From 8320e6bb55946b01f0c282d10bef3ae399f0e8bd Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 17 Aug 2023 10:49:41 +0200 Subject: [PATCH] fix_susp_copy_from_system32 --- .../endpoint/suspicious_copy_on_system32.yml | 22 +++++++++++-------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/suspicious_copy_on_system32.yml b/detections/endpoint/suspicious_copy_on_system32.yml index c054897ab5..e2b5685182 100644 --- a/detections/endpoint/suspicious_copy_on_system32.yml +++ b/detections/endpoint/suspicious_copy_on_system32.yml @@ -1,7 +1,7 @@ name: Suspicious Copy on System32 id: ce633e56-25b2-11ec-9e76-acde48001122 version: 1 -date: '2021-10-05' +date: '2023-08-17' author: Teoderick Contreras, Splunk status: production type: TTP @@ -12,14 +12,18 @@ description: This analytic is to detect a suspicious copy of file from systemroo but this is really a anomaly that needs to be check within the network. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name - IN("cmd.exe", "powershell*","pwsh.exe", "sqlps.exe", "sqltoolsps.exe", "powershell_ise.exe") - AND `process_copy` AND Processes.process IN("*\\Windows\\System32\*", "*\\Windows\\SysWow64\\*") - AND Processes.process = "*copy*" by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `suspicious_copy_on_system32_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.parent_process_name IN("cmd.exe", "powershell*","pwsh.exe", "sqlps.exe", "sqltoolsps.exe", "powershell_ise.exe") + AND `process_copy` AND Processes.process IN("*\\Windows\\System32\\*", "*\\Windows\\SysWow64\\*") + AND Processes.process = "*copy*" + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id temp + | `drop_dm_object_name(Processes)` + | eval splitted_commandline=split(process," ") + | eval first_cmdline=lower(mvindex(splitted_commandline,0)) + | where NOT LIKE(first_cmdline,"%\\windows\\system32\\%") AND NOT LIKE(first_cmdline,"%\\windows\\syswow64\\%") + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + |`suspicious_copy_on_system32_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,