{
  "channel": "ESCU",
  "confidence": "medium",
  "correlation_rule": {
    "notable": {
      "nes_fields": "dest, file_path, file_name",
      "rule_description": "A potentially malicious file program.exe was detected on the C: drive. The creation of this file is often associated with a motive to perform a path interception attack. ",
      "rule_title": "Path Interception attempt discovered $dest$ via creation of program.exe"
    },
    "risk": {
      "risk_object": "dest",
      "risk_object_type": [
        "system"
      ],
      "risk_score": 50
    },
    "suppress": {
      "suppress_fields": "dest, file_path, file_name",
      "suppress_period": "86400s"
    }
  },
  "creation_date": "2017-11-16",
  "data_metadata": {
    "data_models": [
      "Endpoint"
    ],
    "data_source": [
      "Endpoint Intel"
    ],
    "providing_technologies": [
      "Carbon Black Response",
      "CrowdStrike Falcon",
      "Tanium",
      "Ziften"
    ]
  },
  "eli5": "This search queries the Endpoint file-system data model node to list out all the values of destination machines, as well as the values of file hashes and file paths that have the file \"program.exe\" in the C: drive. Path interception occurs when an executable is placed in a specific path so that it is executed by an application instead of by the intended target. In this case, applications vulnerable to path interception (because of unquoted service paths with spaces in Windows registry) allow attackers to execute maliciously crafted program.exes.",
  "how_to_implement": "You must be ingesting data that records the file-system activity from your hosts to populate the Endpoint file-system data model node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file system reads and writes.",
  "known_false_positives": "It is unlikely that a normal user may create and place this file in the C: drive.  Confirm with the user.",
  "maintainers": [
    {
      "company": "Splunk",
      "email": "bpatel@splunk.com",
      "name": "Bhavin Patel"
    }
  ],
  "mappings": {
    "cis20": [
      "CIS 8"
    ],
    "kill_chain_phases": [
      "Actions on Objectives"
    ],
    "mitre_attack": [
      "Privilege Escalation",
      "Persistence"
    ],
    "nist": [
      "PR.PT",
      "DE.CM"
    ]
  },
  "modification_date": "2018-11-15",
  "original_authors": [
    {
      "company": "Splunk",
      "email": "bpatel@splunk.com",
      "name": "Bhavin Patel"
    }
  ],
  "scheduling": {
    "cron_schedule": "30 * * * *",
    "earliest_time": "-70m@m",
    "latest_time": "-10m@m"
  },
  "search": "| tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_hash) as file_hash values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem where Filesystem.file_path=\"C:\\\\program.exe\" by Filesystem.file_name | `drop_dm_object_name(Filesystem)` | `ctime(lastTime)` | `ctime(firstTime)`",
  "search_description": "The search is looking for the creation of program.exe in the C: drive.  The creation of this file in that location may be driven by a motive to perform path interception.",
  "search_id": "c77162d3-f93c-45cc-80c8-22f6v5264g9f",
  "search_name": "Detect Path Interception By Creation Of program.exe",
  "search_type": "detection",
  "security_domain": "endpoint",
  "spec_version": 1,
  "version": "2.0"
}