mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
patel-bhavin
63 lines
2.5 KiB
YAML
63 lines
2.5 KiB
YAML
name: Excessive distinct processes from Windows Temp
|
|
id: 23587b6a-c479-11eb-b671-acde48001122
|
|
version: 2
|
|
date: '2022-02-28'
|
|
author: Michael Hart, Mauricio Velazco, Splunk
|
|
type: Anomaly
|
|
datamodel:
|
|
- Endpoint
|
|
description: This analytic will identify suspicious series of process executions. We
|
|
have observed that post exploit framework tools like Koadic and Meterpreter will
|
|
launch an excessive number of processes with distinct file paths from Windows\Temp
|
|
to execute actions on objective. This behavior is extremely anomalous compared
|
|
to typical application behaviors that use Windows\Temp.
|
|
search: '| tstats `security_content_summariesonly` values(Processes.process) as process
|
|
distinct_count(Processes.process) as distinct_process_count min(_time) as firstTime
|
|
max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_path
|
|
= "*\\Windows\\Temp\\*" by Processes.dest Processes.user _time span=20m | where
|
|
distinct_process_count > 37 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
|
|
| `security_content_ctime(lastTime)` | `excessive_distinct_processes_from_windows_temp_filter`'
|
|
how_to_implement: To successfully implement this search, you need to be ingesting
|
|
logs with the full process path in the process field of CIM's Process data model.
|
|
If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
|
|
Tune and filter known instances where renamed sc.exe may be used.
|
|
known_false_positives: Many benign applications will create processes from executables
|
|
in Windows\Temp, although unlikely to exceed the given threshold. Filter as needed.
|
|
references:
|
|
- https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/
|
|
tags:
|
|
analytic_story:
|
|
- Meterpreter
|
|
confidence: 100
|
|
context:
|
|
- Source:Endpoint
|
|
- Stage:Defense Evasion
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/meterpreter/windows_temp_processes/logExcessiveWindowsTemp.log
|
|
impact: 80
|
|
kill_chain_phases:
|
|
- Exploitation
|
|
message: Multiple processes were executed out of windows\temp within a short amount
|
|
of time on $dest$.
|
|
mitre_attack_id:
|
|
- T1059
|
|
observable:
|
|
- name: dest
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- Processes.process
|
|
- Processes.dest
|
|
- Processes.user
|
|
risk_score: 80
|
|
security_domain: endpoint
|
|
supported_tas:
|
|
- Splunk_TA_windows
|
|
asset_type: Endpoint
|