mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
111 lines
4.1 KiB
YAML
111 lines
4.1 KiB
YAML
asset_type: ''
|
|
confidence: medium
|
|
creation_date: '2017-11-16'
|
|
data_metadata:
|
|
data_models:
|
|
- Endpoint
|
|
data_source:
|
|
- Endpoint Intel
|
|
providing_technologies:
|
|
- Carbon Black Response
|
|
- CrowdStrike Falcon
|
|
- Tanium
|
|
- Ziften
|
|
description: 'The search is looking for the creation of program.exe in the C: drive. The
|
|
creation of this file in that location may be driven by a motive to perform path
|
|
interception.'
|
|
detect:
|
|
splunk:
|
|
correlation_rule:
|
|
notable:
|
|
nes_fields: dest, file_path, file_name
|
|
rule_description: 'A potentially malicious file program.exe was detected on
|
|
the C: drive. The creation of this file is often associated with a motive
|
|
to perform a path interception attack. '
|
|
rule_title: Path Interception attempt discovered $dest$ via creation of program.exe
|
|
risk:
|
|
risk_object: dest
|
|
risk_object_type:
|
|
- system
|
|
risk_score: 50
|
|
schedule:
|
|
cron_schedule: 30 * * * *
|
|
earliest_time: -70m@m
|
|
latest_time: -10m@m
|
|
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as
|
|
lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_hash)
|
|
as file_hash values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem
|
|
where Filesystem.file_path="C:\\program.exe" by Filesystem.file_name | `drop_dm_object_name(Filesystem)`
|
|
| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`'
|
|
suppress:
|
|
suppress_fields: dest, file_path, file_name
|
|
suppress_period: 86400s
|
|
eli5: 'This search queries the Endpoint file-system data model node to list out all
|
|
the values of destination machines, as well as the values of file hashes and file
|
|
paths that have the file "program.exe" in the C: drive. Path interception occurs
|
|
when an executable is placed in a specific path so that it is executed by an application
|
|
instead of by the intended target. In this case, applications vulnerable to path
|
|
interception (because of unquoted service paths with spaces in Windows registry)
|
|
allow attackers to execute maliciously crafted program.exes.'
|
|
entities:
|
|
- dest
|
|
how_to_implement: You must be ingesting data that records the file-system activity
|
|
from your hosts to populate the Endpoint file-system data model node. This is typically
|
|
populated via endpoint detection-and-response products, such as Carbon Black, or
|
|
other endpoint data sources, such as Sysmon. The data used for this search is typically
|
|
generated via logs that report file system reads and writes.
|
|
id: c77162d3-f93c-45cc-80c8-22f6v5264g9f
|
|
investigations:
|
|
- id: bc91a8cf-35e7-4bb2-8140-e756cc06fd76
|
|
name: Get Authentication Logs For Endpoint
|
|
type: splunk
|
|
- id: fecf2918-670d-4f1c-872b-3d7317a41bf9
|
|
name: Get Parent Process Info
|
|
type: splunk
|
|
- id: fdcfb369-1725-4c24-824a-22972d7f0d55
|
|
name: Get Risk Modifiers For User
|
|
type: splunk
|
|
- id: bc91a8cf-35e7-4bb2-8140-e756cc06fd71
|
|
name: Get Process Info
|
|
type: splunk
|
|
- id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7
|
|
name: Get Notable History
|
|
type: splunk
|
|
- id: f3fb4d1b-5f33-4b01-b541-c7af9534c242
|
|
name: Get Notable Info
|
|
type: splunk
|
|
- id: fdcfb369-1725-4c24-824a-22972d7f0d65
|
|
name: Get Risk Modifiers For Endpoint
|
|
type: splunk
|
|
- id: bc91a8cf-35e7-4bb2-8140-e756cc06fd74
|
|
name: Get User Information from Identity Table
|
|
type: splunk
|
|
known_false_positives: 'It is unlikely that a normal user may create and place this
|
|
file in the C: drive. Confirm with the user.'
|
|
maintainers:
|
|
- company: Splunk
|
|
email: bpatel@splunk.com
|
|
name: Bhavin Patel
|
|
mappings:
|
|
cis20:
|
|
- CIS 8
|
|
kill_chain_phases:
|
|
- Actions on Objectives
|
|
mitre_attack:
|
|
- Privilege Escalation
|
|
- Persistence
|
|
nist:
|
|
- PR.PT
|
|
- DE.CM
|
|
modification_date: '2018-11-15'
|
|
name: Detect Path Interception By Creation Of program.exe
|
|
original_authors:
|
|
- company: Splunk
|
|
email: bpatel@splunk.com
|
|
name: Bhavin Patel
|
|
references: []
|
|
security_domain: endpoint
|
|
spec_version: 2
|
|
type: splunk
|
|
version: '2.0'
|