mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
60 lines
2.3 KiB
YAML
60 lines
2.3 KiB
YAML
name: Processes created by netsh
|
|
id: b89919ed-fe5f-492c-b139-95dbb162041e
|
|
version: 5
|
|
date: '2020-11-23'
|
|
author: Bhavin Patel, Splunk
|
|
type: TTP
|
|
datamodel:
|
|
- Endpoint
|
|
description: This search looks for processes launching netsh.exe to execute various
|
|
commands via the netsh command-line utility. Netsh.exe is a command-line scripting
|
|
utility that allows you to, either locally or remotely, display or modify the network
|
|
configuration of a computer that is currently running. Netsh can be used as a persistence
|
|
proxy technique to execute a helper .dll when netsh.exe is executed. In this search,
|
|
we are looking for processes spawned by netsh.exe that are executing commands via
|
|
the command line. Deprecated because we have another detection of the same type.
|
|
search: '| tstats `security_content_summariesonly` count values(Processes.process)
|
|
as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
|
|
where Processes.process_name=netsh.exe by Processes.user Processes.dest Processes.parent_process
|
|
Processes.parent_process_name Processes.process_name | `drop_dm_object_name(Processes)`
|
|
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `processes_created_by_netsh_filter`'
|
|
how_to_implement: To successfully implement this search, you must be ingesting logs
|
|
with the process name, command-line arguments, and parent processes from your endpoints.
|
|
If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
|
|
known_false_positives: It is unusual for netsh.exe to have any child processes in
|
|
most environments. It makes sense to investigate the child process and verify whether
|
|
the process spawned is legitimate. We explicitely exclude "C:\Program Files\rempl\sedlauncher.exe"
|
|
process path since it is a legitimate process by Mircosoft.
|
|
references: []
|
|
tags:
|
|
analytic_story:
|
|
- Netsh Abuse
|
|
asset_type: Endpoint
|
|
cis20:
|
|
- CIS 8
|
|
kill_chain_phases:
|
|
- Actions on Objectives
|
|
mitre_attack_id:
|
|
- T1562.004
|
|
nist:
|
|
- PR.PT
|
|
- DE.CM
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
security_domain: endpoint
|
|
confidence: 50
|
|
impact: 50
|
|
risk_score: 25
|
|
context:
|
|
- Unknown
|
|
message: tbd
|
|
observable:
|
|
- name: field
|
|
type: Unknown
|
|
role:
|
|
- Unknown
|