splunk-security_content/detections/sncd_processes.json

{
  "asset_type": "Endpoint",
  "confidence": "high",
  "creation_date": "2018-11-04",
  "data_metadata": {
    "data_models": [
      "Endpoint"
    ],
    "data_source": [
      "Endpoint Intel"
    ],
    "providing_technologies": [
      "Carbon Black Response",
      "CrowdStrike Falcon",
      "Sysmon",
      "Tanium",
      "Ziften"
    ]
  },
  "description": "This search looks for fast execution of processes used for system network configuration discovery on the endpoint.",
  "detect": {
    "splunk": {
      "correlation_rule": {
        "notable": {
          "nes_fields": "dest, process, user",
          "rule_description": "Fast execution of processes $related to network system configuration discovery seen on $dest$.",
          "rule_title": "Fast execution of processes $process_name$ related to network discovery seen on $dest$"
        },
        "risk": {
          "risk_object": "dest",
          "risk_object_type": [
            "system"
          ],
          "risk_score": 50
        },
        "schedule": {
          "cron_schedule": "0 * * * *",
          "earliest_time": "-70m@m",
          "latest_time": "-10m@m"
        },
        "search": "| tstats `summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.process_name Processes.user _time | `ctime(firstTime)` | `ctime(lastTime)` | `drop_dm_object_name(Processes)` | search `system_network_configuration_discovery_tools` | transaction dest maxpause=5m |where eventcount>=5 | table firstTime lastTime dest user process_name process parent_process eventcount",
        "suppress": {
          "suppress_fields": "dest,user",
          "suppress_period": "86400s"
        }
      }
    }
  },
  "eli5": "Attackers have a range of built-in Windows tools they leverage to ascertain the topography of a network from the point of view of a compromised machine. It is uncommon to see these commands execute quickly within short periods of time. This search returns the number of times, as well as the first time and last times, that every process has run for each endpoint. It then executes the macro `system_network_configuration_discovery_tools`, which looks for processes that are typically used for network configuration discovery. Once you have a list of suspicious process launches for each destination, you can leverage the transaction command to see what processes are fired within a five-minute span on an endpoint and detect only those events where the count of these processes is greater than five.",
  "entities": [
    "dest"
  ],
  "how_to_implement": "You must be ingesting data that records registry activity from your hosts to populate the Endpoint data model in the processes node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is usually generated via logs that report reads and writes to the registry or that are populated via Windows event logs, after enabling process tracking in your Windows audit settings.",
  "id": "a51bfe1a-94f0-48cc-b1e4-16ae10145893",
  "investigations": [
    {
      "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd76",
      "name": "Get Authentication Logs For Endpoint",
      "type": "splunk"
    },
    {
      "id": "fdcfb369-1725-4c24-824a-22972d7f0d55",
      "name": "Get Risk Modifiers For User",
      "type": "splunk"
    },
    {
      "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd71",
      "name": "Get Process Info",
      "type": "splunk"
    },
    {
      "id": "3d6c3213-5fff-4a1e-b57d-b24c262171e7",
      "name": "Get Notable History",
      "type": "splunk"
    },
    {
      "id": "fdcfb369-1725-4c24-824a-22972d7f0d65",
      "name": "Get Risk Modifiers For Endpoint",
      "type": "splunk"
    },
    {
      "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd74",
      "name": "Get User Information from Identity Table",
      "type": "splunk"
    }
  ],
  "known_false_positives": "It is uncommon for normal users to execute a series of commands used for network discovery. System administrators often use scripts to execute these commands. These can generate false positives.",
  "maintainers": [
    {
      "company": "Splunk",
      "email": "bpatel@splunk.com",
      "name": "Bhavin Patel"
    }
  ],
  "mappings": {
    "cis20": [
      "CIS 2"
    ],
    "kill_chain_phases": [
      "Installation",
      "Command and Control",
      "Actions on Objectives"
    ],
    "mitre_attack": [
      "Execution"
    ],
    "nist": [
      "ID.AM",
      "PR.DS"
    ]
  },
  "modification_date": "2018-11-20",
  "name": "Detect processes used for System Network Configuration Discovery",
  "original_authors": [
    {
      "company": "Splunk",
      "email": "bpatel@splunk.com",
      "name": "Bhavin Patel"
    }
  ],
  "references": [],
  "security_domain": "endpoint",
  "spec_version": 2,
  "type": "splunk",
  "version": "1.0"
}