From d64cbafc565cc19f979976fc09ae671715e55e2a Mon Sep 17 00:00:00 2001 From: bpatel Date: Tue, 19 May 2020 12:00:31 -0700 Subject: [PATCH] adding a tested mitre ID --- ...ohibited_applications_spawning_cmd_exe.yml | 38 +++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 detections/detect_prohibited_applications_spawning_cmd_exe.yml diff --git a/detections/detect_prohibited_applications_spawning_cmd_exe.yml b/detections/detect_prohibited_applications_spawning_cmd_exe.yml new file mode 100644 index 0000000000..3d59b92bf2 --- /dev/null +++ b/detections/detect_prohibited_applications_spawning_cmd_exe.yml @@ -0,0 +1,38 @@ +name: Detect Prohibited Applications Spawning cmd exe +id: dcfd6b40-42f9-469d-a433-2e53f7486664 +version: 3 +date: '2020-02-03' +description: This search looks for executions of cmd.exe spawned by a process that + is often abused by attackers and that does not typically launch cmd.exe. +how_to_implement: You must be ingesting data that records process activity from your + hosts and populates the Endpoint data model with the resultant dataset. This search + includes a lookup file, `prohibited_apps_launching_cmd.csv`, that contains a list + of processes that should not be spawning cmd.exe. You can modify this lookup to + better suit your environment. +type: ESCU +references: [] +author: Bhavin Patel, Splunk +search: '| tstats `security_content_summariesonly` count values(Processes.process) + as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name=cmd.exe by Processes.parent_process_name Processes.process_name + Processes.dest Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)` |search [`prohibited_apps_launching_cmd`] | `detect_prohibited_applications_spawning_cmd_exe_filter`' +known_false_positives: There are circumstances where an application may legitimately + execute and interact with the Windows command-line interface. Investigate and modify + the lookup file, as appropriate. +tags: + analytics_story: + - Suspicious Command-Line Executions + - Suspicious MSHTA Activity + mitre_attack_id: + - T1059 + - T1075 + kill_chain_phases: + - Exploitation + cis20: + - CIS 8 + nist: + - PR.PT + - DE.CM + security_domain: endpoint + asset_type: Endpoint