mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Patrick Bareiss
31 lines
1.4 KiB
YAML
31 lines
1.4 KiB
YAML
name: Previously seen command line arguments
|
|
id: fc0edc95-ff2b-48b0-9f6f-63da3789fd23
|
|
version: 2
|
|
date: '2019-03-01'
|
|
description: This search looks for command-line arguments where `cmd.exe /c` is used
|
|
to execute a program, then creates a baseline of the earliest and latest times we
|
|
have encountered this command-line argument in our dataset within the last 30 days.
|
|
how_to_implement: You must be ingesting data that records process activity from your
|
|
hosts to populate the Endpoint data model in the Processes node. You must be ingesting
|
|
logs with both the process name and command line from your endpoints. The complete
|
|
process name with command-line arguments are mapped to the "process" field in the
|
|
Endpoint data model.
|
|
author: Bhavin Patel, Splunk
|
|
search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
|
|
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe
|
|
AND Processes.process="* /c *" by Processes.process | `drop_dm_object_name(Processes)`'
|
|
tags:
|
|
analytics_story:
|
|
- DHS Report TA18-074A
|
|
- Disabling Security Tools
|
|
- Hidden Cobra Malware
|
|
- Netsh Abuse
|
|
- Orangeworm Attack Group
|
|
- Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
|
|
- Suspicious Command-Line Executions
|
|
- Suspicious MSHTA Activity
|
|
detections:
|
|
- Detect Prohibited Applications Spawning cmd.exe
|
|
- Processes launching netsh
|
|
- First time seen command line argument
|