mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
d1vious
100 lines
4.1 KiB
YAML
100 lines
4.1 KiB
YAML
name: Sdelete Application Execution
|
|
id: fcc52b9a-4616-11ec-8454-acde48001122
|
|
version: 1
|
|
date: '2021-11-15'
|
|
author: Teoderick Contreras, Splunk
|
|
type: Anomaly
|
|
datamodel:
|
|
- Endpoint_Processes
|
|
description: This analytic will detect the execution of sdelete.exe attempting to
|
|
delete potentially important files that may related to adversary or insider threats
|
|
to destroy evidence or information sabotage. Sdelete is a SysInternals utility meant
|
|
to securely delete files on disk. This tool is commonly used to clear tracks and
|
|
artifact on the targeted host.
|
|
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"),
|
|
"string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string",
|
|
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
|
null)), process_path=ucast(map_get(input_event, "process_path"), "string", null),
|
|
parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
|
|
null), parent_cmd_line=ucast(map_get(input_event, "parent_process"), "string", null),
|
|
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
|
|
IS NOT NULL AND process_name IS NOT NULL AND like(process_name, "%sdelete%") AND
|
|
(like (cmd_line, "%-c %") OR like (cmd_line, "%-f %")OR like (cmd_line, "%-p %")
|
|
OR like (cmd_line, "%-r %") OR like (cmd_line, "%-q %") OR like (cmd_line, "%-s
|
|
%") OR like (cmd_line, "%-z %") OR like (cmd_line, "%/accepteula%") OR like (cmd_line,
|
|
"%-nobanner%")OR like (cmd_line, "%.doc%")OR like (cmd_line, "%.xls%") OR like (cmd_line,
|
|
"%.ppt%")OR like (cmd_line, "%.rtf%") OR like (cmd_line, "%.pdf%") OR like (cmd_line,
|
|
"%.key%")OR like (cmd_line, "%.log%") OR like (cmd_line, "%.txt%") OR like (cmd_line,
|
|
"%.jpg%") OR like (cmd_line, "%.png%") OR like (cmd_line, "%.gif%") OR like (cmd_line,
|
|
"%.bmp%") OR like (cmd_line, "%.7z%") OR like (cmd_line, "%.zip%") OR like (cmd_line,
|
|
"%.rar%") OR like (cmd_line, "%.tar%") OR like (cmd_line, "%.gz%") OR like (cmd_line,
|
|
"%.xls%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
|
|
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
|
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
|
|
process_name, "process_path", process_path, "parent_process_name", parent_process_name,
|
|
"parent_cmd_line", parent_cmd_line]) | into write_ssa_detected_events();'
|
|
how_to_implement: To successfully implement this search you need to be ingesting information
|
|
on process that include the name of the process responsible for the changes from
|
|
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
|
|
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
|
|
endpoint product.
|
|
known_false_positives: False positives should be limited, filter as needed.
|
|
references:
|
|
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
|
|
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md
|
|
tags:
|
|
analytic_story:
|
|
- Information Sabotage
|
|
- Insider Threat
|
|
cis20: []
|
|
confidence: 70
|
|
context:
|
|
- Source:Endpoint
|
|
- Stage:Execution
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log
|
|
impact: 60
|
|
kill_chain_phases:
|
|
- Exploitation
|
|
message: Sdelete process $process_name$ executed on $dest_device_id$ attempting
|
|
to permanently delete files by $dest_user_id$.
|
|
mitre_attack_id:
|
|
- T1485
|
|
- T1070.004
|
|
- T1070
|
|
nist: []
|
|
observable:
|
|
- name: dest_user_id
|
|
type: User
|
|
role:
|
|
- Victim
|
|
- name: dest_device_id
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
- name: parent_process
|
|
type: Process
|
|
role:
|
|
- Parent Process
|
|
- name: process_name
|
|
type: Process
|
|
role:
|
|
- Child Process
|
|
product:
|
|
- Splunk Behavioral Analytics
|
|
required_fields:
|
|
- _time
|
|
- dest
|
|
- user
|
|
- parent_process_name
|
|
- parent_process
|
|
- process_name
|
|
- process
|
|
- process_id
|
|
- process_path
|
|
- cmd_line
|
|
risk_score: 42
|
|
risk_severity: low
|
|
security_domain: endpoint
|
|
asset_type: Endpoint
|