mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
87 lines
3.2 KiB
YAML
87 lines
3.2 KiB
YAML
name: Anomalous usage of 7zip
|
|
id: 9364ee8e-a39a-11eb-8f1d-acde48001122
|
|
version: 1
|
|
date: '2021-04-22'
|
|
author: Michael Haag, Teoderick Contreras, Splunk
|
|
type: Anomaly
|
|
datamodel:
|
|
- Endpoint
|
|
description: The following detection identifies a 7z.exe spawned from `Rundll32.exe`
|
|
or `Dllhost.exe`. It is assumed that the adversary has brought in `7z.exe` and `7z.dll`.
|
|
It has been observed where an adversary will rename `7z.exe`. Additional coverage
|
|
may be required to identify the behavior of renamed instances of `7z.exe`. During
|
|
triage, identify the source of injection into `Rundll32.exe` or `Dllhost.exe`. Capture
|
|
any files written to disk and analyze as needed. Review parallel processes for additional
|
|
behaviors. Typically, archiving files will result in exfiltration.
|
|
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
|
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
|
|
IN ("rundll32.exe", "dllhost.exe") Processes.process_name=*7z* by Processes.dest
|
|
Processes.user Processes.parent_process Processes.process_name Processes.process
|
|
Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
|
|
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `anomalous_usage_of_7zip_filter`'
|
|
how_to_implement: To successfully implement this search you need to be ingesting information
|
|
on process that include the name of the process responsible for the changes from
|
|
your endpoints into the `Endpoint` datamodel in the `Processes` node.
|
|
known_false_positives: False positives should be limited as this behavior is not normal
|
|
for `rundll32.exe` or `dllhost.exe` to spawn and run 7zip.
|
|
references:
|
|
- https://attack.mitre.org/techniques/T1560/001/
|
|
- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
|
|
- https://thedfirreport.com/2021/01/31/bazar-no-ryuk/
|
|
tags:
|
|
analytic_story:
|
|
- Cobalt Strike
|
|
- NOBELIUM Group
|
|
confidence: 80
|
|
context:
|
|
- Source:Endpoint
|
|
- Stage:Collection
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
|
|
impact: 80
|
|
kill_chain_phases:
|
|
- Exploitation
|
|
message: An instance of $parent_process_name$ spawning $process_name$ was identified
|
|
on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading
|
|
of 7zip.
|
|
mitre_attack_id:
|
|
- T1560.001
|
|
- T1560
|
|
observable:
|
|
- name: user
|
|
type: User
|
|
role:
|
|
- Victim
|
|
- name: dest
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
- name: parent_process_name
|
|
type: Process
|
|
role:
|
|
- Parent Process
|
|
- name: process_name
|
|
type: Process
|
|
role:
|
|
- Child Process
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- Processes.process_name
|
|
- Processes.process
|
|
- Processes.dest
|
|
- Processes.user
|
|
- Processes.parent_process_name
|
|
- Processes.process_name
|
|
- Processes.parent_process
|
|
- Processes.process_id
|
|
- Processes.parent_process_id
|
|
risk_score: 64
|
|
security_domain: endpoint
|
|
supported_tas:
|
|
- Splunk_TA_microsoft_sysmon
|
|
asset_type: Endpoint
|