mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
bpatel
89 lines
2.9 KiB
JSON
89 lines
2.9 KiB
JSON
{
|
|
"asset_type": "Endpoint",
|
|
"channel": "ESCU",
|
|
"confidence": "medium",
|
|
"correlation_rule": {
|
|
"notable": {
|
|
"nes_fields": "dest, user, process",
|
|
"rule_description": "This search looks for scrcons.exe, which indicates that a script was launched via WMI.",
|
|
"rule_title": "Script execution via WMI on $dest$"
|
|
},
|
|
"risk": {
|
|
"risk_object": "dest",
|
|
"risk_object_type": [
|
|
"system"
|
|
],
|
|
"risk_score": 70
|
|
},
|
|
"suppress": {
|
|
"suppress_fields": "dest,process",
|
|
"suppress_period": "28800s"
|
|
}
|
|
},
|
|
"creation_date": "2018-10-23",
|
|
"data_metadata": {
|
|
"data_models": [
|
|
"Endpoint"
|
|
],
|
|
"data_source": [
|
|
"Endpoint Intel"
|
|
],
|
|
"providing_technologies": [
|
|
"Carbon Black Response",
|
|
"Sysmon",
|
|
"Tanium",
|
|
"Ziften"
|
|
]
|
|
},
|
|
"eli5": "Attackers are increasingly abusing Windows Management Infrastructure for stealth, persistence, lateral movement, or just to leverage its functionality. This search looks for scripts launched via WMI, either remotely or locally, by looking for the execution of scrcons.exe, which is the scripting host used by WMI, similar to wscript or cscript.",
|
|
"how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.",
|
|
"known_false_positives": "Although unlikely, administrators may use wmi to launch scripts for legitimate purposes.",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "rvaldez@splunk.com",
|
|
"name": "Rico Valdez"
|
|
}
|
|
],
|
|
"mappings": {
|
|
"cis20": [
|
|
"CIS 3",
|
|
"CIS 5"
|
|
],
|
|
"kill_chain_phases": [
|
|
"Actions on Objectives"
|
|
],
|
|
"mitre_attack": [
|
|
"Execution",
|
|
"Windows Management Instrumentation"
|
|
],
|
|
"nist": [
|
|
"PR.PT",
|
|
"PR.AT",
|
|
"PR.AC",
|
|
"PR.IP"
|
|
]
|
|
},
|
|
"modification_date": "2019-03-01",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "rvaldez@splunk.com",
|
|
"name": "Rico Valdez"
|
|
}
|
|
],
|
|
"scheduling": {
|
|
"cron_schedule": "0 * * * *",
|
|
"earliest_time": "-70m@m",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "| tstats `summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name = \"scrcons.exe\" by Processes.user Processes.dest Processes.process_name | `drop_dm_object_name(\"Processes\")` | `ctime(firstTime)`| `ctime(lastTime)`",
|
|
"search_description": "This search looks for scripts launched via WMI.",
|
|
"search_id": "aa73f80d-d728-4077-b226-81ea0c8be589",
|
|
"search_name": "Script Execution via WMI",
|
|
"search_type": "detection",
|
|
"security_domain": "endpoint",
|
|
"spec_version": 1,
|
|
"version": "1.0"
|
|
}
|