mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
patel-bhavin
82 lines
3.5 KiB
YAML
82 lines
3.5 KiB
YAML
name: Svchost LOLBAS Execution Process Spawn
|
|
id: 09e5c72a-4c0d-11ec-aa29-3e22fbd008af
|
|
version: 2
|
|
date: '2021-11-22'
|
|
author: Mauricio Velazco, Splunk
|
|
type: TTP
|
|
datamodel:
|
|
- Endpoint
|
|
description: The following analytic identifies `svchost.exe` spawning a LOLBAS execution
|
|
process. When adversaries execute code on remote endpoints abusing the Task Scheduler
|
|
and creating a malicious remote scheduled task, the executed command is spawned
|
|
as a child process of `svchost.exe`. The LOLBAS project documents Windows native
|
|
binaries that can be abused by threat actors to perform tasks like executing malicious
|
|
code. Looking for child processes of svchost.exe that are part of the LOLBAS project
|
|
can help defenders identify lateral movement activity.
|
|
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
|
as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=svchost.exe)
|
|
(Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe",
|
|
"Rasautou.exe", "Schtasks.exe", "Xwizard.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe",
|
|
"Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe",
|
|
"Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", "Register-cimprovider.exe",
|
|
"Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe",
|
|
"Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe",
|
|
"WorkFolders.exe", "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe",
|
|
"Regsvr32.exe", "Msiexec.exe", "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe",
|
|
"Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", "Infdefaultinstall.exe",
|
|
"Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe",
|
|
"Msconfig.exe")) by Processes.dest Processes.user Processes.parent_process Processes.process_name
|
|
Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
|
|
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `svchost_lolbas_execution_process_spawn_filter`'
|
|
how_to_implement: To successfully implement this search, you need to be ingesting
|
|
logs with the process name, parent process, and command-line executions from your
|
|
endpoints.
|
|
known_false_positives: Legitimate applications may trigger this behavior, filter as
|
|
needed.
|
|
references:
|
|
- https://attack.mitre.org/techniques/T1053/005/
|
|
- https://www.ired.team/offensive-security/persistence/t1053-schtask
|
|
- https://lolbas-project.github.io/
|
|
tags:
|
|
analytic_story:
|
|
- Active Directory Lateral Movement
|
|
- Living Off The Land
|
|
confidence: 60
|
|
context:
|
|
- Source:Endpoint
|
|
- Stage:Lateral Movement
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement_lolbas/windows-security.log
|
|
impact: 90
|
|
kill_chain_phases:
|
|
- Exploitation
|
|
message: Svchost.exe spawned a LOLBAS process on $dest$
|
|
mitre_attack_id:
|
|
- T1053
|
|
- T1053.005
|
|
observable:
|
|
- name: dest
|
|
type: Endpoint
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- Processes.dest
|
|
- Processes.user
|
|
- Processes.parent_process_name
|
|
- Processes.parent_process
|
|
- Processes.original_file_name
|
|
- Processes.process_name
|
|
- Processes.process
|
|
- Processes.process_id
|
|
- Processes.parent_process_path
|
|
- Processes.process_path
|
|
- Processes.parent_process_id
|
|
risk_score: 54
|
|
security_domain: endpoint
|
|
asset_type: Endpoint
|