From 8386cfd475cdcef8e3b4936bc182d01f2ddb2d4f Mon Sep 17 00:00:00 2001 From: root Date: Mon, 3 May 2021 15:42:03 +0000 Subject: [PATCH] Added detection testing service results inWermgr Process Spawned CMD Or Powershell Process --- ...cess_spawned_cmd_or_powershell_process.yml | 27 +++++++++++-------- 1 file changed, 16 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml index e0ed900827..d3fa042588 100644 --- a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml +++ b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml @@ -6,19 +6,21 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is designed to detect suspicious cmd and powershell process spawned by wermgr.exe process. - This suspicious behavior are commonly seen in code injection technique technique like trickbot to execute a shellcode, dll modules to run malicious behavior. -search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.parent_process_name = "wermgr.exe" Processes.process_name = "cmd.exe" OR Processes.process_name = "powershell.exe" - by Processes.parent_process_name Processes.parent_process_id Processes.process_name Processes.process Processes.process_id Processes.process_guid Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This search is designed to detect suspicious cmd and powershell process + spawned by wermgr.exe process. This suspicious behavior are commonly seen in code + injection technique technique like trickbot to execute a shellcode, dll modules + to run malicious behavior. +search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.parent_process_name = "wermgr.exe" Processes.process_name = "cmd.exe" + OR Processes.process_name = "powershell.exe" by Processes.parent_process_name Processes.parent_process_id Processes.process_name + Processes.process Processes.process_id Processes.process_guid Processes.dest Processes.user + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wermgr_process_spawned_cmd_or_powershell_process_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: unknown references: - https://labs.vipre.com/trickbot-and-its-modules/ @@ -43,5 +45,8 @@ tags: - Processes.process_id - Processes.process_guid - Processes.dest - - Processes.user - security_domain: endpoint \ No newline at end of file + - Processes.user + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log