adding a tested mitre ID

detections/detect_prohibited_applications_spawning_cmd_exe.yml

@@ -0,0 +1,38 @@
+name: Detect Prohibited Applications Spawning cmd exe
+id: dcfd6b40-42f9-469d-a433-2e53f7486664
+version: 3
+date: '2020-02-03'
+description: This search looks for executions of cmd.exe spawned by a process that
+  is often abused by attackers and that does not typically launch cmd.exe.
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts and populates the Endpoint data model with the resultant dataset. This search
+  includes a lookup file, `prohibited_apps_launching_cmd.csv`, that contains a list
+  of processes that should not be spawning cmd.exe. You can modify this lookup to
+  better suit your environment.
+type: ESCU
+references: []
+author: Bhavin Patel, Splunk
+search: '| tstats `security_content_summariesonly` count values(Processes.process)
+  as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where Processes.process_name=cmd.exe by Processes.parent_process_name Processes.process_name
+  Processes.dest Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)` |search [`prohibited_apps_launching_cmd`] | `detect_prohibited_applications_spawning_cmd_exe_filter`'
+known_false_positives: There are circumstances where an application may legitimately
+  execute and interact with the Windows command-line interface. Investigate and modify
+  the lookup file, as appropriate.
+tags:
+  analytics_story:
+  - Suspicious Command-Line Executions
+  - Suspicious MSHTA Activity
+  mitre_attack_id:
+  - T1059
+  - T1075
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint