From 85f4f107a3757d0d34d27cd3a8b4287d9a0ffe38 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Tue, 21 Jun 2022 14:45:43 -0500 Subject: [PATCH 1/3] Changed to anomaly --- .../endpoint}/rundll32_lockworkstation.yml | 4 ++-- tests/endpoint/rundll32_lockworkstation.test.yml | 12 ++++++++++++ 2 files changed, 14 insertions(+), 2 deletions(-) rename {investigations => detections/endpoint}/rundll32_lockworkstation.yml (98%) create mode 100644 tests/endpoint/rundll32_lockworkstation.test.yml diff --git a/investigations/rundll32_lockworkstation.yml b/detections/endpoint/rundll32_lockworkstation.yml similarity index 98% rename from investigations/rundll32_lockworkstation.yml rename to detections/endpoint/rundll32_lockworkstation.yml index f20d95d919..9afac9f1f1 100644 --- a/investigations/rundll32_lockworkstation.yml +++ b/detections/endpoint/rundll32_lockworkstation.yml @@ -1,9 +1,9 @@ name: Rundll32 LockWorkStation id: fa90f372-f91d-11eb-816c-acde48001122 -version: 1 +version: 2 date: '2021-08-09' author: Teoderick Contreras, Splunk -type: Investigation +type: Anomaly datamodel: - Endpoint description: This search is to detect a suspicious rundll32 commandline to lock the diff --git a/tests/endpoint/rundll32_lockworkstation.test.yml b/tests/endpoint/rundll32_lockworkstation.test.yml new file mode 100644 index 0000000000..4d2c2ec50d --- /dev/null +++ b/tests/endpoint/rundll32_lockworkstation.test.yml @@ -0,0 +1,12 @@ +rname: Rundll32 LockWorkStation Unit Test +tests: +- name: Rundll32 LockWorkStation + file: endpoint/rundll32_lockworkstation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog From e681b766c22a11e2602fb0e01fc16dea5564ef3b Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Tue, 21 Jun 2022 14:59:48 -0500 Subject: [PATCH 2/3] Fixing field name --- tests/endpoint/rundll32_lockworkstation.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/rundll32_lockworkstation.test.yml b/tests/endpoint/rundll32_lockworkstation.test.yml index 4d2c2ec50d..2e913208f4 100644 --- a/tests/endpoint/rundll32_lockworkstation.test.yml +++ b/tests/endpoint/rundll32_lockworkstation.test.yml @@ -1,4 +1,4 @@ -rname: Rundll32 LockWorkStation Unit Test +name: Rundll32 LockWorkStation Unit Test tests: - name: Rundll32 LockWorkStation file: endpoint/rundll32_lockworkstation.yml From 575cd80e017aadc2908d65ae3eb5c1e93b7bea7e Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Tue, 21 Jun 2022 15:17:25 -0500 Subject: [PATCH 3/3] Updated observable & asset_type --- detections/endpoint/rundll32_lockworkstation.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/rundll32_lockworkstation.yml b/detections/endpoint/rundll32_lockworkstation.yml index 9afac9f1f1..3a596146e7 100644 --- a/detections/endpoint/rundll32_lockworkstation.yml +++ b/detections/endpoint/rundll32_lockworkstation.yml @@ -46,7 +46,7 @@ tags: role: - Victim - name: SourceImage - type: process name + type: Process Name role: - Attacker product: @@ -65,3 +65,4 @@ tags: - Processes.parent_process_id risk_score: 25 security_domain: endpoint + asset_type: Endpoint \ No newline at end of file