mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
81 lines
3.2 KiB
JSON
81 lines
3.2 KiB
JSON
{
|
|
"asset_type": "Windows",
|
|
"channel": "ESCU",
|
|
"confidence": "medium",
|
|
"correlation_rule": {
|
|
"notable": {
|
|
"nes_fields": "dest, file_name, process",
|
|
"rule_description": "The process $process$ on $dest$ wrote $file_name$ to 'System Volume Information'.",
|
|
"rule_title": "Suspicious process $process$ wrote to 'System Volume Information' on $dest$"
|
|
},
|
|
"risk": {
|
|
"risk_object": "dest",
|
|
"risk_object_type": [
|
|
"system"
|
|
],
|
|
"risk_score": 70
|
|
},
|
|
"suppress": {
|
|
"suppress_fields": "dest",
|
|
"suppress_period": "86400s"
|
|
}
|
|
},
|
|
"creation_date": "2018-01-08",
|
|
"data_metadata": {
|
|
"data_source": [
|
|
"Endpoint Intel"
|
|
],
|
|
"data_sourcetypes": [
|
|
"XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
|
|
],
|
|
"providing_technologies": [
|
|
"Sysmon"
|
|
]
|
|
},
|
|
"eli5": "This search uses data on file writes captured via Sysmon to watch for writes to the \"System Volume Information\" folder by processes other than the system process. The search looks for event code 11 in the Sysmon events, which indicates a file-creation event. It then looks for a file created with a path that includes \"System Volume Information\" and a process ID (PID) other than 4. PID 4 is assigned to the System process on Windows systems. Excluding these writes allows us to filter out legitimate activity. It will report the system where the activity occurred, the path to which the file was written, the process responsible for the write, and the times it first and last saw this activity.",
|
|
"how_to_implement": "You need to be ingesting logs with both the process name and command-line from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.",
|
|
"known_false_positives": "It is possible that other utilities or system processes may legitimately write to this folder. Investigate and modify the search to include exceptions as appropriate.",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "rvaldez@splunk.com",
|
|
"name": "Rico Valdez"
|
|
}
|
|
],
|
|
"mappings": {
|
|
"cis20": [
|
|
"CIS 8"
|
|
],
|
|
"mitre_attack": [
|
|
"Collection",
|
|
"Data Staged"
|
|
],
|
|
"nist": [
|
|
"DE.CM"
|
|
]
|
|
},
|
|
"modification_date": "2018-01-08",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "rvaldez@splunk.com",
|
|
"name": "Rico Valdez"
|
|
}
|
|
],
|
|
"scheduling": {
|
|
"cron_schedule": "0 * * * *",
|
|
"earliest_time": "-70m@m",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "(sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR tag=process) EventCode=11 process_id!=4 file_path=*System\\ Volume\\ Information* | stats count min(_time) as firstTime max(_time) as lastTime by dest, Image, file_path | `ctime(firstTime)`| `ctime(lastTime)`",
|
|
"search_description": "This search detects writes to the 'System Volume Information' folder by something other than the System process.",
|
|
"search_id": "cd6297cd-2bdd-4aa1-84aa-5d2f84228fac",
|
|
"search_name": "Suspicious writes to System Volume Information",
|
|
"search_type": "detection",
|
|
"security_domain": "endpoint",
|
|
"spec_version": 1,
|
|
"status": "production",
|
|
"team_notes": "",
|
|
"version": "1.0"
|
|
}
|