admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inDetect Path Interception By Creation Of program exe

Browse Source
This commit is contained in:
root
2020-11-04 13:07:50 +00:00
parent 3842a15221
commit c1ee613a59
1 changed files with 14 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml
+14 -8
View File
@@ -2,17 +2,20 @@ name: Detect Path Interception By Creation Of program exe
id: c77162d3-f93c-45cc-80c8-22f6v5264g9f
version: 3
date: '2020-07-03'
description: 'The detection Detect Path Interception By Creation Of program exe is detecting the abuse of
unquoted service paths, which is a popular technique for privilege escalation. '
description: 'The detection Detect Path Interception By Creation Of program exe is
detecting the abuse of unquoted service paths, which is a popular technique for
privilege escalation. '
type: ESCU
references:
- https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae
- https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae
author: Patrick Bareiss, Splunk
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from
datamodel=Endpoint.Processes where Processes.parent_process_name=services.exe by Processes.user Processes.process_name
Processes.process Processes.dest | `drop_dm_object_name(Processes)` | rex field=process "^.*\\\\(?<service_process>.*\.(?:exe|bat|com|ps1))"
| eval process_name = lower(process_name) | eval service_process = lower(service_process)| where process_name != service_process
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_path_interception_by_creation_of_program_exe_filter`'
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=services.exe
by Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)`
| rex field=process "^.*\\\\(?<service_process>.*\.(?:exe|bat|com|ps1))" | eval
process_name = lower(process_name) | eval service_process = lower(service_process)|
where process_name != service_process | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
| `detect_path_interception_by_creation_of_program_exe_filter`'
known_false_positives: unknown
tags:
analytics_story:
@@ -28,3 +31,6 @@ tags:
- DE.CM
security_domain: endpoint
asset_type: Endpoint
automated_detection_testing: passed
dataset:
- https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1574.009/windows-sysmon.log