asset_type: ''
confidence: medium
creation_date: '2017-08-23'
data_metadata:
  data_models:
    - Endpoint
  data_source:
    - Endpoint Intel
  providing_technologies:
    - Carbon Black Response
    - CrowdStrike Falcon
    - Sysmon
    - Tanium
    - Ziften
description: Command lines that are extremely long may be indicative of malicious
  activity on your hosts.
detect:
  splunk:
    correlation_rule:
      notable:
        nes_fields: dest, process, user
        rule_description: An unusually long command line $cmdline$ was found on $dest$
        rule_title: Unusually Long Command Line on $dest$
      risk:
        risk_object: dest
        risk_object_type:
          - system
        risk_score: 50
      schedule:
        cron_schedule: 0 * * * *
        earliest_time: -1d@d
        latest_time: -10m@m
      search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as
        lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.dest
        Processes.process_name Processes.process | `drop_dm_object_name("Processes")`
        | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|  eval processlen=len(process) | eventstats
        stdev(processlen) as stdev, avg(processlen) as avg by dest | stats max(processlen)
        as maxlen, values(stdev) as stdevperhost, values(avg) as avgperhost by dest,
        user, process_name, process| eval threshold = 10 | where maxlen > ((threshold*stdevperhost)
        + avgperhost)'
      suppress:
        suppress_fields: dest,user,process
        suppress_period: 28800s
eli5: This search calculates the average and standard deviation for the length of
  the command lines on each of your endpoints and alerts when it detects a command
  line with a length over 10 times the standard deviation larger than the average
  command line.
entities:
  - dest
  - process_name
  - user
how_to_implement: You must be ingesting endpoint data that tracks process activity,
  including parent-child relationships, from your endpoints to populate the Endpoint
  data model in the Processes node. The command-line arguments are mapped to the "process"
  field in the Endpoint data model.
id: c77162d3-f93c-45cc-80c8-22f6a4264e7f
investigations:
  - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd76
    name: Get Authentication Logs For Endpoint
    type: splunk
  - id: fecf2918-670d-4f1c-872b-3d7317a41bf9
    name: Get Parent Process Info
    type: splunk
  - id: fdcfb369-1725-4c24-824a-22972d7f0d55
    name: Get Risk Modifiers For User
    type: splunk
  - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd71
    name: Get Process Info
    type: splunk
  - id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7
    name: Get Notable History
    type: splunk
  - id: f3fb4d1b-5f33-4b01-b541-c7af9534c242
    name: Get Notable Info
    type: splunk
  - id: fdcfb369-1725-4c24-824a-22972d7f0d65
    name: Get Risk Modifiers For Endpoint
    type: splunk
  - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd74
    name: Get User Information from Identity Table
    type: splunk
  - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd22
    name: Investigate Web Activity From Host
    type: splunk
known_false_positives: Some legitimate applications start with long command lines.
maintainers:
  - company: Splunk
    email: bpatel@splunk.com
    name: Bhavin Patel
mappings:
  cis20:
    - CIS 8
  kill_chain_phases:
    - Actions on Objectives
  mitre_attack:
    - Execution
  nist:
    - PR.PT
    - DE.CM
modification_date: '2019-02-28'
name: Unusually Long Command Line
original_authors:
  - company: Splunk
    email: davidd@splunk.com
    name: David Dorsey
references: []
security_domain: endpoint
spec_version: 2
type: splunk
version: '3.0'