mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
49 lines
2.3 KiB
JSON
49 lines
2.3 KiB
JSON
{
|
|
"category": "Best Practices",
|
|
"channel": "ESCU",
|
|
"creation_date": "2017-06-26",
|
|
"description": "Identify and investigate prohibited/unauthorized software or processes that may be concealing malicious behavior within your environment. ",
|
|
"id": "8892a655-6205-43f7-abba-06460e38c8ae",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "davidd@splunk.com",
|
|
"name": "David Dorsey"
|
|
}
|
|
],
|
|
"modification_date": "2017-09-15",
|
|
"name": "Monitor for Unauthorized Software",
|
|
"narrative": "It is critical to identify unauthorized software and processes running on enterprise endpoints and determine whether they are likely to be malicious. This Analytic Story requires the user to populate the Interesting Processes table within Enterprise Security with prohibited processes. An included support search will augment this data, adding information on processes thought to be malicious. This search requires data from endpoint detection-and-response solutions, endpoint data sources (such as Sysmon), or Windows Event Logs--assuming that the Active Directory administrator has enabled process tracking within the System Event Audit Logs.<br></br>It is important to investigate any software identified as suspicious, in order to understand how it was installed or executed. Analyzing authentication logs or any historic notable events might elicit additional investigative leads of interest. For best results, schedule the search to run every two weeks. ",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "davidd@splunk.com",
|
|
"name": "David Dorsey"
|
|
}
|
|
],
|
|
"references": [
|
|
"https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
|
|
],
|
|
"searches": {
|
|
"contextual_searches": [
|
|
"Get Notable History",
|
|
"Get User Information from Identity Table",
|
|
"Get Authentication Logs For Endpoint",
|
|
"Get Risk Modifiers For User",
|
|
"Get Risk Modifiers For Endpoint"
|
|
],
|
|
"detection_searches": [
|
|
"Prohibited Software On Endpoint"
|
|
],
|
|
"investigative_searches": [
|
|
"Get Process Info",
|
|
"Investigate Web Activity From Host"
|
|
],
|
|
"support_searches": [
|
|
"Add Prohibited Processes to Enterprise Security"
|
|
]
|
|
},
|
|
"spec_version": 1,
|
|
"version": "1.0"
|
|
}
|