splunk-security_content/detections/suspicious_reg_process.yml

asset_type: Endpoint
confidence: medium
creation_date: '2017-10-11'
data_metadata:
  data_models:
    - Endpoint
  data_source:
    - Endpoint Intel
  providing_technologies:
    - Carbon Black Response
    - CrowdStrike Falcon
    - Sysmon
    - Tanium
    - Ziften
description: This search looks for reg.exe being launched from a command prompt not
  started by the user. When a user launches cmd.exe, the parent process is usually
  explorer.exe. This search filters out those instances.
detect:
  splunk:
    correlation_rule:
      notable:
        nes_fields: dest, user, process_name
        rule_description: The system $dest$ had reg.exe process run not initiated
          by a user.
        rule_title: Suspicious reg.exe process detected on $dest$
      risk:
        risk_object: dest
        risk_object_type:
          - system
        risk_score: 80
      schedule:
        cron_schedule: 0 * * * *
        earliest_time: -70m@m
        latest_time: -10m@m
      search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as
        lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name
        != explorer.exe Processes.process_name =cmd.exe by Processes.user Processes.process_name
        Processes.parent_process_name Processes.dest Processes.process_id Processes.parent_process_id
        | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
        | search [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
        where Processes.parent_process_name=cmd.exe Processes.process_name= reg.exe
        by Processes.parent_process_id Processes.dest Processes.process_name | `drop_dm_object_name("Processes")`
        | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rename parent_process_id as process_id
        |dedup process_id| table process_id dest]'
      suppress:
        suppress_fields: dest, user
        suppress_period: 14400s
eli5: This search looks for the execution of reg.exe with a parent process of cmd.exe.
  It then executes a subsearch looking for those cmd.exe processes with a parent that
  is not explorer.exe. It then joins those two searches to make sure that the reg.exe
  process is a grandchild of the non explorer.exe process. The search will return
  the number of such instances and the first and last time this activity has been
  seen on each endpoint and user.
entities:
  - dest
how_to_implement: You must be ingesting data that records process activity from your
  hosts to populate the Endpoint data model in the Processes node. You must also be
  ingesting logs with both the process name and command line from your endpoints.
  The command-line arguments are mapped to the "process" field in the Endpoint data
  model.
id: a6b3ab4e-dd77-4213-95fa-fc94701995e0
investigations:
  - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd76
    name: Get Authentication Logs For Endpoint
    type: splunk
  - id: fecf2918-670d-4f1c-872b-3d7317a41bf9
    name: Get Parent Process Info
    type: splunk
  - id: fdcfb369-1725-4c24-824a-22972d7f0d55
    name: Get Risk Modifiers For User
    type: splunk
  - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd71
    name: Get Process Info
    type: splunk
  - id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7
    name: Get Notable History
    type: splunk
  - id: f3fb4d1b-5f33-4b01-b541-c7af9534c242
    name: Get Notable Info
    type: splunk
  - id: fdcfb369-1725-4c24-824a-22972d7f0d65
    name: Get Risk Modifiers For Endpoint
    type: splunk
  - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd74
    name: Get User Information from Identity Table
    type: splunk
known_false_positives: It's possible for system administrators to write scripts that
  exhibit this behavior. If this is the case, the search will need to be modified
  to filter them out.
maintainers:
  - company: Splunk
    email: davidd@splunk.com
    name: David Dorsey
mappings:
  cis20:
    - CIS 8
  kill_chain_phases:
    - Actions on Objectives
  mitre_attack:
    - Defense Evasion
    - Modify Registry
    - Disabling Security Tools
  nist:
    - DE.CM
modification_date: '2019-03-01'
name: Suspicious Reg.exe Process
original_authors:
  - company: Splunk
    email: davidd@splunk.com
    name: David Dorsey
references:
  - https://car.mitre.org/wiki/CAR-2013-03-001
security_domain: endpoint
spec_version: 2
type: splunk
version: '2.0'