splunk-security_content/detections/unusually_long_commandlines.json

{
  "asset_type": "",
  "confidence": "medium",
  "creation_date": "2017-08-23",
  "data_metadata": {
    "data_models": [
      "Endpoint"
    ],
    "data_source": [
      "Endpoint Intel"
    ],
    "providing_technologies": [
      "Carbon Black Response",
      "CrowdStrike Falcon",
      "Sysmon",
      "Tanium",
      "Ziften"
    ]
  },
  "description": "Command lines that are extremely long may be indicative of malicious activity on your hosts.",
  "detect": {
    "splunk": {
      "correlation_rule": {
        "notable": {
          "nes_fields": "dest, process, user",
          "rule_description": "An unusually long command line $cmdline$ was found on $dest$",
          "rule_title": "Unusually Long Command Line on $dest$"
        },
        "risk": {
          "risk_object": "dest",
          "risk_object_type": [
            "system"
          ],
          "risk_score": 50
        },
        "schedule": {
          "cron_schedule": "0 * * * *",
          "earliest_time": "-1d@d",
          "latest_time": "-10m@m"
        },
        "search": "| tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.dest Processes.process_name Processes.process | `drop_dm_object_name(\"Processes\")` | `ctime(firstTime)`| `ctime(lastTime)`|  eval processlen=len(process) | eventstats stdev(processlen) as stdev, avg(processlen) as avg by dest | stats max(processlen) as maxlen, values(stdev) as stdevperhost, values(avg) as avgperhost by dest, user, process_name, process| eval threshold = 10 | where maxlen > ((threshold*stdevperhost) + avgperhost)",
        "suppress": {
          "suppress_fields": "dest,user,process",
          "suppress_period": "28800s"
        }
      }
    }
  },
  "eli5": "This search calculates the average and standard deviation for the length of the command lines on each of your endpoints and alerts when it detects a command line with a length over 10 times the standard deviation larger than the average command line.",
  "entities": [
    "dest",
    "process_name",
    "user"
  ],
  "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships, from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.",
  "id": "c77162d3-f93c-45cc-80c8-22f6a4264e7f",
  "investigations": [
    {
      "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd76",
      "name": "Get Authentication Logs For Endpoint",
      "type": "splunk"
    },
    {
      "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9",
      "name": "Get Parent Process Info",
      "type": "splunk"
    },
    {
      "id": "fdcfb369-1725-4c24-824a-22972d7f0d55",
      "name": "Get Risk Modifiers For User",
      "type": "splunk"
    },
    {
      "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd71",
      "name": "Get Process Info",
      "type": "splunk"
    },
    {
      "id": "3d6c3213-5fff-4a1e-b57d-b24c262171e7",
      "name": "Get Notable History",
      "type": "splunk"
    },
    {
      "id": "f3fb4d1b-5f33-4b01-b541-c7af9534c242",
      "name": "Get Notable Info",
      "type": "splunk"
    },
    {
      "id": "fdcfb369-1725-4c24-824a-22972d7f0d65",
      "name": "Get Risk Modifiers For Endpoint",
      "type": "splunk"
    },
    {
      "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd74",
      "name": "Get User Information from Identity Table",
      "type": "splunk"
    },
    {
      "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd22",
      "name": "Investigate Web Activity From Host",
      "type": "splunk"
    }
  ],
  "known_false_positives": "Some legitimate applications start with long command lines.",
  "maintainers": [
    {
      "company": "Splunk",
      "email": "bpatel@splunk.com",
      "name": "Bhavin Patel"
    }
  ],
  "mappings": {
    "cis20": [
      "CIS 8"
    ],
    "kill_chain_phases": [
      "Actions on Objectives"
    ],
    "mitre_attack": [
      "Execution"
    ],
    "nist": [
      "PR.PT",
      "DE.CM"
    ]
  },
  "modification_date": "2019-02-28",
  "name": "Unusually Long Command Line",
  "original_authors": [
    {
      "company": "Splunk",
      "email": "davidd@splunk.com",
      "name": "David Dorsey"
    }
  ],
  "references": [],
  "security_domain": "endpoint",
  "spec_version": 2,
  "type": "splunk",
  "version": "3.0"
}