mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
87 lines
2.8 KiB
JSON
87 lines
2.8 KiB
JSON
{
|
|
"asset_type": "Endpoint",
|
|
"channel": "ESCU",
|
|
"confidence": "high",
|
|
"correlation_rule": {
|
|
"notable": {
|
|
"nes_fields": "dest, process, user",
|
|
"rule_description": "Prohibited software $process_name$ has been detected on $dest$",
|
|
"rule_title": "Prohibited Software Detected On $dest$"
|
|
},
|
|
"risk": {
|
|
"risk_object": "src",
|
|
"risk_object_type": [
|
|
"system"
|
|
],
|
|
"risk_score": 50
|
|
},
|
|
"suppress": {
|
|
"suppress_fields": "dest, user",
|
|
"suppress_period": "86400s"
|
|
}
|
|
},
|
|
"creation_date": "2017-12-08",
|
|
"data_metadata": {
|
|
"data_models": [
|
|
"Application_State"
|
|
],
|
|
"data_source": [
|
|
"Endpoint Intel"
|
|
],
|
|
"providing_technologies": [
|
|
"Carbon Black Response",
|
|
"CrowdStrike Falcon",
|
|
"Sysmon",
|
|
"Tanium",
|
|
"Ziften"
|
|
]
|
|
},
|
|
"eli5": "This search returns the number of times, as well as the first and last time, it has seen every process run for each endpoint and user, and then displays only those processes that you have marked as prohibited in the Enterprise Security 'interesting processes' table.",
|
|
"how_to_implement": "To successfully implement this search, you must ingest information on process activity from your endpoints into Splunk. This can be done using various endpoint detection and response solutions, endpoint data sources such as Sysmon, or via Windows event logs after enabling process tracking in your Windows audit settings.",
|
|
"known_false_positives": "None identified",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "davidd@splunk.com",
|
|
"name": "David Dorsey"
|
|
}
|
|
],
|
|
"mappings": {
|
|
"cis20": [
|
|
"CIS 2"
|
|
],
|
|
"kill_chain_phases": [
|
|
"Actions on Objectives"
|
|
],
|
|
"mitre_attack": [
|
|
"Execution",
|
|
"Accessibility Features"
|
|
],
|
|
"nist": [
|
|
"ID.AM",
|
|
"PR.DS"
|
|
]
|
|
},
|
|
"modification_date": "2018-04-16",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "davidd@splunk.com",
|
|
"name": "David Dorsey"
|
|
}
|
|
],
|
|
"scheduling": {
|
|
"cron_schedule": "0 * * * *",
|
|
"earliest_time": "-70m@m",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "| tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Application_State by All_Application_State.dest All_Application_State.user All_Application_State.process | `ctime(firstTime)`| `ctime(lastTime)` | `drop_dm_object_name(\"All_Application_State\")` | `uncommon_processes`",
|
|
"search_description": "This search looks for applications on the endpoint that you have marked as prohibited.",
|
|
"search_id": "29ccce64-a10c-4389-a45f-337cb29ba1f7",
|
|
"search_name": "Uncommon Processes On Endpoint",
|
|
"search_type": "detection",
|
|
"security_domain": "endpoint",
|
|
"spec_version": 1,
|
|
"version": "2.0"
|
|
}
|