admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inOffice Document Spawned Child Process To Download

Browse Source
This commit is contained in:
root
2021-04-20 16:04:58 +00:00
parent 868df41593
commit dee37ff335
1 changed files with 16 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/office_document_spawned_child_process_to_download.yml
+16 -10
View File
@@ -6,18 +6,21 @@ author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: this search is to detect potential malicious office document executing lolbin child process to download payload or other malware.
Since most of the attacker abused the capability of office document to execute living on land application to blend it to the normal noise in the infected machine to cover its track.
search: '`sysmon` EventCode=1 parent_process_name IN ("powerpnt.exe", "winword.exe", "excel.exe", "visio.exe", "wordpad.exe")
process_name = "*.exe" cmdline IN ("*http:*","*https:*") NOT(OriginalFileName IN("*\\firefox.exe", "*\\chrome.exe","*\\iexplore.exe","*\\msedge.exe"))
| stats min(_time) as firstTime max(_time) as lastTime count by parent_process_name process_name parent_process cmdline process_id OriginalFileName ProcessGuid Computer EventCode
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `office_document_spawned_child_process_to_download_filter`'
description: this search is to detect potential malicious office document executing
lolbin child process to download payload or other malware. Since most of the attacker
abused the capability of office document to execute living on land application to
blend it to the normal noise in the infected machine to cover its track.
search: '`sysmon` EventCode=1 parent_process_name IN ("powerpnt.exe", "winword.exe",
"excel.exe", "visio.exe", "wordpad.exe") process_name = "*.exe" cmdline IN ("*http:*","*https:*") NOT(OriginalFileName
IN("*\\firefox.exe", "*\\chrome.exe","*\\iexplore.exe","*\\msedge.exe")) | stats
min(_time) as firstTime max(_time) as lastTime count by parent_process_name process_name
parent_process cmdline process_id OriginalFileName ProcessGuid Computer EventCode
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_spawned_child_process_to_download_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances office application and browser may be used.
Sysmon TA. Tune and filter known instances office application and browser may be
used.
known_false_positives: default browser not in the filter list
references:
- https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/#
@@ -43,4 +46,7 @@ tags:
- ProcessGuid
- Computer
- EventCode
security_domain: endpoint
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets2/windows-sysmon.log