splunk-security_content/docs/_posts/2018-12-14-batch_file_write_to_system32.md

title, excerpt, categories, last_modified_at, toc, tags

title	excerpt	categories	last_modified_at	toc	tags
Batch File Write to System32	Malicious File	Endpoint	2018-12-14	true	TTP T1204.002 Malicious File Execution Splunk Enterprise Splunk Enterprise Security Splunk Cloud Endpoint Delivery

Try in Splunk Security Cloud{: .btn .btn--success}

Description

The search looks for a batch file (.bat) written to the Windows system directory tree.

• Type: TTP
• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
• Datamodel: Endpoint
• Last Updated: 2018-12-14
• Author: Rico Valdez, Splunk
• ID: 503d17cb-9eab-4cf8-a20e-01d5c6987ae3

ATT&CK

ID	Technique	Tactic
T1204.002	Malicious File	Execution

Search

| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.dest) as dest values(Filesystem.file_name) as file_name values(Filesystem.user) as user from datamodel=Endpoint.Filesystem by Filesystem.file_path 
| `drop_dm_object_name(Filesystem)` 
| `security_content_ctime(lastTime)` 
| `security_content_ctime(firstTime)`
| rex field=file_name "(?<file_extension>\.[^\.]+)$" 
| search file_path=*system32* AND file_extension=.bat 
| `batch_file_write_to_system32_filter`

Associated Analytic Story

• SamSam Ransomware

How To Implement

You must be ingesting data that records the file-system activity from your hosts to populate the Endpoint file-system data-model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.

Required field

• _time
• Filesystem.dest
• Filesystem.file_name
• Filesystem.user
• Filesystem.file_path

Kill Chain Phase

• Delivery

Known False Positives

It is possible for this search to generate a notable event for a batch file write to a path that includes the string "system32", but is not the actual Windows system directory. As such, you should confirm the path of the batch file identified by the search. In addition, a false positive may be generated by an administrator copying a legitimate batch file in this directory tree. You should confirm that the activity is legitimate and modify the search to add exclusions, as necessary.

RBA

Risk Score	Impact	Confidence	Message
63.0	70	90	A file - file_name was written to system32 has occurred on endpoint dest by user user.

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

• https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.002/batch_file_in_system32/windows-sysmon.log

source | version: 1