admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update credential_dumping_via_symlink_to_shadow_copy.yml

Browse Source
This commit is contained in:
mhaag-spl
2021-09-16 10:52:50 -06:00
parent ec15b54f16
commit 9e32a32bdd
1 changed files with 6 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml
+6 -9
View File
@@ -1,22 +1,19 @@
name: Credential Dumping via Symlink to Shadow Copy
id: c5eac648-fae0-4263-91a6-773df1f4c903
version: 1
date: '2019-12-10'
version: 2
date: '2021-09-16'
author: Patrick Bareiss, Splunk
type: TTP
datamodel:
- Endpoint
description: This search detects the creation of a symlink to a shadow copy.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe
as lastTime from datamodel=Endpoint.Processes where `process_cmd`
Processes.process=*mklink* Processes.process=*HarddiskVolumeShadowCopy* by Processes.dest
Processes.user Processes.process_name Processes.process Processes.parent_process
Processes.user Processes.process_name Processes.process Processes.parent_process Processes.original_file_name
Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `credential_dumping_via_symlink_to_shadow_copy_filter` '
how_to_implement: You must be ingesting endpoint data that tracks process activity,
including parent-child relationships from your endpoints to populate the Endpoint
data model in the Processes node. The command-line arguments are mapped to the "process"
field in the Endpoint data model.
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `credential_dumping_via_symlink_to_shadow_copy_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: unknown
references:
- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf