From ae66d556e073fa7b68472cf4f57d263f1dc958e4 Mon Sep 17 00:00:00 2001 From: josehelps Date: Tue, 18 Oct 2022 14:56:03 -0400 Subject: [PATCH] removing extra detection --- ...s_wmic_exe_lolbas_in_non_standard_path.yml | 62 ------------------- 1 file changed, 62 deletions(-) delete mode 100644 dist/ssa/srs/ssa___windows_rename_system_utilities_wmic_exe_lolbas_in_non_standard_path.yml diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_wmic_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_wmic_exe_lolbas_in_non_standard_path.yml deleted file mode 100644 index 2c302df729..0000000000 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_wmic_exe_lolbas_in_non_standard_path.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Windows Rename System Utilities Wmic exe LOLBAS in Non Standard Path -id: 42c9b37c-6928-4e54-8043-2d5265d972dd -version: 1 -description: The following analytic identifies Wmic.exe which is a native living off - the land binary or script (LOLBAS) within the Windows operating system that may - be abused by adversaries by moving it to a new directory. The list of binaries was - derived from the https://lolbas-project.github.io site. -search: ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, - "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"), - "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", - null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", - null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string", - null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where - process_name IS NOT NULL AND process_name="wmic.exe"| where process_path IS NOT - NULL AND match_regex(process_path, /(?i)\\windows\\syswow64\\wbem/)=false | eval - start_time=timestamp,end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id", - event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events(); -how_to_implement: To successfully implement this search, you must be ingesting logs - with the process name, command-line arguments, and parent processes from your endpoints. - Collect endpoint data such as Sysmon or Windows Events 4688. -known_false_positives: False positives may be present and filtering may be required. - Certain utilities will run from non-standard paths based on the third-party application - in use. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml -- https://attack.mitre.org/techniques/T1036/003/ -- https://lolbas-project.github.io/ -tags: - analytic_story: - - Unusual Processes - - Living Off The Land - cis20: - - CIS 8 - kill_chain_phases: - - Actions on Objectives - mitre_attack_id: - - T1036 - - T1036.003 - nist: - - PR.PT - - DE.CM - required_fields: - - dest_device_id - - process_name - - _time - - dest_user_id - - process_path - risk_score: 14 - security_domain: endpoint - risk_severity: low - research_site_url: https://research.splunk.com/endpoint/42c9b37c-6928-4e54-8043-2d5265d972dd/ -test: - name: Windows Rename System Utilities Wmic exe LOLBAS in Non Standard Path Unit - Test - tests: - - name: Windows Rename System Utilities Wmic exe LOLBAS in Non Standard Path - file: endpoint/ssa___wmic_exe.yml - pass_condition: '@count_eq(1)' - attack_data: - - file_name: dotnet_lolbin-windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log - source: WinEventLog:Security