cmdline_tool_not_executed_in_cmd_shell.yml

name: Cmdline Tool Not Executed In CMD Shell
id: 6c3f7dd8-153c-11ec-ac2d-acde48001122
version: 2
date: '2022-10-27'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic identifies a non-standard parent process (not
  matching CMD, PowerShell, or Explorer) spawning `ipconfig.exe` or `systeminfo.exe`.
  This particular behavior was seen in FIN7's JSSLoader .NET payload. This is also
  typically seen when an adversary is injected into another process performing different
  discovery techniques. This event stands out as a TTP since these tools are commonly
  executed with a shell application or Explorer parent, and not by another application.
  This TTP is a good indicator for an adversary gathering host information, but one
  possible false positive might be an automated tool used by a system administator.
data_source:
- Sysmon Event ID 1
search:
  selection1:
    Image|endswith:
    - ipconfig.exe
    - systeminfo.exe
    - net.exe
    - net1.exe
    - arp.exe
    - nslookup.exe
    - route.exe
    - netstat.exe
    - whoami.exe
  condition: (selection1)
how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
  endpoint product.
known_false_positives: A network operator or systems administrator may utilize an
  automated host discovery application that may generate false positives. Filter as
  needed.
references:
- https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation
- https://attack.mitre.org/groups/G0046/
tags:
  analytic_story:
  - FIN7
  - Qakbot
  - CISA AA22-277A
  - Qakbot
  asset_type: Endpoint
  confidence: 80
  impact: 70
  message: A non-standard parent process $parent_process_name$ spawned child process
    $process_name$ to execute command-line tool on $dest$.
  mitre_attack_id:
  - T1059
  - T1059.007
  observable:
  - name: dest
    type: Endpoint
    role:
    - Victim
  - name: user
    type: User
    role:
    - Victim
  - name: parent_process_name
    type: Process
    role:
    - Parent Process
  - name: process_name
    type: Process
    role:
    - Child Process
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 56
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/jssloader/sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: xmlwineventlog