mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
90 lines
3.0 KiB
JSON
90 lines
3.0 KiB
JSON
{
|
|
"asset_type": "Endpoint",
|
|
"channel": "ESCU",
|
|
"confidence": "high",
|
|
"correlation_rule": {
|
|
"notable": {
|
|
"nes_fields": "dest, process",
|
|
"rule_description": "The system $dest$ executed a file with a double extension.",
|
|
"rule_title": "Process With Multiple Extensions Launched on $dest$"
|
|
},
|
|
"risk": {
|
|
"risk_object": "dest",
|
|
"risk_object_type": [
|
|
"system"
|
|
],
|
|
"risk_score": 60
|
|
},
|
|
"suppress": {
|
|
"suppress_fields": "dest, process",
|
|
"suppress_period": "28800s"
|
|
}
|
|
},
|
|
"creation_date": "2018-01-26",
|
|
"data_metadata": {
|
|
"data_models": [
|
|
"Endpoint"
|
|
],
|
|
"data_source": [
|
|
"Endpoint Intel"
|
|
],
|
|
"providing_technologies": [
|
|
"Carbon Black Response",
|
|
"CrowdStrike Falcon",
|
|
"Sysmon",
|
|
"Tanium",
|
|
"Ziften"
|
|
]
|
|
},
|
|
"eli5": "This search uses the \"Application State\" data model to look for process names with specific combinations of double extensions. Relatively straightforward, the search looks for strings in the \"process\" field that match what you're looking for.",
|
|
"how_to_implement": "To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node.",
|
|
"known_false_positives": "None identified.",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"mappings": {
|
|
"cis20": [
|
|
"CIS 3",
|
|
"CIS 8"
|
|
],
|
|
"kill_chain_phases": [
|
|
"Actions on Objectives"
|
|
],
|
|
"mitre_attack": [
|
|
"Execution",
|
|
"Persistence",
|
|
"Change Default File Association"
|
|
],
|
|
"nist": [
|
|
"DE.CM",
|
|
"PR.PT",
|
|
"PR.IP"
|
|
]
|
|
},
|
|
"modification_date": "2018-11-02",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "rvaldez@splunk.com",
|
|
"name": "Rico Valdez"
|
|
}
|
|
],
|
|
"scheduling": {
|
|
"cron_schedule": "0 * * * *",
|
|
"earliest_time": "-70m@m",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "| tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = *.doc.exe OR Processes.process = *.htm.exe OR Processes.process = *.html.exe OR Processes.process = *.txt.exe OR Processes.process = *.pdf.exe OR Processes.process = *.doc.exe by Processes.dest Processes.user Processes.process Processes.parent_process | `ctime(firstTime)` | `ctime(lastTime)` | `drop_dm_object_name(Processes)`",
|
|
"search_description": "This search looks for processes launched from files that have double extensions in the file name. This is typically done to obscure the \"real\" file extension and make it appear as though the file being accessed is a data file, as opposed to executable content.",
|
|
"search_id": "b06a555e-dce0-417d-a2eb-28a5d8d66ef7",
|
|
"search_name": "Execution of File with Multiple Extensions",
|
|
"search_type": "detection",
|
|
"security_domain": "endpoint",
|
|
"spec_version": 1,
|
|
"version": "1.0"
|
|
}
|