mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
88 lines
3.4 KiB
JSON
88 lines
3.4 KiB
JSON
{
|
|
"asset_type": "Endpoint",
|
|
"channel": "ESCU",
|
|
"confidence": "medium",
|
|
"correlation_rule": {
|
|
"notable": {
|
|
"nes_fields": "dest, user, process_name",
|
|
"rule_description": "This search looks for flags passed to schtasks.exe on the command-line that indicate that task names specific to Bad Rabbit ransomware has been created or deleted",
|
|
"rule_title": "Scheduled tasks used in BadRabbit ransomware detected on $dest$"
|
|
},
|
|
"risk": {
|
|
"risk_object": "dest",
|
|
"risk_object_type": [
|
|
"system"
|
|
],
|
|
"risk_score": 80
|
|
},
|
|
"suppress": {
|
|
"suppress_fields": "dest, process_name",
|
|
"suppress_period": "28800s"
|
|
}
|
|
},
|
|
"creation_date": "2017-11-03",
|
|
"data_metadata": {
|
|
"data_models": [
|
|
"Endpoint"
|
|
],
|
|
"data_source": [
|
|
"Endpoint Intel"
|
|
],
|
|
"providing_technologies": [
|
|
"Carbon Black Response",
|
|
"CrowdStrike Falcon",
|
|
"Sysmon",
|
|
"Tanium",
|
|
"Ziften"
|
|
]
|
|
},
|
|
"eli5": "The search looks for execution of schtasks.exe with parameters that indicate that specific task names related to the Bad Rabbit ransomware were created or deleted. The specific task name used are rhaegal, drogon and viserion_. Schtasks.exe is a native windows program that is used to schedule tasks on local or remote systems. Attackers often leverage this capability to schedule the execution of commands or establish persistence.",
|
|
"how_to_implement": "You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.",
|
|
"known_false_positives": "No known false positives",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"mappings": {
|
|
"cis20": [
|
|
"CIS 3"
|
|
],
|
|
"kill_chain_phases": [
|
|
"Actions on Objectives"
|
|
],
|
|
"mitre_attack": [
|
|
"Persistence",
|
|
"Lateral Movement",
|
|
"Execution",
|
|
"Scheduled Task"
|
|
],
|
|
"nist": [
|
|
"PR.IP"
|
|
]
|
|
},
|
|
"modification_date": "2019-02-28",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"scheduling": {
|
|
"cron_schedule": "0 * * * *",
|
|
"earliest_time": "-70m@m",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "| tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process) as process from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe (Processes.process= \"*create*\" OR Processes.process= \"*delete*\") by Processes.parent_process Processes.process_name Processes.user | `drop_dm_object_name(\"Processes\")` | `ctime(firstTime)`|`ctime(lastTime)` | search (process=*rhaegal* OR process=*drogon* OR *viserion_*)",
|
|
"search_description": "This search looks for flags passed to schtasks.exe on the command-line that indicate that task names related to the execution of Bad Rabbit ransomware were created or deleted.",
|
|
"search_id": "1297fb80-f42a-4b4a-9c8b-78c066437cf6",
|
|
"search_name": "Scheduled tasks used in BadRabbit ransomware",
|
|
"search_type": "detection",
|
|
"security_domain": "endpoint",
|
|
"spec_version": 1,
|
|
"version": "2.0"
|
|
}
|