mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
53 lines
2.5 KiB
YAML
53 lines
2.5 KiB
YAML
name: Baseline of Command Line Length - MLTK
|
|
id: d2a4d85b-fc6a-47a0-82f6-bc1ec2ebc459
|
|
version: 1
|
|
date: '2019-05-08'
|
|
author: Rico Valdez, Splunk
|
|
type: Baseline
|
|
datamodel: []
|
|
description: This search is used to build a Machine Learning Toolkit (MLTK) model
|
|
to characterize the length of the command lines observed for each user in the environment.
|
|
By default, the search uses the last 30 days of data to build the model. The model
|
|
created by this search is then used in the corresponding detection search, which
|
|
identifies outliers in the length of the command line.
|
|
search: '| tstats `security_content_summariesonly` count min(_time) as start_time
|
|
max(_time) as end_time FROM datamodel=Endpoint.Processes by Processes.user Processes.dest
|
|
Processes.process_name Processes.process | `drop_dm_object_name(Processes)` | search
|
|
user!=unknown | `security_content_ctime(start_time)`| `security_content_ctime(end_time)`|
|
|
eval processlen=len(process) | fit DensityFunction processlen by user into cmdline_pdfmodel'
|
|
how_to_implement: You must be ingesting endpoint data and populating the Endpoint
|
|
data model. In addition, you must have the Machine Learning Toolkit (MLTK) version
|
|
>= 4.2 installed, along with any required dependencies. Depending on the number
|
|
of users in your environment, you may also need to adjust the value for max_inputs
|
|
in the MLTK settings for the DensityFunction algorithm, then ensure that the search
|
|
completes in a reasonable timeframe. By default, the search builds the model using
|
|
the past 30 days of data. You can modify the search window to build the model over
|
|
a longer period of time, which may give you better results. You may also want to
|
|
periodically re-run this search to rebuild the model with the latest data. More
|
|
information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.
|
|
known_false_positives: none
|
|
references: []
|
|
tags:
|
|
analytic_story:
|
|
- Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
|
|
- Ransomware
|
|
- Suspicious Command-Line Executions
|
|
- Suspicious MSHTA Activity
|
|
- Unusual Processes
|
|
deployments:
|
|
- Daily Cache Updates
|
|
detections:
|
|
- Detect Prohibited Applications Spawning cmd.exe
|
|
- Unusually Long Command Line - MLTK
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- Processes.user
|
|
- Processes.dest
|
|
- Processes.process_name
|
|
- Processes.process
|
|
security_domain: endpoint
|