mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
60 lines
2.5 KiB
YAML
60 lines
2.5 KiB
YAML
author: Patrick Bareiss, Splunk
|
|
date: '2020-04-29'
|
|
description: Analyze the Process Chain and identify the malicious file. By analyzing
|
|
the parent process guid and searching for the process guid, the spawning process
|
|
chain can be identified.
|
|
id: c5506139-ef86-4cd9-8535-0512aa732e79
|
|
inputs:
|
|
- process_guid
|
|
name: Process Chain Analysis
|
|
search: '`sysmon` EventCode=1 NOT process=*Splunk* | rename process_guid AS out_process_guid
|
|
process_name AS out_process_name parent_process_guid AS out_parent_process_guid
|
|
parent_process_name AS out_parent_process_name | stats count by out_process_guid
|
|
out_process_name out_parent_process_guid out_parent_process_name | eval join_process_guid
|
|
= out_process_guid | join join_process_guid [ search `sysmon` process_guid={process_guid}
|
|
EventCode=1 | rename process_name AS sub_process_name process_guid AS sub_process_guid
|
|
parent_process_name AS sub_parent_process_name parent_process_guid AS sub_parent_process_guid
|
|
| stats count by sub_process_name sub_process_guid sub_parent_process_name sub_parent_process_guid
|
|
| eval join_process_guid = sub_parent_process_guid] | rename sub_process_guid AS
|
|
process_guid sub_process_name AS process_name out_process_guid AS parent_process_guid
|
|
out_process_name AS parent_process_name out_parent_process_guid AS grandparent_process_guid
|
|
out_parent_process_name AS grandparent_process_name | stats count by process_guid
|
|
process_name parent_process_guid parent_process_name grandparent_process_guid grandparent_process_name
|
|
| head 1 | fields - count'
|
|
tags:
|
|
analytic_story:
|
|
- AWS Network ACL Activity
|
|
- Collection and Staging
|
|
- Command and Control
|
|
- DHS Report TA18-074A
|
|
- Data Protection
|
|
- Disabling Security Tools
|
|
- 'Emotet Malware DHS Report TA18-201A '
|
|
- Hidden Cobra Malware
|
|
- Lateral Movement
|
|
- Malicious PowerShell
|
|
- Monitor for Unauthorized Software
|
|
- Netsh Abuse
|
|
- Orangeworm Attack Group
|
|
- Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
|
|
- Prohibited Traffic Allowed or Protocol Mismatch
|
|
- Ransomware
|
|
- SamSam Ransomware
|
|
- Suspicious AWS Traffic
|
|
- Suspicious Command-Line Executions
|
|
- Suspicious DNS Traffic
|
|
- Suspicious MSHTA Activity
|
|
- Suspicious WMI Use
|
|
- Suspicious Windows Registry Activities
|
|
- Unusual Processes
|
|
- Windows Defense Evasion Tactics
|
|
- Windows File Extension and Association Abuse
|
|
- Windows Log Manipulation
|
|
- Windows Persistence Techniques
|
|
- Windows Privilege Escalation
|
|
- Windows Service Abuse
|
|
product:
|
|
- Splunk Phantom
|
|
type: response
|
|
version: 1
|