From a32955b9858a8d5ca7e5e41d600d697aa19d8f0c Mon Sep 17 00:00:00 2001 From: divious1 Date: Tue, 7 Sep 2021 21:51:20 -0400 Subject: [PATCH] updating detection base on feedback from mschilt in issue 1527 --- .../system_information_discovery_detection.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/system_information_discovery_detection.yml b/detections/endpoint/system_information_discovery_detection.yml index f1191ab224..ed90c3cbf4 100644 --- a/detections/endpoint/system_information_discovery_detection.yml +++ b/detections/endpoint/system_information_discovery_detection.yml @@ -1,7 +1,7 @@ name: System Information Discovery Detection id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72 -version: 1 -date: '2020-10-12' +version: 2 +date: '2021-09-07' author: Patrick Bareiss, Splunk type: TTP datamodel: @@ -11,10 +11,10 @@ description: Detect system information discovery techniques used by attackers to search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="*wmic* qfe*" OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.user - Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` +Processes.process_name Processes.process Processes.dest Process.parent_process | `drop_dm_object_name(Processes)` | eventstats dc(process) as dc_processes_by_dest by dest | where dc_processes_by_dest - > 2 | stats values(process) min(firstTime) as firstTime max(lastTime) as lastTime - by user, dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + > 2 | stats values(process) as processes min(firstTime) as firstTime max(lastTime) as lastTime + by user, dest, parent_process | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `system_information_discovery_detection_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from