mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
54 lines
2.0 KiB
YAML
54 lines
2.0 KiB
YAML
author: Bhavin Patel, Splunk
|
|
date: '2019-02-28'
|
|
description: This search queries the Endpoint data model to give you details about
|
|
the parent process of a process running on a host which is under investigation.
|
|
Enter the values of the process name in question and the dest
|
|
how_to_implement: You must be ingesting endpoint data that tracks process activity,
|
|
including parent-child relationships from your endpoints to populate the Endpoint
|
|
data model in the Processes node. The command-line arguments are mapped to the "process"
|
|
field in the Endpoint data model.
|
|
id: fecf2918-670d-4f1c-872b-3d7317a41bf9
|
|
inputs:
|
|
- parent_process_name
|
|
- dest
|
|
name: Get Parent Process Info
|
|
search: '| tstats `summariesonly` count values(Processes.process) as process min(_time)
|
|
as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user
|
|
Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name("Processes")`
|
|
| search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)`
|
|
| `security_content_ctime(lastTime)`'
|
|
tags:
|
|
analytic_story:
|
|
- Collection and Staging
|
|
- Command and Control
|
|
- DHS Report TA18-074A
|
|
- Disabling Security Tools
|
|
- 'Emotet Malware DHS Report TA18-201A '
|
|
- Hidden Cobra Malware
|
|
- Lateral Movement
|
|
- Malicious PowerShell
|
|
- Monitor for Unauthorized Software
|
|
- Netsh Abuse
|
|
- Orangeworm Attack Group
|
|
- Phishing Payloads
|
|
- Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
|
|
- Prohibited Traffic Allowed or Protocol Mismatch
|
|
- Ransomware
|
|
- SamSam Ransomware
|
|
- Suspicious Command-Line Executions
|
|
- Suspicious DNS Traffic
|
|
- Suspicious MSHTA Activity
|
|
- Suspicious WMI Use
|
|
- Suspicious Windows Registry Activities
|
|
- Unusual Processes
|
|
- Windows Defense Evasion Tactics
|
|
- Windows File Extension and Association Abuse
|
|
- Windows Log Manipulation
|
|
- Windows Persistence Techniques
|
|
- Windows Privilege Escalation
|
|
- Windows Service Abuse
|
|
product:
|
|
- Splunk Phantom
|
|
type: response
|
|
version: 2
|