mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Patrick Bareiss
40 lines
1.5 KiB
YAML
40 lines
1.5 KiB
YAML
name: Windows hosts file modification
|
|
id: 06a6fc63-a72d-41dc-8736-7e3dd9612116
|
|
version: 1
|
|
date: '2018-11-02'
|
|
description: The search looks for modifications to the hosts file on all Windows endpoints
|
|
across your environment.
|
|
how_to_implement: To successfully implement this search, you must be ingesting data
|
|
that records the file-system activity from your hosts to populate the Endpoint.Filesystem
|
|
data model node. This is typically populated via endpoint detection-and-response
|
|
products, such as Carbon Black, or by other endpoint data sources, such as Sysmon.
|
|
The data used for this search is typically generated via logs that report file-system
|
|
reads and writes.
|
|
type: ESCU
|
|
references: []
|
|
author: Rico Valdez, Splunk
|
|
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
|
as lastTime FROM datamodel=Endpoint.Filesystem by Filesystem.file_name Filesystem.file_path
|
|
Filesystem.dest | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
|
|
| search Filesystem.file_name=hosts AND Filesystem.file_path=*Windows\\System32\\*
|
|
| `drop_dm_object_name(Filesystem)` | `windows_hosts_file_modification_filter`'
|
|
known_false_positives: There may be legitimate reasons for system administrators to
|
|
add entries to this file.
|
|
tags:
|
|
analytics_story:
|
|
- Host Redirection
|
|
kill_chain_phases:
|
|
- Command and Control
|
|
cis20:
|
|
- CIS 3
|
|
- CIS 8
|
|
- CIS 12
|
|
nist:
|
|
- PR.IP
|
|
- PR.PT
|
|
- PR.AC
|
|
- DE.AE
|
|
- DE.CM
|
|
security_domain: endpoint
|
|
asset_type: Endpoint
|