Branch was auto-updated.

detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml

@@ -6,25 +6,30 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search is to detect a suspicious parent process execution of commandline
-  tool not in shell commandline. This technique was seen in FIN7 JSSLoader .net compile
-  payload where it run ipconfig.exe and systeminfo.exe using .net application. This
-  event cause some good TTP since those tool are commonly run in commandline not by
-  another application. This TTP is a good indicator for application gather host information
-  either an attacker or an automated tool made by admin.
+description: The following analytic identifies a non-standard parent process (not
+  matching CMD, PowerShell, or Explorer) spawning `ipconfig.exe` or `systeminfo.exe`.
+  This particular behavior was seen in FIN7's JSSLoader .NET payload. This is also
+  typically seen when an adversary is injected into another process performing different
+  discovery techniques. This event stands out as a TTP since these tools are commonly
+  executed with a shell application or Explorer parent, and not by another application.
+  This TTP is a good indicator for an adversary gathering host information, but one
+  possible false positive might be an automated tool used by a system administator.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where  (Processes.process_name = "ipconfig.exe"
   OR Processes.process_name = "systeminfo.exe") AND NOT (Processes.parent_process_name
-  = "cmd.exe" OR Processes.parent_process_name = "powershell*" OR Processes.parent_process_name
-  = "explorer.exe") by Processes.parent_process_name Processes.parent_process Processes.process_name
-  Processes.process_id Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)`
+  = "cmd.exe" OR Processes.parent_process_name = "powershell*" OR Processes.parent_process_name="pwsh.exe"
+  OR Processes.parent_process_name = "explorer.exe") by Processes.parent_process_name
+  Processes.parent_process Processes.process_name Processes.original_file_name Processes.process_id
+  Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmdline_tool_not_executed_in_cmd_shell_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: network operator or admin may create this type of tool to gather
-  host information
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: A network operator or systems administrator may utilize an
+  automated host discovery application that may generate false positives. Filter as
+  needed.
 references:
 - https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
 - https://attack.mitre.org/groups/G0046/
@@ -41,8 +46,8 @@ tags:
   impact: 70
   kill_chain_phases:
   - Exploitation
-  message: parent process name $parent_process_name$ with child process $process_name$
-    to execute commandline tool in $dest$
+  message: A non-standard parent process $parent_process_name$ spawned child process
+    $process_name$ to execute command-line tool on $dest$.
   mitre_attack_id:
   - T1059
   - T1059.007
@@ -55,18 +60,30 @@ tags:
     type: User
     role:
     - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process_id
-  - Processes.process
   - Processes.dest
   - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint