splunk-security_content/detections/endpoint/attacker_tools_on_endpoint.yml

name: Attacker Tools On Endpoint
id: a51bfe1a-94f0-48cc-b4e4-16a110145893
version: 2
date: '2021-11-04'
author: Bhavin Patel, Splunk
type: TTP
datamodel:
- Endpoint
description: This search looks for execution of commonly used attacker tools on an
  endpoint.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime values(Processes.process) as process values(Processes.parent_process)
  as parent_process from datamodel=Endpoint.Processes where Processes.dest!=unknown
  Processes.user!=unknown by Processes.dest Processes.user Processes.process_name
  Processes.process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `drop_dm_object_name(Processes)` | lookup attacker_tools attacker_tool_names AS
  process_name OUTPUT description | search description !=false| `attacker_tools_on_endpoint_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data
  that records process activity from your hosts to populate the endpoint data model
  in the processes node. This is typically populated via endpoint detection-and-response
  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
  used for this search is usually generated via logs that report process tracking
  in your Windows audit settings.
known_false_positives: Some administrator activity can be potentially triggered, please
  add those users to the filter macro.
references: []
tags:
  analytic_story:
  - Monitor for Unauthorized Software
  - XMRig
  - SamSam Ransomware
  - Unusual Processes
  - CISA AA22-264A
  asset_type: Endpoint
  cis20:
  - CIS 2
  confidence: 80
  context:
  - Source:Endpoint
  - Stage:Execution
  - Stage:Recon
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1595/attacker_scan_tools/windows-sysmon.log
  impact: 80
  kill_chain_phases:
  - Installation
  - Command & Control
  - Actions on Objectives
  message: An attacker tool $process_name$,listed in attacker_tools.csv is executed
    on host $dest$ by User $user$. This process $process_name$ is known to do- $description$
  mitre_attack_id:
  - T1036.005
  - T1036
  - T1003
  - T1595
  nist:
  - ID.AM
  - PR.DS
  observable:
  - name: user
    type: User
    role:
    - Victim
  - name: dest
    type: Hostname
    role:
    - Victim
  - name: parent_process
    type: Process
    role:
    - Parent Process
  - name: process_name
    type: Process
    role:
    - Child Process
    - Attacker
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - Processes.dest
  - Processes.user
  - Processes.process_name
  - Processes.parent_process
  risk_score: 64
  security_domain: endpoint
  supported_tas:
  - Splunk_TA_microsoft_sysmon