mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
65 lines
2.0 KiB
YAML
65 lines
2.0 KiB
YAML
name: Samsam Test File Write
|
|
id: 493a879d-519d-428f-8f57-a06a0fdc107e
|
|
version: 1
|
|
date: '2018-12-14'
|
|
author: Rico Valdez, Splunk
|
|
type: TTP
|
|
datamodel:
|
|
- Endpoint
|
|
description: The search looks for a file named "test.txt" written to the windows system
|
|
directory tree, which is consistent with Samsam propagation.
|
|
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
|
as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_name)
|
|
as file_name from datamodel=Endpoint.Filesystem where Filesystem.file_path=*\\windows\\system32\\test.txt
|
|
by Filesystem.file_path | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)`
|
|
| `security_content_ctime(firstTime)` | `samsam_test_file_write_filter`'
|
|
how_to_implement: You must be ingesting data that records the file-system activity
|
|
from your hosts to populate the Endpoint file-system data-model node. If you are
|
|
using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
|
|
you want to collect data.
|
|
known_false_positives: No false positives have been identified.
|
|
references: []
|
|
tags:
|
|
analytic_story:
|
|
- SamSam Ransomware
|
|
asset_type: Endpoint
|
|
automated_detection_testing: passed
|
|
cis20:
|
|
- CIS 8
|
|
confidence: 20
|
|
context:
|
|
- source:endpoint
|
|
- stage: Impact
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/sam_sam_note/windows-sysmon.log
|
|
impact: 60
|
|
kill_chain_phases:
|
|
- Delivery
|
|
message: A samsam ransomware test file creation in $file_path$ in host $dest$
|
|
mitre_attack_id:
|
|
- T1486
|
|
nist:
|
|
- PR.PT
|
|
- DE.CM
|
|
observable:
|
|
- name: dest
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
- name: user
|
|
type: user
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- Filesystem.user
|
|
- Filesystem.dest
|
|
- Filesystem.file_name
|
|
- Filesystem.file_path
|
|
risk_score: 12
|
|
security_domain: endpoint
|