admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2023-08-17 10:06:52 -07:00
committed by GitHub
parent 03d19eca29 bed0f8f4ca
commit e160359cb9
1 changed files with 13 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/suspicious_copy_on_system32.yml
+13 -9
View File
@@ -1,7 +1,7 @@
name: Suspicious Copy on System32
id: ce633e56-25b2-11ec-9e76-acde48001122
version: 1
date: '2021-10-05'
date: '2023-08-17'
author: Teoderick Contreras, Splunk
status: production
type: TTP
@@ -12,14 +12,18 @@ description: This analytic is to detect a suspicious copy of file from systemroo
but this is really a anomaly that needs to be check within the network.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
IN("cmd.exe", "powershell*","pwsh.exe", "sqlps.exe", "sqltoolsps.exe", "powershell_ise.exe")
AND `process_copy` AND Processes.process IN("*\\Windows\\System32\*", "*\\Windows\\SysWow64\\*")
AND Processes.process = "*copy*" by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
`suspicious_copy_on_system32_filter`'
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
where Processes.parent_process_name IN("cmd.exe", "powershell*","pwsh.exe", "sqlps.exe", "sqltoolsps.exe", "powershell_ise.exe")
AND `process_copy` AND Processes.process IN("*\\Windows\\System32\\*", "*\\Windows\\SysWow64\\*")
AND Processes.process = "*copy*"
by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id temp
| `drop_dm_object_name(Processes)`
| eval splitted_commandline=split(process," ")
| eval first_cmdline=lower(mvindex(splitted_commandline,0))
| where NOT LIKE(first_cmdline,"%\\windows\\system32\\%") AND NOT LIKE(first_cmdline,"%\\windows\\syswow64\\%")
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
|`suspicious_copy_on_system32_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,