mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
87 lines
3.4 KiB
JSON
87 lines
3.4 KiB
JSON
{
|
|
"asset_type": "Endpoint",
|
|
"channel": "ESCU",
|
|
"confidence": "medium",
|
|
"correlation_rule": {
|
|
"notable": {
|
|
"nes_fields": "dest, user, process_name",
|
|
"rule_description": "This search looks for flags passed to schtasks.exe on the command line that indicate that a task--whose name is associated with the Dragonfly threat actor--has been created or deleted",
|
|
"rule_title": "Scheduled task used by Dragonfly threat actor detected on $dest$"
|
|
},
|
|
"risk": {
|
|
"risk_object": "dest",
|
|
"risk_object_type": [
|
|
"system"
|
|
],
|
|
"risk_score": 80
|
|
},
|
|
"suppress": {
|
|
"suppress_fields": "dest, process_name, process",
|
|
"suppress_period": "28800s"
|
|
}
|
|
},
|
|
"creation_date": "2018-03-19",
|
|
"data_metadata": {
|
|
"data_models": [
|
|
"Endpoint"
|
|
],
|
|
"data_source": [
|
|
"Endpoint Intel"
|
|
],
|
|
"providing_technologies": [
|
|
"Carbon Black Response",
|
|
"CrowdStrike Falcon",
|
|
"Sysmon",
|
|
"Tanium",
|
|
"Ziften"
|
|
]
|
|
},
|
|
"eli5": "The search looks for execution of schtasks.exe with parameters that indicate that a specific task \"reset,\" whose name is associated with the Dragonfly threat actor--has been created or deleted. Schtasks.exe is a native Windows program that is used to schedule tasks on local or remote systems. Attackers often leverage this capability to schedule the execution of commands or establish persistence.",
|
|
"how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.",
|
|
"known_false_positives": "No known false positives",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"mappings": {
|
|
"cis20": [
|
|
"CIS 3"
|
|
],
|
|
"kill_chain_phases": [
|
|
"Actions on Objectives"
|
|
],
|
|
"mitre_attack": [
|
|
"Execution",
|
|
"Scheduled Task"
|
|
],
|
|
"nist": [
|
|
"PR.IP"
|
|
]
|
|
},
|
|
"modification_date": "2018-12-03",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"scheduling": {
|
|
"cron_schedule": "0 * * * *",
|
|
"earliest_time": "-70m@m",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "| tstats `summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest | `drop_dm_object_name(Processes)` | `ctime(firstTime)`| `ctime(lastTime)` | search (process=*delete* OR process=*create*) process=*reset*",
|
|
"search_description": "This search looks for flags passed to schtasks.exe on the command-line that indicate a task name associated with the Dragonfly threat actor was created or deleted.",
|
|
"search_id": "d5af132c-7c17-439c-9d31-13d55340f36c",
|
|
"search_name": "Scheduled Task Name Used by Dragonfly Threat Actors",
|
|
"search_type": "detection",
|
|
"security_domain": "endpoint",
|
|
"spec_version": 1,
|
|
"team_notes": "https://www.us-cert.gov/sites/default/files/publications/MIFR-10127623_TLP_WHITE.pdf, https://www.symantec.com/blogs/threat-intelligence/dragonfly-energy-sector-cyber-attacks",
|
|
"version": "2.0"
|
|
}
|