splunk-security_content/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md

title, excerpt, categories, last_modified_at, toc, toc_label, tags

title	excerpt	categories	last_modified_at	toc	toc_label	tags
Attacker Tools On Endpoint	Match Legitimate Name or Location, Masquerading, OS Credential Dumping, Active Scanning	Endpoint	2021-11-04	true		Match Legitimate Name or Location Defense Evasion Masquerading Defense Evasion OS Credential Dumping Credential Access Active Scanning Reconnaissance Splunk Enterprise Splunk Enterprise Security Splunk Cloud Endpoint

Try in Splunk Security Cloud{: .btn .btn--success}

Description

This search looks for execution of commonly used attacker tools on an endpoint.

• Type: TTP
• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
• Datamodel: Endpoint
• Last Updated: 2021-11-04
• Author: Bhavin Patel, Splunk
• ID: a51bfe1a-94f0-48cc-b4e4-16a110145893

ATT&CK

ID	Technique	Tactic
T1036.005	Match Legitimate Name or Location	Defense Evasion

| T1036 | Masquerading | Defense Evasion |

| T1003 | OS Credential Dumping | Credential Access |

| T1595 | Active Scanning | Reconnaissance |

Search

| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process) as process values(Processes.parent_process) as parent_process from datamodel=Endpoint.Processes where Processes.dest!=unknown Processes.user!=unknown by Processes.dest Processes.user Processes.process_name Processes.process 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `drop_dm_object_name(Processes)` 
| lookup attacker_tools attacker_tool_names AS process_name OUTPUT description 
| search description !=false
| `attacker_tools_on_endpoint_filter`

Associated Analytic Story

• Monitor for Unauthorized Software
• XMRig
• SamSam Ransomware
• Unusual Processes

How To Implement

To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is usually generated via logs that report process tracking in your Windows audit settings.

Required field

• Processes.dest
• Processes.user
• Processes.process_name
• Processes.parent_process

Kill Chain Phase

• Installation
• Command and Control
• Actions on Objectives

Known False Positives

Some administrator activity can be potentially triggered, please add those users to the filter macro.

RBA

Risk Score	Impact	Confidence	Message
64.0	80	80	An attacker tool process_name,listed in attacker_tools.csv is executed on host dest by User user. This process process_name is known to do- description

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

• https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1595/attacker_scan_tools/windows-sysmon.log

source | version: 2