security_content/dev/endpoint/detection_of_tools_built_by_nirsoft.yml at develop · codingWithJimmy/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
name: Detection of tools built by NirSoft
id: 3d8d201c-aa03-422d-b0ee-2e5ecf9718c0
version: 3
date: '2020-07-21'
author: Bhavin Patel, Splunk
status: experimental
type: TTP
description: This search looks for specific command-line arguments that may indicate
  the execution of tools made by Nirsoft, which are legitimate, but may be abused
  by attackers.
data_source:
- Sysmon Event ID 1
search:
  selection1:
    CommandLine:
    - '* /stext *'
    - '* /scomma *'
  condition: (selection1)
how_to_implement: You must be ingesting endpoint data that tracks process activity,
  including parent-child relationships from your endpoints to populate the Endpoint
  data model in the Processes node. The command-line arguments are mapped to the "process"
  field in the Endpoint data model.
known_false_positives: While legitimate, these NirSoft tools are prone to abuse. You
  should verfiy that the tool was used for a legitimate purpose.
references: []
tags:
  analytic_story:
  - 'Emotet Malware  DHS Report TA18-201A '
  asset_type: Endpoint
  confidence: 50
  impact: 50
  message: tbd
  mitre_attack_id:
  - T1072
  observable:
  - name: user
    type: User
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 25
  security_domain: endpoint