admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2023-01-10 13:00:13 -08:00
committed by GitHub
parent 6797867e61 ab0d182a27
commit d70e0aa25b
1 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/account_discovery_with_net_app.yml
+8 -8
View File
@@ -1,12 +1,12 @@
name: Account Discovery With Net App
id: 339805ce-ac30-11eb-b87d-acde48001122
version: 3
date: '2021-09-16'
author: Teoderick Contreras, Splunk
version: 4
date: '2023-01-04'
author: Teoderick Contreras, Splunk, TheLawsOfChaos, Github Community
type: TTP
datamodel:
- Endpoint
description: this search is to detect a potential account discovery series of command
description: This search is to detect a potential account discovery series of command
used by several malware or attack to recon the target machine. This technique is
also seen in some note worthy malware like trickbot where it runs a cmd process,
or even drop its module that will execute the said series of net command. This series
@@ -16,16 +16,16 @@ description: this search is to detect a potential account discovery series of co
search: '| tstats `security_content_summariesonly` values(Processes.process) as process
values(Processes.parent_process) as parent_process values(Processes.process_id)
as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
where `process_net` AND (Processes.process="*user*" OR Processes.process="*config*"
where `process_net` AND (Processes.process="* user *" OR Processes.process="*config*"
OR Processes.process="*view /all*") by Processes.process_name Processes.dest Processes.user
Processes.parent_process_name | where count >=5 | `drop_dm_object_name(Processes)`
Processes.parent_process_name | where count >=4 | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `account_discovery_with_net_app_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product..
known_false_positives: admin or power user may used this series of command.
known_false_positives: Admin or power user may used this series of command.
references:
- https://labs.vipre.com/trickbot-and-its-modules/
- https://whitehat.eu/incident-response-case-study-featuring-ryuk-and-trickbot-part-2/
@@ -81,4 +81,4 @@ tags:
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
asset_type: Endpoint
asset_type: Endpoint