mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
70 lines
2.4 KiB
YAML
70 lines
2.4 KiB
YAML
name: Windows Remote Create Service
|
|
id: 0259ff91-a6f3-4af1-af83-6360eff7fd80
|
|
version: 4
|
|
date: '2023-05-18'
|
|
author: Michael Haag, Splunk
|
|
status: experimental
|
|
type: TTP
|
|
description: 'This analytic identifies an endpoint that remotely connects to another endpoint to create a new service using sc.exe. On the remote endpoint, the new service will be created and this action will trigger the creation of EventCode 7045 along with all the resulting service information.'
|
|
data_source:
|
|
- Windows Security 4688
|
|
search:
|
|
selection1:
|
|
process.cmd_line|re:
|
|
- 'create'
|
|
- '\\\\'
|
|
process.file.name: sc.exe
|
|
condition: (selection1)
|
|
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
|
|
known_false_positives: Note that false positives may occur, and filtering may be necessary, especially when it comes to remote service creation by administrators or software management utilities.
|
|
references:
|
|
- https://attack.mitre.org/techniques/T1543/003/
|
|
tags:
|
|
analytic_story:
|
|
- Active Directory Lateral Movement
|
|
asset_type: Endpoint
|
|
confidence: 50
|
|
impact: 50
|
|
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to create a remote service.
|
|
mitre_attack_id:
|
|
- T1543
|
|
- T1543.003
|
|
observable:
|
|
- name: dest_user_id
|
|
type: User
|
|
role:
|
|
- Victim
|
|
- name: dest_device_id
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
- name: parent_process_name
|
|
type: Process
|
|
role:
|
|
- Parent Process
|
|
- name: process_name
|
|
type: Process
|
|
role:
|
|
- Child Process
|
|
product:
|
|
- Splunk Behavioral Analytics
|
|
required_fields:
|
|
- _time
|
|
- dest_device_id
|
|
- process_name
|
|
- parent_process_name
|
|
- process_path
|
|
- dest_user_id
|
|
- process
|
|
kill_chain_phases:
|
|
- Exploitation
|
|
risk_score: 25
|
|
security_domain: endpoint
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/atomic_red_team/4688-remote-service-create-windows-security.log
|
|
source: XmlWinEventLog
|
|
sourcetype: XmlWinEventLog
|
|
update_timestamp: true
|