Merge pull request #1794 from splunk/fixing_prohibited_apps_spawning_cmdprompt

Land of the Haag

detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml

@@ -1,14 +1,12 @@
 name: Detect Prohibited Applications Spawning cmd exe
 id: c10a18cb-fd80-4ffa-a844-25026e0a0c94
-version: 1
-date: 2020-7-13
+version: 2
+date: '2021-11-10'
 author: Ignacio Bermudez Corrales, Splunk
-type: TTP
+type: Anomaly
 datamodel: []
-description: This search looks for executions of cmd.exe spawned by a process that
-  is often abused by attackers and that does not typically launch cmd.exe. This is
-  a SPL2 implementation of the rule `Detect Prohibited Applications Spawning cmd.exe`
-  by @bpatel.
+description: 'The following analytic identifies parent processes, browsers, Windows terminal applications, Office Products and Java spawning cmd.exe. By its very nature, many applications spawn cmd.exe natively or built into macros. Much of this will need to be tuned to further enhance the risk.
+During triage, review parallel process execution and identify any file modifications that may have occurred. Capture any artifacts and review further.'
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
@@ -27,32 +25,25 @@ search: '| from read_ssa_enriched_events()
   | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
   dest_user_id), body=create_map(["event_id", event_id,  "process_name", process_name,
   "parent_process_name", parent_process]) | into write_ssa_detected_events();'
-how_to_implement: You must be ingesting sysmon logs. This search has been modified
+how_to_implement: In order to successfully implement this analytic, you will need endpoint process data from a EDR product or Sysmon. This search has been modified
   to process raw sysmon data from attack_range's nxlogs on DSP.
 known_false_positives: There are circumstances where an application may legitimately
-  execute and interact with the Windows command-line interface. Investigate and modify
-  the lookup file, as appropriate.
-references: []
+  execute and interact with the Windows command-line interface. 
+references:
+  - https://attack.mitre.org/techniques/T1059/
 tags:
   analytic_story:
   - Suspicious Command-Line Executions
-  - Suspicious MSHTA Activity
-  - Suspicious Zoom Child Processes
-  - Sunburst Malware
   cis20:
   - CIS 8
-  confidence: 80
+  confidence: 50
   context:
-  - Source:AD
   - Source:Endpoint
-  - Stage:Command And Control
-  - Consequence:Loss Of Control
+  - Stage:Defense Evasion
   impact: 70
   kill_chain_phases:
   - Exploitation
-  message: Potential malicious landing to the console via unexpected programs that
-    called cmd.exe.  Operation is performed at the device $dest_device_id$, by the
-    account $dest_user_id$ where parent process $parent_process$ spwaned $process_name$.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event that warrants investigating.
   mitre_attack_id:
   - T1059
   nist:
@@ -67,10 +58,14 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: cmd_line
-    type: processname
+  - name: parent_process_name
+    type: Parent Process
     role:
-    - Others
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -79,6 +74,6 @@ tags:
   - _time
   - dest_device_id
   - dest_user_id
-  risk_score: 56
+  risk_score: 35
   risk_severity: low
-  security_domain: endpoint
+  security_domain: endpoint

tests/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.test.yml

@@ -1,10 +1,10 @@
 name: Detect Prohibited Applications Spawning cmd exe Unit Test
 tests:
-  - name: Access LSASS Memory for Dump Creation
+  - name: Detect Prohibited Applications Spawning cmd exe
     file: endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
     pass_condition: '@count_gt(0)'
-    description: Test credential dumping detections
+    description: Detect Prohibited Applications Spawning cmd exe
     attack_data:
       - file_name: windows-security.log
         data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-security.log
-        source: WinEventLog:Security
+        source: WinEventLog:Security