mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
52 lines
1.6 KiB
YAML
52 lines
1.6 KiB
YAML
name: USN Journal Deletion
|
|
id: b6e0ff70-b122-4227-9368-4cf322ab43c3
|
|
version: 2
|
|
date: '2018-12-03'
|
|
author: David Dorsey, Splunk
|
|
status: production
|
|
type: TTP
|
|
description: The fsutil.exe application is a legitimate Windows utility used to perform
|
|
tasks related to the file allocation table (FAT) and NTFS file systems. The update
|
|
sequence number (USN) change journal provides a log of all changes made to the files
|
|
on the disk. This search looks for fsutil.exe deleting the USN journal.
|
|
data_source:
|
|
- Sysmon Event ID 1
|
|
search:
|
|
selection1:
|
|
Image|endswith: fsutil.exe
|
|
condition: selection1
|
|
how_to_implement: You must be ingesting data that records process activity from your
|
|
hosts to populate the Endpoint data model in the Processes node. You must also be
|
|
ingesting logs with both the process name and command line from your endpoints.
|
|
The command-line arguments are mapped to the "process" field in the Endpoint data
|
|
model.
|
|
known_false_positives: None identified
|
|
references: []
|
|
tags:
|
|
analytic_story:
|
|
- Windows Log Manipulation
|
|
- Ransomware
|
|
asset_type: Endpoint
|
|
confidence: 90
|
|
impact: 50
|
|
message: Possible USN journal deletion on $dest$
|
|
mitre_attack_id:
|
|
- T1070
|
|
observable:
|
|
- name: dest
|
|
type: Endpoint
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
risk_score: 45
|
|
security_domain: endpoint
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/atomic_red_team/windows-sysmon.log
|
|
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
|
sourcetype: xmlwineventlog
|