From 6731ef650b3a06bd172ad150280d8a6f4b98c86c Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 15 Mar 2022 09:54:59 -0600 Subject: [PATCH 1/3] Updated Rex Git Issue #2066 --- .../detect_regasm_with_no_command_line_arguments.yml | 6 +++--- .../detect_regsvcs_with_no_command_line_arguments.yml | 6 +++--- .../dllhost_with_no_command_line_arguments_with_network.yml | 6 +++--- ...gpupdate_with_no_command_line_arguments_with_network.yml | 6 +++--- ...rundll32_with_no_command_line_arguments_with_network.yml | 6 +++--- ...searchprotocolhost_with_no_command_line_with_network.yml | 6 +++--- .../suspicious_dllhost_no_command_line_arguments.yml | 6 +++--- .../suspicious_gpupdate_no_command_line_arguments.yml | 6 +++--- .../suspicious_rundll32_with_no_command_line_arguments.yml | 6 +++--- ...picious_searchprotocolhost_no_command_line_arguments.yml | 6 +++--- 10 files changed, 30 insertions(+), 30 deletions(-) diff --git a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml index c1dc6b4aca..130cd8baf0 100644 --- a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml @@ -1,7 +1,7 @@ name: Detect Regasm with no Command Line Arguments id: c3bc1430-04e7-4178-835f-047d8e6e97df -version: 2 -date: '2021-09-20' +version: 3 +date: '2022-03-15' author: Michael Haag, Splunk type: TTP datamodel: @@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint where `process_regasm` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | regex process="(regasm\.exe.{0,4}$)" | `detect_regasm_with_no_command_line_arguments_filter`' + | regex process="(?i)(regasm\.exe.{0,4}$)" | `detect_regasm_with_no_command_line_arguments_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml index 3c10194a8d..b3b7d04f39 100644 --- a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml @@ -1,7 +1,7 @@ name: Detect Regsvcs with No Command Line Arguments id: 6b74d578-a02e-4e94-a0d1-39440d0bf254 -version: 2 -date: '2021-09-20' +version: 3 +date: '2022-03-15' author: Michael Haag, Splunk type: TTP datamodel: @@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint where `process_regsvcs` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | regex process="(regsvcs\.exe.{0,4}$)"| `detect_regsvcs_with_no_command_line_arguments_filter`' + | regex process="(?i)(regsvcs\.exe.{0,4}$)"| `detect_regsvcs_with_no_command_line_arguments_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml index 756291943e..af44878426 100644 --- a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml @@ -1,7 +1,7 @@ name: DLLHost with no Command Line Arguments with Network id: f1c07594-a141-11eb-8407-acde48001122 -version: 2 -date: '2021-10-13' +version: 3 +date: '2022-03-15' author: Michael Haag, Splunk type: TTP datamodel: @@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint where Processes.process_name=dllhost.exe by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | regex process="(dllhost\.exe.{0,4}$)" | join process_guid [| tstats `security_content_summariesonly` + | regex process="(?i)(dllhost\.exe.{0,4}$)" | join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name process_path process process_guid diff --git a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml index 685632cb66..7d506e7883 100644 --- a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml @@ -1,7 +1,7 @@ name: GPUpdate with no Command Line Arguments with Network id: 2c853856-a140-11eb-a5b5-acde48001122 -version: 1 -date: '2021-04-19' +version: 2 +date: '2022-03-15' author: Michael Haag, Splunk type: TTP datamodel: @@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint where Processes.process_name=gpupdate.exe by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | regex process="(gpupdate\.exe.{0,4}$)" | join process_guid [| tstats `security_content_summariesonly` + | regex process="(?i)(gpupdate\.exe.{0,4}$)"| join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name process_path process process_guid diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml index f0c38c6b49..a4a99898d1 100644 --- a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml @@ -1,7 +1,7 @@ name: Rundll32 with no Command Line Arguments with Network id: 35307032-a12d-11eb-835f-acde48001122 -version: 3 -date: '2021-10-13' +version: 4 +date: '2022-03-15' author: Michael Haag, Splunk type: TTP datamodel: @@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint where `process_rundll32` by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | regex process="(rundll32\.exe.{0,4}$)" | + | `security_content_ctime(lastTime)` | regex process="(?i)(rundll32\.exe.{0,4}$)" | join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name diff --git a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml index 2ac0c1b075..e7de28956e 100644 --- a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml +++ b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml @@ -1,7 +1,7 @@ name: SearchProtocolHost with no Command Line with Network id: b690df8c-a145-11eb-a38b-acde48001122 -version: 2 -date: '2021-10-13' +version: 3 +date: '2022-03-15' author: Michael Haag, Splunk type: TTP datamodel: @@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | regex process="(searchprotocolhost\.exe.{0,4}$)" | join process_guid [| tstats + | regex process="(?i)(searchprotocolhost\.exe.{0,4}$)" | join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name diff --git a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml index 64c5947322..1312e658f1 100644 --- a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml @@ -1,7 +1,7 @@ name: Suspicious DLLHost no Command Line Arguments id: ff61e98c-0337-4593-a78f-72a676c56f26 -version: 2 -date: '2021-09-20' +version: 3 +date: '2022-03-15' author: Michael Haag, Splunk type: TTP datamodel: @@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint where `process_dllhost` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | regex process="(dllhost\.exe.{0,4}$)" | `suspicious_dllhost_no_command_line_arguments_filter`' + | regex process="(?i)(dllhost\.exe.{0,4}$)" | `suspicious_dllhost_no_command_line_arguments_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml index 312a46cd6f..63799d764f 100644 --- a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml @@ -1,7 +1,7 @@ name: Suspicious GPUpdate no Command Line Arguments id: f308490a-473a-40ef-ae64-dd7a6eba284a -version: 2 -date: '2021-09-20' +version: 3 +date: '2022-03-15' author: Michael Haag, Splunk type: TTP datamodel: @@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint where `process_gpupdate` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | regex process="(gpupdate\.exe.{0,4}$)" | `suspicious_gpupdate_no_command_line_arguments_filter`' + | regex process="(?i)(gpupdate\.exe.{0,4}$)" | `suspicious_gpupdate_no_command_line_arguments_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml index 9b0768f61b..9923bf96eb 100644 --- a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml @@ -1,7 +1,7 @@ name: Suspicious Rundll32 no Command Line Arguments id: e451bd16-e4c5-4109-8eb1-c4c6ecf048b4 -version: 2 -date: '2021-09-20' +version: 3 +date: '2022-03-15' author: Michael Haag, Splunk type: TTP datamodel: @@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint where `process_rundll32` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | regex process="(rundll32\.exe.{0,4}$)" | `suspicious_rundll32_no_command_line_arguments_filter`' + | regex process="(?i)(rundll32\.exe.{0,4}$)" | `suspicious_rundll32_no_command_line_arguments_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml index 0610b9087d..0a667c2244 100644 --- a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml @@ -1,7 +1,7 @@ name: Suspicious SearchProtocolHost no Command Line Arguments id: f52d2db8-31f9-4aa7-a176-25779effe55c -version: 2 -date: '2021-09-20' +version: 3 +date: '2022-03-15' author: Michael Haag, Splunk type: TTP datamodel: @@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | regex process="(searchprotocolhost\.exe.{0,4}$)" | `suspicious_searchprotocolhost_no_command_line_arguments_filter`' + | regex process="(?i)(searchprotocolhost\.exe.{0,4}$)" | `suspicious_searchprotocolhost_no_command_line_arguments_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, From ecd464907e0cbd039d10e14db83b562b94c5f016 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 15 Mar 2022 11:11:05 -0600 Subject: [PATCH 2/3] fixes to no cli with netconn switched to using sysmon 2.0 TA and using All_Traffic. Caveat here is, process_id. --- ...st_with_no_command_line_arguments_with_network.yml | 10 +++++----- ...te_with_no_command_line_arguments_with_network.yml | 10 +++++----- ...32_with_no_command_line_arguments_with_network.yml | 11 ++++++----- ...protocolhost_with_no_command_line_with_network.yml | 10 +++++----- 4 files changed, 21 insertions(+), 20 deletions(-) diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml index af44878426..0fa7c3f1ee 100644 --- a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml @@ -16,11 +16,11 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint where Processes.process_name=dllhost.exe by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | regex process="(?i)(dllhost\.exe.{0,4}$)" | join process_guid [| tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid - Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] - | table _time dest parent_process_name process_name process_path process process_guid - connection_to_CNC dest_port | `dllhost_with_no_command_line_arguments_with_network_filter`' + | regex process="(?i)(dllhost\.exe.{0,4}$)" | join process_id [| tstats `security_content_summariesonly` + count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id + All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] + | table _time dest parent_process_name process_name process_path process process_id dest_port C2 + | `dllhost_with_no_command_line_arguments_with_network_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. diff --git a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml index 7d506e7883..fcfb383ee1 100644 --- a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml @@ -17,11 +17,11 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint where Processes.process_name=gpupdate.exe by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | regex process="(?i)(gpupdate\.exe.{0,4}$)"| join process_guid [| tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid - Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] - | table _time dest parent_process_name process_name process_path process process_guid - connection_to_CNC dest_port | `gpupdate_with_no_command_line_arguments_with_network_filter`' + | regex process="(?i)(gpupdate\.exe.{0,4}$)"| join process_id [| tstats `security_content_summariesonly` + count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id + All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] + | table _time dest parent_process_name process_name process_path process process_id dest_port C2 + | `gpupdate_with_no_command_line_arguments_with_network_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml index a4a99898d1..46b784388a 100644 --- a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml @@ -17,11 +17,12 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint where `process_rundll32` by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | regex process="(?i)(rundll32\.exe.{0,4}$)" | - join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports - where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` - | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name - process_path process process_guid connection_to_CNC dest_port | `rundll32_with_no_command_line_arguments_with_network_filter`' + | `security_content_ctime(lastTime)` | regex process="(?i)(rundll32\.exe.{0,4}$)" + | join process_id [| tstats `security_content_summariesonly` + count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id + All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] + | table _time dest parent_process_name process_name process_path process process_id dest_port C2 + | `rundll32_with_no_command_line_arguments_with_network_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. diff --git a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml index e7de28956e..1845c37215 100644 --- a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml +++ b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml @@ -17,11 +17,11 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | regex process="(?i)(searchprotocolhost\.exe.{0,4}$)" | join process_guid [| tstats - `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port - !="0" by Ports.process_guid Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` - | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name - process_path process process_guid connection_to_CNC dest_port | `searchprotocolhost_with_no_command_line_with_network_filter`' + | regex process="(?i)(searchprotocolhost\.exe.{0,4}$)" | join process_id [| tstats `security_content_summariesonly` + count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id + All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] + | table _time dest parent_process_name process_name process_path process process_id dest_port C2 + | `searchprotocolhost_with_no_command_line_with_network_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `ports` node. From 3cb81550db75abf53d8e5587f16f8abc555fea02 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 15 Mar 2022 12:30:39 -0600 Subject: [PATCH 3/3] rookie mistake --- .../dllhost_with_no_command_line_arguments_with_network.yml | 2 +- .../gpupdate_with_no_command_line_arguments_with_network.yml | 2 +- .../rundll32_with_no_command_line_arguments_with_network.yml | 2 +- .../searchprotocolhost_with_no_command_line_with_network.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml index 0fa7c3f1ee..614061636c 100644 --- a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml @@ -13,7 +13,7 @@ description: The following analytic identifies DLLHost.exe with no command line parallel processes. Identify any suspicious module loads related to credential dumping or file writes. DLLHost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name=dllhost.exe by _time span=1h Processes.process_guid + where Processes.process_name=dllhost.exe by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(?i)(dllhost\.exe.{0,4}$)" | join process_id [| tstats `security_content_summariesonly` diff --git a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml index fcfb383ee1..b19ba37540 100644 --- a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml @@ -14,7 +14,7 @@ description: The following analytic identifies gpupdate.exe with no command line dumping or file writes. gpupdate.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name=gpupdate.exe by _time span=1h Processes.process_guid + where Processes.process_name=gpupdate.exe by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(?i)(gpupdate\.exe.{0,4}$)"| join process_id [| tstats `security_content_summariesonly` diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml index 46b784388a..bc4cd4c43b 100644 --- a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml @@ -14,7 +14,7 @@ description: The following analytic identifies rundll32.exe with no command line dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where `process_rundll32` by _time span=1h Processes.process_guid Processes.process_name + where `process_rundll32` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(?i)(rundll32\.exe.{0,4}$)" diff --git a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml index 1845c37215..72bb777f36 100644 --- a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml +++ b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml @@ -14,7 +14,7 @@ description: The following analytic identifies searchprotocolhost.exe with no co related to credential dumping or file writes. searchprotocolhost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_guid + where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(?i)(searchprotocolhost\.exe.{0,4}$)" | join process_id [| tstats `security_content_summariesonly`