From 7f8652b85bae96ae611b03cb713d1eaafff26e0c Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 3 Feb 2021 15:44:56 +0100 Subject: [PATCH 1/2] bug fix --- detections/endpoint/first_time_seen_running_windows_service.yml | 2 +- macros/previously_seen_windows_services_window.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/first_time_seen_running_windows_service.yml b/detections/endpoint/first_time_seen_running_windows_service.yml index d42c148b37..f14f09f3de 100644 --- a/detections/endpoint/first_time_seen_running_windows_service.yml +++ b/detections/endpoint/first_time_seen_running_windows_service.yml @@ -20,7 +20,7 @@ search: '`wineventlog_system` EventCode=7036 | rex field=Message "The (?[-\(\)\s\w]+) service entered the (?\w+) state" | where state="running" | lookup previously_seen_running_windows_services service as service OUTPUT firstTimeSeen | - where isnull(firstTimeSeen) OR firstTimeSeen > relative_time(now(), "`previously_seen_windows_service_window`") | + where isnull(firstTimeSeen) OR firstTimeSeen > relative_time(now(), `previously_seen_windows_services_window`) | table _time dest service | `first_time_seen_running_windows_service_filter`' known_false_positives: A previously unseen service is not necessarily malicious. Verify that the service is legitimate and that was installed by a legitimate process. diff --git a/macros/previously_seen_windows_services_window.yml b/macros/previously_seen_windows_services_window.yml index a2f195faec..7306ffe3a3 100644 --- a/macros/previously_seen_windows_services_window.yml +++ b/macros/previously_seen_windows_services_window.yml @@ -1,3 +1,3 @@ description: Use this macro to determine how far back you should be checking for new Windows services definition: '"-70m@m"' -name: previously_seen_windows_service_window +name: previously_seen_windows_services_window From 623c8fee33cf352f318e7a06b7dc7e4b355feea6 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 3 Feb 2021 17:03:19 +0100 Subject: [PATCH 2/2] moved to experimental --- ...first_time_seen_running_windows_service.yml | 0 ..._time_seen_running_windows_service.test.yml | 18 ------------------ 2 files changed, 18 deletions(-) rename detections/{ => experimental}/endpoint/first_time_seen_running_windows_service.yml (100%) delete mode 100644 tests/endpoint/first_time_seen_running_windows_service.test.yml diff --git a/detections/endpoint/first_time_seen_running_windows_service.yml b/detections/experimental/endpoint/first_time_seen_running_windows_service.yml similarity index 100% rename from detections/endpoint/first_time_seen_running_windows_service.yml rename to detections/experimental/endpoint/first_time_seen_running_windows_service.yml diff --git a/tests/endpoint/first_time_seen_running_windows_service.test.yml b/tests/endpoint/first_time_seen_running_windows_service.test.yml deleted file mode 100644 index 3aaa4683f0..0000000000 --- a/tests/endpoint/first_time_seen_running_windows_service.test.yml +++ /dev/null @@ -1,18 +0,0 @@ -name: First Time Seen Running Windows Service Unit Test -tests: -- name: First Time Seen Running Windows Service - file: endpoint/first_time_seen_running_windows_service.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - baselines: - - name: Previously Seen Running Windows Services - Initial - file: baselines/previously_seen_running_windows_services.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: '-70m@m' - attack_data: - - file_name: windows-system.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/first_time_windows_service/windows-system.log - source: WinEventLog:System - sourcetype: WinEventLog