admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'remcos_agent' of https://github.com/splunk/security_content into remcos_agent

Browse Source
This commit is contained in:
Detection Testing Service
2021-09-23 08:09:44 +00:00
parent 6abadead7c d445133a16
commit 9831efea63
1 changed files with 16 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/suspicious_image_creation_in_appdata_folder.yml
+16 -13
View File
@@ -6,27 +6,30 @@ author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
description: This search is to detect a suspicious creation of image in appdata folder made by process that also has a file reference in appdata folder.
This technique was seen in remcos rat that capture screenshot of the compromised machine and place it in the appdata and will be send to its C2 server.
This TTP is really a good indicator to check that process because it is in suspicious folder path and image files are not commonly created by user in this folder path.
description: This search is to detect a suspicious creation of image in appdata folder
made by process that also has a file reference in appdata folder. This technique
was seen in remcos rat that capture screenshot of the compromised machine and place
it in the appdata and will be send to its C2 server. This TTP is really a good indicator
to check that process because it is in suspicious folder path and image files are
not commonly created by user in this folder path.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*"
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
| `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly`
count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
where Filesystem.file_name IN ("*.png","*.jpg","*.bmp","*.gif","*.tiff") Filesystem.file_path = "*\\appdata\\Roaming\\*"
by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name
Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time
file_name file_path process_name process_path process]
| `suspicious_image_creation_in_appdata_folder_filter`'
where Filesystem.file_name IN ("*.png","*.jpg","*.bmp","*.gif","*.tiff") Filesystem.file_path
= "*\\appdata\\Roaming\\*" by _time span=1h Filesystem.dest Filesystem.file_create_time
Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` |
fields _time dest file_create_time file_name file_path process_name process_path
process] | `suspicious_image_creation_in_appdata_folder_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: unknown
references:
- https://success.trendmicro.com/solution/1123281-remcos-malware-information
- https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/
- https://success.trendmicro.com/solution/1123281-remcos-malware-information
- https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/
tags:
analytic_story:
- Remcos
@@ -44,7 +47,7 @@ tags:
- _time
- dest
- file_create_time
- file_name
- file_name
- file_path
- process_name
- process_path
@@ -52,7 +55,6 @@ tags:
security_domain: endpoint
impact: 70
confidence: 70
# (impact * confidence)/100
risk_score: 49
context:
- Source:Endpoint
@@ -66,4 +68,5 @@ tags:
- name: process_name
type: process name
role:
- Attacker
- Attacker
automated_detection_testing: passed