splunk-security_content/detections/execution_of_nirsoft_tools.json

{
    "asset_type": "Endpoint",
    "confidence": "medium",
    "creation_date": "2018-09-11",
    "data_metadata": {
        "data_models": [
            "Endpoint"
        ],
        "data_source": [
            "Endpoint Intel"
        ],
        "providing_technologies": [
            "Carbon Black Response",
            "CrowdStrike Falcon",
            "Sysmon",
            "Tanium",
            "Ziften"
        ]
    },
    "description": "This search looks for specific command-line arguments that may indicate the execution of tools made by Nirsoft, which are legitimate, but may be abused by attackers.",
    "detect": {
        "splunk": {
            "correlation_rule": {
                "notable": {
                    "nes_fields": "dest, user, process",
                    "rule_description": "This search looks for specific arguments passed via the command line and detects execution of tools built by NirSoft, which are often abused by attackers.",
                    "rule_title": "Potential abuse of NirSoft tools on $dest$"
                },
                "risk": {
                    "risk_object": "dest",
                    "risk_object_type": [
                        "system"
                    ],
                    "risk_score": 80
                },
                "schedule": {
                    "cron_schedule": "0 * * * *",
                    "earliest_time": "-70m@m",
                    "latest_time": "-10m@m"
                },
                "search": "| tstats `summariesonly` count min(_time) values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process=\"* /stext *\" OR Processes.process=\"* /scomma *\" ) by Processes.parent_process Processes.process_name Processes.user | `drop_dm_object_name(Processes)` | `ctime(firstTime)` |`ctime(lastTime)`",
                "suppress": {
                    "suppress_fields": "dest, process",
                    "suppress_period": "28800s"
                }
            }
        }
    },
    "eli5": "The search looks for process-creation events accompanied by specific command-line arguments (\"scomma\" and \"stext\"). These parameters may be leveraged by a set of free, legitimate tools built by NirSoft. Attackers have been seen abusing the tools' capabilities to steal passwords, set up key loggers, recover account information from mail clients, and conduct other nefarious activities. The search will identify the count, the first and last times a process is executed, the command-line arguments, and the parent process.",
    "entities": [
        "dest"
    ],
    "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.",
    "id": "1297fb80-f42a-4q4a-9c8b-78c061417cf6",
    "investigations": [
        {
            "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd76",
            "name": "Get Authentication Logs For Endpoint",
            "type": "splunk"
        },
        {
            "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9",
            "name": "Get Parent Process Info",
            "type": "splunk"
        },
        {
            "id": "fdcfb369-1725-4c24-824a-22972d7f0d55",
            "name": "Get Risk Modifiers For User",
            "type": "splunk"
        },
        {
            "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd71",
            "name": "Get Process Info",
            "type": "splunk"
        },
        {
            "id": "3d6c3213-5fff-4a1e-b57d-b24c262171e7",
            "name": "Get Notable History",
            "type": "splunk"
        },
        {
            "id": "f3fb4d1b-5f33-4b01-b541-c7af9534c242",
            "name": "Get Notable Info",
            "type": "splunk"
        },
        {
            "id": "fdcfb369-1725-4c24-824a-22972d7f0d65",
            "name": "Get Risk Modifiers For Endpoint",
            "type": "splunk"
        },
        {
            "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd74",
            "name": "Get User Information from Identity Table",
            "type": "splunk"
        },
        {
            "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd22",
            "name": "Investigate Web Activity From Host",
            "type": "splunk"
        }
    ],
    "known_false_positives": "While legitimate, these NirSoft tools are prone to abuse. You should verfiy that the tool was used for a legitimate purpose.",
    "maintainers": [
        {
            "company": "Splunk",
            "email": "bpatel@splunk.com",
            "name": "Bhavin Patel"
        }
    ],
    "mappings": {
        "cis20": [
            "CIS 3"
        ],
        "kill_chain_phases": [
            "Installation",
            "Actions on Objectives"
        ],
        "mitre_attack": [
            "Discovery",
            "Execution",
            "Lateral Movement",
            "Third-party Software",
            "Account Discovery"
        ],
        "nist": [
            "PR.IP"
        ]
    },
    "modification_date": "2018-12-03",
    "name": "Detection of tools built by NirSoft",
    "original_authors": [
        {
            "company": "Splunk",
            "email": "bpatel@splunk.com",
            "name": "Bhavin Patel"
        }
    ],
    "references": [],
    "security_domain": "endpoint",
    "spec_version": 2,
    "type": "splunk",
    "version": "2.0"
}