mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
85 lines
2.9 KiB
JSON
85 lines
2.9 KiB
JSON
{
|
|
"channel": "ESCU",
|
|
"confidence": "medium",
|
|
"correlation_rule": {
|
|
"notable": {
|
|
"nes_fields": "dest, process, user,cmdline",
|
|
"rule_description": "An unusually long command-line $cmdline$ was found on $dest$",
|
|
"rule_title": "Unusually Long Command-Line on $dest$"
|
|
},
|
|
"risk": {
|
|
"risk_object": "dest",
|
|
"risk_object_type": [
|
|
"system"
|
|
],
|
|
"risk_score": 50
|
|
},
|
|
"suppress": {
|
|
"suppress_fields": "dest,user,process",
|
|
"suppress_period": "28800s"
|
|
}
|
|
},
|
|
"creation_date": "2017-08-23",
|
|
"data_metadata": {
|
|
"data_source": [
|
|
"Endpoint Intel"
|
|
],
|
|
"data_sourcetypes": [
|
|
"XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
|
|
],
|
|
"providing_technologies": [
|
|
"Carbon Black Response",
|
|
"CrowdStrike Falcon",
|
|
"Sysmon",
|
|
"Tanium",
|
|
"Ziften"
|
|
]
|
|
},
|
|
"eli5": "This search calculates the average and standard deviation for the length of the command-lines on each of your endpoints and alerts when a command-line is found with a length over 10 times the standard deviation larger than the average command-line.",
|
|
"how_to_implement": "You need to be ingesting logs with both the process name and command-line from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Please consider changing the value of threshold in the search for reducing false positives.",
|
|
"known_false_positives": "Some legitimate applications start with long command-lines.",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"mappings": {
|
|
"cis20": [
|
|
"CIS 8"
|
|
],
|
|
"kill_chain_phases": [
|
|
"Actions on Objectives"
|
|
],
|
|
"mitre_attack": [
|
|
"Execution"
|
|
],
|
|
"nist": [
|
|
"PR.PT",
|
|
"DE.CM"
|
|
]
|
|
},
|
|
"modification_date": "2018-08-22",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "davidd@splunk.com",
|
|
"name": "David Dorsey"
|
|
}
|
|
],
|
|
"scheduling": {
|
|
"cron_schedule": "0 * * * *",
|
|
"earliest_time": "-1d@d",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "(sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR tag=process) | stats count min(_time) as firstTime max(_time) as lastTime by dest, user, process, cmdline | `ctime(firstTime)`| `ctime(lastTime)` | eval cmdlen=len(cmdline) | eventstats stdev(cmdlen) as stdev, avg(cmdlen) as avg by dest | stats max(cmdlen) as maxlen, values(stdev) as stdevperhost, values(avg) as avgperhost by dest, process,cmdline| eval threshold = 10 | where maxlen > ((threshold*stdevperhost) + avgperhost)",
|
|
"search_description": "Command-lines that are extremely long can be indicative of malicious activity on your hosts.",
|
|
"search_id": "c77162d3-f93c-45cc-80c8-22f6a4264e7f",
|
|
"search_name": "Unusually Long Command Line",
|
|
"search_type": "detection",
|
|
"security_domain": "endpoint",
|
|
"spec_version": 1,
|
|
"version": "2.0"
|
|
}
|