mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
83 lines
3.4 KiB
JSON
83 lines
3.4 KiB
JSON
{
|
|
"asset_type": "Endpoint",
|
|
"channel": "ESCU",
|
|
"confidence": "medium",
|
|
"correlation_rule": {
|
|
"notable": {
|
|
"nes_fields": "dest,parent_process",
|
|
"rule_description": "The process pssxec.exe was run with the -accepteula flag on $dest$ by $user$.",
|
|
"rule_title": "PsExec executed with accepteula flag on $dest$."
|
|
},
|
|
"risk": {
|
|
"risk_object": "dest",
|
|
"risk_object_type": [
|
|
"system"
|
|
],
|
|
"risk_score": 75
|
|
},
|
|
"suppress": {
|
|
"suppress_fields": "dest, parent_process",
|
|
"suppress_period": "86400s"
|
|
}
|
|
},
|
|
"creation_date": "2018-03-28",
|
|
"data_metadata": {
|
|
"data_source": [
|
|
"Endpoint Intel"
|
|
],
|
|
"data_sourcetypes": [
|
|
"XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
|
|
],
|
|
"providing_technologies": [
|
|
"Sysmon"
|
|
]
|
|
},
|
|
"eli5": "In this search, we are looking for the PsExec process with <code>accepteula</code> on the command line.",
|
|
"how_to_implement": "To successfully implement this search, you need to be ingesting logs with the process name, command-line arguments, and parent process from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon Technology Add-on (TA).",
|
|
"known_false_positives": "Administrators can leverage PsExec for accessing remote systems and might pass <code>accepteula</code> as an argument if they are running this tool for the first time. However, it is not likely that you'd see multiple occurrences of this event on a machine",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"mappings": {
|
|
"cis20": [
|
|
"CIS 8"
|
|
],
|
|
"kill_chain_phases": [
|
|
"Actions on Objectives"
|
|
],
|
|
"mitre_attack": [
|
|
"Execution",
|
|
"Command-Line Interface"
|
|
],
|
|
"nist": [
|
|
"PR.PT",
|
|
"DE.CM"
|
|
]
|
|
},
|
|
"modification_date": "2018-03-28",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"scheduling": {
|
|
"cron_schedule": "0 * * * *",
|
|
"earliest_time": "-70m@m",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "sourcetype=xmlwineventlog:microsoft-windows-sysmon/operational process=PsExec.exe accepteula | search cmdline=*accepteula* | stats count values(cmdline) as cmdlines, min(_time) as firstTime, max(_time) as lastTime by dest, user, parent_process | `ctime(firstTime)`| `ctime(lastTime)` | table firstTime, lastTime, count, dest, user, parent_process, cmdlines",
|
|
"search_description": "This search looks for events where <code>PsExec.exe</code> is run with the <code>accepteula</code> flag in the command line. PsExec is a built-in Windows utility that enables you to execute processes on other systems. It is fully interactive for console applications. This tool is widely used for launching interactive command prompts on remote systems. Threat actors leverage this extensively for executing code on compromised systems. If an attacker is running PsExec for the first time, they will be prompted to accept the end-user license agreement (EULA), which can be passed as the argument <code>accepteula</code> within the command line.",
|
|
"search_id": "b89919ed-fe5f-492c-b139-151xb162040e",
|
|
"search_name": "Detect PsExec With accepteula Flag",
|
|
"search_type": "detection",
|
|
"security_domain": "endpoint",
|
|
"spec_version": 1,
|
|
"version": "1.0"
|
|
}
|