splunk-security_content/detections/prohibited_apps_spawning_cmdprompt.yml

asset_type: Endpoint
baselines:
  - id: fc0edc95-ff2b-48b0-9f6f-63da3789fd23
    name: Previously seen command line arguments
    type: splunk
  - id: d2a4d85b-fc6a-47a0-82f6-bc1ec2ebc459
    name: Baseline of Command Line Length - MLTK
    type: splunk
confidence: medium
creation_date: '2017-10-07'
data_metadata:
  data_models:
    - Endpoint
  data_source:
    - Endpoint Intel
  providing_technologies:
    - Carbon Black Response
    - CrowdStrike Falcon
    - Sysmon
    - Tanium
    - Ziften
description: This search looks for executions of cmd.exe spawned by a process that
  is often abused by attackers and that does not typically launch cmd.exe.
detect:
  splunk:
    correlation_rule:
      notable:
        nes_fields: dest, process, parent_process
        rule_description: A prohibited application from prohibited_apps_launching_cmd.csv
          was leveraged to launch cmd.exe
        rule_title: Prohibited application($parent_process$) used to launch cmd.exe
          on $dest$
      risk:
        risk_object: dest
        risk_object_type:
          - system
        risk_score: 80
      schedule:
        cron_schedule: 0 * * * *
        earliest_time: -70m@m
        latest_time: -10m@m
      search: '| tstats `security_content_summariesonly` count values(Processes.process)
        as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
        where Processes.process_name=cmd.exe by Processes.parent_process_name Processes.process_name
        Processes.dest Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
        |search [`prohibited_apps_launching_cmd`]'
      suppress:
        suppress_fields: dest, parent_process
        suppress_period: 86400s
eli5: Obtaining access to the Command-Line Interface (CLI) is typically a primary
  attacker goal. Once an attacker has obtained the ability to execute code on a target
  system, they will often further manipulate the system via commands passed to the
  CLI. It is also unusual for many applications to spawn a command shell during normal
  operation, while it is often observed if an application has been compromised in
  some way. As such, it is often beneficial to look for cmd.exe being executed by
  processes that are often targeted for exploitation, or that would not spawn cmd.exe
  in any other circumstances. A lookup file is provided to easily modify the processes
  that are being watched for execution of cmd.exe.
entities:
  - dest
  - process_name
  - user
how_to_implement: You must be ingesting data that records process activity from your
  hosts and populates the Endpoint data model with the resultant dataset. This search
  includes a lookup file, `prohibited_apps_launching_cmd.csv`, that contains a list
  of processes that should not be spawning cmd.exe. You can modify this lookup to
  better suit your environment.
id: dcfd6b40-42f9-469d-a433-2e53f7486664
investigations:
  - id: fecf2918-670d-4f1c-872b-3d7317a41xf9
    name: Get Registry Activities
    type: splunk
  - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd76
    name: Get Authentication Logs For Endpoint
    type: splunk
  - id: fecf2918-670d-4f1c-872b-3d7317a41bf9
    name: Get Parent Process Info
    type: splunk
  - id: fdcfb369-1725-4c24-824a-22972d7f0d55
    name: Get Risk Modifiers For User
    type: splunk
  - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd71
    name: Get Process Info
    type: splunk
  - id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7
    name: Get Notable History
    type: splunk
  - id: f3fb4d1b-5f33-4b01-b541-c7af9534c242
    name: Get Notable Info
    type: splunk
  - id: fdcfb369-1725-4c24-824a-22972d7f0d65
    name: Get Risk Modifiers For Endpoint
    type: splunk
  - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd74
    name: Get User Information from Identity Table
    type: splunk
  - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd22
    name: Investigate Web Activity From Host
    type: splunk
known_false_positives: There are circumstances where an application may legitimately
  execute and interact with the Windows command-line interface. Investigate and modify
  the lookup file, as appropriate.
maintainers:
  - company: Splunk
    email: bpatel@splunk.com
    name: Bhavin Patel
mappings:
  cis20:
    - CIS 8
  kill_chain_phases:
    - Exploitation
  mitre_attack:
    - Execution
    - Command-Line Interface
  nist:
    - PR.PT
    - DE.CM
modification_date: '2018-11-15'
name: Detect Prohibited Applications Spawning cmd.exe
original_authors:
  - company: Splunk
    email: bpatel@splunk.com
    name: Bhavin Patel
references: []
security_domain: endpoint
spec_version: 2
type: splunk
version: '2.0'