mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
d1vious
78 lines
3.9 KiB
YAML
78 lines
3.9 KiB
YAML
name: Sdelete Application Execution
|
|
id: fcc52b9a-4616-11ec-8454-acde48001122
|
|
version: 1
|
|
description: This analytic will detect the execution of sdelete.exe attempting to
|
|
delete potentially important files that may related to adversary or insider threats
|
|
to destroy evidence or information sabotage. Sdelete is a SysInternals utility meant
|
|
to securely delete files on disk. This tool is commonly used to clear tracks and
|
|
artifact on the targeted host.
|
|
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"),
|
|
"string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string",
|
|
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
|
null)), process_path=ucast(map_get(input_event, "process_path"), "string", null),
|
|
parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
|
|
null), parent_cmd_line=ucast(map_get(input_event, "parent_process"), "string", null),
|
|
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
|
|
IS NOT NULL AND process_name IS NOT NULL AND like(process_name, "%sdelete%") AND
|
|
(like (cmd_line, "%-c %") OR like (cmd_line, "%-f %")OR like (cmd_line, "%-p %")
|
|
OR like (cmd_line, "%-r %") OR like (cmd_line, "%-q %") OR like (cmd_line, "%-s
|
|
%") OR like (cmd_line, "%-z %") OR like (cmd_line, "%/accepteula%") OR like (cmd_line,
|
|
"%-nobanner%")OR like (cmd_line, "%.doc%")OR like (cmd_line, "%.xls%") OR like (cmd_line,
|
|
"%.ppt%")OR like (cmd_line, "%.rtf%") OR like (cmd_line, "%.pdf%") OR like (cmd_line,
|
|
"%.key%")OR like (cmd_line, "%.log%") OR like (cmd_line, "%.txt%") OR like (cmd_line,
|
|
"%.jpg%") OR like (cmd_line, "%.png%") OR like (cmd_line, "%.gif%") OR like (cmd_line,
|
|
"%.bmp%") OR like (cmd_line, "%.7z%") OR like (cmd_line, "%.zip%") OR like (cmd_line,
|
|
"%.rar%") OR like (cmd_line, "%.tar%") OR like (cmd_line, "%.gz%") OR like (cmd_line,
|
|
"%.xls%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
|
|
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
|
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
|
|
process_name, "process_path", process_path, "parent_process_name", parent_process_name,
|
|
"parent_cmd_line", parent_cmd_line]) | into write_ssa_detected_events();'
|
|
how_to_implement: To successfully implement this search you need to be ingesting information
|
|
on process that include the name of the process responsible for the changes from
|
|
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
|
|
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
|
|
endpoint product.
|
|
known_false_positives: False positives should be limited, filter as needed.
|
|
references:
|
|
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
|
|
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md
|
|
tags:
|
|
analytic_story:
|
|
- Information Sabotage
|
|
- Insider Threat
|
|
cis20: []
|
|
kill_chain_phases:
|
|
- Exploitation
|
|
mitre_attack_id:
|
|
- T1485
|
|
- T1070.004
|
|
- T1070
|
|
nist: []
|
|
required_fields:
|
|
- _time
|
|
- dest
|
|
- user
|
|
- parent_process_name
|
|
- parent_process
|
|
- process_name
|
|
- process
|
|
- process_id
|
|
- process_path
|
|
- cmd_line
|
|
risk_score: 42
|
|
security_domain: endpoint
|
|
risk_severity: low
|
|
research_site_url: https://research.splunk.com/endpoint/fcc52b9a-4616-11ec-8454-acde48001122/
|
|
event_schema: cim
|
|
test:
|
|
name: Sdelete Application Execution Unit Test
|
|
tests:
|
|
- name: Sdelete Application Execution
|
|
file: endpoint/ssa___sdelete_application_execution.yml
|
|
pass_condition: '@count_gt(0)'
|
|
attack_data:
|
|
- file_name: security.log
|
|
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log
|
|
source: WinEventLog:Security
|