admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

awfulshred

Browse Source
This commit is contained in:
tccontre
2023-02-16 09:56:29 +01:00
parent 9fd1c9e299
commit e83277db2b
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/wbemprox_com_object_execution.yml
+5 -2
View File
@@ -6,8 +6,11 @@ author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
description: this search is designed to detect potential malicious process loading
COM object to wbemprox.dll,
description: The following analytic identifies a potential suspicious process loading a COM object from wbemprox.dll or faskprox.dll.
The Microsoft Component Object Model (COM) is a platform-independent, distributed, object-oriented system for creating binary software
components that can interact. This feature is being abused by several threat actors, adversaries or even red teamers to gain privilege
escalation or even to evade detections. This TTP is a good indicator that a process is loading possible known .dll modules that were known
for its COM object.
search: '`sysmon` EventCode=7 ImageLoaded IN ("*\\fastprox.dll", "*\\wbemprox.dll",
"*\\wbemcomn.dll") NOT (process_name IN ("wmiprvse.exe", "WmiApSrv.exe", "unsecapp.exe"))
NOT(Image IN("*\\windows\\*","*\\program files*", "*\\wbem\\*")) | stats count min(_time)