From 601d8c3f327f726f011c642b60a3f9be72d26b5d Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 10 Nov 2022 12:45:28 -0800 Subject: [PATCH] SPL update --- .../endpoint/detect_rare_executables.yml | 27 +++++++++---------- 1 file changed, 13 insertions(+), 14 deletions(-) diff --git a/detections/experimental/endpoint/detect_rare_executables.yml b/detections/experimental/endpoint/detect_rare_executables.yml index 956446e04c..5b980714a9 100644 --- a/detections/experimental/endpoint/detect_rare_executables.yml +++ b/detections/experimental/endpoint/detect_rare_executables.yml @@ -1,22 +1,23 @@ name: Detect Rare Executables id: 44fddcb2-8d3b-454c-874e-7c6de5a4f7ac -version: 5 -date: '2020-03-16' +version: 3 +date: '2022-11-10' author: Bhavin Patel, Splunk type: Anomaly datamodel: - Endpoint -description: This search will return a table of rare processes, the names of the systems - running them, and the users who initiated each process. -search: '| tstats `security_content_summariesonly` count values(Processes.dest) as - dest values(Processes.user) as user min(_time) as firstTime max(_time) as lastTime - from datamodel=Endpoint.Processes by Processes.process_name | rename Processes.process_name - as process | rex field=user "(?.*)\\\\(?.*)" | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)`| search [| tstats count from datamodel=Endpoint.Processes - by Processes.process_name | rare Processes.process_name limit=30 | rename Processes.process_name - as process| `filter_rare_process_allow_list`| table process ] | `detect_rare_executables_filter` ' +description: This search will return a table of processes in the a given window, remove process names which are in the allowed list and list out the top 30 rare processes discovered on different hosts. +search: '| tstats `security_content_summariesonly` count values(Processes.dest) as dest values(Processes.user) as user min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.process_name +| rename Processes.process_name as process +| `filter_rare_process_allow_list` +| sort count +| head 30 +| rex field=user "(?.*)\\\\(?.*)" +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `detect_rare_executables_filter` ' how_to_implement: To successfully implement this search, you must be ingesting data - that records process activity from your hosts and populating the endpoint data model + that records process activity from your hosts and populating the `Endpoint` data model with the resultant dataset. The macro `filter_rare_process_allow_list` searches two lookup files for allowed processes. These consist of `rare_process_allow_list_default.csv` and `rare_process_allow_list_local.csv`. To add your own processes to the allow @@ -30,9 +31,7 @@ known_false_positives: Some legitimate processes may be only rarely executed in references: [] tags: analytic_story: - - 'Emotet Malware DHS Report TA18-201A ' - Unusual Processes - - Cloud Federated Credential Abuse asset_type: Endpoint cis20: - CIS 2