admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2023-03-07 00:20:09 -08:00
committed by GitHub
parent d044832578 788359e169
commit e5a3abaedb
70 changed files with 1331 additions and 894 deletions
Download Patch File Download Diff File Expand all files Collapse all files
data_sources/endpoint/Sysmon_Event_ID_1.yml
+2
View File
@@ -53,10 +53,12 @@ convert_to_log_source:
mapping:
ProcessId: NewProcessId
Image: NewProcessName
Image|endswith: NewProcessName|endswith
CommandLine: Process_Command_Line
User: SubjectUserSid
ParentProcessId: ProcessId
ParentImage: ParentProcessName
ParentImage|endswith: ParentProcessName|endswith
Computer: Computer
- data_source: Crowdstrike Process
mapping:
data_sources/endpoint/Windows_Security_4688.yml
+8 -4
View File
@@ -30,20 +30,24 @@ field_mappings:
data_set: Endpoint.Processes
mapping:
NewProcessId: Processes.process_id
NewProcessName: Processes.process_name
NewProcessName: Processes.process_path
NewProcessName|endswith: Processes.process_name
Process_Command_Line: Processes.process
SubjectUserSid: Processes.user
ProcessId: Processes.parent_process_id
ParentProcessName: Processes.parent_process_name
ParentProcessName: Processes.parent_process_path
ParentProcessName|endswith: Processes.parent_process_name
Computer: Processes.dest
- data_model: ocsf
mapping:
NewProcessId: process.pid
NewProcessName: process.file.name
NewProcessName: process.file.path
NewProcessName|endswith: process.file.name
Process_Command_Line: process.cmd_line
SubjectUserSid: process.user.name
ProcessId: actor.process.pid
ParentProcessName: actor.process.file.name
ParentProcessName: actor.process.file.path
ParentProcessName|endswith: actor.process.file.name
Computer: device.hostname
convert_to_log_source:
- data_source: Sysmon Event ID 1
ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml
+19 -13
View File
@@ -14,19 +14,21 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (process_file_name="WinRAR.exe" OR like(process_file_name, "7z%")
OR like(process_file_name, "winzip%")) AND (like(actor_process_file_name, "%powershell.exe")
OR like(actor_process_file_name, "%cmd.exe")) --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(process_file_name="WinRAR.exe" OR like(process_file_name, "7z%") OR like(process_file_name,
"winzip%")) AND (like(actor_process_file_name, "%powershell.exe") OR like(actor_process_file_name,
"%cmd.exe")) --finding_report--'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -72,6 +74,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -80,6 +84,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___attempt_to_delete_services.yml
+17 -12
View File
@@ -17,18 +17,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="sc.exe" AND like(process_cmd_line, "%delete%")
--finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
process_file_name="sc.exe" AND like(process_cmd_line, "%delete%") --finding_report--'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -72,6 +73,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -80,6 +83,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___attempt_to_disable_services.yml
+18 -12
View File
@@ -17,18 +17,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where like(process_cmd_line, "%config%") AND like(process_cmd_line, "%disabled%")
AND process_file_name="sc.exe" --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
like(process_cmd_line, "%config%") AND like(process_cmd_line, "%disabled%") AND
process_file_name="sc.exe" --finding_report--'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -71,6 +73,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -79,6 +83,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
+17 -11
View File
@@ -15,17 +15,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (process_file_name="reg.exe" OR process_file_name="cmd.exe") AND (match_regex(process_cmd_line,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(process_file_name="reg.exe" OR process_file_name="cmd.exe") AND (match_regex(process_cmd_line,
/(?i)HKEY_LOCAL_MACHINE\\System/)=true OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true
OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(process_cmd_line,
/(?i)HKLM\\System/)=true OR match_regex(process_cmd_line, /(?i)HKLM\\SAM/)=true
@@ -71,6 +73,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -79,6 +83,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml
+18 -12
View File
@@ -15,18 +15,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="bcdedit.exe" AND (like(process_cmd_line, "%no%")
AND like(process_cmd_line, "%recoveryenabled%")) --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
process_file_name="bcdedit.exe" AND (like(process_cmd_line, "%no%") AND like(process_cmd_line,
"%recoveryenabled%")) --finding_report--'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
@@ -67,6 +69,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -75,6 +79,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml
+17 -12
View File
@@ -15,18 +15,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="cipher.exe" AND like(process_cmd_line, "%/W:%")
--finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
process_file_name="cipher.exe" AND like(process_cmd_line, "%/W:%") --finding_report--'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -68,6 +69,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -76,6 +79,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___delete_a_net_user.yml
+18 -12
View File
@@ -18,18 +18,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/delete%")
AND (process_file_name="net.exe" OR process_file_name="net1.exe") --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/delete%") AND (process_file_name="net.exe"
OR process_file_name="net1.exe") --finding_report--'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -71,6 +73,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -79,6 +83,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
+18 -13
View File
@@ -16,19 +16,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (process_file_name="icacls.exe" OR process_file_name="xcacls.exe"
OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, /(?i)deny/)=true
--finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe")
AND match_regex(process_cmd_line, /(?i)deny/)=true --finding_report--'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -69,6 +70,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -77,6 +80,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
+19 -13
View File
@@ -16,19 +16,21 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (actor_process_file_name="winword.exe" OR actor_process_file_name="excel.exe"
OR actor_process_file_name="outlook.exe" OR actor_process_file_name="acrobat.exe"
OR actor_process_file_name="acrord32.exe" OR actor_process_file_name="iexplore.exe"
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(actor_process_file_name="winword.exe" OR actor_process_file_name="excel.exe" OR
actor_process_file_name="outlook.exe" OR actor_process_file_name="acrobat.exe" OR
actor_process_file_name="acrord32.exe" OR actor_process_file_name="iexplore.exe"
OR actor_process_file_name="opera.exe" OR actor_process_file_name="firefox.exe"
OR actor_process_file_name="powershell.exe" OR actor_process_file_name IS NOT NULL)
OR (actor_process_file_name="java.exe" AND (NOT match_regex(parent_process, /(?i)patch1-Hotfix1a/)=true))
@@ -71,6 +73,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -79,6 +83,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml
+22 -17
View File
@@ -19,23 +19,24 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (like(process_cmd_line, "%--multi-thread-streams%") OR like(process_cmd_line,
"%--transfers%") OR like(process_cmd_line, "%--auto-confirm%") OR like(process_cmd_line,
"%--ignore-existing%") OR like(process_cmd_line, "%--no-check-certificate%") OR
like(process_cmd_line, "%--progress%") OR like(process_cmd_line, "%--config%") OR
like(process_cmd_line, "%ftp%") OR like(process_cmd_line, "%pcloud%") OR like(process_cmd_line,
"%mega%") OR like(process_cmd_line, "%copy%")) AND process_file_name="rclone.exe"
--finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(like(process_cmd_line, "%--multi-thread-streams%") OR like(process_cmd_line, "%--transfers%")
OR like(process_cmd_line, "%--auto-confirm%") OR like(process_cmd_line, "%--ignore-existing%")
OR like(process_cmd_line, "%--no-check-certificate%") OR like(process_cmd_line,
"%--progress%") OR like(process_cmd_line, "%--config%") OR like(process_cmd_line,
"%ftp%") OR like(process_cmd_line, "%pcloud%") OR like(process_cmd_line, "%mega%")
OR like(process_cmd_line, "%copy%")) AND process_file_name="rclone.exe" --finding_report--'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
@@ -80,6 +81,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -88,6 +91,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___disable_net_user_account.yml
+18 -12
View File
@@ -16,18 +16,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/active:no%")
AND (process_file_name="net.exe" OR process_file_name="net1.exe") --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/active:no%") AND
(process_file_name="net.exe" OR process_file_name="net1.exe") --finding_report--'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -70,6 +72,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -78,6 +82,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml
+19 -13
View File
@@ -18,19 +18,21 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (like(process_cmd_line, "%-retry=%") OR like(process_cmd_line, "%-type=%")
OR like(process_cmd_line, "%-q=%") OR like(process_cmd_line, "%-qt=%") OR like(process_cmd_line,
"%-querytype=%")) AND process_file_name="nslookup.exe" --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(like(process_cmd_line, "%-retry=%") OR like(process_cmd_line, "%-type=%") OR like(process_cmd_line,
"%-q=%") OR like(process_cmd_line, "%-qt=%") OR like(process_cmd_line, "%-querytype=%"))
AND process_file_name="nslookup.exe" --finding_report--'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
@@ -75,6 +77,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -83,6 +87,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml
+17 -12
View File
@@ -15,18 +15,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where like(process_cmd_line, "%setzerodata%") AND process_file_name="fsutil.exe"
--finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
like(process_cmd_line, "%setzerodata%") AND process_file_name="fsutil.exe" --finding_report--'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -70,6 +71,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -78,6 +81,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
+18 -13
View File
@@ -16,19 +16,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (process_file_name="icacls.exe" OR process_file_name="xcacls.exe"
OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, /(?i)grant/)=true
--finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe")
AND match_regex(process_cmd_line, /(?i)grant/)=true --finding_report--'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -69,6 +70,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -77,6 +80,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml
+17 -12
View File
@@ -16,18 +16,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="attrib.exe" AND match_regex(process_cmd_line, /(?i)/)=true
--finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
process_file_name="attrib.exe" AND match_regex(process_cmd_line, /(?i)/)=true --finding_report--'
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
@@ -71,6 +72,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -79,6 +82,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
+17 -11
View File
@@ -18,17 +18,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (match_regex(process_cmd_line, /(?i)S-1-1-0:/)=true OR match_regex(process_cmd_line,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(match_regex(process_cmd_line, /(?i)S-1-1-0:/)=true OR match_regex(process_cmd_line,
/(?i)SYSTEM:/)=true OR match_regex(process_cmd_line, /(?i)everyone:/)=true) AND
(process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe")
--finding_report--'
@@ -71,6 +73,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -79,6 +83,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml
+21 -15
View File
@@ -15,21 +15,23 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (process_file_name="cscript.exe" OR process_file_name="wscript.exe")
AND (match_regex(actor_process_file_name, /(?i)visio.exe/)=true OR match_regex(actor_process_file_name,
/(?i)mspub.exe/)=true OR match_regex(actor_process_file_name, /(?i)powerpnt.exe/)=true
OR match_regex(actor_process_file_name, /(?i)excel.exe/)=true OR match_regex(actor_process_file_name,
/(?i)winword.exe/)=true) --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(process_file_name="cscript.exe" OR process_file_name="wscript.exe") AND (match_regex(actor_process_file_name,
/(?i)visio.exe/)=true OR match_regex(actor_process_file_name, /(?i)mspub.exe/)=true
OR match_regex(actor_process_file_name, /(?i)powerpnt.exe/)=true OR match_regex(actor_process_file_name,
/(?i)excel.exe/)=true OR match_regex(actor_process_file_name, /(?i)winword.exe/)=true)
--finding_report--'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -73,6 +75,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -81,6 +85,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml
+18 -13
View File
@@ -16,19 +16,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where like(process_cmd_line, "%shadowstorage%") AND like(process_cmd_line,
"%resize%") AND like(process_cmd_line, "%maxsize%") AND process_file_name="vssadmin.exe"
--finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
like(process_cmd_line, "%shadowstorage%") AND like(process_cmd_line, "%resize%")
AND like(process_cmd_line, "%maxsize%") AND process_file_name="vssadmin.exe" --finding_report--'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -71,6 +72,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -79,6 +82,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___sdelete_application_execution.yml
+28 -22
View File
@@ -17,28 +17,30 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (like(process_cmd_line, "%.xls%") OR like(process_cmd_line, "%.gz%")
OR like(process_cmd_line, "%.tar%") OR like(process_cmd_line, "%.rar%") OR like(process_cmd_line,
"%.zip%") OR like(process_cmd_line, "%.7z%") OR like(process_cmd_line, "%.bmp%")
OR like(process_cmd_line, "%.gif%") OR like(process_cmd_line, "%.png%") OR like(process_cmd_line,
"%.jpg%") OR like(process_cmd_line, "%.txt%") OR like(process_cmd_line, "%.log%")
OR like(process_cmd_line, "%.key%") OR like(process_cmd_line, "%.pdf%") OR like(process_cmd_line,
"%.rtf%") OR like(process_cmd_line, "%.ppt%") OR like(process_cmd_line, "%.xls%")
OR like(process_cmd_line, "%.doc%") OR like(process_cmd_line, "%-nobanner%") OR
like(process_cmd_line, "%/accepteula%") OR like(process_cmd_line, "%-z %") OR like(process_cmd_line,
"%-s %") OR like(process_cmd_line, "%-q %") OR like(process_cmd_line, "%-r %") OR
like(process_cmd_line, "%-p %") OR like(process_cmd_line, "%-f %") OR like(process_cmd_line,
"%-c %")) AND like(process_file_name, "%sdelete%") --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(like(process_cmd_line, "%.xls%") OR like(process_cmd_line, "%.gz%") OR like(process_cmd_line,
"%.tar%") OR like(process_cmd_line, "%.rar%") OR like(process_cmd_line, "%.zip%")
OR like(process_cmd_line, "%.7z%") OR like(process_cmd_line, "%.bmp%") OR like(process_cmd_line,
"%.gif%") OR like(process_cmd_line, "%.png%") OR like(process_cmd_line, "%.jpg%")
OR like(process_cmd_line, "%.txt%") OR like(process_cmd_line, "%.log%") OR like(process_cmd_line,
"%.key%") OR like(process_cmd_line, "%.pdf%") OR like(process_cmd_line, "%.rtf%")
OR like(process_cmd_line, "%.ppt%") OR like(process_cmd_line, "%.xls%") OR like(process_cmd_line,
"%.doc%") OR like(process_cmd_line, "%-nobanner%") OR like(process_cmd_line, "%/accepteula%")
OR like(process_cmd_line, "%-z %") OR like(process_cmd_line, "%-s %") OR like(process_cmd_line,
"%-q %") OR like(process_cmd_line, "%-r %") OR like(process_cmd_line, "%-p %") OR
like(process_cmd_line, "%-f %") OR like(process_cmd_line, "%-c %")) AND like(process_file_name,
"%sdelete%") --finding_report--'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -82,6 +84,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -90,6 +94,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml
+60 -51
View File
@@ -18,55 +18,57 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (process_file_name="xwizard.exe" OR process_file_name="xpsrchvw.exe"
OR process_file_name="xcopy.exe" OR process_file_name="wusa.exe" OR process_file_name="wuauclt.exe"
OR process_file_name="wuapp.exe" OR process_file_name="wuapihost.exe" OR process_file_name="wsqmcons.exe"
OR process_file_name="wsmprovhost.exe" OR process_file_name="wscript.exe" OR process_file_name="write.exe"
OR process_file_name="wpr.exe" OR process_file_name="wpnpinst.exe" OR process_file_name="wowreg32.exe"
OR process_file_name="wlrmdr.exe" OR process_file_name="wlanext.exe" OR process_file_name="wksprt.exe"
OR process_file_name="wkspbroker.exe" OR process_file_name="wisptis.exe" OR process_file_name="winver.exe"
OR process_file_name="winrshost.exe" OR process_file_name="winrs.exe" OR process_file_name="winresume.exe"
OR process_file_name="winlogon.exe" OR process_file_name="winload.exe" OR process_file_name="wininit.exe"
OR process_file_name="wimserv.exe" OR process_file_name="wifitask.exe" OR process_file_name="wiawow64.exe"
OR process_file_name="wiaacmgr.exe" OR process_file_name="whoami.exe" OR process_file_name="where.exe"
OR process_file_name="wextract.exe" OR process_file_name="wevtutil.exe" OR process_file_name="wermgr.exe"
OR process_file_name="wecutil.exe" OR process_file_name="wbengine.exe" OR process_file_name="wbadmin.exe"
OR process_file_name="waitfor.exe" OR process_file_name="w32tm.exe" OR process_file_name="vssadmin.exe"
OR process_file_name="vmicsvc.exe" OR process_file_name="verifiergui.exe" OR process_file_name="verifier.exe"
OR process_file_name="verclsid.exe" OR process_file_name="vdsldr.exe" OR process_file_name="vds.exe"
OR process_file_name="userinit.exe" OR process_file_name="upnpcont.exe" OR process_file_name="unregmp2.exe"
OR process_file_name="unlodctr.exe" OR process_file_name="ucsvc.exe" OR process_file_name="tzutil.exe"
OR process_file_name="tzsync.exe" OR process_file_name="typeperf.exe" OR process_file_name="tskill.exe"
OR process_file_name="tsdiscon.exe" OR process_file_name="tscon.exe" OR process_file_name="tracerpt.exe"
OR process_file_name="tpmvscmgrsvr.exe" OR process_file_name="tpmvscmgr.exe" OR
process_file_name="timeout.exe" OR process_file_name="tcmsetup.exe" OR process_file_name="taskmgr.exe"
OR process_file_name="tasklist.exe" OR process_file_name="taskkill.exe" OR process_file_name="taskhostw.exe"
OR process_file_name="taskhost.exe" OR process_file_name="taskeng.exe" OR process_file_name="takeown.exe"
OR process_file_name="tabcal.exe" OR process_file_name="systray.exe" OR process_file_name="systemreset.exe"
OR process_file_name="systeminfo.exe" OR process_file_name="syskey.exe" OR process_file_name="sxstrace.exe"
OR process_file_name="svchost.exe" OR process_file_name="subst.exe" OR process_file_name="srdelayed.exe"
OR process_file_name="spreview.exe" OR process_file_name="sppsvc.exe" OR process_file_name="spoolsv.exe"
OR process_file_name="spinstall.exe" OR process_file_name="sort.exe" OR process_file_name="snmptrap.exe"
OR process_file_name="smss.exe" OR process_file_name="slui.exe" OR process_file_name="sihost.exe"
OR process_file_name="sigverif.exe" OR process_file_name="shutdown.exe" OR process_file_name="shrpubw.exe"
OR process_file_name="shadow.exe" OR process_file_name="sfc.exe" OR process_file_name="setx.exe"
OR process_file_name="setupugc.exe" OR process_file_name="setupcl.exe" OR process_file_name="setspn.exe"
OR process_file_name="sethc.exe" OR process_file_name="sessionmsg.exe" OR process_file_name="services.exe"
OR process_file_name="secinit.exe" OR process_file_name="sdiagnhost.exe" OR process_file_name="sdclt.exe"
OR process_file_name="sdchange.exe" OR process_file_name="sdbinst.exe" OR process_file_name="schtasks.exe"
OR process_file_name="sc.exe" OR process_file_name="sbunattend.exe" OR process_file_name="rwinsta.exe"
OR process_file_name="runonce.exe" OR process_file_name="rundll32.exe" OR process_file_name="runas.exe"
OR process_file_name="rstrui.exe" OR process_file_name="rrinstaller.exe" OR process_file_name="rmttpmvscmgrsvr.exe"
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(process_file_name="xwizard.exe" OR process_file_name="xpsrchvw.exe" OR process_file_name="xcopy.exe"
OR process_file_name="wusa.exe" OR process_file_name="wuauclt.exe" OR process_file_name="wuapp.exe"
OR process_file_name="wuapihost.exe" OR process_file_name="wsqmcons.exe" OR process_file_name="wsmprovhost.exe"
OR process_file_name="wscript.exe" OR process_file_name="write.exe" OR process_file_name="wpr.exe"
OR process_file_name="wpnpinst.exe" OR process_file_name="wowreg32.exe" OR process_file_name="wlrmdr.exe"
OR process_file_name="wlanext.exe" OR process_file_name="wksprt.exe" OR process_file_name="wkspbroker.exe"
OR process_file_name="wisptis.exe" OR process_file_name="winver.exe" OR process_file_name="winrshost.exe"
OR process_file_name="winrs.exe" OR process_file_name="winresume.exe" OR process_file_name="winlogon.exe"
OR process_file_name="winload.exe" OR process_file_name="wininit.exe" OR process_file_name="wimserv.exe"
OR process_file_name="wifitask.exe" OR process_file_name="wiawow64.exe" OR process_file_name="wiaacmgr.exe"
OR process_file_name="whoami.exe" OR process_file_name="where.exe" OR process_file_name="wextract.exe"
OR process_file_name="wevtutil.exe" OR process_file_name="wermgr.exe" OR process_file_name="wecutil.exe"
OR process_file_name="wbengine.exe" OR process_file_name="wbadmin.exe" OR process_file_name="waitfor.exe"
OR process_file_name="w32tm.exe" OR process_file_name="vssadmin.exe" OR process_file_name="vmicsvc.exe"
OR process_file_name="verifiergui.exe" OR process_file_name="verifier.exe" OR process_file_name="verclsid.exe"
OR process_file_name="vdsldr.exe" OR process_file_name="vds.exe" OR process_file_name="userinit.exe"
OR process_file_name="upnpcont.exe" OR process_file_name="unregmp2.exe" OR process_file_name="unlodctr.exe"
OR process_file_name="ucsvc.exe" OR process_file_name="tzutil.exe" OR process_file_name="tzsync.exe"
OR process_file_name="typeperf.exe" OR process_file_name="tskill.exe" OR process_file_name="tsdiscon.exe"
OR process_file_name="tscon.exe" OR process_file_name="tracerpt.exe" OR process_file_name="tpmvscmgrsvr.exe"
OR process_file_name="tpmvscmgr.exe" OR process_file_name="timeout.exe" OR process_file_name="tcmsetup.exe"
OR process_file_name="taskmgr.exe" OR process_file_name="tasklist.exe" OR process_file_name="taskkill.exe"
OR process_file_name="taskhostw.exe" OR process_file_name="taskhost.exe" OR process_file_name="taskeng.exe"
OR process_file_name="takeown.exe" OR process_file_name="tabcal.exe" OR process_file_name="systray.exe"
OR process_file_name="systemreset.exe" OR process_file_name="systeminfo.exe" OR
process_file_name="syskey.exe" OR process_file_name="sxstrace.exe" OR process_file_name="svchost.exe"
OR process_file_name="subst.exe" OR process_file_name="srdelayed.exe" OR process_file_name="spreview.exe"
OR process_file_name="sppsvc.exe" OR process_file_name="spoolsv.exe" OR process_file_name="spinstall.exe"
OR process_file_name="sort.exe" OR process_file_name="snmptrap.exe" OR process_file_name="smss.exe"
OR process_file_name="slui.exe" OR process_file_name="sihost.exe" OR process_file_name="sigverif.exe"
OR process_file_name="shutdown.exe" OR process_file_name="shrpubw.exe" OR process_file_name="shadow.exe"
OR process_file_name="sfc.exe" OR process_file_name="setx.exe" OR process_file_name="setupugc.exe"
OR process_file_name="setupcl.exe" OR process_file_name="setspn.exe" OR process_file_name="sethc.exe"
OR process_file_name="sessionmsg.exe" OR process_file_name="services.exe" OR process_file_name="secinit.exe"
OR process_file_name="sdiagnhost.exe" OR process_file_name="sdclt.exe" OR process_file_name="sdchange.exe"
OR process_file_name="sdbinst.exe" OR process_file_name="schtasks.exe" OR process_file_name="sc.exe"
OR process_file_name="sbunattend.exe" OR process_file_name="rwinsta.exe" OR process_file_name="runonce.exe"
OR process_file_name="rundll32.exe" OR process_file_name="runas.exe" OR process_file_name="rstrui.exe"
OR process_file_name="rrinstaller.exe" OR process_file_name="rmttpmvscmgrsvr.exe"
OR process_file_name="resmon.exe" OR process_file_name="reset.exe" OR process_file_name="replace.exe"
OR process_file_name="repair-bde.exe" OR process_file_name="relog.exe" OR process_file_name="rekeywiz.exe"
OR process_file_name="regsvr32.exe" OR process_file_name="regini.exe" OR process_file_name="regedt32.exe"
@@ -238,8 +240,8 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
OR process_file_name="axinstui.exe" OR process_file_name="autoworkplace.exe" OR
process_file_name="authhost.exe" OR process_file_name="atbroker.exe" OR process_file_name="applicationframehost.exe"
OR process_file_name="adaptertroubleshooter.exe" OR process_file_name="arp.exe")
AND (NOT match_regex(process_path, /(?i)\\windows\\syswow64/)=true) AND (NOT match_regex(process_path,
/(?i)\\windows\\system32/)=true) --finding_report--'
AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) AND (NOT
match_regex(process_file_path, /(?i)\\windows\\system32/)=true) --finding_report--'
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
known_false_positives: None
references: []
@@ -259,6 +261,8 @@ tags:
type: User Name
- name: device.hostname
type: Hostname
- name: process.file.path
type: File
- name: process.file.name
type: File Name
- name: process.cmd_line
@@ -268,6 +272,7 @@ tags:
required_fields:
- process.user.name
- device.hostname
- process.file.path
- process.file.name
- process.cmd_line
risk_score: 56
@@ -275,6 +280,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -283,6 +290,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml
+17 -11
View File
@@ -15,17 +15,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="wbadmin.exe" AND (like(process_cmd_line, "%systemstatebackup%")
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
process_file_name="wbadmin.exe" AND (like(process_cmd_line, "%systemstatebackup%")
OR like(process_cmd_line, "%catalog%") OR like(process_cmd_line, "%delete%")) --finding_report--'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
@@ -69,6 +71,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -77,6 +81,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
+17 -11
View File
@@ -15,17 +15,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (match_regex(process_cmd_line, /(?i)powershell/)=true OR match_regex(process_cmd_line,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(match_regex(process_cmd_line, /(?i)powershell/)=true OR match_regex(process_cmd_line,
/(?i)setup/)=true OR match_regex(process_cmd_line, /(?i)application/)=true OR match_regex(process_cmd_line,
/(?i)sysmon/)=true OR match_regex(process_cmd_line, /(?i)system/)=true OR match_regex(process_cmd_line,
/(?i)security/)=true) AND like(process_cmd_line, "% cl %") AND process_file_name="wevtutil.exe"
@@ -75,6 +77,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -83,6 +87,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
+18 -12
View File
@@ -15,18 +15,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where like(process_cmd_line, "%/e:false%") AND like(process_cmd_line, "%
sl %") AND process_file_name="wevtutil.exe" --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
like(process_cmd_line, "%/e:false%") AND like(process_cmd_line, "% sl %") AND process_file_name="wevtutil.exe"
--finding_report--'
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
@@ -71,6 +73,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -79,6 +83,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml
+17 -11
View File
@@ -19,17 +19,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (like(process_cmd_line, "%resume%") OR like(process_cmd_line, "%setcustomheaders%")
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(like(process_cmd_line, "%resume%") OR like(process_cmd_line, "%setcustomheaders%")
OR like(process_cmd_line, "%setminretrydelay%") OR like(process_cmd_line, "%setnotifycmdline%")
OR like(process_cmd_line, "%setnotifyflags%") OR like(process_cmd_line, "%addfile%")
OR like(process_cmd_line, "%create%")) AND process_file_name="bitsadmin.exe" --finding_report--'
@@ -78,6 +80,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -86,6 +90,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml
+17 -12
View File
@@ -24,18 +24,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where like(process_cmd_line, "%transfer%") AND process_file_name="bitsadmin.exe"
--finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
like(process_cmd_line, "%transfer%") AND process_file_name="bitsadmin.exe" --finding_report--'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -83,6 +84,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -91,6 +94,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml
+17 -12
View File
@@ -20,18 +20,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where like(process_cmd_line, "%decode%") AND process_file_name="certutil.exe"
--finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
like(process_cmd_line, "%decode%") AND process_file_name="certutil.exe" --finding_report--'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -78,6 +79,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -86,6 +89,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml
+18 -13
View File
@@ -19,19 +19,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (process_file_name="certutil.exe" AND like(process_cmd_line, "%split%")
AND like(process_cmd_line, "%urlcache%")) OR like(process_cmd_line, "%urlcache%")
--finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(process_file_name="certutil.exe" AND like(process_cmd_line, "%split%") AND like(process_cmd_line,
"%urlcache%")) OR like(process_cmd_line, "%urlcache%") --finding_report--'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -74,6 +75,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -82,6 +85,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml
+18 -13
View File
@@ -19,19 +19,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (process_file_name="certutil.exe" AND like(process_cmd_line, "%split%")
AND like(process_cmd_line, "%verifyctl%")) OR like(process_cmd_line, "%verifyctl%")
--finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(process_file_name="certutil.exe" AND like(process_cmd_line, "%split%") AND like(process_cmd_line,
"%verifyctl%")) OR like(process_cmd_line, "%verifyctl%") --finding_report--'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -75,6 +76,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -83,6 +86,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml
+17 -11
View File
@@ -20,17 +20,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where match_regex(process_cmd_line, /(?i)inprocserver32/)=true AND process_file_name="reg.exe"
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
match_regex(process_cmd_line, /(?i)inprocserver32/)=true AND process_file_name="reg.exe"
--finding_report--'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
@@ -73,6 +75,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -81,6 +85,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml
+19 -14
View File
@@ -30,20 +30,21 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (like(process_cmd_line, "%-F %") OR like(process_cmd_line, "%--data
%") OR like(process_cmd_line, "%-d %") OR like(process_cmd_line, "%--upload-file
%") OR like(process_cmd_line, "%-T %")) AND match_regex(process_file_name, /(?i)curl.exe/)=true
--finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(like(process_cmd_line, "%-F %") OR like(process_cmd_line, "%--data %") OR like(process_cmd_line,
"%-d %") OR like(process_cmd_line, "%--upload-file %") OR like(process_cmd_line,
"%-T %")) AND match_regex(process_file_name, /(?i)curl.exe/)=true --finding_report--'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
@@ -86,6 +87,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -94,6 +97,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml
+21 -12
View File
@@ -14,18 +14,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where match_regex(process_file_name, /(?i)mpcmdrun.exe/)=true AND (NOT match_regex(process_path,
/(?i)\\windows defender/)=true) AND (NOT match_regex(process_path, /(?i)\\microsoft\\windows
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
match_regex(process_file_name, /(?i)mpcmdrun.exe/)=true AND (NOT match_regex(process_file_path,
/(?i)\\windows defender/)=true) AND (NOT match_regex(process_file_path, /(?i)\\microsoft\\windows
defender\\platform/)=true) --finding_report--'
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
known_false_positives: False positives may be present and filtering may be required.
@@ -48,6 +50,8 @@ tags:
type: User Name
- name: device.hostname
type: Hostname
- name: process.file.path
type: File
- name: process.file.name
type: File Name
- name: process.cmd_line
@@ -57,6 +61,7 @@ tags:
required_fields:
- process.user.name
- device.hostname
- process.file.path
- process.file.name
- process.cmd_line
risk_score: 56
@@ -64,6 +69,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -72,6 +79,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml
+18 -12
View File
@@ -18,18 +18,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (like(process_cmd_line, "%/s%") OR like(process_cmd_line, "%-S%"))
AND process_file_name="diskshadow.exe" --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(like(process_cmd_line, "%/s%") OR like(process_cmd_line, "%-S%")) AND process_file_name="diskshadow.exe"
--finding_report--'
how_to_implement: To successfully implement this search you need to be ingesting information
on processes that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
@@ -68,6 +70,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -76,6 +80,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml
+25 -16
View File
@@ -18,17 +18,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (match_regex(process_file_name, /(?i)MSBuild.exe/)=true OR match_regex(process_file_name,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(match_regex(process_file_name, /(?i)MSBuild.exe/)=true OR match_regex(process_file_name,
/(?i)comsvcconfig.exe/)=true OR match_regex(process_file_name, /(?i)dfsradmin.exe/)=true
OR match_regex(process_file_name, /(?i)dfsvc.exe/)=true OR match_regex(process_file_name,
/(?i)microsoft.workflow.compiler.exe/)=true OR match_regex(process_file_name, /(?i)smsvchost.exe/)=true
@@ -57,11 +59,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
OR match_regex(process_file_name, /(?i)microsoft.activedirectory.webservices.exe/)=true
OR match_regex(process_file_name, /(?i)iisual.exe/)=true OR match_regex(process_file_name,
/(?i)filehistory.exe/)=true OR match_regex(process_file_name, /(?i)secureassessmentbrowser.exe/)=true)
AND (NOT (match_regex(process_path, /(?i)\\windows\\system32/)=true OR match_regex(process_path,
/(?i)\\windows\\syswow64/)=true OR match_regex(process_path, /(?i)\\windows\\adws/)=true
OR match_regex(process_path, /(?i)\\windows\\networkcontroller/)=true OR match_regex(process_path,
/(?i)\\windows\\systemapps/)=true OR match_regex(process_path, /(?i)\\winsxs/)=true
OR match_regex(process_path, /(?i)\\microsoft.net/)=true)) --finding_report--'
AND (NOT (match_regex(process_file_path, /(?i)\\windows\\system32/)=true OR match_regex(process_file_path,
/(?i)\\windows\\syswow64/)=true OR match_regex(process_file_path, /(?i)\\windows\\adws/)=true
OR match_regex(process_file_path, /(?i)\\windows\\networkcontroller/)=true OR match_regex(process_file_path,
/(?i)\\windows\\systemapps/)=true OR match_regex(process_file_path, /(?i)\\winsxs/)=true
OR match_regex(process_file_path, /(?i)\\microsoft.net/)=true)) --finding_report--'
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
known_false_positives: False positives may be present and filtering may be required.
Certain utilities will run from non-standard paths based on the third-party application
@@ -93,6 +95,8 @@ tags:
type: User Name
- name: device.hostname
type: Hostname
- name: process.file.path
type: File
- name: process.file.name
type: File Name
- name: process.cmd_line
@@ -102,6 +106,7 @@ tags:
required_fields:
- process.user.name
- device.hostname
- process.file.path
- process.file.name
- process.cmd_line
risk_score: 49
@@ -109,6 +114,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -117,6 +124,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml
+17 -11
View File
@@ -34,17 +34,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where match_regex(process_cmd_line, /(?i)get-recipient/)=true OR match_regex(process_cmd_line,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
match_regex(process_cmd_line, /(?i)get-recipient/)=true OR match_regex(process_cmd_line,
/(?i)new-mailboxsearch/)=true OR match_regex(process_cmd_line, /(?i)new-managementroleassignment/)=true
OR match_regex(process_cmd_line, /(?i)new-mailboxexportrequest/)=true --finding_report--'
how_to_implement: To successfully implement this analytic, you will need to enable
@@ -91,6 +93,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -99,6 +103,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml
+22 -16
View File
@@ -17,22 +17,24 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where ((like(process_cmd_line, "%ms-msdt:/id%") OR like(process_cmd_line,
"%ms-msdt:-id%") OR like(process_cmd_line, "%ms-msdt:/id%") OR like(process_cmd_line,
"%ms-msdt:%") OR like(process_cmd_line, "%msdt%")) AND process_file_name="msdt.exe")
AND (match_regex(process_cmd_line, /(?i).xml/)=true OR match_regex(process_cmd_line,
/(?i)it_rebrowseforfile=/)=true OR match_regex(process_cmd_line, /(?i)it_browseforfile=/)=true)
AND match_regex(process_cmd_line, /(?i)pcwdiagnostic/)=true --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
((like(process_cmd_line, "%ms-msdt:/id%") OR like(process_cmd_line, "%ms-msdt:-id%")
OR like(process_cmd_line, "%ms-msdt:/id%") OR like(process_cmd_line, "%ms-msdt:%")
OR like(process_cmd_line, "%msdt%")) AND process_file_name="msdt.exe") AND (match_regex(process_cmd_line,
/(?i).xml/)=true OR match_regex(process_cmd_line, /(?i)it_rebrowseforfile=/)=true
OR match_regex(process_cmd_line, /(?i)it_browseforfile=/)=true) AND match_regex(process_cmd_line,
/(?i)pcwdiagnostic/)=true --finding_report--'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -77,6 +79,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -85,6 +89,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml
+18 -12
View File
@@ -20,18 +20,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%"))
AND process_file_name="explorer.exe" --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) AND
process_file_name="explorer.exe" --finding_report--'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints.
@@ -71,6 +73,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -79,6 +83,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
+27 -18
View File
@@ -17,19 +17,21 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (process_file_name="bitsadmin.exe" OR process_file_name="certoc.exe"
OR process_file_name="certreq.exe" OR process_file_name="certutil.exe" OR process_file_name="cmdkey.exe"
OR process_file_name="cmdl32.exe" OR process_file_name="cmstp.exe" OR process_file_name="configsecuritypolicy.exe"
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(process_file_name="bitsadmin.exe" OR process_file_name="certoc.exe" OR process_file_name="certreq.exe"
OR process_file_name="certutil.exe" OR process_file_name="cmdkey.exe" OR process_file_name="cmdl32.exe"
OR process_file_name="cmstp.exe" OR process_file_name="configsecuritypolicy.exe"
OR process_file_name="control.exe" OR process_file_name="cscript.exe" OR process_file_name="datasvcutil.exe"
OR process_file_name="desktopimgdownldr.exe" OR process_file_name="dfsvc.exe" OR
process_file_name="diantz.exe" OR process_file_name="diskshadow.exe" OR process_file_name="dllhost.exe"
@@ -56,11 +58,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
OR process_file_name="verclsid.exe" OR process_file_name="wab.exe" OR process_file_name="wlrmdr.exe"
OR process_file_name="wmic.exe" OR process_file_name="workfolders.exe" OR process_file_name="wscript.exe"
OR process_file_name="wsreset.exe" OR process_file_name="wuauclt.exe" OR process_file_name="xwizard.exe")
AND (NOT (match_regex(process_path, /(?i)(?i)\\windows\\system32/)=true OR match_regex(process_path,
/(?i)(?i)\\windows\\syswow64/)=true OR match_regex(process_path, /(?i)(?i)\\windows\\networkcontrolle/)=true
OR match_regex(process_path, /(?i)(?i)\\windows\\systemapps/)=true OR match_regex(process_path,
/(?i)(?i)\\winsxs/)=true OR match_regex(process_path, /(?i)(?i)\\microsoft.net/)=true))
--finding_report--'
AND (NOT (match_regex(process_file_path, /(?i)(?i)\\windows\\system32/)=true OR
match_regex(process_file_path, /(?i)(?i)\\windows\\syswow64/)=true OR match_regex(process_file_path,
/(?i)(?i)\\windows\\networkcontrolle/)=true OR match_regex(process_file_path, /(?i)(?i)\\windows\\systemapps/)=true
OR match_regex(process_file_path, /(?i)(?i)\\winsxs/)=true OR match_regex(process_file_path,
/(?i)(?i)\\microsoft.net/)=true)) --finding_report--'
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
known_false_positives: False positives may be present and filtering may be required.
Certain utilities will run from non-standard paths based on the third-party application
@@ -90,6 +92,8 @@ tags:
type: User Name
- name: device.hostname
type: Hostname
- name: process.file.path
type: File
- name: process.file.name
type: File Name
- name: process.cmd_line
@@ -99,6 +103,7 @@ tags:
required_fields:
- process.user.name
- device.hostname
- process.file.path
- process.file.name
- process.cmd_line
risk_score: 49
@@ -106,6 +111,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -114,6 +121,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_mshta_child_process.yml
+21 -15
View File
@@ -16,21 +16,23 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (process_file_name="wscript.exe" OR process_file_name="cscript.exe"
OR process_file_name="searchprotocolhost.exe" OR process_file_name="microsoft.workflow.compiler.exe"
OR process_file_name="msbuild.exe" OR process_file_name="colorcpl.exe" OR process_file_name="scrcons.exe"
OR process_file_name="cmd.exe" OR process_file_name="powershell.exe") AND like(actor_process_file_name,
"%mshta.exe") --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(process_file_name="wscript.exe" OR process_file_name="cscript.exe" OR process_file_name="searchprotocolhost.exe"
OR process_file_name="microsoft.workflow.compiler.exe" OR process_file_name="msbuild.exe"
OR process_file_name="colorcpl.exe" OR process_file_name="scrcons.exe" OR process_file_name="cmd.exe"
OR process_file_name="powershell.exe") AND like(actor_process_file_name, "%mshta.exe")
--finding_report--'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -77,6 +79,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -85,6 +89,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml
+18 -12
View File
@@ -19,18 +19,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%"))
AND process_file_name="mshta.exe" --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) AND
process_file_name="mshta.exe" --finding_report--'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -76,6 +78,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -84,6 +88,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml
+18 -12
View File
@@ -17,18 +17,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (like(process_cmd_line, "%about%") OR like(process_cmd_line, "%javascript%")
OR like(process_cmd_line, "%vbscript%")) AND process_file_name="mshta.exe" --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(like(process_cmd_line, "%about%") OR like(process_cmd_line, "%javascript%") OR
like(process_cmd_line, "%vbscript%")) AND process_file_name="mshta.exe" --finding_report--'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -74,6 +76,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -82,6 +86,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml
+18 -12
View File
@@ -17,18 +17,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where ((like(process_cmd_line, "%/f %") OR like(process_cmd_line, "%-f %"))
AND process_file_name="odbcconf.exe") AND like(process_cmd_line, "%.rsp%") --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
((like(process_cmd_line, "%/f %") OR like(process_cmd_line, "%-f %")) AND process_file_name="odbcconf.exe")
AND like(process_cmd_line, "%.rsp%") --finding_report--'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -70,6 +72,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -78,6 +82,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
+18 -12
View File
@@ -23,18 +23,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="ntdsutil.exe" AND (like(process_cmd_line, "%create%")
AND like(process_cmd_line, "%ntds%")) --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
process_file_name="ntdsutil.exe" AND (like(process_cmd_line, "%create%") AND like(process_cmd_line,
"%ntds%")) --finding_report--'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -80,6 +82,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -88,6 +92,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml
+18 -13
View File
@@ -22,19 +22,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where ((like(process_cmd_line, "%-ma %") OR like(process_cmd_line, "%-mm
%")) AND (process_file_name="procdump64.exe" OR process_file_name="procdump.exe"))
AND like(process_cmd_line, "%lsass%") --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
((like(process_cmd_line, "%-ma %") OR like(process_cmd_line, "%-mm %")) AND (process_file_name="procdump64.exe"
OR process_file_name="procdump.exe")) AND like(process_cmd_line, "%lsass%") --finding_report--'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -77,6 +78,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -85,6 +88,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
+18 -12
View File
@@ -21,18 +21,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe"
OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe"
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR
process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe"
OR process_file_name="pwsh.exe") AND (NOT match_regex(process_cmd_line, /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true)
--finding_report--'
how_to_implement: You must be ingesting data that records process activity from your
@@ -83,6 +85,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -91,6 +95,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml
+18 -12
View File
@@ -20,18 +20,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where like(process_cmd_line, "%4194304%") AND match_regex(process_cmd_line,
/(?i)get-aduser/)=true --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
like(process_cmd_line, "%4194304%") AND match_regex(process_cmd_line, /(?i)get-aduser/)=true
--finding_report--'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -69,6 +71,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -77,6 +81,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml
+17 -11
View File
@@ -20,17 +20,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where match_regex(process_cmd_line, /(?i)preauthnotrequired/)=true AND match_regex(process_cmd_line,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
match_regex(process_cmd_line, /(?i)preauthnotrequired/)=true AND match_regex(process_cmd_line,
/(?i)get-domainuser/)=true --finding_report--'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -68,6 +70,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -76,6 +80,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml
+18 -12
View File
@@ -17,18 +17,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe"
OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe"
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR
process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe"
OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)downloadfile/)=true
--finding_report--'
how_to_implement: To successfully implement this search you need to be ingesting information
@@ -77,6 +79,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -85,6 +89,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml
+18 -12
View File
@@ -19,18 +19,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe"
OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe"
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR
process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe"
OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)start-bitstransfer/)=true
--finding_report--'
how_to_implement: To successfully implement this search you need to be ingesting information
@@ -75,6 +77,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -83,6 +87,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml
+18 -12
View File
@@ -16,18 +16,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="rasautou.exe" AND match_regex(process_cmd_line,
/(?i)-p /)=true AND match_regex(process_cmd_line, /(?i)-d /)=true --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
process_file_name="rasautou.exe" AND match_regex(process_cmd_line, /(?i)-p /)=true
AND match_regex(process_cmd_line, /(?i)-d /)=true --finding_report--'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -74,6 +76,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -82,6 +86,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml
+20 -11
View File
@@ -16,17 +16,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="acccheckconsole.exe" AND (NOT match_regex(process_path,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
process_file_name="acccheckconsole.exe" AND (NOT match_regex(process_file_path,
/(?i)\\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker/)=true)
--finding_report--'
how_to_implement: To successfully implement this search, you must be ingesting logs
@@ -56,6 +58,8 @@ tags:
type: User Name
- name: device.hostname
type: Hostname
- name: process.file.path
type: File
- name: process.file.name
type: File Name
- name: process.cmd_line
@@ -65,6 +69,7 @@ tags:
required_fields:
- process.user.name
- device.hostname
- process.file.path
- process.file.name
- process.cmd_line
risk_score: 14
@@ -72,6 +77,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -80,6 +87,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml
+21 -12
View File
@@ -16,18 +16,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="adplus.exe" AND (NOT match_regex(process_path,
/(?i)\\program files (x86)\\windows kits\\10\\debuggers\\x86/)=true) --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
process_file_name="adplus.exe" AND (NOT match_regex(process_file_path, /(?i)\\program
files (x86)\\windows kits\\10\\debuggers\\x86/)=true) --finding_report--'
how_to_implement: To successfully implement this search, you must be ingesting logs
with the process name, command-line arguments, and parent processes from your endpoints.
Collect endpoint data such as Sysmon or Windows Events 4688.
@@ -55,6 +57,8 @@ tags:
type: User Name
- name: device.hostname
type: Hostname
- name: process.file.path
type: File
- name: process.file.name
type: File Name
- name: process.cmd_line
@@ -64,6 +68,7 @@ tags:
required_fields:
- process.user.name
- device.hostname
- process.file.path
- process.file.name
- process.cmd_line
risk_score: 14
@@ -71,6 +76,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -79,6 +86,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml
+21 -12
View File
@@ -16,18 +16,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="advpack.dll" AND (NOT match_regex(process_path,
/(?i)\\windows\\syswow64/)=true) --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
process_file_name="advpack.dll" AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true)
--finding_report--'
how_to_implement: To successfully implement this search, you must be ingesting logs
with the process name, command-line arguments, and parent processes from your endpoints.
Collect endpoint data such as Sysmon or Windows Events 4688.
@@ -55,6 +57,8 @@ tags:
type: User Name
- name: device.hostname
type: Hostname
- name: process.file.path
type: File
- name: process.file.name
type: File Name
- name: process.cmd_line
@@ -64,6 +68,7 @@ tags:
required_fields:
- process.user.name
- device.hostname
- process.file.path
- process.file.name
- process.cmd_line
risk_score: 14
@@ -71,6 +76,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -79,6 +86,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml
+21 -12
View File
@@ -16,18 +16,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="agentexecutor.exe" AND (NOT match_regex(process_path,
/(?i)\\program files (x86)/)=true) --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
process_file_name="agentexecutor.exe" AND (NOT match_regex(process_file_path, /(?i)\\program
files (x86)/)=true) --finding_report--'
how_to_implement: To successfully implement this search, you must be ingesting logs
with the process name, command-line arguments, and parent processes from your endpoints.
Collect endpoint data such as Sysmon or Windows Events 4688.
@@ -55,6 +57,8 @@ tags:
type: User Name
- name: device.hostname
type: Hostname
- name: process.file.path
type: File
- name: process.file.name
type: File Name
- name: process.cmd_line
@@ -64,6 +68,7 @@ tags:
required_fields:
- process.user.name
- device.hostname
- process.file.path
- process.file.name
- process.cmd_line
risk_score: 14
@@ -71,6 +76,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -79,6 +86,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml
+21 -12
View File
@@ -16,18 +16,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="appinstaller.exe" AND (NOT match_regex(process_path,
/(?i)\\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe/)=true)
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
process_file_name="appinstaller.exe" AND (NOT match_regex(process_file_path, /(?i)\\program
files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe/)=true)
--finding_report--'
how_to_implement: To successfully implement this search, you must be ingesting logs
with the process name, command-line arguments, and parent processes from your endpoints.
@@ -56,6 +58,8 @@ tags:
type: User Name
- name: device.hostname
type: Hostname
- name: process.file.path
type: File
- name: process.file.name
type: File Name
- name: process.cmd_line
@@ -65,6 +69,7 @@ tags:
required_fields:
- process.user.name
- device.hostname
- process.file.path
- process.file.name
- process.cmd_line
risk_score: 14
@@ -72,6 +77,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -80,6 +87,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml
+21 -12
View File
@@ -16,18 +16,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="appvlp.exe" AND (NOT match_regex(process_path,
/(?i)\\program files (x86)\\microsoft office\\root\\client/)=true) --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
process_file_name="appvlp.exe" AND (NOT match_regex(process_file_path, /(?i)\\program
files (x86)\\microsoft office\\root\\client/)=true) --finding_report--'
how_to_implement: To successfully implement this search, you must be ingesting logs
with the process name, command-line arguments, and parent processes from your endpoints.
Collect endpoint data such as Sysmon or Windows Events 4688.
@@ -55,6 +57,8 @@ tags:
type: User Name
- name: device.hostname
type: Hostname
- name: process.file.path
type: File
- name: process.file.name
type: File Name
- name: process.cmd_line
@@ -64,6 +68,7 @@ tags:
required_fields:
- process.user.name
- device.hostname
- process.file.path
- process.file.name
- process.cmd_line
risk_score: 14
@@ -71,6 +76,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -79,6 +86,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml
+20 -11
View File
@@ -16,17 +16,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="aspnet_compiler.exe" AND (NOT match_regex(process_path,
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
process_file_name="aspnet_compiler.exe" AND (NOT match_regex(process_file_path,
/(?i)\\windows\\microsoft.net\\framework64\\v4.0.30319/)=true) --finding_report--'
how_to_implement: To successfully implement this search, you must be ingesting logs
with the process name, command-line arguments, and parent processes from your endpoints.
@@ -55,6 +57,8 @@ tags:
type: User Name
- name: device.hostname
type: Hostname
- name: process.file.path
type: File
- name: process.file.name
type: File Name
- name: process.cmd_line
@@ -64,6 +68,7 @@ tags:
required_fields:
- process.user.name
- device.hostname
- process.file.path
- process.file.name
- process.cmd_line
risk_score: 14
@@ -71,6 +76,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -79,6 +86,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml
+20 -11
View File
@@ -16,17 +16,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="at.exe" AND (NOT match_regex(process_path, /(?i)\\windows\\syswow64/)=true)
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
process_file_name="at.exe" AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true)
--finding_report--'
how_to_implement: To successfully implement this search, you must be ingesting logs
with the process name, command-line arguments, and parent processes from your endpoints.
@@ -55,6 +57,8 @@ tags:
type: User Name
- name: device.hostname
type: Hostname
- name: process.file.path
type: File
- name: process.file.name
type: File Name
- name: process.cmd_line
@@ -64,6 +68,7 @@ tags:
required_fields:
- process.user.name
- device.hostname
- process.file.path
- process.file.name
- process.cmd_line
risk_score: 14
@@ -71,6 +76,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -79,6 +86,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml
+21 -12
View File
@@ -16,18 +16,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="atbroker.exe" AND (NOT match_regex(process_path,
/(?i)\\windows\\syswow64/)=true) --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
process_file_name="atbroker.exe" AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true)
--finding_report--'
how_to_implement: To successfully implement this search, you must be ingesting logs
with the process name, command-line arguments, and parent processes from your endpoints.
Collect endpoint data such as Sysmon or Windows Events 4688.
@@ -55,6 +57,8 @@ tags:
type: User Name
- name: device.hostname
type: Hostname
- name: process.file.path
type: File
- name: process.file.name
type: File Name
- name: process.cmd_line
@@ -64,6 +68,7 @@ tags:
required_fields:
- process.user.name
- device.hostname
- process.file.path
- process.file.name
- process.cmd_line
risk_score: 14
@@ -71,6 +76,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -79,6 +86,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml
+17 -11
View File
@@ -15,17 +15,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (match_regex(process_cmd_line, /(?i)minidump/)=true AND process_file_name="rundll32.exe")
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(match_regex(process_cmd_line, /(?i)minidump/)=true AND process_file_name="rundll32.exe")
AND match_regex(process_cmd_line, /(?i)comsvcs.dll/)=true --finding_report--'
how_to_implement: You must be ingesting endpoint data that tracks process activity,
including Windows command line logging. You can see how we test this with [Event
@@ -68,6 +70,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -76,6 +80,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml
+18 -12
View File
@@ -19,18 +19,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (like(process_cmd_line, "%about%") OR like(process_cmd_line, "%javascript%")
OR like(process_cmd_line, "%vbscript%")) AND process_file_name="rundll32.exe" --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(like(process_cmd_line, "%about%") OR like(process_cmd_line, "%javascript%") OR
like(process_cmd_line, "%vbscript%")) AND process_file_name="rundll32.exe" --finding_report--'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -75,6 +77,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -83,6 +87,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml
+18 -13
View File
@@ -18,19 +18,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="MSBuild.exe" AND (match_regex(actor_process_file_name,
/(?i)cscript.exe/)=true OR match_regex(actor_process_file_name, /(?i)wscript.exe/)=true)
--finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
process_file_name="MSBuild.exe" AND (match_regex(actor_process_file_name, /(?i)cscript.exe/)=true
OR match_regex(actor_process_file_name, /(?i)wscript.exe/)=true) --finding_report--'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -77,6 +78,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -85,6 +88,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
+17 -12
View File
@@ -18,18 +18,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where like(process_cmd_line, "%-decompile%") AND process_file_name="hh.exe"
--finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
like(process_cmd_line, "%-decompile%") AND process_file_name="hh.exe" --finding_report--'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -73,6 +74,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -81,6 +84,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml
+18 -12
View File
@@ -23,18 +23,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%"))
AND process_file_name="hh.exe" --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) AND
process_file_name="hh.exe" --finding_report--'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -81,6 +83,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -89,6 +93,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml
+18 -12
View File
@@ -26,18 +26,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (like(process_cmd_line, "%mk:@MSITStore:%") OR like(process_cmd_line,
"%its:%")) AND process_file_name="hh.exe" --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(like(process_cmd_line, "%mk:@MSITStore:%") OR like(process_cmd_line, "%its:%"))
AND process_file_name="hh.exe" --finding_report--'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -84,6 +86,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -92,6 +96,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml
+18 -12
View File
@@ -15,18 +15,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (like(process_cmd_line, "%-y %") OR like(process_cmd_line, "%/y %"))
AND process_file_name="msiexec.exe" --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(like(process_cmd_line, "%-y %") OR like(process_cmd_line, "%/y %")) AND process_file_name="msiexec.exe"
--finding_report--'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -67,6 +69,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -75,6 +79,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml
+18 -12
View File
@@ -15,18 +15,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%"))
AND process_file_name="msiexec.exe" --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) AND
process_file_name="msiexec.exe" --finding_report--'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -67,6 +69,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -75,6 +79,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml
+18 -12
View File
@@ -15,18 +15,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where (like(process_cmd_line, "%-z %") OR like(process_cmd_line, "%/z %"))
AND process_file_name="msiexec.exe" --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
(like(process_cmd_line, "%-z %") OR like(process_cmd_line, "%/z %")) AND process_file_name="msiexec.exe"
--finding_report--'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -67,6 +69,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -75,6 +79,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname
ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml
+18 -12
View File
@@ -19,18 +19,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
"string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
| eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
"map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
"string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
null) | where process_file_name="MSBuild.exe" AND match_regex(actor_process_file_name,
/(?i)wmiprvse.exe/)=true --finding_report--'
any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
| eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
"string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
| eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
| eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
| eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
process_file_name="MSBuild.exe" AND match_regex(actor_process_file_name, /(?i)wmiprvse.exe/)=true
--finding_report--'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -77,6 +79,8 @@ tags:
mappings:
- ocsf: process.pid
cim: process_id
- ocsf: process.file.path
cim: process_path
- ocsf: process.file.name
cim: process_name
- ocsf: process.cmd_line
@@ -85,6 +89,8 @@ tags:
cim: user
- ocsf: actor.process.pid
cim: parent_process_id
- ocsf: actor.process.file.path
cim: parent_process_path
- ocsf: actor.process.file.name
cim: parent_process_name
- ocsf: device.hostname