splunk-security_content/detections/prohibited_software_on_endpoint.yml

name: Prohibited Software On Endpoint
id: a51bfe1a-94f0-48cc-b4e4-b6ae50145893
version: 2
date: '2019-10-11'
description: This search looks for applications on the endpoint that you have marked
  as prohibited.
how_to_implement: To successfully implement this search, you must be ingesting data
  that records process activity from your hosts to populate the endpoint data model
  in the processes node. This is typically populated via endpoint detection-and-response
  products, such as Carbon Black or endpoint data sources, such as Sysmon. The data
  used for this search is usually generated via logs that report process tracking
  in your Windows audit settings. In addition, you must also have only the `process_name`
  (not the entire process path) marked as "prohibited" in the Enterprise Security
  `interesting processes` table. To include the process names marked as "prohibited",
  which is included with ES Content Updates, run the included search <code>Add Prohibited
  Processes to Enterprise Security</code>.
type: ESCU
references: []
author: David Dorsey, Splunk
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.process_name
  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)`
  | `prohibited_softwares` | `prohibited_software_on_endpoint_filter`'
known_false_positives: None identified
tags:
  analytics_story:
  - SamSam Ransomware
  - 'Emotet Malware  DHS Report TA18-201A '
  - Monitor for Unauthorized Software
  kill_chain_phases:
  - Installation
  - Command and Control
  - Actions on Objectives
  cis20:
  - CIS 2
  nist:
  - ID.AM
  - PR.DS
  security_domain: endpoint
  asset_type: Endpoint