mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
92 lines
4.3 KiB
YAML
92 lines
4.3 KiB
YAML
name: Mmc LOLBAS Execution Process Spawn
|
|
id: f6601940-4c74-11ec-b9b7-3e22fbd008af
|
|
version: 2
|
|
date: '2024-05-12'
|
|
author: Mauricio Velazco, Splunk
|
|
status: production
|
|
type: TTP
|
|
description: The following analytic identifies `mmc.exe` spawning a LOLBAS execution
|
|
process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing
|
|
on process creation events where `mmc.exe` is the parent process. This activity
|
|
is significant because adversaries can abuse the DCOM protocol and MMC20 COM object
|
|
to execute malicious code, using Windows native binaries documented by the LOLBAS
|
|
project. If confirmed malicious, this behavior could indicate lateral movement,
|
|
allowing attackers to execute code remotely, potentially leading to further compromise
|
|
and persistence within the environment.
|
|
data_source:
|
|
- Sysmon EventID 1
|
|
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
|
as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=mmc.exe)
|
|
(Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe",
|
|
"Rasautou.exe", "Schtasks.exe", "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe",
|
|
"Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", "Certoc.exe", "Ieexec.exe",
|
|
"Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe",
|
|
"Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe",
|
|
"SettingSyncHost.exe", "Cmstp.exe", "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe",
|
|
"Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", "Diskshadow.exe",
|
|
"Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe",
|
|
"Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe",
|
|
"Verclsid.exe", "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe",
|
|
"Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", "Msconfig.exe")) by Processes.dest
|
|
Processes.user Processes.parent_process Processes.process_name Processes.process
|
|
Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
|
|
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mmc_lolbas_execution_process_spawn_filter`'
|
|
how_to_implement: The detection is based on data that originates from Endpoint Detection
|
|
and Response (EDR) agents. These agents are designed to provide security-related
|
|
telemetry from the endpoints where the agent is installed. To implement this search,
|
|
you must ingest logs that contain the process GUID, process name, and parent process.
|
|
Additionally, you must ingest complete command-line executions. These logs must
|
|
be processed using the appropriate Splunk Technology Add-ons that are specific to
|
|
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
|
|
data model. Use the Splunk Common Information Model (CIM) to normalize the field
|
|
names and speed up the data modeling process.
|
|
known_false_positives: Legitimate applications may trigger this behavior, filter as
|
|
needed.
|
|
references:
|
|
- https://attack.mitre.org/techniques/T1021/003/
|
|
- https://www.cybereason.com/blog/dcom-lateral-movement-techniques
|
|
- https://lolbas-project.github.io/
|
|
tags:
|
|
analytic_story:
|
|
- Active Directory Lateral Movement
|
|
- Living Off The Land
|
|
asset_type: Endpoint
|
|
confidence: 60
|
|
impact: 90
|
|
message: Mmc.exe spawned a LOLBAS process on $dest$.
|
|
mitre_attack_id:
|
|
- T1021
|
|
- T1021.003
|
|
- T1218.014
|
|
observable:
|
|
- name: dest
|
|
type: Endpoint
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- Processes.dest
|
|
- Processes.user
|
|
- Processes.parent_process_name
|
|
- Processes.parent_process
|
|
- Processes.original_file_name
|
|
- Processes.process_name
|
|
- Processes.process
|
|
- Processes.process_id
|
|
- Processes.parent_process_path
|
|
- Processes.process_path
|
|
- Processes.parent_process_id
|
|
risk_score: 54
|
|
security_domain: endpoint
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data:
|
|
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement_lolbas/windows-sysmon.log
|
|
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
|
sourcetype: xmlwineventlog
|