name: Batch File Write to System32
id: 503d17cb-9eab-4cf8-a20e-01d5c6987ae3
version: 1
date: '2018-12-14'
description: The search looks for a batch file (.bat) written to the Windows system
  directory tree.
how_to_implement: You must be ingesting data that records the file-system activity
  from your hosts to populate the Endpoint file-system data-model node. If you are
  using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
  you want to collect data.
type: ESCU
references: []
author: Rico Valdez, Splunk
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime values(Filesystem.dest) as dest values(Filesystem.file_name) as file_name
  values(Filesystem.user) as user from datamodel=Endpoint.Filesystem by Filesystem.file_path
  | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`|
  rex field=file_name "(?<file_extension>\.[^\.]+)$" | search file_path=*system32*
  AND file_extension=.bat | `batch_file_write_to_system32_filter`'
known_false_positives: It is possible for this search to generate a notable event
  for a batch file write to a path that includes the string "system32", but is not
  the actual Windows system directory. As such, you should confirm the path of the
  batch file identified by the search. In addition, a false positive may be generated
  by an administrator copying a legitimate batch file in this directory tree. You
  should confirm that the activity is legitimate and modify the search to add exclusions,
  as necessary.
tags:
  analytics_story:
  - SamSam Ransomware
  kill_chain_phases:
  - Delivery
  cis20:
  - CIS 8
  nist:
  - PR.PT
  - DE.CM
  security_domain: endpoint
  asset_type: Endpoint