asset_type: ''
confidence: medium
creation_date: '2017-11-16'
data_metadata:
  data_models:
    - Endpoint
  data_source:
    - Endpoint Intel
  providing_technologies:
    - Carbon Black Response
    - CrowdStrike Falcon
    - Tanium
    - Ziften
description: 'The search is looking for the creation of program.exe in the C: drive.  The
  creation of this file in that location may be driven by a motive to perform path
  interception.'
detect:
  splunk:
    correlation_rule:
      notable:
        nes_fields: dest, file_path, file_name
        rule_description: 'A potentially malicious file program.exe was detected on
          the C: drive. The creation of this file is often associated with a motive
          to perform a path interception attack. '
        rule_title: Path Interception attempt discovered $dest$ via creation of program.exe
      risk:
        risk_object: dest
        risk_object_type:
          - system
        risk_score: 50
      schedule:
        cron_schedule: 30 * * * *
        earliest_time: -70m@m
        latest_time: -10m@m
      search: '| tstats `summariesonly` count min(_time) as firstTime max(_time) as
        lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_hash)
        as file_hash values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem
        where Filesystem.file_path="C:\\program.exe" by Filesystem.file_name | `drop_dm_object_name(Filesystem)`
        | `ctime(lastTime)` | `ctime(firstTime)`'
      suppress:
        suppress_fields: dest, file_path, file_name
        suppress_period: 86400s
eli5: 'This search queries the Endpoint file-system data model node to list out all
  the values of destination machines, as well as the values of file hashes and file
  paths that have the file "program.exe" in the C: drive. Path interception occurs
  when an executable is placed in a specific path so that it is executed by an application
  instead of by the intended target. In this case, applications vulnerable to path
  interception (because of unquoted service paths with spaces in Windows registry)
  allow attackers to execute maliciously crafted program.exes.'
entities:
  - dest
how_to_implement: You must be ingesting data that records the file-system activity
  from your hosts to populate the Endpoint file-system data model node. This is typically
  populated via endpoint detection-and-response products, such as Carbon Black, or
  other endpoint data sources, such as Sysmon. The data used for this search is typically
  generated via logs that report file system reads and writes.
id: c77162d3-f93c-45cc-80c8-22f6v5264g9f
investigations:
  - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd76
    name: Get Authentication Logs For Endpoint
    type: splunk
  - id: fecf2918-670d-4f1c-872b-3d7317a41bf9
    name: Get Parent Process Info
    type: splunk
  - id: fdcfb369-1725-4c24-824a-22972d7f0d55
    name: Get Risk Modifiers For User
    type: splunk
  - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd71
    name: Get Process Info
    type: splunk
  - id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7
    name: Get Notable History
    type: splunk
  - id: f3fb4d1b-5f33-4b01-b541-c7af9534c242
    name: Get Notable Info
    type: splunk
  - id: fdcfb369-1725-4c24-824a-22972d7f0d65
    name: Get Risk Modifiers For Endpoint
    type: splunk
  - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd74
    name: Get User Information from Identity Table
    type: splunk
known_false_positives: 'It is unlikely that a normal user may create and place this
  file in the C: drive.  Confirm with the user.'
maintainers:
  - company: Splunk
    email: bpatel@splunk.com
    name: Bhavin Patel
mappings:
  cis20:
    - CIS 8
  kill_chain_phases:
    - Actions on Objectives
  mitre_attack:
    - Privilege Escalation
    - Persistence
  nist:
    - PR.PT
    - DE.CM
modification_date: '2018-11-15'
name: Detect Path Interception By Creation Of program.exe
original_authors:
  - company: Splunk
    email: bpatel@splunk.com
    name: Bhavin Patel
references: []
security_domain: endpoint
spec_version: 2
type: splunk
version: '2.0'