admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inWrite Executable in SMB Share

Browse Source
This commit is contained in:
root
2021-04-27 14:01:03 +00:00
parent 4f0dbbe5f6
commit b54eec9d68
1 changed files with 14 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/write_executable_in_smb_share.yml
+14 -10
View File
@@ -6,14 +6,15 @@ author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: This search is to detect suspicious dropping or creating an executable file in known sensitive SMB share.
This technique is commonly used for lateral movement like how trickbot try to infect other machine in the infected network.
This detection catch the access event (FILE WRITE) access to a share.
search: '`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.exe","*.dll") Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask= "0x2"
| stats min(_time) as firstTime max(_time) as lastTime count by EventCode Share_Name Relative_Target_Name Object_Type Access_Mask user src_port Source_Address
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `write_executable_in_smb_share_filter`'
description: This search is to detect suspicious dropping or creating an executable
file in known sensitive SMB share. This technique is commonly used for lateral movement
like how trickbot try to infect other machine in the infected network. This detection
catch the access event (FILE WRITE) access to a share.
search: '`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.exe","*.dll")
Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask=
"0x2" | stats min(_time) as firstTime max(_time) as lastTime count by EventCode
Share_Name Relative_Target_Name Object_Type Access_Mask user src_port Source_Address
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `write_executable_in_smb_share_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also
required. Also enable the object Audit access success/failure in your group policy.
@@ -41,5 +42,8 @@ tags:
- Access_Mask
- user
- src_port
- Source_Address
security_domain: endpoint
- Source_Address
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/exe_smbshare/windows-security.log