admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Another fix for the Ports change

Browse Source
This commit is contained in:
pyth0n1c
2022-02-22 16:46:33 -08:00
committed by GitHub
parent 46e0f41d6f
commit 8a43aa3033
1 changed files with 15 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_installutil_uninstall_option_with_network.yml
+15 -12
View File
@@ -1,7 +1,7 @@
name: Windows InstallUtil Uninstall Option with Network
id: 1a52c836-43ef-11ec-a36c-acde48001122
version: 1
date: '2021-11-12'
version: 2
date: '2022-02-22'
author: Michael Haag, Splunk
type: TTP
datamodel:
@@ -24,16 +24,19 @@ description: 'The following analytic identifies the Windows InstallUtil.exe bina
During triage review resulting network connections, file modifications, and parallel
processes. Capture any artifacts and review further.'
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where `process_installutil` Processes.process IN ("*/u*", "*uninstall*") by _time
span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path
Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join process_guid
[ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports
where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)`
| rename dest as connection_to_CNC] | table _time dest parent_process_name process_name
original_file_name process_path process process_guid connection_to_CNC dest_port
| `windows_installutil_uninstall_option_with_network_filter`'
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where `process_installutil` Processes.process IN ("*/u*", "*uninstall*")
by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| join process_guid
[ | tstats `security_content_summariesonly` count FROM
datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port !="0" by All_Traffic.process_guid All_Traffic.dest All_Traffic.dest_port
| `drop_dm_object_name(All_Traffic)`
| rename dest as connection_to_CNC]
| table _time dest parent_process_name process_name original_file_name process_path process process_guid connection_to_CNC dest_port
| `windows_installutil_uninstall_option_with_network_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node.