mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Patrick Bareiss
47 lines
2.2 KiB
YAML
47 lines
2.2 KiB
YAML
name: Detect Rare Executables
|
|
id: 44fddcb2-8d3b-454c-874e-7c6de5a4f7ac
|
|
version: 5
|
|
date: '2020-03-16'
|
|
description: This search will return a table of rare processes, the names of the systems
|
|
running them, and the users who initiated each process.
|
|
how_to_implement: To successfully implement this search, you must be ingesting data
|
|
that records process activity from your hosts and populating the endpoint data model
|
|
with the resultant dataset. The macro `filter_rare_process_whitelist` searches two
|
|
lookup files to whitelist your processes. These consist of `rare_process_whitelist_default.csv`
|
|
and `rare_process_whitelist_local.csv`. To add your own processes to the whitelist,
|
|
add them to `rare_process_whitelist_local.csv`. If you wish to remove an entry from
|
|
the default lookup file, you will have to modify the macro itself to set the whitelist
|
|
value for that process to false. You can modify the limit parameter and search scheduling
|
|
to better suit your environment.
|
|
type: ESCU
|
|
references: []
|
|
author: Bhavin Patel, Splunk
|
|
search: '| tstats `security_content_summariesonly` count values(Processes.dest) as
|
|
dest values(Processes.user) as user min(_time) as firstTime max(_time) as lastTime
|
|
from datamodel=Endpoint.Processes by Processes.process_name | rename Processes.process_name
|
|
as process | rex field=user "(?<user_domain>.*)\\\\(?<user_name>.*)" | `security_content_ctime(firstTime)`|
|
|
`security_content_ctime(lastTime)`| search [| tstats count from datamodel=Endpoint.Processes
|
|
by Processes.process_name | rare Processes.process_name limit=30 | rename Processes.process_name
|
|
as process| `filter_rare_process_whitelist`| table process ] | `detect_rare_executables_filter` '
|
|
known_false_positives: Some legitimate processes may be only rarely executed in your
|
|
environment. As these are identified, update `rare_process_whitelist_local.csv`
|
|
to filter them out of your search results.
|
|
tags:
|
|
analytics_story:
|
|
- 'Emotet Malware DHS Report TA18-201A '
|
|
- Unusual Processes
|
|
kill_chain_phases:
|
|
- Installation
|
|
- Command and Control
|
|
- Actions on Objectives
|
|
cis20:
|
|
- CIS 2
|
|
- CIS 8
|
|
nist:
|
|
- ID.AM
|
|
- PR.PT
|
|
- PR.DS
|
|
- DE.CM
|
|
security_domain: endpoint
|
|
asset_type: Endpoint
|