mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
research bot
72 lines
3.1 KiB
YAML
72 lines
3.1 KiB
YAML
name: Unusually Long Command Line
|
|
id: 58f43aba-1775-445e-b19c-be2b87d83ae3
|
|
version: 1
|
|
date: '2020-10-06'
|
|
author: Ignacio Bermudez Corrales, Splunk
|
|
type: streaming
|
|
datamodel: []
|
|
description: Command lines that are extremely long may be indicative of malicious
|
|
activity on your hosts. This search leverages the Splunk Streaming ML DSP plugin
|
|
to help identify command lines with lengths that are unusual for a given user. This
|
|
detection is inspired on Unusually Long Command Line authored by Rico Valdez.
|
|
search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
|
|
"_time"), "string", null)) | eval cmd_line=ucast(map_get(input_event, "process"),
|
|
"string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
|
|
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
|
|
process_name=ucast(map_get(input_event, "process_name"), "string", null), event_id=ucast(map_get(input_event,
|
|
"event_id"), "string", null) | where cmd_line!=null and dest_user_id!=null | eval
|
|
cmd_line_norm=replace(cast(cmd_line, "string"), /\s(--?\w+)|(\/\w+)/, " ARG"), cmd_line_norm=replace(cmd_line_norm,
|
|
/\w:\\[^\s]+/, "PATH"), cmd_line_norm=replace(cmd_line_norm, /\d+/, "N"), input=parse_double(len(coalesce(cmd_line_norm,
|
|
""))) | select timestamp, process_name, dest_device_id, dest_user_id, cmd_line,
|
|
input | adaptive_threshold algorithm="quantile" entity="process_name" window=60480000
|
|
| where label AND quantile>0.99 | first_time_event input_columns=["dest_device_id",
|
|
"cmd_line"] | where first_time_dest_device_id_cmd_line | eval start_time = timestamp,
|
|
end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map(["event_id",
|
|
event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();'
|
|
how_to_implement: You must be ingesting sysmon endpoint data that monitors command
|
|
lines.
|
|
known_false_positives: This detection may flag suspiciously long command lines when
|
|
there is not sufficient evidence (samples) for a given process that this detection
|
|
is tracking; or when there is high variability in the length of the command line
|
|
for the tracked process. Also, some legitimate applications may use long command
|
|
lines. Such is the case of Ansible, that encodes Powershell scripts using long base64.
|
|
Attackers may use this technique to obfuscate their payloads.
|
|
references: []
|
|
tags:
|
|
analytic_story:
|
|
- Unusual Processes
|
|
cis20:
|
|
- CIS 8
|
|
confidence: 40
|
|
context:
|
|
- source:endpoint
|
|
- stage: Defense Evasion
|
|
impact: 30
|
|
kill_chain_phases:
|
|
- Actions on Objectives
|
|
message: A process $process_name$ with a long commandline $cmd_line$ executed in
|
|
host $dest_device_id$
|
|
nist:
|
|
- PR.PT
|
|
- DE.CM
|
|
observable:
|
|
- name: dest_device_id
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
- name: dest_user_id
|
|
type: user
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Behavioral Analytics
|
|
required_fields:
|
|
- process_name
|
|
- _time
|
|
- dest_device_id
|
|
- dest_user_id
|
|
- process
|
|
risk_score: 12
|
|
risk_severity: low
|
|
security_domain: endpoint
|