mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
88 lines
3.2 KiB
JSON
88 lines
3.2 KiB
JSON
{
|
|
"asset_type": "Endpoint",
|
|
"channel": "ESCU",
|
|
"confidence": "high",
|
|
"correlation_rule": {
|
|
"notable": {
|
|
"nes_fields": "dest, process, user",
|
|
"rule_description": "Prohibited software $process_name$ has been detected on $dest$.",
|
|
"rule_title": "Prohibited Software Detected On $dest$"
|
|
},
|
|
"risk": {
|
|
"risk_object": "dest",
|
|
"risk_object_type": [
|
|
"system"
|
|
],
|
|
"risk_score": 50
|
|
},
|
|
"suppress": {
|
|
"suppress_fields": "dest,user",
|
|
"suppress_period": "86400s"
|
|
}
|
|
},
|
|
"creation_date": "2017-06-26",
|
|
"data_metadata": {
|
|
"data_models": [
|
|
"Endpoint"
|
|
],
|
|
"data_source": [
|
|
"Endpoint Intel"
|
|
],
|
|
"providing_technologies": [
|
|
"Carbon Black Response",
|
|
"CrowdStrike Falcon",
|
|
"Sysmon",
|
|
"Tanium",
|
|
"Ziften"
|
|
]
|
|
},
|
|
"eli5": "This search returns the number of times, as well as the first and last time, every process has run for each endpoint and user. It then displays only those processes that you have marked as \"prohibited\" in the Enterprise Security \"Interesting Processes\" table.",
|
|
"how_to_implement": "To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the processes node. This is typically populated via endpoint detection-and-response products, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is usually generated via logs that report reads and writes to the registry or populated via Windows event logs, after enabling process tracking in your Windows audit settings. In addition, you must also have processes marked as \"prohibited\" in the Enterprise Security <code>interesting processes</code> table. To include the processes marked as \"prohibited\", which is included with ES Content Updates, run the included search <code>Support - Add Prohibited Processes to ES</code>.",
|
|
"known_false_positives": "None identified",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"mappings": {
|
|
"cis20": [
|
|
"CIS 2"
|
|
],
|
|
"kill_chain_phases": [
|
|
"Installation",
|
|
"Command and Control",
|
|
"Actions on Objectives"
|
|
],
|
|
"mitre_attack": [
|
|
"Execution"
|
|
],
|
|
"nist": [
|
|
"ID.AM",
|
|
"PR.DS"
|
|
]
|
|
},
|
|
"modification_date": "2010-11-02",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "davidd@splunk.com",
|
|
"name": "David Dorsey"
|
|
}
|
|
],
|
|
"scheduling": {
|
|
"cron_schedule": "0 * * * *",
|
|
"earliest_time": "-70m@m",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "| tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.process | `ctime(firstTime)`| `ctime(lastTime)` | `drop_dm_object_name(Processes)` | `prohibited_softwares`",
|
|
"search_description": "This search looks for applications on the endpoint that you have marked as prohibited.",
|
|
"search_id": "a51bfe1a-94f0-48cc-b4e4-b6ae50145893",
|
|
"search_name": "Prohibited Software On Endpoint",
|
|
"search_type": "detection",
|
|
"security_domain": "endpoint",
|
|
"spec_version": 1,
|
|
"version": "1.0"
|
|
}
|