admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'automated_detection_service' of github.com:splunk/security-content into automated_detection_service

Browse Source
This commit is contained in:
P4T12ICK
2020-10-13 16:57:23 +02:00
parent 2565e75939 b355f71dbd
commit e33bda29b8
1 changed files with 13 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/system_information_discovery_detection.yml
+13 -15
View File
@@ -1,24 +1,20 @@
name: System Information Discovery Detection
id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72
version: 1
author: Patrick Bareiss, Splunk
date: '2020-10-12'
description: Detect system information discovery techniques used by attackers to understand
configurations of the system to further exploit it.
type: ESCU
id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72
known_false_positives: Administrators debugging servers
name: System Information Discovery Detection
references:
- https://oscp.infosecsanyam.in/priv-escalation/windows-priv-escalation
author: Patrick Bareiss, Splunk
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
from datamodel=Endpoint.Processes
where (Processes.process="*wmic* qfe*" OR Processes.process=*systeminfo* OR Processes.process=*hostname*)
by Processes.user Processes.process_name Processes.process Processes.dest
| `drop_dm_object_name(Processes)`
| eventstats dc(process) as dc_processes_by_dest by dest
| where dc_processes_by_dest > 2
| stats values(process) min(firstTime) as firstTime max(lastTime) as lastTime by user, dest
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processes.process="*wmic* qfe*"
OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.user
Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)`
| eventstats dc(process) as dc_processes_by_dest by dest | where dc_processes_by_dest
> 2 | stats values(process) min(firstTime) as firstTime max(lastTime) as lastTime
by user, dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
| `system_information_discovery_detection_filter`'
known_false_positives: Administrators debugging servers
tags:
analytics_story:
- Discovery Techniques
@@ -36,3 +32,5 @@ tags:
nist:
- DE.CM
security_domain: endpoint
type: ESCU
version: 1