admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updated prohibited apps

Browse Source
This commit is contained in:
David Dorsey
2022-03-01 12:03:51 -06:00
parent 261b8e0bc2
commit ecb7ea0cce
2 changed files with 25 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
+22 -16
View File
@@ -10,24 +10,30 @@ description: The following analytic identifies parent processes, browsers, Windo
terminal applications, Office Products and Java spawning cmd.exe. By its very nature,
many applications spawn cmd.exe natively or built into macros. Much of this will
need to be tuned to further enhance the risk.
search: '| from read_ssa_enriched_events()
search: ''| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
| eval process_name=ucast(map_get(input_event, "process_name"), "string", null),
parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string",
null)), cmd_line=lower(ucast(map_get(input_event, "process"),"string", null)), dest_user_id=ucast(map_get(input_event,
"dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"),
"string", null), event_id=ucast(map_get(input_event,"event_id"), "string", null)
| where process_name="cmd.exe" | rex field=parent_process "(?<ParentBaseFileName>[^\\\\]+)$"
| eval process_name = ucast(map_get(input_event, "process_name"), "string", null),
parent_process_name = lower(ucast(input_event.parent_process_name, "string", null)),
cmd_line = lower(ucast(map_get(input_event, "process"),"string", null)),
dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null),
dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
event_id=ucast(map_get(input_event,"event_id"), "string", null)
| where process_name="cmd.exe"
| rex field=parent_process_name "(?<ParentBaseFileName>[^\\\\]+)$"
| where ParentBaseFileName="winword.exe" OR ParentBaseFileName="excel.exe" OR ParentBaseFileName="outlook.exe"
OR ParentBaseFileName="powerpnt.exe" OR ParentBaseFileName="visio.exe" OR ParentBaseFileName="mspub.exe"
OR ParentBaseFileName="acrobat.exe" OR ParentBaseFileName="acrord32.exe" OR ParentBaseFileName="iexplore.exe"
OR ParentBaseFileName="opera.exe" OR ParentBaseFileName="firefox.exe" OR (ParentBaseFileName="java.exe"
AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)patch1-Hotfix1a/)=false)))
OR ParentBaseFileName="powershell.exe" OR (ParentBaseFileName="chrome.exe" AND (cmd_line
IS NULL OR (cmd_line IS NOT NULL AND NOT like(cmd_line, "%chrome-extension%"))))
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
dest_user_id), body=create_map(["event_id", event_id, "process_name", process_name,
"parent_process_name", parent_process, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
OR ParentBaseFileName="powerpnt.exe" OR ParentBaseFileName="visio.exe" OR ParentBaseFileName="mspub.exe"
OR ParentBaseFileName="acrobat.exe" OR ParentBaseFileName="acrord32.exe" OR ParentBaseFileName="iexplore.exe"
OR ParentBaseFileName="opera.exe" OR ParentBaseFileName="firefox.exe"
OR (ParentBaseFileName="java.exe"
AND (parent_process_name IS NOT NULL AND match_regex(parent_process_name, /(?i)patch1-Hotfix1a/)=false))
OR ParentBaseFileName="powershell.exe"
OR (ParentBaseFileName="chrome.exe"
AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)chrome-extension/)=false)))
| eval start_time=timestamp, end_time=timestamp,
entities=mvappend(dest_device_id, dest_user_id),
body=create_map(["event_id", event_id, "process_name", process_name, "parent_process_name",
parent_process_name, "cmd_line", cmd_line, "ParentBaseFileName", ParentBaseFileName])
| into write_ssa_detected_events()'
how_to_implement: In order to successfully implement this analytic, you will need
endpoint process data from a EDR product or Sysmon. This search has been modified
to process raw sysmon data from attack_range's nxlogs on DSP.
tests/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.test.yml
+3 -3
View File
@@ -2,9 +2,9 @@ name: Detect Prohibited Applications Spawning cmd exe Unit Test
tests:
- name: Detect Prohibited Applications Spawning cmd exe
file: endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
pass_condition: '@count_gt(0)'
pass_condition: '@count_gt(1)'
description: Detect Prohibited Applications Spawning cmd exe
attack_data:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-security.log
source: WinEventLog:Security
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/prohibited_cmd_spawn/prohibited_apps_spawning_cmd.log
source: WinEventLog:Security