admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm

Browse Source
This commit is contained in:
mhaag-spl
2021-09-20 12:05:19 -06:00
parent 70e1c9a454 8a2401bedf
commit ea9cfddf1c
1 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
+12 -8
View File
@@ -5,7 +5,7 @@ date: '2021-09-20'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
- Endpoint
description: The following analytic identifies searchprotocolhost.exe with no command
line arguments. It is unusual for searchprotocolhost.exe to execute with no command
line arguments present. This particular behavior is common with malicious software,
@@ -14,11 +14,15 @@ description: The following analytic identifies searchprotocolhost.exe with no co
dumping or file writes. searchprotocolhost.exe is natively found in C:\Windows\system32
and C:\Windows\syswow64.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_id Processes.process_name
Processes.dest Processes.process_path Processes.process Processes.parent_process_name
where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_id
Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| regex process="(searchprotocolhost\.exe.{0,4}$)" | `suspicious_searchprotocolhost_no_command_line_arguments_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Limited false positives may be present in small environments.
Tuning may be required based on parent process.
references:
@@ -59,11 +63,11 @@ tags:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name #parent process name
- Processes.parent_process #parent cmdline
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name #process name
- Processes.process #process cmdline
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path