mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
96 lines
3.4 KiB
JSON
96 lines
3.4 KiB
JSON
{
|
|
"asset_type": "Endpoint",
|
|
"channel": "ESCU",
|
|
"confidence": "medium",
|
|
"correlation_rule": {
|
|
"notable": {
|
|
"nes_fields": "dest, user, process",
|
|
"rule_description": "This search looks for arguments to sc.exe indicating the creation or modification of a Windows service.",
|
|
"rule_title": "Sc.exe Manipulating Windows Services on $dest$"
|
|
},
|
|
"risk": {
|
|
"risk_object": "dest",
|
|
"risk_object_type": [
|
|
"system"
|
|
],
|
|
"risk_score": 60
|
|
},
|
|
"suppress": {
|
|
"suppress_fields": "dest, process",
|
|
"suppress_period": "28800s"
|
|
}
|
|
},
|
|
"creation_date": "2017-11-03",
|
|
"data_metadata": {
|
|
"data_models": [
|
|
"Endpoint"
|
|
],
|
|
"data_source": [
|
|
"Endpoint Intel"
|
|
],
|
|
"providing_technologies": [
|
|
"Carbon Black Response",
|
|
"CrowdStrike Falcon",
|
|
"Sysmon",
|
|
"Tanium",
|
|
"Ziften"
|
|
]
|
|
},
|
|
"eli5": "This search looks for the execution of sc.exe with parameters that indicate the utility is being used to create a new Windows service, or modify an existing one. Attackers often create a new service to host their malicious code, or they may take a non-critical service or one that is disabled, and modify it to point to their malware and enable the service if necessary. It is unusual for a service to be created or modified using the sc.exe utility.",
|
|
"how_to_implement": "You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.",
|
|
"known_false_positives": "Using sc.exe to manipulate Windows services is uncommon. However, there may be legitimate instances of this behavior. It is important to validate and investigate as appropriate.",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "rvaldez@splunk.com",
|
|
"name": "Rico Valdez"
|
|
}
|
|
],
|
|
"mappings": {
|
|
"cis20": [
|
|
"CIS 3",
|
|
"CIS 5",
|
|
"CIS 8"
|
|
],
|
|
"kill_chain_phases": [
|
|
"Installation"
|
|
],
|
|
"mitre_attack": [
|
|
"Persistence",
|
|
"Privilege Escalation",
|
|
"New Service",
|
|
"Modify Existing Service",
|
|
"Defense Evasion",
|
|
"Disabling Security Tools"
|
|
],
|
|
"nist": [
|
|
"PR.IP",
|
|
"PR.PT",
|
|
"PR.AC",
|
|
"PR.AT",
|
|
"DE.CM"
|
|
]
|
|
},
|
|
"modification_date": "2019-02-27",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "rvaldez@splunk.com",
|
|
"name": "Rico Valdez"
|
|
}
|
|
],
|
|
"scheduling": {
|
|
"cron_schedule": "0 * * * *",
|
|
"earliest_time": "-70m@m",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "| tstats `summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = sc.exe Processes.process=\"* create *\" Processes.process=\"* config *\" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `ctime(firstTime)` | `ctime(lastTime)`",
|
|
"search_description": "This search looks for arguments to sc.exe indicating the creation or modification of a Windows service.",
|
|
"search_id": "f0c693d8-2a89-4ce7-80b4-98fea4c3ea6d",
|
|
"search_name": "Sc.exe Manipulating Windows Services",
|
|
"search_type": "detection",
|
|
"security_domain": "endpoint",
|
|
"spec_version": 1,
|
|
"version": "2.0"
|
|
}
|