splunk-security_content/detections/first_time_seen_command_line_argument.yml

name: First time seen command line argument
id: 9be56c82-b1cc-4318-87eb-q138afaaqa39
version: 5
date: '2020-07-21'
description: This search looks for command-line arguments that use a `/c` parameter
  to execute a command that has not previously been seen.
how_to_implement: You must be ingesting data that records process activity from your
  hosts to populate the Endpoint data model in the Processes node. You must be ingesting
  logs with both the process name and command line from your endpoints. The complete
  process name with command-line arguments are mapped to the "process" field in the
  Endpoint data model. Please make sure you run the support search "Previously seen
  command line arguments,"—which creates a lookup file called `previously_seen_cmd_line_arguments.csv`—a
  historical baseline of all command-line arguments. You must also validate this list.
  For the search to do accurate calculation, ensure the search scheduling is the same
  value as the `relative_time` evaluation function.
type: ESCU
references: []
author: Bhavin Patel, Splunk
search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where Processes.process_name = cmd.exe
  Processes.process = "* /c *" by Processes.process Processes.process_name Processes.parent_process_name
  Processes.dest| `drop_dm_object_name(Processes)`| `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | search [| tstats `security_content_summariesonly`
  earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Endpoint.Processes
  where Processes.process_name = cmd.exe Processes.process = "* /c *" by Processes.process
  | `drop_dm_object_name(Processes)` | inputlookup append=t previously_seen_cmd_line_arguments
  | stats min(firstTime) as firstTime, max(lastTime) as lastTime by process | outputlookup
  previously_seen_cmd_line_arguments | eval newCmdLineArgument=if(firstTime >= relative_time(now(),
  "-70m@m"), 1, 0) | where newCmdLineArgument=1 | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | table process] | `first_time_seen_command_line_argument_filter` '
known_false_positives: Legitimate programs can also use command-line arguments to
  execute. Please verify the command-line arguments to check what command/program
  is being executed. We recommend customizing the `first_time_seen_cmd_line_filter`
  macro to exclude legitimate parent_process_name
tags:
  analytics_story:
  - DHS Report TA18-074A
  - Suspicious Command-Line Executions
  - Orangeworm Attack Group
  - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
  - Hidden Cobra Malware
  mitre_attack_id:
  - T1059.001
  - T1059.003
  kill_chain_phases:
  - Command and Control
  - Actions on Objectives
  cis20:
  - CIS 3
  - CIS 8
  nist:
  - PR.PT
  - DE.CM
  - PR.IP
  security_domain: endpoint
  asset_type: Endpoint