splunk-security_content/detections/path_interception_program.exe.json

{
  "asset_type": "",
  "confidence": "medium",
  "creation_date": "2017-11-16",
  "data_metadata": {
    "data_models": [
      "Endpoint"
    ],
    "data_source": [
      "Endpoint Intel"
    ],
    "providing_technologies": [
      "Carbon Black Response",
      "CrowdStrike Falcon",
      "Tanium",
      "Ziften"
    ]
  },
  "description": "The search is looking for the creation of program.exe in the C: drive.  The creation of this file in that location may be driven by a motive to perform path interception.",
  "detect": {
    "splunk": {
      "correlation_rule": {
        "notable": {
          "nes_fields": "dest, file_path, file_name",
          "rule_description": "A potentially malicious file program.exe was detected on the C: drive. The creation of this file is often associated with a motive to perform a path interception attack. ",
          "rule_title": "Path Interception attempt discovered $dest$ via creation of program.exe"
        },
        "risk": {
          "risk_object": "dest",
          "risk_object_type": [
            "system"
          ],
          "risk_score": 50
        },
        "schedule": {
          "cron_schedule": "30 * * * *",
          "earliest_time": "-70m@m",
          "latest_time": "-10m@m"
        },
        "search": "| tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_hash) as file_hash values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem where Filesystem.file_path=\"C:\\\\program.exe\" by Filesystem.file_name | `drop_dm_object_name(Filesystem)` | `ctime(lastTime)` | `ctime(firstTime)`",
        "suppress": {
          "suppress_fields": "dest, file_path, file_name",
          "suppress_period": "86400s"
        }
      }
    }
  },
  "eli5": "This search queries the Endpoint file-system data model node to list out all the values of destination machines, as well as the values of file hashes and file paths that have the file \"program.exe\" in the C: drive. Path interception occurs when an executable is placed in a specific path so that it is executed by an application instead of by the intended target. In this case, applications vulnerable to path interception (because of unquoted service paths with spaces in Windows registry) allow attackers to execute maliciously crafted program.exes.",
  "entities": [
    "dest"
  ],
  "how_to_implement": "You must be ingesting data that records the file-system activity from your hosts to populate the Endpoint file-system data model node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file system reads and writes.",
  "id": "c77162d3-f93c-45cc-80c8-22f6v5264g9f",
  "investigations": [
    {
      "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd76",
      "name": "Get Authentication Logs For Endpoint",
      "type": "splunk"
    },
    {
      "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9",
      "name": "Get Parent Process Info",
      "type": "splunk"
    },
    {
      "id": "fdcfb369-1725-4c24-824a-22972d7f0d55",
      "name": "Get Risk Modifiers For User",
      "type": "splunk"
    },
    {
      "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd71",
      "name": "Get Process Info",
      "type": "splunk"
    },
    {
      "id": "3d6c3213-5fff-4a1e-b57d-b24c262171e7",
      "name": "Get Notable History",
      "type": "splunk"
    },
    {
      "id": "f3fb4d1b-5f33-4b01-b541-c7af9534c242",
      "name": "Get Notable Info",
      "type": "splunk"
    },
    {
      "id": "fdcfb369-1725-4c24-824a-22972d7f0d65",
      "name": "Get Risk Modifiers For Endpoint",
      "type": "splunk"
    },
    {
      "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd74",
      "name": "Get User Information from Identity Table",
      "type": "splunk"
    }
  ],
  "known_false_positives": "It is unlikely that a normal user may create and place this file in the C: drive.  Confirm with the user.",
  "maintainers": [
    {
      "company": "Splunk",
      "email": "bpatel@splunk.com",
      "name": "Bhavin Patel"
    }
  ],
  "mappings": {
    "cis20": [
      "CIS 8"
    ],
    "kill_chain_phases": [
      "Actions on Objectives"
    ],
    "mitre_attack": [
      "Privilege Escalation",
      "Persistence"
    ],
    "nist": [
      "PR.PT",
      "DE.CM"
    ]
  },
  "modification_date": "2018-11-15",
  "name": "Detect Path Interception By Creation Of program.exe",
  "original_authors": [
    {
      "company": "Splunk",
      "email": "bpatel@splunk.com",
      "name": "Bhavin Patel"
    }
  ],
  "references": [],
  "security_domain": "endpoint",
  "spec_version": 2,
  "type": "splunk",
  "version": "2.0"
}