ssa___windows_lateral_tool_transfer_remcom.yml

name: Windows Lateral Tool Transfer RemCom
id: 25c6b8ba-2a61-41ad-b80c-8e97cf501920
version: 4
date: '2022-02-23'
author: Michael Haag, Splunk
status: experimental
type: TTP
description: This analytic identifies the use of RemCom.exe - The open source psexec. This utility provides the ability to move laterally and run scripts or commands remotely.
data_source:
- Windows Security 4688
search:
  selection1:
    process.cmd_line|contains:
    - '/user:'
    - '/pwd:'
    - '\\'
    process.file.name: remcom.exe
  condition: (selection1)
how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
  endpoint product.
known_false_positives: It is possible legitimate applications may perform this behavior
  and will need to be filtered.
references:
  - https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
  - https://github.com/kavika13/RemCom
tags:
  analytic_story:
  - Active Directory Lateral Movement
  - Living Off The Land
  asset_type: Endpoint
  confidence: 50
  impact: 80
  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to move laterally.
  mitre_attack_id:
  - T1570
  observable:
  - name: dest_user_id
    type: User
    role:
    - Victim
  - name: dest_device_id
    type: Hostname
    role:
    - Victim
  - name: parent_process_name
    type: Process
    role:
    - Parent Process
  - name: process_name
    type: Process
    role:
    - Child Process
  product:
  - Splunk Behavioral Analytics
  required_fields:
  - _time
  - dest_device_id
  - process_name
  - parent_process_name
  - process_path
  - dest_user_id
  - process
  kill_chain_phases:
  - Exploitation
  risk_score: 40
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1570/remcom/4688_remcom_windows-security.log
    source: XmlWinEventLog
    sourcetype: XmlWinEventLog
    update_timestamp: true