mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
89 lines
2.8 KiB
JSON
89 lines
2.8 KiB
JSON
{
|
|
"asset_type": "Endpoint",
|
|
"channel": "ESCU",
|
|
"confidence": "medium",
|
|
"correlation_rule": {
|
|
"notable": {
|
|
"nes_fields": "dest, user, process",
|
|
"rule_description": "This search looks for scrcons.exe, which indicates that a script was launched via WMI.",
|
|
"rule_title": "Script execution via WMI on $dest$"
|
|
},
|
|
"risk": {
|
|
"risk_object": "dest",
|
|
"risk_object_type": [
|
|
"system"
|
|
],
|
|
"risk_score": 70
|
|
},
|
|
"suppress": {
|
|
"suppress_fields": "dest,user",
|
|
"suppress_period": "28800s"
|
|
}
|
|
},
|
|
"creation_date": "2018-10-23",
|
|
"data_metadata": {
|
|
"data_source": [
|
|
"Endpoint Intel"
|
|
],
|
|
"data_sourcetypes": [
|
|
"XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
|
|
],
|
|
"providing_technologies": [
|
|
"Carbon Black Response",
|
|
"Sysmon",
|
|
"Tanium",
|
|
"Ziften"
|
|
]
|
|
},
|
|
"eli5": "Attackers are increasingly abusing Windows Management Infrastructure for stealth, persistence, lateral movement, or just to leverage its functionality. This search looks for scripts launched via WMI, either remotely or locally, by looking for the execution of scrcons.exe, which is the scripting host used by WMI, similar to wscript or cscript.",
|
|
"how_to_implement": "To successfully implement this search you need to be ingesting logs with both the process name and command-line from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.",
|
|
"known_false_positives": "Although unlikely, administrators may use wmi to launch scripts for legitimate purposes.",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "rvaldez@splunk.com",
|
|
"name": "Rico Valdez"
|
|
}
|
|
],
|
|
"mappings": {
|
|
"cis20": [
|
|
"CIS 3",
|
|
"CIS 5"
|
|
],
|
|
"kill_chain_phases": [
|
|
"Actions on Objectives"
|
|
],
|
|
"mitre_attack": [
|
|
"Execution",
|
|
"Windows Management Instrumentation"
|
|
],
|
|
"nist": [
|
|
"PR.PT",
|
|
"PR.AT",
|
|
"PR.AC",
|
|
"PR.IP"
|
|
]
|
|
},
|
|
"modification_date": "2018-10-23",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "rvaldez@splunk.com",
|
|
"name": "Rico Valdez"
|
|
}
|
|
],
|
|
"scheduling": {
|
|
"cron_schedule": "0 * * * *",
|
|
"earliest_time": "-70m@m",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "(sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR tag=process) process=scrcons.exe | stats count min(_time) as firstTime max(_time) as lastTime by dest, user, parent_process, process, cmdline | `ctime(firstTime)`| `ctime(lastTime)`",
|
|
"search_description": "This search looks for scripts launched via WMI.",
|
|
"search_id": "aa73f80d-d728-4077-b226-81ea0c8be589",
|
|
"search_name": "Script Execution via WMI",
|
|
"search_type": "detection",
|
|
"security_domain": "endpoint",
|
|
"spec_version": 1,
|
|
"version": "1.0"
|
|
}
|