name: Batch File Write to System32
id: 503d17cb-9eab-4cf8-a20e-01d5c6987ae3
version: 3
date: '2022-12-21'
author: Steven Dick, Michael Haag, Rico Valdez, Splunk
type: TTP
datamodel:
- Endpoint
description: The search looks for a batch file (.bat) written to the Windows system
  directory tree.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
  where Processes.process_name=*  by _time span=1h Processes.process_id Processes.process_name
  Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [|
  tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\system32\\*",
  "*\\syswow64\\*") Filesystem.file_name="*.bat" by _time span=1h Filesystem.dest
  Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)`
  | fields _time dest file_create_time file_name file_path process_name process_path
  process] | dedup file_create_time | table dest, file_create_time, file_name, file_path,
  process_name  | `batch_file_write_to_system32_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
  endpoint product.
known_false_positives: It is possible for this search to generate a notable event
  for a batch file write to a path that includes the string "system32", but is not
  the actual Windows system directory. As such, you should confirm the path of the
  batch file identified by the search. In addition, a false positive may be generated
  by an administrator copying a legitimate batch file in this directory tree. You
  should confirm that the activity is legitimate and modify the search to add exclusions,
  as necessary.
references: []
tags:
  analytic_story:
  - SamSam Ransomware
  asset_type: Endpoint
  cis20:
  - CIS 8
  confidence: 90
  context:
  - Source:Endpoint
  - Stage:Execution
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.002/batch_file_in_system32/windows-sysmon.log
  impact: 70
  kill_chain_phases:
  - Delivery
  message: A file - $file_name$ was written to system32 has occurred on endpoint $dest$
    by user $user$.
  mitre_attack_id:
  - T1204
  - T1204.002
  nist:
  - PR.PT
  - DE.CM
  observable:
  - name: user
    type: User
    role:
    - Victim
  - name: dest
    type: Hostname
    role:
    - Victim
  - name: file_name
    type: File Name
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Filesystem.dest
  - Filesystem.file_name
  - Filesystem.user
  - Filesystem.file_path
  - Processes.process_name
  - Processes.dest
  - Filesystem.process_guid
  - Processes.process_guid
  - Processes.dest
  risk_score: 63
  security_domain: endpoint
  supported_tas:
  - Splunk_TA_microsoft_sysmon