admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

rebuilt

Browse Source
This commit is contained in:
mhaag-spl
2021-11-16 09:38:19 -07:00
parent 66ba3885da
commit a915e56292
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/plink_remote_forwarding.yml
+4 -4
View File
@@ -1,18 +1,18 @@
name: Plink Remote Forwarding
id: 773e26e4-461a-11ec-a9be-acde48001122
id: 547710a8-46fb-11ec-a3a1-acde48001122
version: 1
date: '2021-11-15'
date: '2021-11-16'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
description: The following analytic identifies the use of `plink` being utilized as a way to tunnel protocols outbound. Adversaries utilize this application to reverse proxy ssh and RDP outbound to a remote destination.
description: 'The following analytic identifies the use of `plink` being utilized as a way to tunnel protocols outbound. Adversaries utilize this application to reverse proxy ssh and RDP outbound to a remote destination.'
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=plink.exe OR Processes.original_file_name="plink") Processes.process IN ("*-D *", "*-L *", "*-R *") OR Processes.process IN ("*-l *","*-pw *") OR Processes.process IN ("*-ssh*", "*-telnet*", "*-rlogin*" "*-raw*", "*-serial*") OR Processes.process IN ("*-T *","*-N *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `security_content_ctime(lastTime)`
| `plink_remote_forwarding_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: False positives should be limited, however filter as needed.