name: Attacker Tools On Endpoint
id: a51bfe1a-94f0-48cc-b4e4-16a110145893
version: 2
date: '2021-11-04'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: This search looks for execution of commonly used attacker tools on an
  endpoint.
data_source:
- Sysmon Event ID 1
search:
  selection1:
    User: unknown
    Computer: unknown
  condition: selection1
how_to_implement: To successfully implement this search, you must be ingesting data
  that records process activity from your hosts to populate the endpoint data model
  in the processes node. This is typically populated via endpoint detection-and-response
  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
  used for this search is usually generated via logs that report process tracking
  in your Windows audit settings.
known_false_positives: Some administrator activity can be potentially triggered, please
  add those users to the filter macro.
references: []
tags:
  analytic_story:
  - Monitor for Unauthorized Software
  - XMRig
  - SamSam Ransomware
  - Unusual Processes
  - CISA AA22-264A
  asset_type: Endpoint
  confidence: 80
  impact: 80
  message: An attacker tool $process_name$,listed in attacker_tools.csv is executed
    on host $dest$ by User $user$. This process $process_name$ is known to do- $description$
  mitre_attack_id:
  - T1036.005
  - T1036
  - T1003
  - T1595
  observable:
  - name: user
    type: User
    role:
    - Victim
  - name: dest
    type: Hostname
    role:
    - Victim
  - name: parent_process
    type: Process
    role:
    - Parent Process
  - name: process_name
    type: Process
    role:
    - Child Process
    - Attacker
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 64
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1595/attacker_scan_tools/windows-sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: xmlwineventlog