mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
92 lines
3.4 KiB
JSON
92 lines
3.4 KiB
JSON
{
|
|
"asset_type": "Endpoint",
|
|
"channel": "ESCU",
|
|
"confidence": "medium",
|
|
"correlation_rule": {
|
|
"notable": {
|
|
"nes_fields": "dest, user, process_name",
|
|
"rule_description": "The system $dest$ executed a PowerShell process that has an encoded command on the command-line",
|
|
"rule_title": "PowerShell process with an encoded command detected on $dest$"
|
|
},
|
|
"risk": {
|
|
"risk_object": "dest",
|
|
"risk_object_type": [
|
|
"system"
|
|
],
|
|
"risk_score": 20
|
|
},
|
|
"suppress": {
|
|
"suppress_fields": "dest, user, process_name",
|
|
"suppress_period": "14400s"
|
|
}
|
|
},
|
|
"creation_date": "2016-09-18",
|
|
"data_metadata": {
|
|
"data_models": [
|
|
"Endpoint"
|
|
],
|
|
"data_source": [
|
|
"Endpoint Intel"
|
|
],
|
|
"providing_technologies": [
|
|
"Carbon Black Response",
|
|
"CrowdStrike Falcon",
|
|
"Sysmon",
|
|
"Tanium",
|
|
"Ziften"
|
|
]
|
|
},
|
|
"eli5": "This search looks for PowerShell processes that are passing encoded commands on the command-line. The flags \"-EncodedCommand\" and \"-enc\" are two different possible flags that can be used to pass base64 encoded commands to PowerShell. This search will return the host, the user the process ran under, the process and it's command-line arguments, the number of times it's seen this process, and the first and last times it saw this process.",
|
|
"how_to_implement": "You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.",
|
|
"known_false_positives": "System administrators may use this option, but it's not common.",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "davidd@splunk.com",
|
|
"name": "David Dorsey"
|
|
}
|
|
],
|
|
"mappings": {
|
|
"cis20": [
|
|
"CIS 3",
|
|
"CIS 7",
|
|
"CIS 8"
|
|
],
|
|
"kill_chain_phases": [
|
|
"Command and Control",
|
|
"Actions on Objectives"
|
|
],
|
|
"mitre_attack": [
|
|
"Execution",
|
|
"PowerShell",
|
|
"Scripting"
|
|
],
|
|
"nist": [
|
|
"PR.PT",
|
|
"DE.CM",
|
|
"PR.IP"
|
|
]
|
|
},
|
|
"modification_date": "2018-12-03",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "davidd@splunk.com",
|
|
"name": "David Dorsey"
|
|
}
|
|
],
|
|
"scheduling": {
|
|
"cron_schedule": "0 * * * *",
|
|
"earliest_time": "-70m@m",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "| tstats `summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest | `drop_dm_object_name(Processes)` | `ctime(firstTime)`| `ctime(lastTime)` | search process=*-EncodedCommand* OR process=*-enc*",
|
|
"search_description": "This search looks for PowerShell processes that have encoded the script within the command-line. Malware has been seen using this parameter, as it obfuscates the code and makes it relatively easy to pass a script on the command-line.",
|
|
"search_id": "c4db14d9-7909-48b4-a054-aa14d89dbb19",
|
|
"search_name": "Malicious PowerShell Process - Encoded Command",
|
|
"search_type": "detection",
|
|
"security_domain": "endpoint",
|
|
"spec_version": 1,
|
|
"version": "3.0"
|
|
}
|