From c0835e27c408f428f8701fbbee1c2ee43d80f044 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 21 Apr 2021 19:42:18 +0000 Subject: [PATCH] Added detection testing service results inExcel Spawning PowerShell --- .../endpoint/excel_spawning_powershell.yml | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/excel_spawning_powershell.yml b/detections/endpoint/excel_spawning_powershell.yml index 83b11858fb..5c4cbf45b5 100644 --- a/detections/endpoint/excel_spawning_powershell.yml +++ b/detections/endpoint/excel_spawning_powershell.yml @@ -15,20 +15,23 @@ description: The following detection identifies Microsoft Excel spawning PowerSh and identify any files that may have been written. search: '| tstats `security_content_summariesonly` count values(Processes.process) min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.parent_process_name="excel.exe" Processes.process_name IN ("powershell.exe", "pwsh.exe") by Processes.parent_process Processes.process_name - Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | `excel_spawning_powershell_filter`' + where Processes.parent_process_name="excel.exe" Processes.process_name IN ("powershell.exe", + "pwsh.exe") by Processes.parent_process Processes.process_name Processes.user Processes.dest + | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` + | `excel_spawning_powershell_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. known_false_positives: False positives should be limited, but if any are present, filter as needed. references: - - https://redcanary.com/threat-detection-report/techniques/powershell/ - - https://attack.mitre.org/techniques/T1566/001/ +- https://redcanary.com/threat-detection-report/techniques/powershell/ +- https://attack.mitre.org/techniques/T1566/001/ tags: analytic_story: - Spearphishing Attachments - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -45,4 +48,5 @@ tags: - dest - user - parent_process_id - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed