admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
github-actions[bot]
2021-08-31 21:25:08 +00:00
committed by GitHub
parent 027c8341a6 32124761cf
commit d3f6c3f6ac
1 changed files with 22 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml
+22 -14
View File
@@ -1,24 +1,31 @@
name: Process Creating LNK file in Suspicious Location
id: 5d814af1-1041-47b5-a9ac-d754e82e9a26
version: 4
date: '2021-01-28'
version: 5
date: '2021-08-26'
author: Jose Hernandez, Splunk
type: TTP
datamodel: []
datamodel:
- Endpoint
description: This search looks for a process launching an `*.lnk` file under `C:\User*`
or `*\Local\Temp\*`. This is common behavior used by various spear phishing tools.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.lnk"
AND Filesystem.file_path="C:\\Temp*" by _time span=1h Filesystem.process_id Filesystem.file_name
Filesystem.file_path Filesystem.file_hash Filesystem.user | `drop_dm_object_name(Filesystem)`
| rename process_id as lnk_pid | join lnk_pid, _time [| tstats `security_content_summariesonly`
count FROM datamodel=Endpoint.Processes where Processes.process_name=* by _time
span=1h Processes.parent_process_id Processes.process_id Processes.process_name
Processes.dest Processes.process_path Processes.process | `drop_dm_object_name(Processes)`
| rename parent_process_id as lnk_pid | fields _time lnk_pid process_id dest process_name
process_path process] | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| table firstTime, lastTime, lnk_pid, process_id, user, dest, file_name, file_path,
process_name, process, process_path, file_hash | `process_creating_lnk_file_in_suspicious_location_filter` '
as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.lnk" AND (Filesystem.file_path="C:\\User\\*" OR Filesystem.file_path="*\\Temp\\*")
by _time span=1h Filesystem.process_guid Filesystem.file_name Filesystem.file_path Filesystem.file_hash Filesystem.user
| `drop_dm_object_name(Filesystem)`
| rename process_guid as lnk_guid
| join lnk_guid, _time
[| tstats `security_content_summariesonly`
count FROM datamodel=Endpoint.Processes where Processes.process_name=* by _time
span=1h Processes.parent_process_guid Processes.process_id Processes.process_name
Processes.dest Processes.process_path Processes.process
| `drop_dm_object_name(Processes)`
| rename parent_process_guid as lnk_guid
| fields _time lnk_guid process_id dest process_name
process_path process]
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| table firstTime, lastTime, lnk_guid, process_id, user, dest, file_name, file_path, process_name, process, process_path, file_hash
| `process_creating_lnk_file_in_suspicious_location_filter`'
how_to_implement: You must be ingesting data that records filesystem and process activity
from your hosts to populate the Endpoint data model. This is typically populated
via endpoint detection-and-response product, such as Carbon Black, or endpoint data
@@ -77,3 +84,4 @@ tags:
- Filesystem.user
risk_score: 63
security_domain: network