From e9130822f356e2201b50c9a299722472a390dbbc Mon Sep 17 00:00:00 2001 From: root Date: Tue, 11 May 2021 08:14:34 +0000 Subject: [PATCH] Added detection testing service results inExcessive Usage Of Cacls App --- .../endpoint/excessive_usage_of_cacls_app.yml | 26 ++++++++++--------- 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/detections/endpoint/excessive_usage_of_cacls_app.yml b/detections/endpoint/excessive_usage_of_cacls_app.yml index 6d4bcef2a4..b947842ebc 100644 --- a/detections/endpoint/excessive_usage_of_cacls_app.yml +++ b/detections/endpoint/excessive_usage_of_cacls_app.yml @@ -6,18 +6,17 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect excessive usage of cacls,xcacls or icacls application to change file or folder permission. - This behavior is commonly seen in some adversaries attacker to impair some users from deleting or accessing - its malware components or artifact from the compromised machine. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id values(Processes.process_name) as process_name +description: This search is to detect excessive usage of cacls,xcacls or icacls application + to change file or folder permission. This behavior is commonly seen in some adversaries + attacker to impair some users from deleting or accessing its malware components + or artifact from the compromised machine. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id values(Processes.process_name) as process_name count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = "cacls.exe" OR Processes.process_name = "icacls.exe" OR Processes.process_name = "XCACLS.exe" - by Processes.parent_process_name Processes.parent_process Processes.dest Processes.user _time span=1m - | where count >=10 - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `excessive_usage_of_cacls_app_filter`' + where Processes.process_name = "cacls.exe" OR Processes.process_name = "icacls.exe" + OR Processes.process_name = "XCACLS.exe" by Processes.parent_process_name Processes.parent_process + Processes.dest Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_cacls_app_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -43,4 +42,7 @@ tags: - Processes.parent_process_name - Processes.dest - Processes.user - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log