmdl32.exe,c:\windows\system32\*,Microsoft Connection Manager Auto-Download
|
||||
cmdl32.exe,c:\windows\syswow64\*,Microsoft Connection Manager Auto-Download
|
||||
mshta.exe,c:\windows\system32\*,Used by Windows to execute html applications. (.hta)
|
||||
mshta.exe,c:\windows\syswow64\*,Used by Windows to execute html applications. (.hta)
|
||||
cmdkey.exe,c:\windows\system32\*,"creates, lists, and deletes stored user names and passwords or credentials."
|
||||
cmdkey.exe,c:\windows\syswow64\*,"creates, lists, and deletes stored user names and passwords or credentials."
|
||||
ilasm.exe,c:\windows\microsoft.net\framework\v4.0.30319\*,used for compile c# code into dll or exe.
|
||||
ilasm.exe,c:\windows\microsoft.net\framework64\v4.0.30319\*,used for compile c# code into dll or exe.
|
||||
rdrleakdiag.exe,c:\windows\system32\*,Microsoft Windows resource leak diagnostic tool
|
||||
rdrleakdiag.exe,c:\windows\syswow64\*,Microsoft Windows resource leak diagnostic tool
|
||||
mpcmdrun.exe,c:\programdata\microsoft\windows defender\platform\4.18.2008.4-0\*,Binary part of Windows Defender. Used to manage settings in Windows Defender
|
||||
mpcmdrun.exe,c:\programdata\microsoft\windows defender\platform\4.18.2008.7-0\*,Binary part of Windows Defender. Used to manage settings in Windows Defender
|
||||
mpcmdrun.exe,c:\programdata\microsoft\windows defender\platform\4.18.2008.9-0\*,Binary part of Windows Defender. Used to manage settings in Windows Defender
|
||||
jsc.exe,c:\windows\microsoft.net\framework\v4.0.30319\*,Binary file used by .NET to compile javascript code to .exe or .dll format
|
||||
jsc.exe,c:\windows\microsoft.net\framework64\v4.0.30319\*,Binary file used by .NET to compile javascript code to .exe or .dll format
|
||||
jsc.exe,c:\windows\microsoft.net\framework\v2.0.50727\*,Binary file used by .NET to compile javascript code to .exe or .dll format
|
||||
jsc.exe,c:\windows\microsoft.net\framework64\v2.0.50727\*,Binary file used by .NET to compile javascript code to .exe or .dll format
|
||||
cmstp.exe,c:\windows\system32\*,Installs or removes a Connection Manager service profile.
|
||||
cmstp.exe,c:\windows\syswow64\*,Installs or removes a Connection Manager service profile.
|
||||
stordiag.exe,c:\windows\system32\*,Storage diagnostic tool
|
||||
stordiag.exe,c:\windows\syswow64\*,Storage diagnostic tool
|
||||
odbcconf.exe,c:\windows\system32\*,Used in Windows for managing ODBC connections
|
||||
odbcconf.exe,c:\windows\syswow64\*,Used in Windows for managing ODBC connections
|
||||
wlrmdr.exe,c:\windows\system32\*,Windows Logon Reminder executable
|
||||
printbrm.exe,c:\windows\system32\spool\tools\*,Printer Migration Command-Line Tool
|
||||
dfsvc.exe,c:\windows\microsoft.net\framework\v2.0.50727\*,ClickOnce engine in Windows used by .NET
|
||||
dfsvc.exe,c:\windows\microsoft.net\framework64\v2.0.50727\*,ClickOnce engine in Windows used by .NET
|
||||
dfsvc.exe,c:\windows\microsoft.net\framework\v4.0.30319\*,ClickOnce engine in Windows used by .NET
|
||||
dfsvc.exe,c:\windows\microsoft.net\framework64\v4.0.30319\*,ClickOnce engine in Windows used by .NET
|
||||
extrac32.exe,c:\windows\system32\*,"Extract to ADS, copy or overwrite a file with Extrac32.exe"
|
||||
extrac32.exe,c:\windows\syswow64\*,"Extract to ADS, copy or overwrite a file with Extrac32.exe"
|
||||
rundll32.exe,c:\windows\system32\*,Used by Windows to execute dll files
|
||||
rundll32.exe,c:\windows\syswow64\*,Used by Windows to execute dll files
|
||||
runonce.exe,c:\windows\system32\*,Executes a Run Once Task that has been configured in the registry
|
||||
runonce.exe,c:\windows\syswow64\*,Executes a Run Once Task that has been configured in the registry
|
||||
explorer.exe,c:\windows\*,Binary used for managing files and system components within Windows
|
||||
explorer.exe,c:\windows\syswow64\*,Binary used for managing files and system components within Windows
|
||||
wuauclt.exe,c:\windows\system32\*,Windows Update Client
|
||||
wsreset.exe,c:\windows\system32\*,Used to reset Windows Store settings according to its manifest file
|
||||
finger.exe,c:\windows\system32\*,Displays information about a user or users on a specified remote computer that is running the Finger service or daemon
|
||||
finger.exe,c:\windows\syswow64\*,Displays information about a user or users on a specified remote computer that is running the Finger service or daemon
|
||||
regini.exe,c:\windows\system32\*,Used to manipulate the registry
|
||||
regini.exe,c:\windows\syswow64\*,Used to manipulate the registry
|
||||
reg.exe,c:\windows\system32\*,Used to manipulate the registry
|
||||
reg.exe,c:\windows\syswow64\*,Used to manipulate the registry
|
||||
syncappvpublishingserver.exe,c:\windows\system32\*,Used by App-v to get App-v server lists
|
||||
syncappvpublishingserver.exe,c:\windows\syswow64\*,Used by App-v to get App-v server lists
|
||||
bitsadmin.exe,c:\windows\system32\*,Used for managing background intelligent transfer
|
||||
bitsadmin.exe,c:\windows\syswow64\*,Used for managing background intelligent transfer
|
||||
msiexec.exe,c:\windows\system32\*,Used by Windows to execute msi files
|
||||
msiexec.exe,c:\windows\syswow64\*,Used by Windows to execute msi files
|
||||
regsvcs.exe,c:\windows\system32\*,Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies
|
||||
regsvcs.exe,c:\windows\syswow64\*,Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies
|
||||
gpscript.exe,c:\windows\system32\*,Used by group policy to process scripts
|
||||
gpscript.exe,c:\windows\syswow64\*,Used by group policy to process scripts
|
||||
diskshadow.exe,c:\windows\system32\*,Diskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS).
|
||||
diskshadow.exe,c:\windows\syswow64\*,Diskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS).
|
||||
ieexec.exe,c:\windows\microsoft.net\framework\v2.0.50727\*,The IEExec.exe application is an undocumented Microsoft .NET Framework application that is included with the .NET Framework. You can use the IEExec.exe application as a host to run other managed applications that you start by using a URL.
|
||||
ieexec.exe,c:\windows\microsoft.net\framework64\v2.0.50727\*,The IEExec.exe application is an undocumented Microsoft .NET Framework application that is included with the .NET Framework. You can use the IEExec.exe application as a host to run other managed applications that you start by using a URL.
|
||||
diantz.exe,c:\windows\system32\*,Binary that package existing files into a cabinet (.cab) file
|
||||
diantz.exe,c:\windows\syswow64\*,Binary that package existing files into a cabinet (.cab) file
|
||||
desktopimgdownldr.exe,c:\windows\system32\*,Windows binary used to configure lockscreen/desktop image
|
||||
appinstaller.exe,c:\program files\windowsapps\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe\*,Tool used for installation of AppX/MSIX applications on Windows 10
|
||||
sc.exe,c:\windows\system32\*,Used by Windows to manage services
|
||||
sc.exe,c:\windows\syswow64\*,Used by Windows to manage services
|
||||
replace.exe,c:\windows\system32\*,Used to replace file with another file
|
||||
replace.exe,c:\windows\syswow64\*,Used to replace file with another file
|
||||
schtasks.exe,c:\windows\system32\*,Schedule periodic tasks
|
||||
schtasks.exe,c:\windows\syswow64\*,Schedule periodic tasks
|
||||
microsoft.workflow.compiler.exe,c:\windows\microsoft.net\framework64\v4.0.30319\*,A utility included with .NET that is capable of compiling and executing C# or VB.net code.
|
||||
expand.exe,c:\windows\system32\*,Binary that expands one or more compressed files
|
||||
expand.exe,c:\windows\syswow64\*,Binary that expands one or more compressed files
|
||||
conhost.exe,c:\windows\system32\*,Console Window host
|
||||
bash.exe,c:\windows\system32\*,File used by Windows subsystem for Linux
|
||||
bash.exe,c:\windows\syswow64\*,File used by Windows subsystem for Linux
|
||||
pcwrun.exe,c:\windows\system32\*,Program Compatibility Wizard
|
||||
fltmc.exe,c:\windows\system32\*,Filter Manager Control Program used by Windows
|
||||
wmic.exe,c:\windows\system32\wbem\*,The WMI command-line (WMIC) utility provides a command-line interface for WMI
|
||||
wmic.exe,c:\windows\syswow64\wbem\*,The WMI command-line (WMIC) utility provides a command-line interface for WMI
|
||||
workfolders.exe,c:\windows\system32\*,Work Folders
|
||||
settingsynchost.exe,c:\windows\system32\*,Host Process for Setting Synchronization
|
||||
settingsynchost.exe,c:\windows\syswow64\*,Host Process for Setting Synchronization
|
||||
pktmon.exe,c:\windows\system32\*,Capture Network Packets on the windows 10 with October 2018 Update or later.
|
||||
pktmon.exe,c:\windows\syswow64\*,Capture Network Packets on the windows 10 with October 2018 Update or later.
|
||||
aspnet_compiler.exe,c:\windows\microsoft.net\framework\v4.0.30319\*,ASP.NET Compilation Tool
|
||||
aspnet_compiler.exe,c:\windows\microsoft.net\framework64\v4.0.30319\*,ASP.NET Compilation Tool
|
||||
cscript.exe,c:\windows\system32\*,Binary used to execute scripts in Windows
|
||||
cscript.exe,c:\windows\syswow64\*,Binary used to execute scripts in Windows
|
||||
installutil.exe,c:\windows\microsoft.net\framework\v2.0.50727\*,The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies
|
||||
installutil.exe,c:\windows\microsoft.net\framework64\v2.0.50727\*,The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies
|
||||
installutil.exe,c:\windows\microsoft.net\framework\v4.0.30319\*,The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies
|
||||
installutil.exe,c:\windows\microsoft.net\framework64\v4.0.30319\*,The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies
|
||||
esentutl.exe,c:\windows\system32\*,Binary for working with Microsoft Joint Engine Technology (JET) database
|
||||
esentutl.exe,c:\windows\syswow64\*,Binary for working with Microsoft Joint Engine Technology (JET) database
|
||||
hh.exe,c:\windows\*,Binary used for processing chm files in Windows
|
||||
hh.exe,c:\windows\syswow64\*,Binary used for processing chm files in Windows
|
||||
findstr.exe,c:\windows\system32\*,"Write to ADS, discover, or download files with Findstr.exe"
|
||||
findstr.exe,c:\windows\syswow64\*,"Write to ADS, discover, or download files with Findstr.exe"
|
||||
verclsid.exe,c:\windows\system32\*,Used to verify a COM object before it is instantiated by Windows Explorer
|
||||
verclsid.exe,c:\windows\syswow64\*,Used to verify a COM object before it is instantiated by Windows Explorer
|
||||
certreq.exe,c:\windows\system32\*,Used for requesting and managing certificates
|
||||
certreq.exe,c:\windows\syswow64\*,Used for requesting and managing certificates
|
||||
csc.exe,c:\windows\microsoft.net\framework\v4.0.30319\*,Binary file used by .NET to compile C# code
|
||||
csc.exe,c:\windows\microsoft.net\framework64\v4.0.30319\*,Binary file used by .NET to compile C# code
|
||||
imewdbld.exe,c:\windows\system32\ime\shared\*,Microsoft IME Open Extended Dictionary Module
|
||||
presentationhost.exe,c:\windows\system32\*,File is used for executing Browser applications
|
||||
presentationhost.exe,c:\windows\syswow64\*,File is used for executing Browser applications
|
||||
shell32.dll,c:\windows\system32\*,Windows Shell Common Dll
|
||||
shell32.dll,c:\windows\syswow64\*,Windows Shell Common Dll
|
||||
zipfldr.dll,c:\windows\system32\*,Compressed Folder library
|
||||
zipfldr.dll,c:\windows\syswow64\*,Compressed Folder library
|
||||
desk.cpl,c:\windows\system32\*,Desktop Settings Control Panel
|
||||
desk.cpl,c:\windows\syswow64\*,Desktop Settings Control Panel
|
||||
comsvcs.dll,c:\windows\system32\*,COM+ Services
|
||||
setupapi.dll,c:\windows\system32\*,Windows Setup Application Programming Interface
|
||||
setupapi.dll,c:\windows\syswow64\*,Windows Setup Application Programming Interface
|
||||
mshtml.dll,c:\windows\system32\*,Microsoft HTML Viewer
|
||||
mshtml.dll,c:\windows\syswow64\*,Microsoft HTML Viewer
|
||||
advpack.dll,c:\windows\system32\*,Utility for installing software and drivers with rundll32.exe
|
||||
advpack.dll,c:\windows\syswow64\*,Utility for installing software and drivers with rundll32.exe
|
||||
pcwutl.dll,c:\windows\system32\*,Microsoft HTML Viewer
|
||||
pcwutl.dll,c:\windows\syswow64\*,Microsoft HTML Viewer
|
||||
shdocvw.dll,c:\windows\system32\*,Shell Doc Object and Control Library.
|
||||
shdocvw.dll,c:\windows\syswow64\*,Shell Doc Object and Control Library.
|
||||
ieframe.dll,c:\windows\system32\*,Internet Browser DLL for translating HTML code.
|
||||
ieframe.dll,c:\windows\syswow64\*,Internet Browser DLL for translating HTML code.
|
||||
dfshim.dll,c:\windows\microsoft.net\framework\v2.0.50727\*,ClickOnce engine in Windows used by .NET
|
||||
dfshim.dll,c:\windows\microsoft.net\framework64\v2.0.50727\*,ClickOnce engine in Windows used by .NET
|
||||
dfshim.dll,c:\windows\microsoft.net\framework\v4.0.30319\*,ClickOnce engine in Windows used by .NET
|
||||
dfshim.dll,c:\windows\microsoft.net\framework64\v4.0.30319\*,ClickOnce engine in Windows used by .NET
|
||||
url.dll,c:\windows\system32\*,Internet Shortcut Shell Extension DLL.
|
||||
url.dll,c:\windows\syswow64\*,Internet Shortcut Shell Extension DLL.
|
||||
ieadvpack.dll,c:\windows\system32\*,INF installer for Internet Explorer. Has much of the same functionality as advpack.dll.
|
||||
ieadvpack.dll,c:\windows\syswow64\*,INF installer for Internet Explorer. Has much of the same functionality as advpack.dll.
|
||||
syssetup.dll,c:\windows\system32\*,Windows NT System Setup
|
||||
syssetup.dll,c:\windows\syswow64\*,Windows NT System Setup
|
||||
winrm.vbs,c:\windows\system32\*,Script used for manage Windows RM settings
|
||||
winrm.vbs,c:\windows\syswow64\*,Script used for manage Windows RM settings
|
||||
manage-bde.wsf,c:\windows\system32\*,Script for managing BitLocker
|
||||
cl_mutexverifiers.ps1,c:\windows\diagnostics\system\windowsupdate\*,Proxy execution with CL_Mutexverifiers.ps1
|
||||
cl_mutexverifiers.ps1,c:\windows\diagnostics\system\audio\*,Proxy execution with CL_Mutexverifiers.ps1
|
||||
cl_mutexverifiers.ps1,c:\windows\diagnostics\system\video\*,Proxy execution with CL_Mutexverifiers.ps1
|
||||
cl_mutexverifiers.ps1,c:\windows\diagnostics\system\speech\*,Proxy execution with CL_Mutexverifiers.ps1
|
||||
pubprn.vbs,c:\windows\system32\printing_admin_scripts\en-us\*,Proxy execution with Pubprn.vbs
|
||||
pubprn.vbs,c:\windows\syswow64\printing_admin_scripts\en-us\*,Proxy execution with Pubprn.vbs
|
||||
pester.bat,c:\program files\windowspowershell\modules\pester\3.4.0\bin\*,Used as part of the Powershell pester
|
||||
pester.bat,c:\program files\windowspowershell\modules\pester\*\bin\*,Used as part of the Powershell pester
|
||||
cl_loadassembly.ps1,c:\windows\diagnostics\system\audio\*,PowerShell Diagnostic Script
|
||||
syncappvpublishingserver.vbs,c:\windows\system32\*,Script used related to app-v and publishing server
|
||||
cl_invocation.ps1,c:\windows\diagnostics\system\aero\*,Aero diagnostics script
|
||||
cl_invocation.ps1,c:\windows\diagnostics\system\audio\*,Aero diagnostics script
|
||||
cl_invocation.ps1,c:\windows\diagnostics\system\windowsupdate\*,Aero diagnostics script
|
||||
utilityfunctions.ps1,c:\windows\diagnostics\system\networking\*,PowerShell Diagnostic Script
|
||||
coregen.exe,c:\program files\microsoft silverlight\5.1.50918.0\*,"Binary coregen.exe (Microsoft CoreCLR Native Image Generator) loads exported function GetCLRRuntimeHost from coreclr.dll or from .DLL in arbitrary path. Coregen is located within ""C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\"" or another version of Silverlight. Coregen is signed by Microsoft and bundled with Microsoft Silverlight."
|
||||
coregen.exe,c:\program files (x86)\microsoft silverlight\5.1.50918.0\*,"Binary coregen.exe (Microsoft CoreCLR Native Image Generator) loads exported function GetCLRRuntimeHost from coreclr.dll or from .DLL in arbitrary path. Coregen is located within ""C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\"" or another version of Silverlight. Coregen is signed by Microsoft and bundled with Microsoft Silverlight."
|
||||
fsi.exe,c:\program files\dotnet\sdk\[sdk version]\fsharp\*,64-bit FSharp (F#) Interpreter included with Visual Studio and DotNet Core SDK.
|
||||
fsi.exe,c:\program files (x86)\microsoft visual studio\2019\professional\common7\ide\commonextensions\microsoft\fsharp\*,64-bit FSharp (F#) Interpreter included with Visual Studio and DotNet Core SDK.
|
||||
visualuiaverifynative.exe,c:\program files (x86)\windows kits\10\bin\[sdk version]\arm64\uiaverify\*,A Windows SDK binary for manual and automated testing of Microsoft UI Automation implementation and controls.
|
||||
visualuiaverifynative.exe,c:\program files (x86)\windows kits\10\bin\[sdk version]\x64\uiaverify\*,A Windows SDK binary for manual and automated testing of Microsoft UI Automation implementation and controls.
|
||||
visualuiaverifynative.exe,c:\program files (x86)\windows kits\10\bin\[sdk version]\uiaverify\*,A Windows SDK binary for manual and automated testing of Microsoft UI Automation implementation and controls.
|
||||
ntdsutil.exe,c:\windows\system32\*,Command line utility used to export Active Directory.
|
||||
sqltoolsps.exe,c:\program files (x86)\microsoft sql server\130\tools\binn\*,Tool included with Microsoft SQL that loads SQL Server cmdlts. A replacement for sqlps.exe. Successor to sqlps.exe in SQL Server 2016+.
|
||||
dump64.exe,c:\program files (x86)\microsoft visual studio\installer\feedback\*,Memory dump tool that comes with Microsoft Visual Studio
|
||||
wsl.exe,c:\windows\system32\*,Windows subsystem for Linux executable
|
||||
csi.exe,c:\program files (x86)\microsoft visual studio\2017\community\msbuild\15.0\bin\roslyn\*,Command line interface included with Visual Studio.
|
||||
csi.exe,c:\program files (x86)\microsoft web tools\packages\microsoft.net.compilers.x.y.z\tools\*,Command line interface included with Visual Studio.
|
||||
mftrace.exe,c:\program files (x86)\windows kits\10\bin\10.0.16299.0\*,Trace log generation tool for Media Foundation Tools.
|
||||
mftrace.exe,c:\program files (x86)\windows kits\10\bin\*,Trace log generation tool for Media Foundation Tools.
|
||||
adplus.exe,c:\program files (x86)\windows kits\10\debuggers\x64\*,Debugging tool included with Windows Debugging Tools
|
||||
adplus.exe,c:\program files (x86)\windows kits\10\debuggers\x86\*,Debugging tool included with Windows Debugging Tools
|
||||
excel.exe,c:\program files (x86)\microsoft office 16\clientx86\root\office16\*,Microsoft Office binary
|
||||
excel.exe,c:\program files\microsoft office 16\clientx64\root\office16\*,Microsoft Office binary
|
||||
excel.exe,c:\program files (x86)\microsoft office\office16\*,Microsoft Office binary
|
||||
excel.exe,c:\program files\microsoft office\office16\*,Microsoft Office binary
|
||||
excel.exe,c:\program files (x86)\microsoft office 15\clientx86\root\office15\*,Microsoft Office binary
|
||||
excel.exe,c:\program files\microsoft office 15\clientx64\root\office15\*,Microsoft Office binary
|
||||
excel.exe,c:\program files (x86)\microsoft office\office15\*,Microsoft Office binary
|
||||
excel.exe,c:\program files\microsoft office\office15\*,Microsoft Office binary
|
||||
excel.exe,c:\program files (x86)\microsoft office 14\clientx86\root\office14\*,Microsoft Office binary
|
||||
excel.exe,c:\program files\microsoft office 14\clientx64\root\office14\*,Microsoft Office binary
|
||||
excel.exe,c:\program files (x86)\microsoft office\office14\*,Microsoft Office binary
|
||||
excel.exe,c:\program files\microsoft office\office14\*,Microsoft Office binary
|
||||
excel.exe,c:\program files (x86)\microsoft office\office12\*,Microsoft Office binary
|
||||
excel.exe,c:\program files\microsoft office\office12\*,Microsoft Office binary
|
||||
dotnet.exe,c:\program files\dotnet\*,dotnet.exe comes with .NET Framework
|
||||
sqlps.exe,c:\program files (x86)\microsoft sql server\100\tools\binn\*,"Tool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are Powershell version 4. Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons."
|
||||
sqlps.exe,c:\program files (x86)\microsoft sql server\110\tools\binn\*,"Tool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are Powershell version 4. Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons."
|
||||
sqlps.exe,c:\program files (x86)\microsoft sql server\120\tools\binn\*,"Tool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are Powershell version 4. Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons."
|
||||
sqlps.exe,c:\program files (x86)\microsoft sql server\130\tools\binn\*,"Tool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are Powershell version 4. Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons."
|
||||
sqlps.exe,c:\program files (x86)\microsoft sql server\150\tools\binn\*,"Tool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are Powershell version 4. Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons."
|
||||
acccheckconsole.exe,c:\program files (x86)\windows kits\10\bin\10.0.22000.0\x86\accchecker\*,Verifies UI accessibility requirements
|
||||
acccheckconsole.exe,c:\program files (x86)\windows kits\10\bin\10.0.22000.0\x64\accchecker\*,Verifies UI accessibility requirements
|
||||
acccheckconsole.exe,c:\program files (x86)\windows kits\10\bin\10.0.22000.0\arm\accchecker\*,Verifies UI accessibility requirements
|
||||
acccheckconsole.exe,c:\program files (x86)\windows kits\10\bin\10.0.22000.0\arm64\accchecker\*,Verifies UI accessibility requirements
|
||||
powerpnt.exe,c:\program files (x86)\microsoft office 16\clientx86\root\office16\*,Microsoft Office binary.
|
||||
powerpnt.exe,c:\program files\microsoft office 16\clientx64\root\office16\*,Microsoft Office binary.
|
||||
powerpnt.exe,c:\program files (x86)\microsoft office\office16\*,Microsoft Office binary.
|
||||
powerpnt.exe,c:\program files\microsoft office\office16\*,Microsoft Office binary.
|
||||
powerpnt.exe,c:\program files (x86)\microsoft office 15\clientx86\root\office15\*,Microsoft Office binary.
|
||||
powerpnt.exe,c:\program files\microsoft office 15\clientx64\root\office15\*,Microsoft Office binary.
|
||||
powerpnt.exe,c:\program files (x86)\microsoft office\office15\*,Microsoft Office binary.
|
||||
powerpnt.exe,c:\program files\microsoft office\office15\*,Microsoft Office binary.
|
||||
powerpnt.exe,c:\program files (x86)\microsoft office 14\clientx86\root\office14\*,Microsoft Office binary.
|
||||
powerpnt.exe,c:\program files\microsoft office 14\clientx64\root\office14\*,Microsoft Office binary.
|
||||
powerpnt.exe,c:\program files (x86)\microsoft office\office14\*,Microsoft Office binary.
|
||||
powerpnt.exe,c:\program files\microsoft office\office14\*,Microsoft Office binary.
|
||||
powerpnt.exe,c:\program files (x86)\microsoft office\office12\*,Microsoft Office binary.
|
||||
powerpnt.exe,c:\program files\microsoft office\office12\*,Microsoft Office binary.
|
||||
sqldumper.exe,c:\program files\microsoft sql server\90\shared\*,Debugging utility included with Microsoft SQL.
|
||||
sqldumper.exe,c:\program files (x86)\microsoft office\root\vfs\programfilesx86\microsoft analysis\as oledb\140\*,Debugging utility included with Microsoft SQL.
|
||||
remote.exe,c:\program files (x86)\windows kits\10\debuggers\x64\*,Debugging tool included with Windows Debugging Tools
|
||||
remote.exe,c:\program files (x86)\windows kits\10\debuggers\x86\*,Debugging tool included with Windows Debugging Tools
|
||||
appvlp.exe,c:\program files\microsoft office\root\client\*,Application Virtualization Utility Included with Microsoft Office 2016
|
||||
appvlp.exe,c:\program files (x86)\microsoft office\root\client\*,Application Virtualization Utility Included with Microsoft Office 2016
|
||||
agentexecutor.exe,c:\program files (x86)\*,Intune Management Extension included on Intune Managed Devices
|
||||
dxcap.exe,c:\windows\system32\*,DirectX diagnostics/debugger included with Visual Studio.
|
||||
dxcap.exe,c:\windows\syswow64\*,DirectX diagnostics/debugger included with Visual Studio.
|
||||
cdb.exe,c:\program files (x86)\windows kits\10\debuggers\x64\*,Debugging tool included with Windows Debugging Tools.
|
||||
cdb.exe,c:\program files (x86)\windows kits\10\debuggers\x86\*,Debugging tool included with Windows Debugging Tools.
|
||||
defaultpack.exe,c:\program files (x86)\microsoft\defaultpack\*,This binary can be downloaded along side multiple software downloads on the microsoft website. It gets downloaded when the user forgets to uncheck the option to set Bing as the default search provider.
|
||||
devtoolslauncher.exe,c:\windows\system32\*,Binary will execute specified binary. Part of VS/VScode installation.
|
||||
vsiisexelauncher.exe,c:\program files (x86)\microsoft visual studio\2019\community\common7\ide\extensions\microsoft\web tools\projectsystem\*,Binary will execute specified binary. Part of VS/VScode installation.
|
||||
winword.exe,c:\program files\microsoft office\root\office16\*,Microsoft Office binary
|
||||
winword.exe,c:\program files (x86)\microsoft office 16\clientx86\root\office16\*,Microsoft Office binary
|
||||
winword.exe,c:\program files\microsoft office 16\clientx64\root\office16\*,Microsoft Office binary
|
||||
winword.exe,c:\program files (x86)\microsoft office\office16\*,Microsoft Office binary
|
||||
winword.exe,c:\program files\microsoft office\office16\*,Microsoft Office binary
|
||||
winword.exe,c:\program files (x86)\microsoft office 15\clientx86\root\office15\*,Microsoft Office binary
|
||||
winword.exe,c:\program files\microsoft office 15\clientx64\root\office15\*,Microsoft Office binary
|
||||
winword.exe,c:\program files (x86)\microsoft office\office15\*,Microsoft Office binary
|
||||
winword.exe,c:\program files\microsoft office\office15\*,Microsoft Office binary
|
||||
winword.exe,c:\program files (x86)\microsoft office 14\clientx86\root\office14\*,Microsoft Office binary
|
||||
winword.exe,c:\program files\microsoft office 14\clientx64\root\office14\*,Microsoft Office binary
|
||||
winword.exe,c:\program files (x86)\microsoft office\office14\*,Microsoft Office binary
|
||||
winword.exe,c:\program files\microsoft office\office14\*,Microsoft Office binary
|
||||
winword.exe,c:\program files (x86)\microsoft office\office12\*,Microsoft Office binary
|
||||
winword.exe,c:\program files\microsoft office\office12\*,Microsoft Office binary
|
||||
fsianycpu.exe,c:\program files (x86)\microsoft visual studio\2019\professional\common7\ide\commonextensions\microsoft\fsharp\*,32/64-bit FSharp (F#) Interpreter included with Visual Studio.
|
||||
vsjitdebugger.exe,c:\windows\system32\*,Just-In-Time (JIT) debugger included with Visual Studio
|
||||
wfc.exe,c:\program files (x86)\microsoft sdks\windows\v10.0a\bin\netfx 4.8 tools\*,The Workflow Command-line Compiler tool is included with the Windows Software Development Kit (SDK).
|
||||
msdeploy.exe,c:\program files (x86)\iis\microsoft web deploy v3\*,Microsoft tool used to deploy Web Applications.
|
||||
|
@@ -0,0 +1,480 @@
|
||||
lolbas_file_name,lolbas_file_path,description
|
||||
eventvwr.exe,c:\windows\system32\*,Displays Windows Event Logs in a GUI window.
|
||||
eventvwr.exe,c:\windows\syswow64\*,Displays Windows Event Logs in a GUI window.
|
||||
rasautou.exe,c:\windows\system32\*,Windows Remote Access Dialer
|
||||
regedit.exe,c:\windows\system32\*,Used by Windows to manipulate registry
|
||||
regedit.exe,c:\windows\syswow64\*,Used by Windows to manipulate registry
|
||||
regsvr32.exe,c:\windows\system32\*,Used by Windows to register dlls
|
||||
regsvr32.exe,c:\windows\syswow64\*,Used by Windows to register dlls
|
||||
control.exe,c:\windows\system32\*,Binary used to launch controlpanel items in Windows
|
||||
control.exe,c:\windows\syswow64\*,Binary used to launch controlpanel items in Windows
|
||||
configsecuritypolicy.exe,c:\programdata\microsoft\windows defender\platform\4.18.2008.9-0\*,Binary part of Windows Defender. Used to manage settings in Windows Defender. you can configure different pilot collections for each of the co-management workloads. Being able to use different pilot collections allows you to take a more granular approach when shifting workloads.
|
||||
scriptrunner.exe,c:\windows\system32\*,Execute binary through proxy binary to evade defensive counter measures
|
||||
scriptrunner.exe,c:\windows\syswow64\*,Execute binary through proxy binary to evade defensive counter measures
|
||||
offlinescannershell.exe,c:\program files\windows defender\offline\*,Windows Defender Offline Shell
|
||||
atbroker.exe,c:\windows\system32\*,Helper binary for Assistive Technology (AT)
|
||||
atbroker.exe,c:\windows\syswow64\*,Helper binary for Assistive Technology (AT)
|
||||
mmc.exe,c:\windows\system32\*,Load snap-ins to locally and remotely manage Windows systems
|
||||
mmc.exe,c:\windows\syswow64\*,Load snap-ins to locally and remotely manage Windows systems
|
||||
mavinject.exe,c:\windows\system32\*,Used by App-v in Windows
|
||||
mavinject.exe,c:\windows\syswow64\*,Used by App-v in Windows
|
||||
ftp.exe,c:\windows\system32\*,A binary designed for connecting to FTP servers
|
||||
ftp.exe,c:\windows\syswow64\*,A binary designed for connecting to FTP servers
|
||||
ttdinject.exe,c:\windows\system32\*,Used by Windows 1809 and newer to Debug Time Travel (Underlying call of tttracer.exe)
|
||||
ttdinject.exe,c:\windows\syswow64\*,Used by Windows 1809 and newer to Debug Time Travel (Underlying call of tttracer.exe)
|
||||
certoc.exe,c:\windows\system32\*,Used for installing certificates
|
||||
certoc.exe,c:\windows\syswow64\*,Used for installing certificates
|
||||
at.exe,c:\windows\system32\*,Schedule periodic tasks
|
||||
at.exe,c:\windows\syswow64\*,Schedule periodic tasks
|
||||
netsh.exe,c:\windows\system32\*,Netsh is a Windows tool used to manipulate network interface settings.
|
||||
netsh.exe,c:\windows\syswow64\*,Netsh is a Windows tool used to manipulate network interface settings.
|
||||
pnputil.exe,c:\windows\system32\*,Used for installing drivers
|
||||
ie4uinit.exe,c:\windows\system32\*,Executes commands from a specially prepared ie4uinit.inf file.
|
||||
ie4uinit.exe,c:\windows\syswow64\*,Executes commands from a specially prepared ie4uinit.inf file.
|
||||
infdefaultinstall.exe,c:\windows\system32\*,Binary used to perform installation based on content inside inf files
|
||||
infdefaultinstall.exe,c:\windows\syswow64\*,Binary used to perform installation based on content inside inf files
|
||||
forfiles.exe,c:\windows\system32\*,Selects and executes a command on a file or set of files. This command is useful for batch processing.
|
||||
forfiles.exe,c:\windows\syswow64\*,Selects and executes a command on a file or set of files. This command is useful for batch processing.
|
||||
register-cimprovider.exe,c:\windows\system32\*,Used to register new wmi providers
|
||||
register-cimprovider.exe,c:\windows\syswow64\*,Used to register new wmi providers
|
||||
tttracer.exe,c:\windows\system32\*,Used by Windows 1809 and newer to Debug Time Travel
|
||||
tttracer.exe,c:\windows\syswow64\*,Used by Windows 1809 and newer to Debug Time Travel
|
||||
xwizard.exe,c:\windows\system32\*,Execute custom class that has been added to the registry or download a file with Xwizard.exe
|
||||
xwizard.exe,c:\windows\syswow64\*,Execute custom class that has been added to the registry or download a file with Xwizard.exe
|
||||
pcalua.exe,c:\windows\system32\*,Program Compatibility Assistant
|
||||
print.exe,c:\windows\system32\*,Used by Windows to send files to the printer
|
||||
print.exe,c:\windows\syswow64\*,Used by Windows to send files to the printer
|
||||
runscripthelper.exe,c:\windows\winsxs\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.16299.15_none_c2df1bba78111118\*,Execute target PowerShell script
|
||||
runscripthelper.exe,c:\windows\winsxs\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.16299.192_none_ad4699b571e00c4a\*,Execute target PowerShell script
|
||||
regasm.exe,c:\windows\microsoft.net\framework\v2.0.50727\*,Part of .NET
|
||||
regasm.exe,c:\windows\microsoft.net\framework64\v2.0.50727\*,Part of .NET
|
||||
regasm.exe,c:\windows\microsoft.net\framework\v4.0.30319\*,Part of .NET
|
||||
regasm.exe,c:\windows\microsoft.net\framework64\v4.0.30319\*,Part of .NET
|
||||
cmd.exe,c:\windows\system32\*,The command-line interpreter in Windows
|
||||
cmd.exe,c:\windows\syswow64\*,The command-line interpreter in Windows
|
||||
msbuild.exe,c:\windows\microsoft.net\framework\v2.0.50727\*,Used to compile and execute code
|
||||
msbuild.exe,c:\windows\microsoft.net\framework64\v2.0.50727\*,Used to compile and execute code
|
||||
msbuild.exe,c:\windows\microsoft.net\framework\v3.5\*,Used to compile and execute code
|
||||
msbuild.exe,c:\windows\microsoft.net\framework64\v3.5\*,Used to compile and execute code
|
||||
msbuild.exe,c:\windows\microsoft.net\framework\v4.0.30319\*,Used to compile and execute code
|
||||
msbuild.exe,c:\windows\microsoft.net\framework64\v4.0.30319\*,Used to compile and execute code
|
||||
msbuild.exe,c:\program files (x86)\msbuild\14.0\bin\*,Used to compile and execute code
|
||||
certutil.exe,c:\windows\system32\*,Windows binary used for handling certificates
|
||||
certutil.exe,c:\windows\syswow64\*,Windows binary used for handling certificates
|
||||
vbc.exe,c:\windows\microsoft.net\framework64\v4.0.30319\*,Binary file used for compile vbs code
|
||||
vbc.exe,c:\windows\microsoft.net\framework64\v3.5\*,Binary file used for compile vbs code
|
||||
psr.exe,c:\windows\system32\*,"Windows Problem Steps Recorder, used to record screen and clicks."
|
||||
psr.exe,c:\windows\syswow64\*,"Windows Problem Steps Recorder, used to record screen and clicks."
|
||||
extexport.exe,c:\program files\internet explorer\*,Load a DLL located in the c:\test folder with a specific name.
|
||||
extexport.exe,c:\program files (x86)\internet explorer\*,Load a DLL located in the c:\test folder with a specific name.
|
||||
rpcping.exe,c:\windows\system32\*,Used to verify rpc connection
|
||||
rpcping.exe,c:\windows\syswow64\*,Used to verify rpc connection
|
||||
msdt.exe,c:\windows\system32\*,Microsoft diagnostics tool
|
||||
msdt.exe,c:\windows\syswow64\*,Microsoft diagnostics tool
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\64kb6472.inf_amd64_3daef03bbe98572b\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_comp.inf_amd64_0e9c57ae3396e055\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_comp.inf_amd64_209bd95d56b1ac2d\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_comp.inf_amd64_3fa2a843f8b7f16d\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_comp.inf_amd64_85c860f05274baa0\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_comp.inf_amd64_f7412e3e3404de80\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_comp.inf_amd64_feb9f1cf05b0de58\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_component.inf_amd64_0219cc1c7085a93f\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_component.inf_amd64_df4f60b1cae9b14a\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dc_comp.inf_amd64_16eb18b0e2526e57\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dc_comp.inf_amd64_1c77f1231c19bc72\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dc_comp.inf_amd64_31c60cc38cfcca28\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dc_comp.inf_amd64_82f69cea8b2d928f\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dc_comp.inf_amd64_b4d94f3e41ceb839\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_0606619cc97463de\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_0e95edab338ad669\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_22aac1442d387216\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_2461d914696db722\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_29d727269a34edf5\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_2caf76dbce56546d\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_353320edb98da643\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_4ea0ed0af1507894\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_56a48f4f1c2da7a7\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_64f23fdadb76a511\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_668dd0c6d3f9fa0e\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_6be8e5b7f731a6e5\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_6dad7e4e9a8fa889\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_6df442103a1937a4\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_767e7683f9ad126c\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_8644298f665a12c4\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_868acf86149aef5d\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_92cf9d9d84f1d3db\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_93239c65f222d453\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_9de8154b682af864\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_a7428663aca90897\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_ad7cb5e55a410add\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_afbf41cf8ab202d7\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_d193c96475eaa96e\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_db953c52208ada71\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_e7523682cc7528cc\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_e9f341319ca84274\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_f3a64c75ee4defb7\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch.inf_amd64_f51939e52b944f4b\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch_comp.inf_amd64_4938423c9b9639d7\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch_comp.inf_amd64_c8e108d4a62c59d5\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\cui_dch_comp.inf_amd64_deecec7d232ced2b\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_01ee1299f4982efe\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_02edfc87000937e4\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_0541b698fc6e40b0\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_0707757077710fff\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_0b3e3ed3ace9602a\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_0cff362f9dff4228\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_16ed7d82b93e4f68\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_1a33d2f73651d989\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_1aca2a92a37fce23\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_1af2dd3e4df5fd61\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_1d571527c7083952\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_23f7302c2b9ee813\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_24de78387e6208e4\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_250db833a1cd577e\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_25e7c5a58c052bc5\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_28d80681d3523b1c\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_2dda3b1147a3a572\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_31ba00ea6900d67d\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_329877a66f240808\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_42af9f4718aa1395\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_4645af5c659ae51a\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_48c2e68e54c92258\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_48e7e903a369eae2\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_491d20003583dabe\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_4b34c18659561116\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_51ce968bf19942c2\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_555cfc07a674ecdd\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_561bd21d54545ed3\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_579a75f602cc2dce\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_57f66a4f0a97f1a3\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_587befb80671fb38\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_62f096fe77e085c0\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_6ae0ddbb4a38e23c\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_6bb02522ea3fdb0d\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_6d34ac0763025a06\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_712b6a0adbaabc0a\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_78b09d9681a2400f\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_842874489af34daa\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_88084eb1fe7cebc3\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_89033455cb08186f\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_8a9535cd18c90bc3\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_8c1fc948b5a01c52\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_9088b61921a6ff9f\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_90f68cd0dc48b625\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_95cb371d046d4b4c\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_a58de0cf5f3e9dca\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_abe9d37302f8b1ae\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_acb3edda7b82982f\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_aebc5a8535dd3184\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_b5d4c82c67b39358\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_b846bbf1e81ea3cf\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_babb2e8b8072ff3b\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_bc75cebf5edbbc50\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_be91293cf20d4372\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_c11f4d5f0bc4c592\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_c4e5173126d31cf0\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_c4f600ffe34acc7b\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_c8634ed19e331cda\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_c9081e50bcffa972\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_ceddadac8a2b489e\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_d4406f0ad6ec2581\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_d5877a2e0e6374b6\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_d8ca5f86add535ef\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_e8abe176c7b553b5\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_eabb3ac2c517211f\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_f8d8be8fea71e1a0\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_fe5e116bb07c0629\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64.inf_amd64_fe73d2ebaa05fb95\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\igdlh64_kbl_kit127397.inf_amd64_e1da8ee9e92ccadb\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\k127153.inf_amd64_364f43f2a27f7bd7\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\k127153.inf_amd64_3f3936d8dec668b8\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\k127793.inf_amd64_3ab7883eddccbf0f\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki129523.inf_amd64_32947eecf8f3e231\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki126950.inf_amd64_fa7f56314967630d\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki126951.inf_amd64_94804e3918169543\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki126973.inf_amd64_06dde156632145e3\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki126974.inf_amd64_9168fc04b8275db9\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki127005.inf_amd64_753576c4406c1193\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki127018.inf_amd64_0f67ff47e9e30716\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki127021.inf_amd64_0d68af55c12c7c17\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki127171.inf_amd64_368f8c7337214025\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki127176.inf_amd64_86c658cabfb17c9c\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki127390.inf_amd64_e1ccb879ece8f084\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki127678.inf_amd64_8427d3a09f47dfc1\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki127727.inf_amd64_cf8e31692f82192e\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki127807.inf_amd64_fc915899816dbc5d\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki127850.inf_amd64_6ad8d99023b59fd5\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki128602.inf_amd64_6ff790822fd674ab\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki128916.inf_amd64_3509e1eb83b83cfb\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki129407.inf_amd64_f26f36ac54ce3076\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki129633.inf_amd64_d9b8af875f664a8c\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki129866.inf_amd64_e7cdca9882c16f55\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki130274.inf_amd64_bafd2440fa1ffdd6\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki130350.inf_amd64_696b7c6764071b63\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki130409.inf_amd64_0d8d61270dfb4560\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki130471.inf_amd64_26ad6921447aa568\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki130624.inf_amd64_d85487143eec5e1a\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki130825.inf_amd64_ee3ba427c553f15f\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki130871.inf_amd64_382f7c369d4bf777\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki131064.inf_amd64_5d13f27a9a9843fa\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki131176.inf_amd64_fb4fe914575fdd15\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki131191.inf_amd64_d668106cb6f2eae0\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki131622.inf_amd64_0058d71ace34db73\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki132032.inf_amd64_f29660d80998e019\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki132337.inf_amd64_223d6831ffa64ab1\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki132535.inf_amd64_7875dff189ab2fa2\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki132544.inf_amd64_b8c1f31373153db4\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki132574.inf_amd64_54c9b905b975ee55\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\ki132869.inf_amd64_052eb72d070df60f\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
gfxdownloadwrapper.exe,c:\windows\system32\driverstore\filerepository\kit126731.inf_amd64_1905c9d5f38631d9\*,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path."
|
||||
dnscmd.exe,c:\windows\system32\*,A command-line interface for managing DNS servers
|
||||
dnscmd.exe,c:\windows\syswow64\*,A command-line interface for managing DNS servers
|
||||
wab.exe,c:\program files\windows mail\*,Windows address book manager
|
||||
wab.exe,c:\program files (x86)\windows mail\*,Windows address book manager
|
||||
msconfig.exe,c:\windows\system32\*,"MSConfig is a troubleshooting tool which is used to temporarily disable or re-enable software, device drivers or Windows services that run during startup process to help the user determine the cause of a problem with Windows"
|
||||
wscript.exe,c:\windows\system32\*,Used by Windows to execute scripts
|
||||
wscript.exe,c:\windows\syswow64\*,Used by Windows to execute scripts
|
||||
makecab.exe,c:\windows\system32\*,Binary to package existing files into a cabinet (.cab) file
|
||||
makecab.exe,c:\windows\syswow64\*,Binary to package existing files into a cabinet (.cab) file
|
||||
datasvcutil.exe,c:\windows\microsoft.net\framework64\v3.5\*,DataSvcUtil.exe is a command-line tool provided by WCF Data Services that consumes an Open Data Protocol (OData) feed and generates the client data service classes that are needed to access a data service from a .NET Framework client application.
|
||||
cmdl32.exe,c:\windows\system32\*,Microsoft Connection Manager Auto-Download
|
||||
cmdl32.exe,c:\windows\syswow64\*,Microsoft Connection Manager Auto-Download
|
||||
mshta.exe,c:\windows\system32\*,Used by Windows to execute html applications. (.hta)
|
||||
mshta.exe,c:\windows\syswow64\*,Used by Windows to execute html applications. (.hta)
|
||||
cmdkey.exe,c:\windows\system32\*,"creates, lists, and deletes stored user names and passwords or credentials."
|
||||
cmdkey.exe,c:\windows\syswow64\*,"creates, lists, and deletes stored user names and passwords or credentials."
|
||||
ilasm.exe,c:\windows\microsoft.net\framework\v4.0.30319\*,used for compile c# code into dll or exe.
|
||||
ilasm.exe,c:\windows\microsoft.net\framework64\v4.0.30319\*,used for compile c# code into dll or exe.
|
||||
rdrleakdiag.exe,c:\windows\system32\*,Microsoft Windows resource leak diagnostic tool
|
||||
rdrleakdiag.exe,c:\windows\syswow64\*,Microsoft Windows resource leak diagnostic tool
|
||||
mpcmdrun.exe,c:\programdata\microsoft\windows defender\platform\4.18.2008.4-0\*,Binary part of Windows Defender. Used to manage settings in Windows Defender
|
||||
mpcmdrun.exe,c:\programdata\microsoft\windows defender\platform\4.18.2008.7-0\*,Binary part of Windows Defender. Used to manage settings in Windows Defender
|
||||
mpcmdrun.exe,c:\programdata\microsoft\windows defender\platform\4.18.2008.9-0\*,Binary part of Windows Defender. Used to manage settings in Windows Defender
|
||||
jsc.exe,c:\windows\microsoft.net\framework\v4.0.30319\*,Binary file used by .NET to compile javascript code to .exe or .dll format
|
||||
jsc.exe,c:\windows\microsoft.net\framework64\v4.0.30319\*,Binary file used by .NET to compile javascript code to .exe or .dll format
|
||||
jsc.exe,c:\windows\microsoft.net\framework\v2.0.50727\*,Binary file used by .NET to compile javascript code to .exe or .dll format
|
||||
jsc.exe,c:\windows\microsoft.net\framework64\v2.0.50727\*,Binary file used by .NET to compile javascript code to .exe or .dll format
|
||||
cmstp.exe,c:\windows\system32\*,Installs or removes a Connection Manager service profile.
|
||||
cmstp.exe,c:\windows\syswow64\*,Installs or removes a Connection Manager service profile.
|
||||
stordiag.exe,c:\windows\system32\*,Storage diagnostic tool
|
||||
stordiag.exe,c:\windows\syswow64\*,Storage diagnostic tool
|
||||
odbcconf.exe,c:\windows\system32\*,Used in Windows for managing ODBC connections
|
||||
odbcconf.exe,c:\windows\syswow64\*,Used in Windows for managing ODBC connections
|
||||
wlrmdr.exe,c:\windows\system32\*,Windows Logon Reminder executable
|
||||
printbrm.exe,c:\windows\system32\spool\tools\*,Printer Migration Command-Line Tool
|
||||
dfsvc.exe,c:\windows\microsoft.net\framework\v2.0.50727\*,ClickOnce engine in Windows used by .NET
|
||||
dfsvc.exe,c:\windows\microsoft.net\framework64\v2.0.50727\*,ClickOnce engine in Windows used by .NET
|
||||
dfsvc.exe,c:\windows\microsoft.net\framework\v4.0.30319\*,ClickOnce engine in Windows used by .NET
|
||||
dfsvc.exe,c:\windows\microsoft.net\framework64\v4.0.30319\*,ClickOnce engine in Windows used by .NET
|
||||
extrac32.exe,c:\windows\system32\*,"Extract to ADS, copy or overwrite a file with Extrac32.exe"
|
||||
extrac32.exe,c:\windows\syswow64\*,"Extract to ADS, copy or overwrite a file with Extrac32.exe"
|
||||
rundll32.exe,c:\windows\system32\*,Used by Windows to execute dll files
|
||||
rundll32.exe,c:\windows\syswow64\*,Used by Windows to execute dll files
|
||||
runonce.exe,c:\windows\system32\*,Executes a Run Once Task that has been configured in the registry
|
||||
runonce.exe,c:\windows\syswow64\*,Executes a Run Once Task that has been configured in the registry
|
||||
explorer.exe,c:\windows\*,Binary used for managing files and system components within Windows
|
||||
explorer.exe,c:\windows\syswow64\*,Binary used for managing files and system components within Windows
|
||||
wuauclt.exe,c:\windows\system32\*,Windows Update Client
|
||||
wsreset.exe,c:\windows\system32\*,Used to reset Windows Store settings according to its manifest file
|
||||
finger.exe,c:\windows\system32\*,Displays information about a user or users on a specified remote computer that is running the Finger service or daemon
|
||||
finger.exe,c:\windows\syswow64\*,Displays information about a user or users on a specified remote computer that is running the Finger service or daemon
|
||||
regini.exe,c:\windows\system32\*,Used to manipulate the registry
|
||||
regini.exe,c:\windows\syswow64\*,Used to manipulate the registry
|
||||
reg.exe,c:\windows\system32\*,Used to manipulate the registry
|
||||
reg.exe,c:\windows\syswow64\*,Used to manipulate the registry
|
||||
syncappvpublishingserver.exe,c:\windows\system32\*,Used by App-v to get App-v server lists
|
||||
syncappvpublishingserver.exe,c:\windows\syswow64\*,Used by App-v to get App-v server lists
|
||||
bitsadmin.exe,c:\windows\system32\*,Used for managing background intelligent transfer
|
||||
bitsadmin.exe,c:\windows\syswow64\*,Used for managing background intelligent transfer
|
||||
msiexec.exe,c:\windows\system32\*,Used by Windows to execute msi files
|
||||
msiexec.exe,c:\windows\syswow64\*,Used by Windows to execute msi files
|
||||
regsvcs.exe,c:\windows\system32\*,Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies
|
||||
regsvcs.exe,c:\windows\syswow64\*,Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies
|
||||
gpscript.exe,c:\windows\system32\*,Used by group policy to process scripts
|
||||
gpscript.exe,c:\windows\syswow64\*,Used by group policy to process scripts
|
||||
diskshadow.exe,c:\windows\system32\*,Diskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS).
|
||||
diskshadow.exe,c:\windows\syswow64\*,Diskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS).
|
||||
ieexec.exe,c:\windows\microsoft.net\framework\v2.0.50727\*,The IEExec.exe application is an undocumented Microsoft .NET Framework application that is included with the .NET Framework. You can use the IEExec.exe application as a host to run other managed applications that you start by using a URL.
|
||||
ieexec.exe,c:\windows\microsoft.net\framework64\v2.0.50727\*,The IEExec.exe application is an undocumented Microsoft .NET Framework application that is included with the .NET Framework. You can use the IEExec.exe application as a host to run other managed applications that you start by using a URL.
|
||||
diantz.exe,c:\windows\system32\*,Binary that package existing files into a cabinet (.cab) file
|
||||
diantz.exe,c:\windows\syswow64\*,Binary that package existing files into a cabinet (.cab) file
|
||||
desktopimgdownldr.exe,c:\windows\system32\*,Windows binary used to configure lockscreen/desktop image
|
||||
appinstaller.exe,c:\program files\windowsapps\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe\*,Tool used for installation of AppX/MSIX applications on Windows 10
|
||||
sc.exe,c:\windows\system32\*,Used by Windows to manage services
|
||||
sc.exe,c:\windows\syswow64\*,Used by Windows to manage services
|
||||
replace.exe,c:\windows\system32\*,Used to replace file with another file
|
||||
replace.exe,c:\windows\syswow64\*,Used to replace file with another file
|
||||
schtasks.exe,c:\windows\system32\*,Schedule periodic tasks
|
||||
schtasks.exe,c:\windows\syswow64\*,Schedule periodic tasks
|
||||
microsoft.workflow.compiler.exe,c:\windows\microsoft.net\framework64\v4.0.30319\*,A utility included with .NET that is capable of compiling and executing C# or VB.net code.
|
||||
expand.exe,c:\windows\system32\*,Binary that expands one or more compressed files
|
||||
expand.exe,c:\windows\syswow64\*,Binary that expands one or more compressed files
|
||||
conhost.exe,c:\windows\system32\*,Console Window host
|
||||
bash.exe,c:\windows\system32\*,File used by Windows subsystem for Linux
|
||||
bash.exe,c:\windows\syswow64\*,File used by Windows subsystem for Linux
|
||||
pcwrun.exe,c:\windows\system32\*,Program Compatibility Wizard
|
||||
fltmc.exe,c:\windows\system32\*,Filter Manager Control Program used by Windows
|
||||
wmic.exe,c:\windows\system32\wbem\*,The WMI command-line (WMIC) utility provides a command-line interface for WMI
|
||||
wmic.exe,c:\windows\syswow64\wbem\*,The WMI command-line (WMIC) utility provides a command-line interface for WMI
|
||||
workfolders.exe,c:\windows\system32\*,Work Folders
|
||||
settingsynchost.exe,c:\windows\system32\*,Host Process for Setting Synchronization
|
||||
settingsynchost.exe,c:\windows\syswow64\*,Host Process for Setting Synchronization
|
||||
pktmon.exe,c:\windows\system32\*,Capture Network Packets on the windows 10 with October 2018 Update or later.
|
||||
pktmon.exe,c:\windows\syswow64\*,Capture Network Packets on the windows 10 with October 2018 Update or later.
|
||||
aspnet_compiler.exe,c:\windows\microsoft.net\framework\v4.0.30319\*,ASP.NET Compilation Tool
|
||||
aspnet_compiler.exe,c:\windows\microsoft.net\framework64\v4.0.30319\*,ASP.NET Compilation Tool
|
||||
cscript.exe,c:\windows\system32\*,Binary used to execute scripts in Windows
|
||||
cscript.exe,c:\windows\syswow64\*,Binary used to execute scripts in Windows
|
||||
installutil.exe,c:\windows\microsoft.net\framework\v2.0.50727\*,The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies
|
||||
installutil.exe,c:\windows\microsoft.net\framework64\v2.0.50727\*,The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies
|
||||
installutil.exe,c:\windows\microsoft.net\framework\v4.0.30319\*,The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies
|
||||
installutil.exe,c:\windows\microsoft.net\framework64\v4.0.30319\*,The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies
|
||||
esentutl.exe,c:\windows\system32\*,Binary for working with Microsoft Joint Engine Technology (JET) database
|
||||
esentutl.exe,c:\windows\syswow64\*,Binary for working with Microsoft Joint Engine Technology (JET) database
|
||||
hh.exe,c:\windows\*,Binary used for processing chm files in Windows
|
||||
hh.exe,c:\windows\syswow64\*,Binary used for processing chm files in Windows
|
||||
findstr.exe,c:\windows\system32\*,"Write to ADS, discover, or download files with Findstr.exe"
|
||||
findstr.exe,c:\windows\syswow64\*,"Write to ADS, discover, or download files with Findstr.exe"
|
||||
verclsid.exe,c:\windows\system32\*,Used to verify a COM object before it is instantiated by Windows Explorer
|
||||
verclsid.exe,c:\windows\syswow64\*,Used to verify a COM object before it is instantiated by Windows Explorer
|
||||
certreq.exe,c:\windows\system32\*,Used for requesting and managing certificates
|
||||
certreq.exe,c:\windows\syswow64\*,Used for requesting and managing certificates
|
||||
csc.exe,c:\windows\microsoft.net\framework\v4.0.30319\*,Binary file used by .NET to compile C# code
|
||||
csc.exe,c:\windows\microsoft.net\framework64\v4.0.30319\*,Binary file used by .NET to compile C# code
|
||||
imewdbld.exe,c:\windows\system32\ime\shared\*,Microsoft IME Open Extended Dictionary Module
|
||||
presentationhost.exe,c:\windows\system32\*,File is used for executing Browser applications
|
||||
presentationhost.exe,c:\windows\syswow64\*,File is used for executing Browser applications
|
||||
shell32.dll,c:\windows\system32\*,Windows Shell Common Dll
|
||||
shell32.dll,c:\windows\syswow64\*,Windows Shell Common Dll
|
||||
zipfldr.dll,c:\windows\system32\*,Compressed Folder library
|
||||
zipfldr.dll,c:\windows\syswow64\*,Compressed Folder library
|
||||
desk.cpl,c:\windows\system32\*,Desktop Settings Control Panel
|
||||
desk.cpl,c:\windows\syswow64\*,Desktop Settings Control Panel
|
||||
comsvcs.dll,c:\windows\system32\*,COM+ Services
|
||||
setupapi.dll,c:\windows\system32\*,Windows Setup Application Programming Interface
|
||||
setupapi.dll,c:\windows\syswow64\*,Windows Setup Application Programming Interface
|
||||
mshtml.dll,c:\windows\system32\*,Microsoft HTML Viewer
|
||||
mshtml.dll,c:\windows\syswow64\*,Microsoft HTML Viewer
|
||||
advpack.dll,c:\windows\system32\*,Utility for installing software and drivers with rundll32.exe
|
||||
advpack.dll,c:\windows\syswow64\*,Utility for installing software and drivers with rundll32.exe
|
||||
pcwutl.dll,c:\windows\system32\*,Microsoft HTML Viewer
|
||||
pcwutl.dll,c:\windows\syswow64\*,Microsoft HTML Viewer
|
||||
shdocvw.dll,c:\windows\system32\*,Shell Doc Object and Control Library.
|
||||
shdocvw.dll,c:\windows\syswow64\*,Shell Doc Object and Control Library.
|
||||
ieframe.dll,c:\windows\system32\*,Internet Browser DLL for translating HTML code.
|
||||
ieframe.dll,c:\windows\syswow64\*,Internet Browser DLL for translating HTML code.
|
||||
dfshim.dll,c:\windows\microsoft.net\framework\v2.0.50727\*,ClickOnce engine in Windows used by .NET
|
||||
dfshim.dll,c:\windows\microsoft.net\framework64\v2.0.50727\*,ClickOnce engine in Windows used by .NET
|
||||
dfshim.dll,c:\windows\microsoft.net\framework\v4.0.30319\*,ClickOnce engine in Windows used by .NET
|
||||
dfshim.dll,c:\windows\microsoft.net\framework64\v4.0.30319\*,ClickOnce engine in Windows used by .NET
|
||||
url.dll,c:\windows\system32\*,Internet Shortcut Shell Extension DLL.
|
||||
url.dll,c:\windows\syswow64\*,Internet Shortcut Shell Extension DLL.
|
||||
ieadvpack.dll,c:\windows\system32\*,INF installer for Internet Explorer. Has much of the same functionality as advpack.dll.
|
||||
ieadvpack.dll,c:\windows\syswow64\*,INF installer for Internet Explorer. Has much of the same functionality as advpack.dll.
|
||||
syssetup.dll,c:\windows\system32\*,Windows NT System Setup
|
||||
syssetup.dll,c:\windows\syswow64\*,Windows NT System Setup
|
||||
winrm.vbs,c:\windows\system32\*,Script used for manage Windows RM settings
|
||||
winrm.vbs,c:\windows\syswow64\*,Script used for manage Windows RM settings
|
||||
manage-bde.wsf,c:\windows\system32\*,Script for managing BitLocker
|
||||
cl_mutexverifiers.ps1,c:\windows\diagnostics\system\windowsupdate\*,Proxy execution with CL_Mutexverifiers.ps1
|
||||
cl_mutexverifiers.ps1,c:\windows\diagnostics\system\audio\*,Proxy execution with CL_Mutexverifiers.ps1
|
||||
cl_mutexverifiers.ps1,c:\windows\diagnostics\system\video\*,Proxy execution with CL_Mutexverifiers.ps1
|
||||
cl_mutexverifiers.ps1,c:\windows\diagnostics\system\speech\*,Proxy execution with CL_Mutexverifiers.ps1
|
||||
pubprn.vbs,c:\windows\system32\printing_admin_scripts\en-us\*,Proxy execution with Pubprn.vbs
|
||||
pubprn.vbs,c:\windows\syswow64\printing_admin_scripts\en-us\*,Proxy execution with Pubprn.vbs
|
||||
pester.bat,c:\program files\windowspowershell\modules\pester\3.4.0\bin\*,Used as part of the Powershell pester
|
||||
pester.bat,c:\program files\windowspowershell\modules\pester\*\bin\*,Used as part of the Powershell pester
|
||||
cl_loadassembly.ps1,c:\windows\diagnostics\system\audio\*,PowerShell Diagnostic Script
|
||||
syncappvpublishingserver.vbs,c:\windows\system32\*,Script used related to app-v and publishing server
|
||||
cl_invocation.ps1,c:\windows\diagnostics\system\aero\*,Aero diagnostics script
|
||||
cl_invocation.ps1,c:\windows\diagnostics\system\audio\*,Aero diagnostics script
|
||||
cl_invocation.ps1,c:\windows\diagnostics\system\windowsupdate\*,Aero diagnostics script
|
||||
utilityfunctions.ps1,c:\windows\diagnostics\system\networking\*,PowerShell Diagnostic Script
|
||||
coregen.exe,c:\program files\microsoft silverlight\5.1.50918.0\*,"Binary coregen.exe (Microsoft CoreCLR Native Image Generator) loads exported function GetCLRRuntimeHost from coreclr.dll or from .DLL in arbitrary path. Coregen is located within ""C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\"" or another version of Silverlight. Coregen is signed by Microsoft and bundled with Microsoft Silverlight."
|
||||
coregen.exe,c:\program files (x86)\microsoft silverlight\5.1.50918.0\*,"Binary coregen.exe (Microsoft CoreCLR Native Image Generator) loads exported function GetCLRRuntimeHost from coreclr.dll or from .DLL in arbitrary path. Coregen is located within ""C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\"" or another version of Silverlight. Coregen is signed by Microsoft and bundled with Microsoft Silverlight."
|
||||
fsi.exe,c:\program files\dotnet\sdk\[sdk version]\fsharp\*,64-bit FSharp (F#) Interpreter included with Visual Studio and DotNet Core SDK.
|
||||
fsi.exe,c:\program files (x86)\microsoft visual studio\2019\professional\common7\ide\commonextensions\microsoft\fsharp\*,64-bit FSharp (F#) Interpreter included with Visual Studio and DotNet Core SDK.
|
||||
visualuiaverifynative.exe,c:\program files (x86)\windows kits\10\bin\[sdk version]\arm64\uiaverify\*,A Windows SDK binary for manual and automated testing of Microsoft UI Automation implementation and controls.
|
||||
visualuiaverifynative.exe,c:\program files (x86)\windows kits\10\bin\[sdk version]\x64\uiaverify\*,A Windows SDK binary for manual and automated testing of Microsoft UI Automation implementation and controls.
|
||||
visualuiaverifynative.exe,c:\program files (x86)\windows kits\10\bin\[sdk version]\uiaverify\*,A Windows SDK binary for manual and automated testing of Microsoft UI Automation implementation and controls.
|
||||
ntdsutil.exe,c:\windows\system32\*,Command line utility used to export Active Directory.
|
||||
sqltoolsps.exe,c:\program files (x86)\microsoft sql server\130\tools\binn\*,Tool included with Microsoft SQL that loads SQL Server cmdlts. A replacement for sqlps.exe. Successor to sqlps.exe in SQL Server 2016+.
|
||||
dump64.exe,c:\program files (x86)\microsoft visual studio\installer\feedback\*,Memory dump tool that comes with Microsoft Visual Studio
|
||||
wsl.exe,c:\windows\system32\*,Windows subsystem for Linux executable
|
||||
csi.exe,c:\program files (x86)\microsoft visual studio\2017\community\msbuild\15.0\bin\roslyn\*,Command line interface included with Visual Studio.
|
||||
csi.exe,c:\program files (x86)\microsoft web tools\packages\microsoft.net.compilers.x.y.z\tools\*,Command line interface included with Visual Studio.
|
||||
mftrace.exe,c:\program files (x86)\windows kits\10\bin\10.0.16299.0\*,Trace log generation tool for Media Foundation Tools.
|
||||
mftrace.exe,c:\program files (x86)\windows kits\10\bin\*,Trace log generation tool for Media Foundation Tools.
|
||||
adplus.exe,c:\program files (x86)\windows kits\10\debuggers\x64\*,Debugging tool included with Windows Debugging Tools
|
||||
adplus.exe,c:\program files (x86)\windows kits\10\debuggers\x86\*,Debugging tool included with Windows Debugging Tools
|
||||
excel.exe,c:\program files (x86)\microsoft office 16\clientx86\root\office16\*,Microsoft Office binary
|
||||
excel.exe,c:\program files\microsoft office 16\clientx64\root\office16\*,Microsoft Office binary
|
||||
excel.exe,c:\program files (x86)\microsoft office\office16\*,Microsoft Office binary
|
||||
excel.exe,c:\program files\microsoft office\office16\*,Microsoft Office binary
|
||||
excel.exe,c:\program files (x86)\microsoft office 15\clientx86\root\office15\*,Microsoft Office binary
|
||||
excel.exe,c:\program files\microsoft office 15\clientx64\root\office15\*,Microsoft Office binary
|
||||
excel.exe,c:\program files (x86)\microsoft office\office15\*,Microsoft Office binary
|
||||
excel.exe,c:\program files\microsoft office\office15\*,Microsoft Office binary
|
||||
excel.exe,c:\program files (x86)\microsoft office 14\clientx86\root\office14\*,Microsoft Office binary
|
||||
excel.exe,c:\program files\microsoft office 14\clientx64\root\office14\*,Microsoft Office binary
|
||||
excel.exe,c:\program files (x86)\microsoft office\office14\*,Microsoft Office binary
|
||||
excel.exe,c:\program files\microsoft office\office14\*,Microsoft Office binary
|
||||
excel.exe,c:\program files (x86)\microsoft office\office12\*,Microsoft Office binary
|
||||
excel.exe,c:\program files\microsoft office\office12\*,Microsoft Office binary
|
||||
dotnet.exe,c:\program files\dotnet\*,dotnet.exe comes with .NET Framework
|
||||
sqlps.exe,c:\program files (x86)\microsoft sql server\100\tools\binn\*,"Tool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are Powershell version 4. Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons."
|
||||
sqlps.exe,c:\program files (x86)\microsoft sql server\110\tools\binn\*,"Tool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are Powershell version 4. Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons."
|
||||
sqlps.exe,c:\program files (x86)\microsoft sql server\120\tools\binn\*,"Tool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are Powershell version 4. Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons."
|
||||
sqlps.exe,c:\program files (x86)\microsoft sql server\130\tools\binn\*,"Tool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are Powershell version 4. Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons."
|
||||
sqlps.exe,c:\program files (x86)\microsoft sql server\150\tools\binn\*,"Tool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are Powershell version 4. Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons."
|
||||
acccheckconsole.exe,c:\program files (x86)\windows kits\10\bin\10.0.22000.0\x86\accchecker\*,Verifies UI accessibility requirements
|
||||
acccheckconsole.exe,c:\program files (x86)\windows kits\10\bin\10.0.22000.0\x64\accchecker\*,Verifies UI accessibility requirements
|
||||
acccheckconsole.exe,c:\program files (x86)\windows kits\10\bin\10.0.22000.0\arm\accchecker\*,Verifies UI accessibility requirements
|
||||
acccheckconsole.exe,c:\program files (x86)\windows kits\10\bin\10.0.22000.0\arm64\accchecker\*,Verifies UI accessibility requirements
|
||||
powerpnt.exe,c:\program files (x86)\microsoft office 16\clientx86\root\office16\*,Microsoft Office binary.
|
||||
powerpnt.exe,c:\program files\microsoft office 16\clientx64\root\office16\*,Microsoft Office binary.
|
||||
powerpnt.exe,c:\program files (x86)\microsoft office\office16\*,Microsoft Office binary.
|
||||
powerpnt.exe,c:\program files\microsoft office\office16\*,Microsoft Office binary.
|
||||
powerpnt.exe,c:\program files (x86)\microsoft office 15\clientx86\root\office15\*,Microsoft Office binary.
|
||||
powerpnt.exe,c:\program files\microsoft office 15\clientx64\root\office15\*,Microsoft Office binary.
|
||||
powerpnt.exe,c:\program files (x86)\microsoft office\office15\*,Microsoft Office binary.
|
||||
powerpnt.exe,c:\program files\microsoft office\office15\*,Microsoft Office binary.
|
||||
powerpnt.exe,c:\program files (x86)\microsoft office 14\clientx86\root\office14\*,Microsoft Office binary.
|
||||
powerpnt.exe,c:\program files\microsoft office 14\clientx64\root\office14\*,Microsoft Office binary.
|
||||
powerpnt.exe,c:\program files (x86)\microsoft office\office14\*,Microsoft Office binary.
|
||||
powerpnt.exe,c:\program files\microsoft office\office14\*,Microsoft Office binary.
|
||||
powerpnt.exe,c:\program files (x86)\microsoft office\office12\*,Microsoft Office binary.
|
||||
powerpnt.exe,c:\program files\microsoft office\office12\*,Microsoft Office binary.
|
||||
sqldumper.exe,c:\program files\microsoft sql server\90\shared\*,Debugging utility included with Microsoft SQL.
|
||||
sqldumper.exe,c:\program files (x86)\microsoft office\root\vfs\programfilesx86\microsoft analysis\as oledb\140\*,Debugging utility included with Microsoft SQL.
|
||||
remote.exe,c:\program files (x86)\windows kits\10\debuggers\x64\*,Debugging tool included with Windows Debugging Tools
|
||||
remote.exe,c:\program files (x86)\windows kits\10\debuggers\x86\*,Debugging tool included with Windows Debugging Tools
|
||||
appvlp.exe,c:\program files\microsoft office\root\client\*,Application Virtualization Utility Included with Microsoft Office 2016
|
||||
appvlp.exe,c:\program files (x86)\microsoft office\root\client\*,Application Virtualization Utility Included with Microsoft Office 2016
|
||||
agentexecutor.exe,c:\program files (x86)\*,Intune Management Extension included on Intune Managed Devices
|
||||
dxcap.exe,c:\windows\system32\*,DirectX diagnostics/debugger included with Visual Studio.
|
||||
dxcap.exe,c:\windows\syswow64\*,DirectX diagnostics/debugger included with Visual Studio.
|
||||
cdb.exe,c:\program files (x86)\windows kits\10\debuggers\x64\*,Debugging tool included with Windows Debugging Tools.
|
||||
cdb.exe,c:\program files (x86)\windows kits\10\debuggers\x86\*,Debugging tool included with Windows Debugging Tools.
|
||||
defaultpack.exe,c:\program files (x86)\microsoft\defaultpack\*,This binary can be downloaded along side multiple software downloads on the microsoft website. It gets downloaded when the user forgets to uncheck the option to set Bing as the default search provider.
|
||||
devtoolslauncher.exe,c:\windows\system32\*,Binary will execute specified binary. Part of VS/VScode installation.
|
||||
vsiisexelauncher.exe,c:\program files (x86)\microsoft visual studio\2019\community\common7\ide\extensions\microsoft\web tools\projectsystem\*,Binary will execute specified binary. Part of VS/VScode installation.
|
||||
winword.exe,c:\program files\microsoft office\root\office16\*,Microsoft Office binary
|
||||
winword.exe,c:\program files (x86)\microsoft office 16\clientx86\root\office16\*,Microsoft Office binary
|
||||
winword.exe,c:\program files\microsoft office 16\clientx64\root\office16\*,Microsoft Office binary
|
||||
winword.exe,c:\program files (x86)\microsoft office\office16\*,Microsoft Office binary
|
||||
winword.exe,c:\program files\microsoft office\office16\*,Microsoft Office binary
|
||||
winword.exe,c:\program files (x86)\microsoft office 15\clientx86\root\office15\*,Microsoft Office binary
|
||||
winword.exe,c:\program files\microsoft office 15\clientx64\root\office15\*,Microsoft Office binary
|
||||
winword.exe,c:\program files (x86)\microsoft office\office15\*,Microsoft Office binary
|
||||
winword.exe,c:\program files\microsoft office\office15\*,Microsoft Office binary
|
||||
winword.exe,c:\program files (x86)\microsoft office 14\clientx86\root\office14\*,Microsoft Office binary
|
||||
winword.exe,c:\program files\microsoft office 14\clientx64\root\office14\*,Microsoft Office binary
|
||||
winword.exe,c:\program files (x86)\microsoft office\office14\*,Microsoft Office binary
|
||||
winword.exe,c:\program files\microsoft office\office14\*,Microsoft Office binary
|
||||
winword.exe,c:\program files (x86)\microsoft office\office12\*,Microsoft Office binary
|
||||
winword.exe,c:\program files\microsoft office\office12\*,Microsoft Office binary
|
||||
fsianycpu.exe,c:\program files (x86)\microsoft visual studio\2019\professional\common7\ide\commonextensions\microsoft\fsharp\*,32/64-bit FSharp (F#) Interpreter included with Visual Studio.
|
||||
vsjitdebugger.exe,c:\windows\system32\*,Just-In-Time (JIT) debugger included with Visual Studio
|
||||
wfc.exe,c:\program files (x86)\microsoft sdks\windows\v10.0a\bin\netfx 4.8 tools\*,The Workflow Command-line Compiler tool is included with the Windows Software Development Kit (SDK).
|
||||
msdeploy.exe,c:\program files (x86)\iis\microsoft web deploy v3\*,Microsoft tool used to deploy Web Applications.
|
||||
|
@@ -0,0 +1,15 @@
|
||||
name: Windows Rename System Utilities Acccheckconsole exe LOLBAS in Non Standard Path
|
||||
Unit Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Acccheckconsole exe LOLBAS in Non Standard
|
||||
Path
|
||||
file: endpoint/ssa___acccheckconsole_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Acccheckconsole exe LOLBAS in
|
||||
Non Standard Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___acccheckconsole_exe.yml
|
||||
@@ -0,0 +1,78 @@
|
||||
name: Windows Rename System Utilities Acccheckconsole exe LOLBAS in Non Standard Path
|
||||
id: c842931e-661f-42bc-a4df-0460d93cfb69
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies AccCheckConsole.exe which is a native
|
||||
living off the land binary or script (LOLBAS) within the Windows operating system
|
||||
that may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="acccheckconsole.exe"| where process_path
|
||||
IS NOT NULL AND match_regex(process_path, /(?i)\\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker/)=false
|
||||
| eval start_time=timestamp,end_time=timestamp, entities=mvappend(device, user),
|
||||
body=create_map(["event_id", event_id, "process_path", process_path, "process_name",
|
||||
process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,14 @@
|
||||
name: Windows Rename System Utilities Adplus exe LOLBAS in Non Standard Path Unit
|
||||
Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Adplus exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___adplus_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Adplus exe LOLBAS in Non Standard
|
||||
Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___adplus_exe.yml
|
||||
@@ -0,0 +1,78 @@
|
||||
name: Windows Rename System Utilities Adplus exe LOLBAS in Non Standard Path
|
||||
id: ecaaf956-c516-4980-b08e-8c01c19614ca
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies adplus.exe which is a native living
|
||||
off the land binary or script (LOLBAS) within the Windows operating system that
|
||||
may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="adplus.exe"| where process_path IS NOT
|
||||
NULL AND match_regex(process_path, /(?i)\\program files (x86)\\windows kits\\10\\debuggers\\x86/)=false
|
||||
| eval start_time=timestamp,end_time=timestamp, entities=mvappend(device, user),
|
||||
body=create_map(["event_id", event_id, "process_path", process_path, "process_name",
|
||||
process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,14 @@
|
||||
name: Windows Rename System Utilities Advpack dll LOLBAS in Non Standard Path Unit
|
||||
Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Advpack dll LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___advpack_dll.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Advpack dll LOLBAS in Non Standard
|
||||
Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___advpack_dll.yml
|
||||
@@ -0,0 +1,77 @@
|
||||
name: Windows Rename System Utilities Advpack dll LOLBAS in Non Standard Path
|
||||
id: 3284e4f4-67f7-49b6-ad5e-a8fcead2eef8
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies Advpack.dll which is a native living
|
||||
off the land binary or script (LOLBAS) within the Windows operating system that
|
||||
may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="advpack.dll"| where process_path IS NOT
|
||||
NULL AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,end_time=timestamp,
|
||||
entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path",
|
||||
process_path, "process_name", process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,14 @@
|
||||
name: Windows Rename System Utilities Agentexecutor exe LOLBAS in Non Standard Path
|
||||
Unit Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Agentexecutor exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___agentexecutor_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Agentexecutor exe LOLBAS in
|
||||
Non Standard Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___agentexecutor_exe.yml
|
||||
@@ -0,0 +1,77 @@
|
||||
name: Windows Rename System Utilities Agentexecutor exe LOLBAS in Non Standard Path
|
||||
id: e124f71f-11bc-47e4-9931-6046d256005d
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies AgentExecutor.exe which is a native
|
||||
living off the land binary or script (LOLBAS) within the Windows operating system
|
||||
that may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="agentexecutor.exe"| where process_path
|
||||
IS NOT NULL AND match_regex(process_path, /(?i)\\program files (x86)/)=false | eval
|
||||
start_time=timestamp,end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id",
|
||||
event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,14 @@
|
||||
name: Windows Rename System Utilities Appinstaller exe LOLBAS in Non Standard Path
|
||||
Unit Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Appinstaller exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___appinstaller_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Appinstaller exe LOLBAS in Non
|
||||
Standard Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___appinstaller_exe.yml
|
||||
@@ -0,0 +1,78 @@
|
||||
name: Windows Rename System Utilities Appinstaller exe LOLBAS in Non Standard Path
|
||||
id: 057c06c7-ef31-4749-b5c9-199152e53a06
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies AppInstaller.exe which is a native
|
||||
living off the land binary or script (LOLBAS) within the Windows operating system
|
||||
that may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="appinstaller.exe"| where process_path
|
||||
IS NOT NULL AND match_regex(process_path, /(?i)\\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe/)=false
|
||||
| eval start_time=timestamp,end_time=timestamp, entities=mvappend(device, user),
|
||||
body=create_map(["event_id", event_id, "process_path", process_path, "process_name",
|
||||
process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,14 @@
|
||||
name: Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard Path Unit
|
||||
Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___appvlp_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard
|
||||
Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___appvlp_exe.yml
|
||||
@@ -0,0 +1,78 @@
|
||||
name: Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard Path
|
||||
id: 93862a89-abe0-4094-909a-08ec390aa5e3
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies Appvlp.exe which is a native living
|
||||
off the land binary or script (LOLBAS) within the Windows operating system that
|
||||
may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="appvlp.exe"| where process_path IS NOT
|
||||
NULL AND match_regex(process_path, /(?i)\\program files (x86)\\microsoft office\\root\\client/)=false
|
||||
| eval start_time=timestamp,end_time=timestamp, entities=mvappend(device, user),
|
||||
body=create_map(["event_id", event_id, "process_path", process_path, "process_name",
|
||||
process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,15 @@
|
||||
name: Windows Rename System Utilities Aspnet_compiler exe LOLBAS in Non Standard Path
|
||||
Unit Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Aspnet_compiler exe LOLBAS in Non Standard
|
||||
Path
|
||||
file: endpoint/ssa___aspnet_compiler_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Aspnet_compiler exe LOLBAS in
|
||||
Non Standard Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___aspnet_compiler_exe.yml
|
||||
@@ -0,0 +1,78 @@
|
||||
name: Windows Rename System Utilities Aspnet_compiler exe LOLBAS in Non Standard Path
|
||||
id: d75cc561-3828-4d0a-92c4-0eb93bfe0929
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies Aspnet_Compiler.exe which is a native
|
||||
living off the land binary or script (LOLBAS) within the Windows operating system
|
||||
that may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="aspnet_compiler.exe"| where process_path
|
||||
IS NOT NULL AND match_regex(process_path, /(?i)\\windows\\microsoft.net\\framework64\\v4.0.30319/)=false
|
||||
| eval start_time=timestamp,end_time=timestamp, entities=mvappend(device, user),
|
||||
body=create_map(["event_id", event_id, "process_path", process_path, "process_name",
|
||||
process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows Rename System Utilities At exe LOLBAS in Non Standard Path Unit Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities At exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___at_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities At exe LOLBAS in Non Standard
|
||||
Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___at_exe.yml
|
||||
@@ -0,0 +1,77 @@
|
||||
name: Windows Rename System Utilities At exe LOLBAS in Non Standard Path
|
||||
id: 6401d583-0052-4dc5-a713-68b510826d2b
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies At.exe which is a native living off
|
||||
the land binary or script (LOLBAS) within the Windows operating system that may
|
||||
be abused by adversaries by moving it to a new directory. The list of binaries was
|
||||
derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="at.exe"| where process_path IS NOT NULL
|
||||
AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,end_time=timestamp,
|
||||
entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path",
|
||||
process_path, "process_name", process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,14 @@
|
||||
name: Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard Path Unit
|
||||
Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___atbroker_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard
|
||||
Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___atbroker_exe.yml
|
||||
@@ -0,0 +1,77 @@
|
||||
name: Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard Path
|
||||
id: b8da7ea5-8c16-4eff-9787-54ec271159e0
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies Atbroker.exe which is a native living
|
||||
off the land binary or script (LOLBAS) within the Windows operating system that
|
||||
may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="atbroker.exe"| where process_path IS
|
||||
NOT NULL AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,end_time=timestamp,
|
||||
entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path",
|
||||
process_path, "process_name", process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows Rename System Utilities Bash exe LOLBAS in Non Standard Path Unit Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Bash exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___bash_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Bash exe LOLBAS in Non Standard
|
||||
Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___bash_exe.yml
|
||||
@@ -0,0 +1,77 @@
|
||||
name: Windows Rename System Utilities Bash exe LOLBAS in Non Standard Path
|
||||
id: 57bb8624-26b3-4d23-a35c-17d5b2fa03b2
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies Bash.exe which is a native living off
|
||||
the land binary or script (LOLBAS) within the Windows operating system that may
|
||||
be abused by adversaries by moving it to a new directory. The list of binaries was
|
||||
derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="bash.exe"| where process_path IS NOT
|
||||
NULL AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,end_time=timestamp,
|
||||
entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path",
|
||||
process_path, "process_name", process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,14 @@
|
||||
name: Windows Rename System Utilities Bginfo exe LOLBAS in Non Standard Path Unit
|
||||
Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Bginfo exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___bginfo_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Bginfo exe LOLBAS in Non Standard
|
||||
Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___bginfo_exe.yml
|
||||
@@ -0,0 +1,14 @@
|
||||
name: Windows Rename System Utilities Bitsadmin exe LOLBAS in Non Standard Path Unit
|
||||
Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Bitsadmin exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___bitsadmin_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Bitsadmin exe LOLBAS in Non
|
||||
Standard Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___bitsadmin_exe.yml
|
||||
@@ -0,0 +1,77 @@
|
||||
name: Windows Rename System Utilities Bitsadmin exe LOLBAS in Non Standard Path
|
||||
id: 919cfed5-71e3-4b56-8468-bfa0f8e48763
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies Bitsadmin.exe which is a native living
|
||||
off the land binary or script (LOLBAS) within the Windows operating system that
|
||||
may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="bitsadmin.exe"| where process_path IS
|
||||
NOT NULL AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,end_time=timestamp,
|
||||
entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path",
|
||||
process_path, "process_name", process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows Rename System Utilities Cdb exe LOLBAS in Non Standard Path Unit Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Cdb exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___cdb_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Cdb exe LOLBAS in Non Standard
|
||||
Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___cdb_exe.yml
|
||||
@@ -0,0 +1,78 @@
|
||||
name: Windows Rename System Utilities Cdb exe LOLBAS in Non Standard Path
|
||||
id: 438a17bb-ffad-4540-a92b-c82177b6c584
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies Cdb.exe which is a native living off
|
||||
the land binary or script (LOLBAS) within the Windows operating system that may
|
||||
be abused by adversaries by moving it to a new directory. The list of binaries was
|
||||
derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="cdb.exe"| where process_path IS NOT NULL
|
||||
AND match_regex(process_path, /(?i)\\program files (x86)\\windows kits\\10\\debuggers\\x86/)=false
|
||||
| eval start_time=timestamp,end_time=timestamp, entities=mvappend(device, user),
|
||||
body=create_map(["event_id", event_id, "process_path", process_path, "process_name",
|
||||
process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,14 @@
|
||||
name: Windows Rename System Utilities Certoc exe LOLBAS in Non Standard Path Unit
|
||||
Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Certoc exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___certoc_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Certoc exe LOLBAS in Non Standard
|
||||
Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___certoc_exe.yml
|
||||
@@ -0,0 +1,77 @@
|
||||
name: Windows Rename System Utilities Certoc exe LOLBAS in Non Standard Path
|
||||
id: 46e1d51f-2979-42e4-8397-63abb398fe71
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies CertOC.exe which is a native living
|
||||
off the land binary or script (LOLBAS) within the Windows operating system that
|
||||
may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="certoc.exe"| where process_path IS NOT
|
||||
NULL AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,end_time=timestamp,
|
||||
entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path",
|
||||
process_path, "process_name", process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,14 @@
|
||||
name: Windows Rename System Utilities Certreq exe LOLBAS in Non Standard Path Unit
|
||||
Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Certreq exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___certreq_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Certreq exe LOLBAS in Non Standard
|
||||
Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___certreq_exe.yml
|
||||
@@ -0,0 +1,77 @@
|
||||
name: Windows Rename System Utilities Certreq exe LOLBAS in Non Standard Path
|
||||
id: 3b322498-f89c-4407-a43d-3218f5debbc5
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies CertReq.exe which is a native living
|
||||
off the land binary or script (LOLBAS) within the Windows operating system that
|
||||
may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="certreq.exe"| where process_path IS NOT
|
||||
NULL AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,end_time=timestamp,
|
||||
entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path",
|
||||
process_path, "process_name", process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,14 @@
|
||||
name: Windows Rename System Utilities Certutil exe LOLBAS in Non Standard Path Unit
|
||||
Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Certutil exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___certutil_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Certutil exe LOLBAS in Non Standard
|
||||
Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___certutil_exe.yml
|
||||
@@ -0,0 +1,77 @@
|
||||
name: Windows Rename System Utilities Certutil exe LOLBAS in Non Standard Path
|
||||
id: 9de4a1d7-65bf-4a6f-b25f-c926570c6543
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies Certutil.exe which is a native living
|
||||
off the land binary or script (LOLBAS) within the Windows operating system that
|
||||
may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="certutil.exe"| where process_path IS
|
||||
NOT NULL AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,end_time=timestamp,
|
||||
entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path",
|
||||
process_path, "process_name", process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,14 @@
|
||||
name: Windows Rename System Utilities Cl_invocation ps1 LOLBAS in Non Standard Path
|
||||
Unit Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Cl_invocation ps1 LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___cl_invocation_ps1.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Cl_invocation ps1 LOLBAS in
|
||||
Non Standard Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___cl_invocation_ps1.yml
|
||||
@@ -0,0 +1,78 @@
|
||||
name: Windows Rename System Utilities Cl_invocation ps1 LOLBAS in Non Standard Path
|
||||
id: b84023f7-4fc9-429e-bb10-ab19095041f1
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies CL_Invocation.ps1 which is a native
|
||||
living off the land binary or script (LOLBAS) within the Windows operating system
|
||||
that may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="cl_invocation.ps1"| where process_path
|
||||
IS NOT NULL AND match_regex(process_path, /(?i)\\windows\\diagnostics\\system\\windowsupdate/)=false
|
||||
| eval start_time=timestamp,end_time=timestamp, entities=mvappend(device, user),
|
||||
body=create_map(["event_id", event_id, "process_path", process_path, "process_name",
|
||||
process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,15 @@
|
||||
name: Windows Rename System Utilities Cl_loadassembly ps1 LOLBAS in Non Standard Path
|
||||
Unit Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Cl_loadassembly ps1 LOLBAS in Non Standard
|
||||
Path
|
||||
file: endpoint/ssa___cl_loadassembly_ps1.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Cl_loadassembly ps1 LOLBAS in
|
||||
Non Standard Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___cl_loadassembly_ps1.yml
|
||||
@@ -0,0 +1,78 @@
|
||||
name: Windows Rename System Utilities Cl_loadassembly ps1 LOLBAS in Non Standard Path
|
||||
id: a32d2585-a516-4808-a130-92f480c55988
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies CL_LoadAssembly.ps1 which is a native
|
||||
living off the land binary or script (LOLBAS) within the Windows operating system
|
||||
that may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="cl_loadassembly.ps1"| where process_path
|
||||
IS NOT NULL AND match_regex(process_path, /(?i)\\windows\\diagnostics\\system\\audio/)=false
|
||||
| eval start_time=timestamp,end_time=timestamp, entities=mvappend(device, user),
|
||||
body=create_map(["event_id", event_id, "process_path", process_path, "process_name",
|
||||
process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,15 @@
|
||||
name: Windows Rename System Utilities Cl_mutexverifiers ps1 LOLBAS in Non Standard
|
||||
Path Unit Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Cl_mutexverifiers ps1 LOLBAS in Non Standard
|
||||
Path
|
||||
file: endpoint/ssa___cl_mutexverifiers_ps1.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Cl_mutexverifiers ps1 LOLBAS
|
||||
in Non Standard Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___cl_mutexverifiers_ps1.yml
|
||||
@@ -0,0 +1,79 @@
|
||||
name: Windows Rename System Utilities Cl_mutexverifiers ps1 LOLBAS in Non Standard
|
||||
Path
|
||||
id: 53c3b8a2-9e6c-4b34-8bf3-c76fd4fcacf3
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies CL_Mutexverifiers.ps1 which is a native
|
||||
living off the land binary or script (LOLBAS) within the Windows operating system
|
||||
that may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="cl_mutexverifiers.ps1"| where process_path
|
||||
IS NOT NULL AND match_regex(process_path, /(?i)\\windows\\diagnostics\\system\\speech/)=false
|
||||
| eval start_time=timestamp,end_time=timestamp, entities=mvappend(device, user),
|
||||
body=create_map(["event_id", event_id, "process_path", process_path, "process_name",
|
||||
process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows Rename System Utilities Cmd exe LOLBAS in Non Standard Path Unit Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Cmd exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___cmd_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Cmd exe LOLBAS in Non Standard
|
||||
Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___cmd_exe.yml
|
||||
@@ -0,0 +1,77 @@
|
||||
name: Windows Rename System Utilities Cmd exe LOLBAS in Non Standard Path
|
||||
id: 90784ffc-3576-45d7-bb16-d62f6120c4e5
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies Cmd.exe which is a native living off
|
||||
the land binary or script (LOLBAS) within the Windows operating system that may
|
||||
be abused by adversaries by moving it to a new directory. The list of binaries was
|
||||
derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="cmd.exe"| where process_path IS NOT NULL
|
||||
AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,end_time=timestamp,
|
||||
entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path",
|
||||
process_path, "process_name", process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,14 @@
|
||||
name: Windows Rename System Utilities Cmdkey exe LOLBAS in Non Standard Path Unit
|
||||
Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Cmdkey exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___cmdkey_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Cmdkey exe LOLBAS in Non Standard
|
||||
Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___cmdkey_exe.yml
|
||||
@@ -0,0 +1,77 @@
|
||||
name: Windows Rename System Utilities Cmdkey exe LOLBAS in Non Standard Path
|
||||
id: 304b4002-dfad-422e-93b7-bb6e9a490513
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies Cmdkey.exe which is a native living
|
||||
off the land binary or script (LOLBAS) within the Windows operating system that
|
||||
may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="cmdkey.exe"| where process_path IS NOT
|
||||
NULL AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,end_time=timestamp,
|
||||
entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path",
|
||||
process_path, "process_name", process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,14 @@
|
||||
name: Windows Rename System Utilities Cmdl32 exe LOLBAS in Non Standard Path Unit
|
||||
Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Cmdl32 exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___cmdl32_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Cmdl32 exe LOLBAS in Non Standard
|
||||
Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___cmdl32_exe.yml
|
||||
@@ -0,0 +1,77 @@
|
||||
name: Windows Rename System Utilities Cmdl32 exe LOLBAS in Non Standard Path
|
||||
id: 10de5e76-a676-4149-a949-1132b117a11a
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies cmdl32.exe which is a native living
|
||||
off the land binary or script (LOLBAS) within the Windows operating system that
|
||||
may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="cmdl32.exe"| where process_path IS NOT
|
||||
NULL AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,end_time=timestamp,
|
||||
entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path",
|
||||
process_path, "process_name", process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows Rename System Utilities Cmstp exe LOLBAS in Non Standard Path Unit Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Cmstp exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___cmstp_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Cmstp exe LOLBAS in Non Standard
|
||||
Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___cmstp_exe.yml
|
||||
@@ -0,0 +1,77 @@
|
||||
name: Windows Rename System Utilities Cmstp exe LOLBAS in Non Standard Path
|
||||
id: c7cb13df-b234-4654-86c6-9a35c930de42
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies Cmstp.exe which is a native living
|
||||
off the land binary or script (LOLBAS) within the Windows operating system that
|
||||
may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="cmstp.exe"| where process_path IS NOT
|
||||
NULL AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,end_time=timestamp,
|
||||
entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path",
|
||||
process_path, "process_name", process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,14 @@
|
||||
name: Windows Rename System Utilities Comsvcs dll LOLBAS in Non Standard Path Unit
|
||||
Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Comsvcs dll LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___comsvcs_dll.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Comsvcs dll LOLBAS in Non Standard
|
||||
Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___comsvcs_dll.yml
|
||||
@@ -0,0 +1,77 @@
|
||||
name: Windows Rename System Utilities Comsvcs dll LOLBAS in Non Standard Path
|
||||
id: 3b4d71e9-ceb0-48ea-b1c1-a62dd66b9f66
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies Comsvcs.dll which is a native living
|
||||
off the land binary or script (LOLBAS) within the Windows operating system that
|
||||
may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="comsvcs.dll"| where process_path IS NOT
|
||||
NULL AND match_regex(process_path, /(?i)\\windows\\system32/)=false | eval start_time=timestamp,end_time=timestamp,
|
||||
entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path",
|
||||
process_path, "process_name", process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,15 @@
|
||||
name: Windows Rename System Utilities Configsecuritypolicy exe LOLBAS in Non Standard
|
||||
Path Unit Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Configsecuritypolicy exe LOLBAS in Non Standard
|
||||
Path
|
||||
file: endpoint/ssa___configsecuritypolicy_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Configsecuritypolicy exe LOLBAS
|
||||
in Non Standard Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___configsecuritypolicy_exe.yml
|
||||
@@ -0,0 +1,79 @@
|
||||
name: Windows Rename System Utilities Configsecuritypolicy exe LOLBAS in Non Standard
|
||||
Path
|
||||
id: 2212344c-5a19-4907-b561-b91832c54fa8
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies ConfigSecurityPolicy.exe which is a
|
||||
native living off the land binary or script (LOLBAS) within the Windows operating
|
||||
system that may be abused by adversaries by moving it to a new directory. The list
|
||||
of binaries was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="configsecuritypolicy.exe"| where process_path
|
||||
IS NOT NULL AND match_regex(process_path, /(?i)\\programdata\\microsoft\\windows
|
||||
defender\\platform\\4.18.2008.9-0/)=false | eval start_time=timestamp,end_time=timestamp,
|
||||
entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path",
|
||||
process_path, "process_name", process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,14 @@
|
||||
name: Windows Rename System Utilities Conhost exe LOLBAS in Non Standard Path Unit
|
||||
Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Conhost exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___conhost_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Conhost exe LOLBAS in Non Standard
|
||||
Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___conhost_exe.yml
|
||||
@@ -0,0 +1,77 @@
|
||||
name: Windows Rename System Utilities Conhost exe LOLBAS in Non Standard Path
|
||||
id: d1c99845-9762-4da4-b30e-7fbf05304baf
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies Conhost.exe which is a native living
|
||||
off the land binary or script (LOLBAS) within the Windows operating system that
|
||||
may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="conhost.exe"| where process_path IS NOT
|
||||
NULL AND match_regex(process_path, /(?i)\\windows\\system32/)=false | eval start_time=timestamp,end_time=timestamp,
|
||||
entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path",
|
||||
process_path, "process_name", process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,14 @@
|
||||
name: Windows Rename System Utilities Control exe LOLBAS in Non Standard Path Unit
|
||||
Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Control exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___control_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Control exe LOLBAS in Non Standard
|
||||
Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___control_exe.yml
|
||||
@@ -0,0 +1,77 @@
|
||||
name: Windows Rename System Utilities Control exe LOLBAS in Non Standard Path
|
||||
id: 8f4b0432-e5cd-434e-a87d-bffa2e936adb
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies Control.exe which is a native living
|
||||
off the land binary or script (LOLBAS) within the Windows operating system that
|
||||
may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="control.exe"| where process_path IS NOT
|
||||
NULL AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,end_time=timestamp,
|
||||
entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path",
|
||||
process_path, "process_name", process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,14 @@
|
||||
name: Windows Rename System Utilities Coregen exe LOLBAS in Non Standard Path Unit
|
||||
Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Coregen exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___coregen_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Coregen exe LOLBAS in Non Standard
|
||||
Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___coregen_exe.yml
|
||||
@@ -0,0 +1,78 @@
|
||||
name: Windows Rename System Utilities Coregen exe LOLBAS in Non Standard Path
|
||||
id: 5964991e-0c6e-4fb1-b9f3-acae15fd9858
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies coregen.exe which is a native living
|
||||
off the land binary or script (LOLBAS) within the Windows operating system that
|
||||
may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="coregen.exe"| where process_path IS NOT
|
||||
NULL AND match_regex(process_path, /(?i)\\program files (x86)\\microsoft silverlight\\5.1.50918.0/)=false
|
||||
| eval start_time=timestamp,end_time=timestamp, entities=mvappend(device, user),
|
||||
body=create_map(["event_id", event_id, "process_path", process_path, "process_name",
|
||||
process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,14 @@
|
||||
name: Windows Rename System Utilities Createdump exe LOLBAS in Non Standard Path Unit
|
||||
Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Createdump exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___createdump_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Createdump exe LOLBAS in Non
|
||||
Standard Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___createdump_exe.yml
|
||||
@@ -0,0 +1,78 @@
|
||||
name: Windows Rename System Utilities Createdump exe LOLBAS in Non Standard Path
|
||||
id: 65a8c727-c955-4b50-8504-92b66222b06b
|
||||
version: 1
|
||||
date: '2022-10-17'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies Createdump.exe which is a native living
|
||||
off the land binary or script (LOLBAS) within the Windows operating system that
|
||||
may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="createdump.exe"| where process_path IS
|
||||
NOT NULL AND match_regex(process_path, /(?i)\\program files\\dotnet\\shared\\microsoft.netcore.app\\*/)=false
|
||||
| eval start_time=timestamp,end_time=timestamp, entities=mvappend(device, user),
|
||||
body=create_map(["event_id", event_id, "process_path", process_path, "process_name",
|
||||
process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows Rename System Utilities Csc exe LOLBAS in Non Standard Path Unit Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Csc exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___csc_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Csc exe LOLBAS in Non Standard
|
||||
Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___csc_exe.yml
|
||||
@@ -0,0 +1,78 @@
|
||||
name: Windows Rename System Utilities Csc exe LOLBAS in Non Standard Path
|
||||
id: ea783c88-d20f-461b-a295-cf1a87bd8502
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies Csc.exe which is a native living off
|
||||
the land binary or script (LOLBAS) within the Windows operating system that may
|
||||
be abused by adversaries by moving it to a new directory. The list of binaries was
|
||||
derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="csc.exe"| where process_path IS NOT NULL
|
||||
AND match_regex(process_path, /(?i)\\windows\\microsoft.net\\framework64\\v4.0.30319/)=false
|
||||
| eval start_time=timestamp,end_time=timestamp, entities=mvappend(device, user),
|
||||
body=create_map(["event_id", event_id, "process_path", process_path, "process_name",
|
||||
process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,14 @@
|
||||
name: Windows Rename System Utilities Cscript exe LOLBAS in Non Standard Path Unit
|
||||
Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Cscript exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___cscript_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Cscript exe LOLBAS in Non Standard
|
||||
Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___cscript_exe.yml
|
||||
@@ -0,0 +1,77 @@
|
||||
name: Windows Rename System Utilities Cscript exe LOLBAS in Non Standard Path
|
||||
id: dfcc58d1-4f59-42a6-85f9-7ea2085ae8fe
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies Cscript.exe which is a native living
|
||||
off the land binary or script (LOLBAS) within the Windows operating system that
|
||||
may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="cscript.exe"| where process_path IS NOT
|
||||
NULL AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,end_time=timestamp,
|
||||
entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path",
|
||||
process_path, "process_name", process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows Rename System Utilities Csi exe LOLBAS in Non Standard Path Unit Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Csi exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___csi_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Csi exe LOLBAS in Non Standard
|
||||
Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___csi_exe.yml
|
||||
@@ -0,0 +1,78 @@
|
||||
name: Windows Rename System Utilities Csi exe LOLBAS in Non Standard Path
|
||||
id: 5258b32a-b811-4323-9e98-4701b8a6295c
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies csi.exe which is a native living off
|
||||
the land binary or script (LOLBAS) within the Windows operating system that may
|
||||
be abused by adversaries by moving it to a new directory. The list of binaries was
|
||||
derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="csi.exe"| where process_path IS NOT NULL
|
||||
AND match_regex(process_path, /(?i)\\program files (x86)\\microsoft web tools\\packages\\microsoft.net.compilers.x.y.z\\tools/)=false
|
||||
| eval start_time=timestamp,end_time=timestamp, entities=mvappend(device, user),
|
||||
body=create_map(["event_id", event_id, "process_path", process_path, "process_name",
|
||||
process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,15 @@
|
||||
name: Windows Rename System Utilities Customshellhost exe LOLBAS in Non Standard Path
|
||||
Unit Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Customshellhost exe LOLBAS in Non Standard
|
||||
Path
|
||||
file: endpoint/ssa___customshellhost_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Customshellhost exe LOLBAS in
|
||||
Non Standard Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___customshellhost_exe.yml
|
||||
@@ -0,0 +1,77 @@
|
||||
name: Windows Rename System Utilities Customshellhost exe LOLBAS in Non Standard Path
|
||||
id: 500eae11-d88a-4e2f-ac87-a2ed5d3dd292
|
||||
version: 1
|
||||
date: '2022-10-17'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies CustomShellHost.exe which is a native
|
||||
living off the land binary or script (LOLBAS) within the Windows operating system
|
||||
that may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="customshellhost.exe"| where process_path
|
||||
IS NOT NULL AND match_regex(process_path, /(?i)\\windows\\system32/)=false | eval
|
||||
start_time=timestamp,end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id",
|
||||
event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,14 @@
|
||||
name: Windows Rename System Utilities Datasvcutil exe LOLBAS in Non Standard Path
|
||||
Unit Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Datasvcutil exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___datasvcutil_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Datasvcutil exe LOLBAS in Non
|
||||
Standard Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___datasvcutil_exe.yml
|
||||
@@ -0,0 +1,78 @@
|
||||
name: Windows Rename System Utilities Datasvcutil exe LOLBAS in Non Standard Path
|
||||
id: cf1686f6-516f-4e58-ae86-524e162def2f
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies DataSvcUtil.exe which is a native living
|
||||
off the land binary or script (LOLBAS) within the Windows operating system that
|
||||
may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="datasvcutil.exe"| where process_path
|
||||
IS NOT NULL AND match_regex(process_path, /(?i)\\windows\\microsoft.net\\framework64\\v3.5/)=false
|
||||
| eval start_time=timestamp,end_time=timestamp, entities=mvappend(device, user),
|
||||
body=create_map(["event_id", event_id, "process_path", process_path, "process_name",
|
||||
process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,14 @@
|
||||
name: Windows Rename System Utilities Defaultpack exe LOLBAS in Non Standard Path
|
||||
Unit Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Defaultpack exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___defaultpack_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Defaultpack exe LOLBAS in Non
|
||||
Standard Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___defaultpack_exe.yml
|
||||
@@ -0,0 +1,78 @@
|
||||
name: Windows Rename System Utilities Defaultpack exe LOLBAS in Non Standard Path
|
||||
id: 640aa341-73f5-4958-8d44-7d4171af8862
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies DefaultPack.EXE which is a native living
|
||||
off the land binary or script (LOLBAS) within the Windows operating system that
|
||||
may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="defaultpack.exe"| where process_path
|
||||
IS NOT NULL AND match_regex(process_path, /(?i)\\program files (x86)\\microsoft\\defaultpack/)=false
|
||||
| eval start_time=timestamp,end_time=timestamp, entities=mvappend(device, user),
|
||||
body=create_map(["event_id", event_id, "process_path", process_path, "process_name",
|
||||
process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows Rename System Utilities Desk cpl LOLBAS in Non Standard Path Unit Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Desk cpl LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___desk_cpl.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Desk cpl LOLBAS in Non Standard
|
||||
Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___desk_cpl.yml
|
||||
@@ -0,0 +1,77 @@
|
||||
name: Windows Rename System Utilities Desk cpl LOLBAS in Non Standard Path
|
||||
id: 7f6caf3f-0f0f-4c3e-ba8b-04664bc12771
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies Desk.cpl which is a native living off
|
||||
the land binary or script (LOLBAS) within the Windows operating system that may
|
||||
be abused by adversaries by moving it to a new directory. The list of binaries was
|
||||
derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="desk.cpl"| where process_path IS NOT
|
||||
NULL AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,end_time=timestamp,
|
||||
entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path",
|
||||
process_path, "process_name", process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,15 @@
|
||||
name: Windows Rename System Utilities Desktopimgdownldr exe LOLBAS in Non Standard
|
||||
Path Unit Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Desktopimgdownldr exe LOLBAS in Non Standard
|
||||
Path
|
||||
file: endpoint/ssa___desktopimgdownldr_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Desktopimgdownldr exe LOLBAS
|
||||
in Non Standard Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___desktopimgdownldr_exe.yml
|
||||
@@ -0,0 +1,78 @@
|
||||
name: Windows Rename System Utilities Desktopimgdownldr exe LOLBAS in Non Standard
|
||||
Path
|
||||
id: c9f3d074-f077-4d98-9eec-f9e3629e5e58
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies Desktopimgdownldr.exe which is a native
|
||||
living off the land binary or script (LOLBAS) within the Windows operating system
|
||||
that may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="desktopimgdownldr.exe"| where process_path
|
||||
IS NOT NULL AND match_regex(process_path, /(?i)\\windows\\system32/)=false | eval
|
||||
start_time=timestamp,end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id",
|
||||
event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,15 @@
|
||||
name: Windows Rename System Utilities Devicecredentialdeployment exe LOLBAS in Non
|
||||
Standard Path Unit Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Devicecredentialdeployment exe LOLBAS in Non
|
||||
Standard Path
|
||||
file: endpoint/ssa___devicecredentialdeployment_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Devicecredentialdeployment exe
|
||||
LOLBAS in Non Standard Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___devicecredentialdeployment_exe.yml
|
||||
@@ -0,0 +1,79 @@
|
||||
name: Windows Rename System Utilities Devicecredentialdeployment exe LOLBAS in Non
|
||||
Standard Path
|
||||
id: a00a1c2a-8512-4c29-8e88-01d45b259755
|
||||
version: 1
|
||||
date: '2022-10-17'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies DeviceCredentialDeployment.exe which
|
||||
is a native living off the land binary or script (LOLBAS) within the Windows operating
|
||||
system that may be abused by adversaries by moving it to a new directory. The list
|
||||
of binaries was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="devicecredentialdeployment.exe"| where
|
||||
process_path IS NOT NULL AND match_regex(process_path, /(?i)\\windows\\system32/)=false
|
||||
| eval start_time=timestamp,end_time=timestamp, entities=mvappend(device, user),
|
||||
body=create_map(["event_id", event_id, "process_path", process_path, "process_name",
|
||||
process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,15 @@
|
||||
name: Windows Rename System Utilities Devtoolslauncher exe LOLBAS in Non Standard
|
||||
Path Unit Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Devtoolslauncher exe LOLBAS in Non Standard
|
||||
Path
|
||||
file: endpoint/ssa___devtoolslauncher_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Devtoolslauncher exe LOLBAS
|
||||
in Non Standard Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___devtoolslauncher_exe.yml
|
||||
@@ -0,0 +1,78 @@
|
||||
name: Windows Rename System Utilities Devtoolslauncher exe LOLBAS in Non Standard
|
||||
Path
|
||||
id: 989eef3d-36d4-4b83-a004-94f7f171e529
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies Devtoolslauncher.exe which is a native
|
||||
living off the land binary or script (LOLBAS) within the Windows operating system
|
||||
that may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="devtoolslauncher.exe"| where process_path
|
||||
IS NOT NULL AND match_regex(process_path, /(?i)\\windows\\system32/)=false | eval
|
||||
start_time=timestamp,end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id",
|
||||
event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,14 @@
|
||||
name: Windows Rename System Utilities Dfshim dll LOLBAS in Non Standard Path Unit
|
||||
Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Dfshim dll LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___dfshim_dll.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Dfshim dll LOLBAS in Non Standard
|
||||
Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___dfshim_dll.yml
|
||||
@@ -0,0 +1,78 @@
|
||||
name: Windows Rename System Utilities Dfshim dll LOLBAS in Non Standard Path
|
||||
id: 2615f2e9-0f34-4106-b649-7a5ff5644f9f
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies Dfshim.dll which is a native living
|
||||
off the land binary or script (LOLBAS) within the Windows operating system that
|
||||
may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="dfshim.dll"| where process_path IS NOT
|
||||
NULL AND match_regex(process_path, /(?i)\\windows\\microsoft.net\\framework64\\v4.0.30319/)=false
|
||||
| eval start_time=timestamp,end_time=timestamp, entities=mvappend(device, user),
|
||||
body=create_map(["event_id", event_id, "process_path", process_path, "process_name",
|
||||
process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows Rename System Utilities Dfsvc exe LOLBAS in Non Standard Path Unit Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Dfsvc exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___dfsvc_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Dfsvc exe LOLBAS in Non Standard
|
||||
Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___dfsvc_exe.yml
|
||||
@@ -0,0 +1,78 @@
|
||||
name: Windows Rename System Utilities Dfsvc exe LOLBAS in Non Standard Path
|
||||
id: 0bf3fa5b-e25a-476b-8474-61ad82e4d82c
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies Dfsvc.exe which is a native living
|
||||
off the land binary or script (LOLBAS) within the Windows operating system that
|
||||
may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="dfsvc.exe"| where process_path IS NOT
|
||||
NULL AND match_regex(process_path, /(?i)\\windows\\microsoft.net\\framework64\\v4.0.30319/)=false
|
||||
| eval start_time=timestamp,end_time=timestamp, entities=mvappend(device, user),
|
||||
body=create_map(["event_id", event_id, "process_path", process_path, "process_name",
|
||||
process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,14 @@
|
||||
name: Windows Rename System Utilities Diantz exe LOLBAS in Non Standard Path Unit
|
||||
Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Diantz exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___diantz_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Diantz exe LOLBAS in Non Standard
|
||||
Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___diantz_exe.yml
|
||||
@@ -0,0 +1,77 @@
|
||||
name: Windows Rename System Utilities Diantz exe LOLBAS in Non Standard Path
|
||||
id: 09bcd983-9735-45e7-9bdd-a78f4557954d
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies Diantz.exe which is a native living
|
||||
off the land binary or script (LOLBAS) within the Windows operating system that
|
||||
may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="diantz.exe"| where process_path IS NOT
|
||||
NULL AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,end_time=timestamp,
|
||||
entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path",
|
||||
process_path, "process_name", process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,14 @@
|
||||
name: Windows Rename System Utilities Diskshadow exe LOLBAS in Non Standard Path Unit
|
||||
Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Diskshadow exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___diskshadow_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Diskshadow exe LOLBAS in Non
|
||||
Standard Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___diskshadow_exe.yml
|
||||
@@ -0,0 +1,77 @@
|
||||
name: Windows Rename System Utilities Diskshadow exe LOLBAS in Non Standard Path
|
||||
id: 38ce0449-88f2-47c6-b6bd-0619f674a33d
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies Diskshadow.exe which is a native living
|
||||
off the land binary or script (LOLBAS) within the Windows operating system that
|
||||
may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="diskshadow.exe"| where process_path IS
|
||||
NOT NULL AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,end_time=timestamp,
|
||||
entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path",
|
||||
process_path, "process_name", process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,14 @@
|
||||
name: Windows Rename System Utilities Dnscmd exe LOLBAS in Non Standard Path Unit
|
||||
Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Dnscmd exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___dnscmd_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Dnscmd exe LOLBAS in Non Standard
|
||||
Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___dnscmd_exe.yml
|
||||
@@ -0,0 +1,77 @@
|
||||
name: Windows Rename System Utilities Dnscmd exe LOLBAS in Non Standard Path
|
||||
id: 9972c51f-0b1e-4dff-8341-678520c4ddf8
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies Dnscmd.exe which is a native living
|
||||
off the land binary or script (LOLBAS) within the Windows operating system that
|
||||
may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="dnscmd.exe"| where process_path IS NOT
|
||||
NULL AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,end_time=timestamp,
|
||||
entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path",
|
||||
process_path, "process_name", process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows Rename System Utilities Dnx exe LOLBAS in Non Standard Path Unit Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Dnx exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___dnx_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Dnx exe LOLBAS in Non Standard
|
||||
Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___dnx_exe.yml
|
||||
@@ -0,0 +1,14 @@
|
||||
name: Windows Rename System Utilities Dotnet exe LOLBAS in Non Standard Path Unit
|
||||
Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Dotnet exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___dotnet_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Dotnet exe LOLBAS in Non Standard
|
||||
Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___dotnet_exe.yml
|
||||
@@ -0,0 +1,77 @@
|
||||
name: Windows Rename System Utilities Dotnet exe LOLBAS in Non Standard Path
|
||||
id: 083ee82a-4880-4561-b781-6aded01e73f1
|
||||
version: 1
|
||||
date: '2022-10-18'
|
||||
author: Splunk Threat Research Bot, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies Dotnet.exe which is a native living
|
||||
off the land binary or script (LOLBAS) within the Windows operating system that
|
||||
may be abused by adversaries by moving it to a new directory. The list of binaries
|
||||
was derived from the https://lolbas-project.github.io site.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
|
||||
process_name IS NOT NULL AND process_name="dotnet.exe"| where process_path IS NOT
|
||||
NULL AND match_regex(process_path, /(?i)\\program files\\dotnet/)=false | eval start_time=timestamp,end_time=timestamp,
|
||||
entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path",
|
||||
process_path, "process_name", process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting logs
|
||||
with the process name, command-line arguments, and parent processes from your endpoints.
|
||||
Collect endpoint data such as Sysmon or Windows Events 4688.
|
||||
known_false_positives: False positives may be present and filtering may be required.
|
||||
Certain utilities will run from non-standard paths based on the third-party application
|
||||
in use.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
|
||||
- https://attack.mitre.org/techniques/T1036/003/
|
||||
- https://lolbas-project.github.io/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Living Off The Land
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A system process $process_name$ with path $process_path$ spawn in non-default
|
||||
folder path on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1036
|
||||
- T1036.003
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- dest_user_id
|
||||
- process_path
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
file_path: ba_detection_template.yml
|
||||
@@ -0,0 +1,14 @@
|
||||
name: Windows Rename System Utilities Dump64 exe LOLBAS in Non Standard Path Unit
|
||||
Test
|
||||
tests:
|
||||
- name: Windows Rename System Utilities Dump64 exe LOLBAS in Non Standard Path
|
||||
file: endpoint/ssa___dump64_exe.yml
|
||||
pass_condition: '@count_eq(1)'
|
||||
description: ' Test Windows Rename System Utilities Dump64 exe LOLBAS in Non Standard
|
||||
Path'
|
||||
attack_data:
|
||||
- file_name: dotnet_lolbin-windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
|
||||
source: WinEventLog:Security
|
||||
file_path: ba_test_template.yml
|
||||
file: endpoint/ssa___dump64_exe.yml
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user