mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
87 lines
3.1 KiB
JSON
87 lines
3.1 KiB
JSON
{
|
|
"asset_type": "Endpoint",
|
|
"channel": "ESCU",
|
|
"confidence": "medium",
|
|
"correlation_rule": {
|
|
"notable": {
|
|
"nes_fields": "dest, user, process",
|
|
"rule_description": "This search looks for flags passed to schtasks.exe on the command-line that indicate a job is scheduled to force a reboot",
|
|
"rule_title": "Schtasks used for scheduling a force reboot"
|
|
},
|
|
"risk": {
|
|
"risk_object": "dest",
|
|
"risk_object_type": [
|
|
"system"
|
|
],
|
|
"risk_score": 80
|
|
},
|
|
"suppress": {
|
|
"suppress_fields": "dest, process",
|
|
"suppress_period": "28800s"
|
|
}
|
|
},
|
|
"creation_date": "2017-11-03",
|
|
"data_metadata": {
|
|
"data_models": [
|
|
"Endpoint"
|
|
],
|
|
"data_source": [
|
|
"Endpoint Intel"
|
|
],
|
|
"providing_technologies": [
|
|
"Carbon Black Response",
|
|
"CrowdStrike Falcon",
|
|
"Sysmon",
|
|
"Tanium",
|
|
"Ziften"
|
|
]
|
|
},
|
|
"eli5": "The search looks for execution of schtasks.exe with parameters that indicate a task is being scheduled that would cause a forced reboot on the host. Schtasks.exe is a native windows program that is used to schedule tasks on local or remote systems. Attackers often leverage this capability to schedule the execution of commands or establish persistence. This tactic is leveraged by the Bad Rabbit Ransomware.",
|
|
"how_to_implement": "To successfully implement this search you need to be ingesting logs with both the process name and command-line from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.",
|
|
"known_false_positives": "Administrators may create jobs on systems forcing reboots to perform updates, maintenance, etc.",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"mappings": {
|
|
"cis20": [
|
|
"CIS 3"
|
|
],
|
|
"kill_chain_phases": [
|
|
"Actions on Objectives"
|
|
],
|
|
"mitre_attack": [
|
|
"Persistence",
|
|
"Execution",
|
|
"Scheduled Task"
|
|
],
|
|
"nist": [
|
|
"PR.IP"
|
|
]
|
|
},
|
|
"modification_date": "2019-02-27",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"scheduling": {
|
|
"cron_schedule": "0 * * * *",
|
|
"earliest_time": "-5h@h",
|
|
"latest_time": "-1h@h"
|
|
},
|
|
"search": "| tstats `summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = schtasks.exe Processes.process=\"*shutdown*\" Processes.process=\"*/r*\" Processes.process=\"*/f*\" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `ctime(firstTime)` | `ctime(lastTime)`",
|
|
"search_description": "This search looks for flags passed to schtasks.exe on the command-line that indicate that a forced reboot of system is scheduled.",
|
|
"search_id": "1297fb80-f42a-4b4a-9c8a-88c066437cf6",
|
|
"search_name": "Schtasks used for forcing a reboot",
|
|
"search_type": "detection",
|
|
"security_domain": "endpoint",
|
|
"spec_version": 1,
|
|
"version": "2.0"
|
|
}
|