From 63968601d22c60fbfe3d949efc028cfa6603ac74 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Tue, 12 Apr 2022 11:40:08 -0500 Subject: [PATCH 1/3] parentheses to separate logic --- detections/endpoint/ssa___windows_mshta_child_process.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/ssa___windows_mshta_child_process.yml b/detections/endpoint/ssa___windows_mshta_child_process.yml index 9706fd2350..3e1373264e 100644 --- a/detections/endpoint/ssa___windows_mshta_child_process.yml +++ b/detections/endpoint/ssa___windows_mshta_child_process.yml @@ -17,10 +17,10 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name IS NOT - NULL | where parent_process_name="mshta.exe" AND process_name="powershell.exe" OR + NULL | where parent_process_name="mshta.exe" AND ( process_name="powershell.exe" OR process_name="cmd.exe" OR process_name="scrcons.exe" OR process_name="colorcpl.exe" OR process_name="msbuild.exe" OR process_name="microsoft.workflow.compiler.exe" - OR process_name="searchprotocolhost.exe" OR process_name="cscript.exe" OR process_name="wscript.exe" + OR process_name="searchprotocolhost.exe" OR process_name="cscript.exe" OR process_name="wscript.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", From da5eb1be3ac730ef26cdeac062eef38baa32268f Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Tue, 12 Apr 2022 12:01:48 -0500 Subject: [PATCH 2/3] Updated logic & fixed pathing --- detections/endpoint/ssa___windows_mshta_child_process.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/ssa___windows_mshta_child_process.yml b/detections/endpoint/ssa___windows_mshta_child_process.yml index 3e1373264e..2d102c2bc4 100644 --- a/detections/endpoint/ssa___windows_mshta_child_process.yml +++ b/detections/endpoint/ssa___windows_mshta_child_process.yml @@ -1,6 +1,6 @@ name: Windows MSHTA Child Process id: f63f7e9c-9526-11ec-9fc7-acde48001122 -version: 1 +version: 2 date: '2022-02-23' author: Michael Haag, Splunk type: TTP @@ -14,10 +14,10 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", - null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", - null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + null), parent_process_name=lower(ucast(map_get(input_event, "parent_process_name"), "string", + null)), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name IS NOT - NULL | where parent_process_name="mshta.exe" AND ( process_name="powershell.exe" OR + NULL | where like(parent_process_name, "%\\\\mshta.exe") AND ( process_name="powershell.exe" OR process_name="cmd.exe" OR process_name="scrcons.exe" OR process_name="colorcpl.exe" OR process_name="msbuild.exe" OR process_name="microsoft.workflow.compiler.exe" OR process_name="searchprotocolhost.exe" OR process_name="cscript.exe" OR process_name="wscript.exe") From ec66e01b78aa8ab35df200609b9e9ac92e1f39b3 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Tue, 12 Apr 2022 13:11:57 -0500 Subject: [PATCH 3/3] Fixed formatting --- detections/endpoint/ssa___windows_mshta_child_process.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___windows_mshta_child_process.yml b/detections/endpoint/ssa___windows_mshta_child_process.yml index 2d102c2bc4..bbad30871d 100644 --- a/detections/endpoint/ssa___windows_mshta_child_process.yml +++ b/detections/endpoint/ssa___windows_mshta_child_process.yml @@ -17,7 +17,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map null), parent_process_name=lower(ucast(map_get(input_event, "parent_process_name"), "string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name IS NOT - NULL | where like(parent_process_name, "%\\\\mshta.exe") AND ( process_name="powershell.exe" OR + NULL | where like(parent_process_name, "%\\\\mshta.exe") AND (process_name="powershell.exe" OR process_name="cmd.exe" OR process_name="scrcons.exe" OR process_name="colorcpl.exe" OR process_name="msbuild.exe" OR process_name="microsoft.workflow.compiler.exe" OR process_name="searchprotocolhost.exe" OR process_name="cscript.exe" OR process_name="wscript.exe")