name: Detect Renamed 7-Zip
id: 4057291a-b8cf-11eb-95fe-acde48001122
version: 2
date: '2021-09-16'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic identifies renamed 7-Zip usage using Sysmon. At
  this stage of an attack, review parallel processes and file modifications for data
  that is staged or potentially have been exfiltrated. This analytic utilizes the
  OriginalFileName to capture the renamed process. During triage, validate this is
  the legitimate version of `7zip` by reviewing the PE metadata. In addition, review
  parallel processes for further suspicious behavior.
data_source:
- Sysmon Event ID 1
search:
  selection1:
    Image|endswith: 7z*.exe
    OriginalFileName: 7z*.exe
  condition: (selection1)
how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node.
known_false_positives: Limited false positives, however this analytic will need to
  be modified for each environment if Sysmon is not used.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md
tags:
  analytic_story:
  - Collection and Staging
  asset_type: Endpoint
  confidence: 90
  impact: 30
  message: The following $process_name$ has been identified as renamed, spawning from
    $parent_process_name$ on $dest$ by $user$.
  mitre_attack_id:
  - T1560.001
  - T1560
  observable:
  - name: user
    type: User
    role:
    - Victim
  - name: dest
    type: Hostname
    role:
    - Victim
  - name: parent_process_name
    type: Process
    role:
    - Parent Process
  - name: process_name
    type: Process
    role:
    - Child Process
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 27
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: xmlwineventlog