From c1ee613a592ac3dfd44d3b09f3cd1c406efc5452 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 4 Nov 2020 13:07:50 +0000 Subject: [PATCH] Added detection testing service results inDetect Path Interception By Creation Of program exe --- ...nterception_by_creation_of_program_exe.yml | 22 ++++++++++++------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml index 922cdb5ac6..91a709acc4 100644 --- a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml +++ b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml @@ -2,17 +2,20 @@ name: Detect Path Interception By Creation Of program exe id: c77162d3-f93c-45cc-80c8-22f6v5264g9f version: 3 date: '2020-07-03' -description: 'The detection Detect Path Interception By Creation Of program exe is detecting the abuse of - unquoted service paths, which is a popular technique for privilege escalation. ' +description: 'The detection Detect Path Interception By Creation Of program exe is + detecting the abuse of unquoted service paths, which is a popular technique for + privilege escalation. ' type: ESCU references: - - https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae +- https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae author: Patrick Bareiss, Splunk -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from - datamodel=Endpoint.Processes where Processes.parent_process_name=services.exe by Processes.user Processes.process_name - Processes.process Processes.dest | `drop_dm_object_name(Processes)` | rex field=process "^.*\\\\(?.*\.(?:exe|bat|com|ps1))" - | eval process_name = lower(process_name) | eval service_process = lower(service_process)| where process_name != service_process - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_path_interception_by_creation_of_program_exe_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=services.exe + by Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` + | rex field=process "^.*\\\\(?.*\.(?:exe|bat|com|ps1))" | eval + process_name = lower(process_name) | eval service_process = lower(service_process)| + where process_name != service_process | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `detect_path_interception_by_creation_of_program_exe_filter`' known_false_positives: unknown tags: analytics_story: @@ -28,3 +31,6 @@ tags: - DE.CM security_domain: endpoint asset_type: Endpoint + automated_detection_testing: passed + dataset: + - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1574.009/windows-sysmon.log