splunk-security_content/detections/psexec_accepteula.json

{
  "asset_type": "Endpoint",
  "confidence": "medium",
  "creation_date": "2018-03-28",
  "data_metadata": {
    "data_models": [
      "Endpoint"
    ],
    "data_source": [
      "Endpoint Intel"
    ],
    "providing_technologies": [
      "Sysmon"
    ]
  },
  "description": "This search looks for events where `PsExec.exe` is run with the `accepteula` flag in the command line. PsExec is a built-in Windows utility that enables you to execute processes on other systems. It is fully interactive for console applications. This tool is widely used for launching interactive command prompts on remote systems. Threat actors leverage this extensively for executing code on compromised systems. If an attacker is running PsExec for the first time, they will be prompted to accept the end-user license agreement (EULA), which can be passed as the argument `accepteula` within the command line.",
  "detect": {
    "splunk": {
      "correlation_rule": {
        "notable": {
          "nes_fields": "dest,process_name",
          "rule_description": "The process pssxec.exe was run with the -accepteula flag on $dest$ by $user$.",
          "rule_title": "PsExec executed with accepteula flag on $dest$."
        },
        "risk": {
          "risk_object": "dest",
          "risk_object_type": [
            "system"
          ],
          "risk_score": 75
        },
        "schedule": {
          "cron_schedule": "0 * * * *",
          "earliest_time": "-70m@m",
          "latest_time": "-10m@m"
        },
        "search": "| tstats `summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = PsExec.exe Processes.process = \"*accepteula*\" by Processes.process_name Processes.dest  Processes.parent_process_name | `drop_dm_object_name(Processes)`| `ctime(firstTime)`| `ctime(lastTime)`",
        "suppress": {
          "suppress_fields": "dest, process_name",
          "suppress_period": "86400s"
        }
      }
    }
  },
  "eli5": "In this search, we are looking for the PsExec process with `accepteula` on the command line.",
  "entities": [
    "dest"
  ],
  "how_to_implement": "You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.",
  "id": "b89919ed-fe5f-492c-b139-151xb162040e",
  "investigations": [
    {
      "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd76",
      "name": "Get Authentication Logs For Endpoint",
      "type": "splunk"
    },
    {
      "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9",
      "name": "Get Parent Process Info",
      "type": "splunk"
    },
    {
      "id": "fdcfb369-1725-4c24-824a-22972d7f0d55",
      "name": "Get Risk Modifiers For User",
      "type": "splunk"
    },
    {
      "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd71",
      "name": "Get Process Info",
      "type": "splunk"
    },
    {
      "id": "3d6c3213-5fff-4a1e-b57d-b24c262171e7",
      "name": "Get Notable History",
      "type": "splunk"
    },
    {
      "id": "f3fb4d1b-5f33-4b01-b541-c7af9534c242",
      "name": "Get Notable Info",
      "type": "splunk"
    },
    {
      "id": "fdcfb369-1725-4c24-824a-22972d7f0d65",
      "name": "Get Risk Modifiers For Endpoint",
      "type": "splunk"
    },
    {
      "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd74",
      "name": "Get User Information from Identity Table",
      "type": "splunk"
    }
  ],
  "known_false_positives": "Administrators can leverage PsExec for accessing remote systems and might pass `accepteula` as an argument if they are running this tool for the first time. However, it is not likely that you'd see multiple occurrences of this event on a machine",
  "maintainers": [
    {
      "company": "Splunk",
      "email": "bpatel@splunk.com",
      "name": "Bhavin Patel"
    }
  ],
  "mappings": {
    "cis20": [
      "CIS 8"
    ],
    "kill_chain_phases": [
      "Actions on Objectives"
    ],
    "mitre_attack": [
      "Execution",
      "Command-Line Interface"
    ],
    "nist": [
      "PR.PT",
      "DE.CM"
    ]
  },
  "modification_date": "2019-02-26",
  "name": "Detect PsExec With accepteula Flag",
  "original_authors": [
    {
      "company": "Splunk",
      "email": "bpatel@splunk.com",
      "name": "Bhavin Patel"
    }
  ],
  "references": [],
  "security_domain": "endpoint",
  "spec_version": 2,
  "type": "splunk",
  "version": "2.0"
}