From bab3434e540872c4e6afa257cc16fbde4e627f5d Mon Sep 17 00:00:00 2001 From: root Date: Thu, 13 May 2021 20:11:55 +0000 Subject: [PATCH] Added detection testing service results inSLUI Spawning a Process --- .../endpoint/slui_spawning_a_process.yml | 40 +++++++++++-------- 1 file changed, 23 insertions(+), 17 deletions(-) diff --git a/detections/endpoint/slui_spawning_a_process.yml b/detections/endpoint/slui_spawning_a_process.yml index 40ea23cc4d..6317e6f2b8 100644 --- a/detections/endpoint/slui_spawning_a_process.yml +++ b/detections/endpoint/slui_spawning_a_process.yml @@ -6,28 +6,33 @@ author: Michael Haag, Splunk type: batch datamodel: - Endpoint -description: The following analytic identifies the Microsoft Software Licensing User Interface Tool, `slui.exe`, spawning a child process. This behavior is associated with publicly known UAC bypass. - `slui.exe` is commonly associated with software updates and is most often spawned by `svchost.exe`. - The `slui.exe` process should not have child processes, and any processes spawning from it will be running with elevated privileges. - During triage, review the child process and additional parallel processes. Identify any file modifications that may have lead to the bypass. +description: The following analytic identifies the Microsoft Software Licensing User + Interface Tool, `slui.exe`, spawning a child process. This behavior is associated + with publicly known UAC bypass. `slui.exe` is commonly associated with software + updates and is most often spawned by `svchost.exe`. The `slui.exe` process should + not have child processes, and any processes spawning from it will be running with + elevated privileges. During triage, review the child process and additional parallel + processes. Identify any file modifications that may have lead to the bypass. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=slui.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `slui_spawning_a_process_filter`' + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=slui.exe + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `slui_spawning_a_process_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Certain applications may spawn from `slui.exe` that are legitimate. Filtering will be needed to ensure proper monitoring. +known_false_positives: Certain applications may spawn from `slui.exe` that are legitimate. + Filtering will be needed to ensure proper monitoring. references: - - https://www.exploit-db.com/exploits/46998 - - https://www.rapid7.com/db/modules/exploit/windows/local/bypassuac_sluihijack/ - - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html +- https://www.exploit-db.com/exploits/46998 +- https://www.rapid7.com/db/modules/exploit/windows/local/bypassuac_sluihijack/ +- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html tags: analytic_story: - DarkSide Ransomware - Windows Defense Evasion Tactics - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/slui/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -38,11 +43,12 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user + - Processes.dest + - Processes.user - Processes.parent_process - Processes.process_name - Processes.process - - Processes.process_id + - Processes.process_id - Processes.parent_process_id - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed