mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
87 lines
3.4 KiB
JSON
87 lines
3.4 KiB
JSON
{
|
|
"asset_type": "Endpoint",
|
|
"channel": "ESCU",
|
|
"confidence": "medium",
|
|
"correlation_rule": {
|
|
"notable": {
|
|
"nes_fields": "dest, process_name, parent_process",
|
|
"rule_description": "Potentially malicious script execution detected.",
|
|
"rule_title": "Command prompt is executing scripts on $dest$ using $process_name$ "
|
|
},
|
|
"risk": {
|
|
"risk_object": "dest",
|
|
"risk_object_type": [
|
|
"system"
|
|
],
|
|
"risk_score": 50
|
|
},
|
|
"suppress": {
|
|
"suppress_fields": "dest, process_name",
|
|
"suppress_period": "86400s"
|
|
}
|
|
},
|
|
"creation_date": "2017-10-09",
|
|
"data_metadata": {
|
|
"data_models": [
|
|
"Endpoint"
|
|
],
|
|
"data_source": [
|
|
"Endpoint Intel"
|
|
],
|
|
"providing_technologies": [
|
|
"Carbon Black Response",
|
|
"CrowdStrike Falcon",
|
|
"Sysmon",
|
|
"Tanium",
|
|
"Ziften"
|
|
]
|
|
},
|
|
"eli5": "Attackers often leverage various scripting languages to execute their attacks. In a Windows environment, the Windows Script Host is the tool that interprets the scripts and is included in all modern versions of Windows. The Windows Script Host is available as a command-line tool called \"cscript.exe\" or \"wscript.exe.\" To detect this behavior, the search looks for process-creation events for cscript.exe or wscript.exe with a parent process of cmd.exe. The search will return the count, the first and last times this behavior was seen on a destination machine, and user and process information.",
|
|
"how_to_implement": "To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.",
|
|
"known_false_positives": "Some legitimate applications may exhibit this behavior.",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"mappings": {
|
|
"cis20": [
|
|
"CIS 8"
|
|
],
|
|
"kill_chain_phases": [
|
|
"Exploitation"
|
|
],
|
|
"mitre_attack": [
|
|
"Execution",
|
|
"Command-Line Interface"
|
|
],
|
|
"nist": [
|
|
"PR.PT",
|
|
"DE.CM"
|
|
]
|
|
},
|
|
"modification_date": "2018-11-02",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"scheduling": {
|
|
"cron_schedule": "0 * * * *",
|
|
"earliest_time": "-70m@m",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "| tstats `summariesonly` count values(Processes.process) min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process=\"*cmd.exe\" (Processes.process_name=cscript.exe OR Processes.process_name =wscript.exe) by Processes.parent_process Processes.process_name Processes.user Processes.dest | `drop_dm_object_name(\"Processes\")` | `ctime(firstTime)`|`ctime(lastTime)`",
|
|
"search_description": "This search looks for the execution of the cscript.exe or wscript.exe processes, with a parent of cmd.exe. The search will return the count, the first and last time this execution was seen on a machine, the user, and the destination of the machine",
|
|
"search_id": "b89919ed-fe5f-492c-b139-95dbb162039e",
|
|
"search_name": "Detect Use of cmd.exe to Launch Script Interpreters",
|
|
"search_type": "detection",
|
|
"security_domain": "endpoint",
|
|
"spec_version": 1,
|
|
"version": "2.0"
|
|
}
|