mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
97 lines
4.0 KiB
JSON
97 lines
4.0 KiB
JSON
{
|
|
"asset_type": "Endpoint",
|
|
"baselines": [],
|
|
"confidence": "high",
|
|
"creation_date": "2019-04-29",
|
|
"data_metadata": {
|
|
"data_models": [
|
|
"Endpoint"
|
|
],
|
|
"data_source": [
|
|
"Endpoint Intel"
|
|
],
|
|
"providing_technologies": [
|
|
"Carbon Black Response",
|
|
"CrowdStrike Falcon",
|
|
"Sysmon",
|
|
"Tanium",
|
|
"Ziften"
|
|
]
|
|
},
|
|
"description": "This search looks for a ``*.lnk` file under `C:\\User*` or `*\\Local\\Temp\\*` executing a process. This is common behavior used by various spear phishing tools.",
|
|
"detect": {
|
|
"splunk": {
|
|
"correlation_rule": {
|
|
"notable": {
|
|
"nes_fields": "dest, process_name, file_name",
|
|
"rule_description": "suspicious LNK file from $file_name$ is executing a process $process_name$ on $dest$",
|
|
"rule_title": "LNK file $file_name$ is executing process $process_name$ on $dest$"
|
|
},
|
|
"risk": {
|
|
"risk_object": "dest",
|
|
"risk_object_type": [
|
|
"system"
|
|
],
|
|
"risk_score": 40
|
|
},
|
|
"schedule": {
|
|
"cron_schedule": "0 * * * *",
|
|
"earliest_time": "-70m@m",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "| tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name=\"*.lnk\" AND (Filesystem.file_path=\"C:\\\\Users*\" OR Filesystem.file_path=\"*Local\\\\Temp*\") by _time span=1h Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.file_hash Filesystem.user | `drop_dm_object_name(Filesystem)` | rename process_id as lnk_pid | join lnk_pid, _time [| tstats `summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=* by _time span=1h Processes.parent_process_id Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process | `drop_dm_object_name(Processes)` | rename parent_process_id as lnk_pid | fields _time lnk_pid process_id dest process_name process_path process] | `ctime(firstTime)` | `ctime(lastTime)` | table firstTime, lastTime, lnk_pid, process_id, user, dest, file_name, file_path, process_name, process, process_path, file_hash",
|
|
"suppress": {
|
|
"suppress_fields": "dest,file_name",
|
|
"suppress_period": "86400s"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"eli5": "In this search, we are essentially trying to detect if a LNK file created under the C:\\User* or *\\Local\\Temp\\* directory structures is launching a process with in 1 hour of its creation. LNK files or also known as Windows shortcut files are commonly associated with phishing and are a [preferred method used for exploitation](https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html).",
|
|
"entities": [
|
|
"dest"
|
|
],
|
|
"how_to_implement": "You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or endpoint data sources, such as Sysmon.",
|
|
"id": "5d814af1-1041-47b5-a9ac-d754e82e9a26",
|
|
"investigations": [],
|
|
"known_false_positives": "This detection should yield little or no false positive results. It is uncommon for LNK files to execute process from temporary or user directories.",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "jhernandez@splunk.com",
|
|
"name": "Jose Hernandez"
|
|
}
|
|
],
|
|
"mappings": {
|
|
"cis20": [
|
|
"CIS 7",
|
|
"CIS 8"
|
|
],
|
|
"kill_chain_phases": [
|
|
"Installation",
|
|
"Actions on Objectives"
|
|
],
|
|
"mitre_attack": [
|
|
"Spearphishing Attachment"
|
|
],
|
|
"nist": [
|
|
"ID.AM",
|
|
"PR.DS"
|
|
]
|
|
},
|
|
"modification_date": "2019-04-29",
|
|
"name": "Suspicious LNK file launching a process",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "jhernandez@splunk.com",
|
|
"name": "Jose Hernandez"
|
|
}
|
|
],
|
|
"product_type": "splunk",
|
|
"responses": [],
|
|
"security_domain": "network",
|
|
"spec_version": 2,
|
|
"version": "1.0"
|
|
}
|