From c8c731e449d32f38b2de6a024cd8549f41c33af9 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 23 Nov 2021 19:20:48 +0000 Subject: [PATCH] Added detection testing service results inWindows Service Created With Suspicious Service Path --- ...ce_created_with_suspicious_service_path.yml | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml index 20277b8dc4..63dfff09af 100644 --- a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml +++ b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml @@ -7,19 +7,21 @@ type: TTP datamodel: - Endpoint description: The following analytc uses Windows Event Id 7045, `New Service Was Installed`, - to identify the creation of a Windows Service where the service binary path path is located in - a non-common Service folder in Windows. Red Teams and adversaries alike may create malicious - Services for lateral movement or remote code execution as well as persistence and execution. - The Clop ransomware has also been seen in the wild abusing Windows services. + to identify the creation of a Windows Service where the service binary path path + is located in a non-common Service folder in Windows. Red Teams and adversaries + alike may create malicious Services for lateral movement or remote code execution + as well as persistence and execution. The Clop ransomware has also been seen in + the wild abusing Windows services. search: ' `wineventlog_system` EventCode=7045 Service_File_Name = "*\.exe" NOT (Service_File_Name IN ("C:\\Windows\\*", "C:\\Program File*", "C:\\Programdata\\*", "%systemroot%\\*")) - | stats count min(_time) as firstTime max(_time) - as lastTime by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_created_with_suspicious_service_path_filter`' + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name + Service_Name Service_Start_Type Service_Type | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_service_created_with_suspicious_service_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints. -known_false_positives: Legitimate applications may install services with uncommon services paths. +known_false_positives: Legitimate applications may install services with uncommon + services paths. references: - https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html