admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inWindows Service Created With Suspicious Service Path

Browse Source
This commit is contained in:
root
2021-11-23 19:20:48 +00:00
parent 4c696f9ad8
commit c8c731e449
1 changed files with 10 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_service_created_with_suspicious_service_path.yml
+10 -8
View File
@@ -7,19 +7,21 @@ type: TTP
datamodel:
- Endpoint
description: The following analytc uses Windows Event Id 7045, `New Service Was Installed`,
to identify the creation of a Windows Service where the service binary path path is located in
a non-common Service folder in Windows. Red Teams and adversaries alike may create malicious
Services for lateral movement or remote code execution as well as persistence and execution.
The Clop ransomware has also been seen in the wild abusing Windows services.
to identify the creation of a Windows Service where the service binary path path
is located in a non-common Service folder in Windows. Red Teams and adversaries
alike may create malicious Services for lateral movement or remote code execution
as well as persistence and execution. The Clop ransomware has also been seen in
the wild abusing Windows services.
search: ' `wineventlog_system` EventCode=7045 Service_File_Name = "*\.exe" NOT (Service_File_Name
IN ("C:\\Windows\\*", "C:\\Program File*", "C:\\Programdata\\*", "%systemroot%\\*"))
| stats count min(_time) as firstTime max(_time)
as lastTime by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_created_with_suspicious_service_path_filter`'
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name
Service_Name Service_Start_Type Service_Type | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `windows_service_created_with_suspicious_service_path_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the Service name, Service File Name Service Start type, and Service Type
from your endpoints.
known_false_positives: Legitimate applications may install services with uncommon services paths.
known_false_positives: Legitimate applications may install services with uncommon
services paths.
references:
- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html