admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2022-11-11 14:09:06 -08:00
committed by GitHub
parent f70d282a27 faa9f70f07
commit cf4311bd15
1 changed files with 13 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/experimental/endpoint/detect_rare_executables.yml
+13 -14
View File
@@ -1,22 +1,23 @@
name: Detect Rare Executables
id: 44fddcb2-8d3b-454c-874e-7c6de5a4f7ac
version: 5
date: '2020-03-16'
version: 3
date: '2022-11-10'
author: Bhavin Patel, Splunk
type: Anomaly
datamodel:
- Endpoint
description: This search will return a table of rare processes, the names of the systems
running them, and the users who initiated each process.
search: '| tstats `security_content_summariesonly` count values(Processes.dest) as
dest values(Processes.user) as user min(_time) as firstTime max(_time) as lastTime
from datamodel=Endpoint.Processes by Processes.process_name | rename Processes.process_name
as process | rex field=user "(?<user_domain>.*)\\\\(?<user_name>.*)" | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)`| search [| tstats count from datamodel=Endpoint.Processes
by Processes.process_name | rare Processes.process_name limit=30 | rename Processes.process_name
as process| `filter_rare_process_allow_list`| table process ] | `detect_rare_executables_filter` '
description: This search will return a table of processes in the a given window, remove process names which are in the allowed list and list out the top 30 rare processes discovered on different hosts.
search: '| tstats `security_content_summariesonly` count values(Processes.dest) as dest values(Processes.user) as user min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.process_name
| rename Processes.process_name as process
| `filter_rare_process_allow_list`
| sort count
| head 30
| rex field=user "(?<user_domain>.*)\\\\(?<user_name>.*)"
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `detect_rare_executables_filter` '
how_to_implement: To successfully implement this search, you must be ingesting data
that records process activity from your hosts and populating the endpoint data model
that records process activity from your hosts and populating the `Endpoint` data model
with the resultant dataset. The macro `filter_rare_process_allow_list` searches
two lookup files for allowed processes. These consist of `rare_process_allow_list_default.csv`
and `rare_process_allow_list_local.csv`. To add your own processes to the allow
@@ -30,9 +31,7 @@ known_false_positives: Some legitimate processes may be only rarely executed in
references: []
tags:
analytic_story:
- 'Emotet Malware DHS Report TA18-201A '
- Unusual Processes
- Cloud Federated Credential Abuse
asset_type: Endpoint
cis20:
- CIS 2