mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Patrick Bareiss
42 lines
2.1 KiB
YAML
42 lines
2.1 KiB
YAML
name: Processes created by netsh
|
|
id: b89919ed-fe5f-492c-b139-95dbb162041e
|
|
version: 4
|
|
date: '2020-07-21'
|
|
description: This search looks for processes launching netsh.exe to execute various
|
|
commands via the netsh command-line utility. Netsh.exe is a command-line scripting
|
|
utility that allows you to, either locally or remotely, display or modify the network
|
|
configuration of a computer that is currently running. Netsh can be used as a persistence
|
|
proxy technique to execute a helper .dll when netsh.exe is executed. In this search,
|
|
we are looking for processes spawned by netsh.exe that are executing commands via
|
|
the command line.
|
|
how_to_implement: To successfully implement this search, you must be ingesting logs
|
|
with the process name, command-line arguments, and parent processes from your endpoints.
|
|
If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
|
|
type: ESCU
|
|
references: []
|
|
author: Bhavin Patel, Splunk
|
|
search: '| tstats `security_content_summariesonly` count values(Processes.process)
|
|
as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
|
|
where (Processes.parent_process="*C:\\Windows\\System32\\netsh.exe*" AND Processes.process_path!="C:\\Program Files\\rempl\\sedlauncher.exe") by Processes.user
|
|
Processes.dest Processes.parent_process Processes.parent_process_name Processes.process_name
|
|
| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
|
| `processes_created_by_netsh_filter`'
|
|
known_false_positives: It is unusual for netsh.exe to have any child processes in
|
|
most environments. It makes sense to investigate the child process and verify whether
|
|
the process spawned is legitimate. We explicitely exclude "C:\Program Files\rempl\sedlauncher.exe" process path since it is a legitimate process by Mircosoft.
|
|
tags:
|
|
analytics_story:
|
|
- Netsh Abuse
|
|
mitre_attack_id:
|
|
- T1059.001
|
|
- T1059.003
|
|
kill_chain_phases:
|
|
- Actions on Objectives
|
|
cis20:
|
|
- CIS 8
|
|
nist:
|
|
- PR.PT
|
|
- DE.CM
|
|
security_domain: endpoint
|
|
asset_type: Endpoint
|