author: Patrick Bareiss, Splunk
date: '2020-04-29'
description: Analyze the Process Chain and identify the malicious file. By analyzing
  the parent process guid and searching for the process guid, the spawning process
  chain can be identified.
id: c5506139-ef86-4cd9-8535-0512aa732e79
inputs:
- process_guid
name: Process Chain Analysis
search: '`sysmon` EventCode=1 NOT process=*Splunk* | rename process_guid AS out_process_guid
  process_name AS out_process_name parent_process_guid AS out_parent_process_guid
  parent_process_name AS out_parent_process_name | stats count by out_process_guid
  out_process_name out_parent_process_guid out_parent_process_name | eval join_process_guid
  = out_process_guid | join join_process_guid [ search `sysmon` process_guid={process_guid}
  EventCode=1 | rename process_name AS sub_process_name process_guid AS sub_process_guid
  parent_process_name AS sub_parent_process_name parent_process_guid AS sub_parent_process_guid
  | stats count by sub_process_name sub_process_guid sub_parent_process_name sub_parent_process_guid
  | eval join_process_guid = sub_parent_process_guid] | rename sub_process_guid AS
  process_guid sub_process_name AS process_name out_process_guid AS parent_process_guid
  out_process_name AS parent_process_name out_parent_process_guid AS grandparent_process_guid
  out_parent_process_name AS grandparent_process_name | stats count by process_guid
  process_name parent_process_guid parent_process_name grandparent_process_guid grandparent_process_name
  | head 1 | fields - count'
tags:
  analytic_story:
  - AWS Network ACL Activity
  - Collection and Staging
  - Command and Control
  - DHS Report TA18-074A
  - Data Protection
  - Disabling Security Tools
  - 'Emotet Malware  DHS Report TA18-201A '
  - Hidden Cobra Malware
  - Lateral Movement
  - Malicious PowerShell
  - Monitor for Unauthorized Software
  - Netsh Abuse
  - Orangeworm Attack Group
  - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
  - Prohibited Traffic Allowed or Protocol Mismatch
  - Ransomware
  - SamSam Ransomware
  - Suspicious AWS Traffic
  - Suspicious Command-Line Executions
  - Suspicious DNS Traffic
  - Suspicious MSHTA Activity
  - Suspicious WMI Use
  - Suspicious Windows Registry Activities
  - Unusual Processes
  - Windows Defense Evasion Tactics
  - Windows File Extension and Association Abuse
  - Windows Log Manipulation
  - Windows Persistence Techniques
  - Windows Privilege Escalation
  - Windows Service Abuse
  product:
  - Splunk Phantom
type: response
version: 1