admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'detection_testing_part_two' of github.com:splunk/security-content into detection_testing_part_two

Browse Source
This commit is contained in:
P4T12ICK
2020-12-09 10:00:41 +01:00
parent 442edba8d8 a926dd52bb
commit b85dd98c8a
2 changed files with 16 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/suspicious_lnk_file_launching_a_process.yml
+13 -11
View File
@@ -12,17 +12,16 @@ type: ESCU
author: Jose Hernandez, Splunk
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.lnk"
AND Filesystem.file_path="C:\\Temp*" by
_time span=1h Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.file_hash
Filesystem.user | `drop_dm_object_name(Filesystem)` | rename process_id as lnk_pid
| join lnk_pid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name=* by _time span=1h Processes.parent_process_id Processes.process_id
Processes.process_name Processes.dest Processes.process_path Processes.process |
`drop_dm_object_name(Processes)` | rename parent_process_id as lnk_pid | fields
_time lnk_pid process_id dest process_name process_path process] | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | table firstTime, lastTime, lnk_pid, process_id,
user, dest, file_name, file_path, process_name, process, process_path, file_hash
| `suspicious_lnk_file_launching_a_process_filter` '
AND Filesystem.file_path="C:\\Temp*" by _time span=1h Filesystem.process_id Filesystem.file_name
Filesystem.file_path Filesystem.file_hash Filesystem.user | `drop_dm_object_name(Filesystem)`
| rename process_id as lnk_pid | join lnk_pid, _time [| tstats `security_content_summariesonly`
count FROM datamodel=Endpoint.Processes where Processes.process_name=* by _time
span=1h Processes.parent_process_id Processes.process_id Processes.process_name
Processes.dest Processes.process_path Processes.process | `drop_dm_object_name(Processes)`
| rename parent_process_id as lnk_pid | fields _time lnk_pid process_id dest process_name
process_path process] | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| table firstTime, lastTime, lnk_pid, process_id, user, dest, file_name, file_path,
process_name, process, process_path, file_hash | `suspicious_lnk_file_launching_a_process_filter` '
known_false_positives: This detection should yield little or no false positive results.
It is uncommon for LNK files to execute process from temporary or user directories.
tags:
@@ -41,3 +40,6 @@ tags:
- PR.DS
security_domain: network
asset_type: Endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/lnk_file_temp_folder/windows-sysmon.log
detections/endpoint/wmi_permanent_event_subscription___sysmon.yml
+3
View File
@@ -31,3 +31,6 @@ tags:
- PR.IP
security_domain: endpoint
asset_type: Endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team/windows-sysmon.log