admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inWindows Service Creation on Remote Endpoint

Browse Source
This commit is contained in:
root
2021-11-12 20:56:33 +00:00
parent a7a85f2fc3
commit 8ff650ebe8
1 changed files with 13 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_service_creation_on_remote_endpoint.yml
+13 -11
View File
@@ -6,20 +6,22 @@ author: Mauricio Velazco, Splunk
type: TTP
datamodel:
- Endpoint
description: This analytic looks for the execution of `sc.exe` with command-line
arguments utilized to create a Windows Service on a remote endpoint. Red Teams and
adversaries alike may abuse the Service Control Manager for lateral movement and remote code execution.
description: This analytic looks for the execution of `sc.exe` with command-line arguments
utilized to create a Windows Service on a remote endpoint. Red Teams and adversaries
alike may abuse the Service Control Manager for lateral movement and remote code
execution.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=sc.exe
OR Processes.original_file_name=sc.exe) (Processes.process=*\\\\* AND Processes.process=*create*
AND Processes.process=*binpath*) by Processes.dest
Processes.user Processes.parent_process_name Processes.process_name Processes.process
Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_service_creation_on_remote_endpoint_filter`'
AND Processes.process=*binpath*) by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
| `windows_service_creation_on_remote_endpoint_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your endpoints.
known_false_positives: Administrators may create Windows Services on remote systems, but this
activity is usually limited to a small set of hosts or users.
logs with the process name, parent process, and command-line executions from your
endpoints.
known_false_positives: Administrators may create Windows Services on remote systems,
but this activity is usually limited to a small set of hosts or users.
references:
- https://docs.microsoft.com/en-us/windows/win32/services/service-control-manager
- https://docs.microsoft.com/en-us/windows/win32/services/controlling-a-service-using-sc
@@ -64,4 +66,4 @@ tags:
type: Endpoint
role:
- Victim
automated_detection_testing: passed