diff --git a/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml b/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml index 75d969f3d3..f29e38cf3f 100644 --- a/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml +++ b/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml @@ -1,7 +1,7 @@ name: Detect Outlook exe writing a zip file id: a51bfe1a-94f0-4822-b1e4-16ae10145893 -version: 11 -date: '2025-02-10' +version: 12 +date: '2025-04-22' author: Bhavin Patel, Splunk status: experimental type: TTP @@ -14,38 +14,21 @@ description: The following analytic identifies the execution of `outlook.exe` wr the security of the affected system and network. data_source: - Sysmon EventID 1 AND Sysmon EventID 11 -search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process - Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id - Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec - Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe + by _time span=5m Processes.parent_process_id Processes.process_id Processes.dest + Processes.process_name Processes.parent_process_name Processes.user | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rename + process_id as malicious_id| rename parent_process_id as outlook_id| join malicious_id + type=inner[| tstats `security_content_summariesonly` count values(Filesystem.file_path) + as file_path values(Filesystem.file_name) as file_name FROM datamodel=Endpoint.Filesystem where (Filesystem.file_path=*.zip* OR Filesystem.file_name=*.lnk ) AND (Filesystem.file_path=C:\\Users* - OR Filesystem.file_path=*Local\\Temp*) by Filesystem.action Filesystem.dest Filesystem.file_access_time - Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name - Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid - Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` - | table action dest original_file_name parent_process parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path process process_exec process_guid - process_hash process_id process_integrity_level process_name process_path user user_id - vendor_product file_access_time file_create_time file_hash file_modify_time file_name - file_path file_acl file_size firstTime lastTime | stats values(action) as action - values(parent_process) as parent_process values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_id) as process_id values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(file_access_time) as file_access_time values(file_create_time) - as file_create_time values(file_hash) as file_hash values(file_modify_time) as file_modify_time - values(file_name) as file_name values(file_path) as file_path values(file_acl) as - file_acl values(file_size) as file_size by process_guid | where isnotnull(process) - AND isnotnull(file_name) | `detect_outlook_exe_writing_a_zip_file_filter`' + OR Filesystem.file_path=*Local\\Temp*) by _time span=5m Filesystem.process_id Filesystem.file_hash + Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | rename process_id as malicious_id| fields + malicious_id outlook_id dest file_path file_name file_hash count file_id] | table + firstTime lastTime user malicious_id outlook_id process_name parent_process_name + file_name file_path | where file_name != "" | `detect_outlook_exe_writing_a_zip_file_filter`' how_to_implement: You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml index 69023c9b89..3eec217377 100644 --- a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml @@ -15,37 +15,16 @@ description: The following analytic detects instances of DLLHost.exe running wit network's security. data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name=dllhost.exe Processes.action!="blocked" by Processes.action - Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec - Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name - Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name - Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic - where All_Traffic.dest_port != 0 by All_Traffic.action All_Traffic.app All_Traffic.dest - All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc - All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip - All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product - All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest - original_file_name parent_process parent_process_exec parent_process_guid parent_process_id - parent_process_name parent_process_path process process_exec process_guid process_hash - process_id process_integrity_level process_name process_path user user_id vendor_product - app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port - transport | stats values(action) as action values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) - as dest_port values(direction) as direction values(dvc) as dvc values(protocol) - as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) - as src_ip values(src_port) as src_port values(transport) as transport by process_id - | where isnotnull(process_name) AND isnotnull(dest_port) | `dllhost_with_no_command_line_arguments_with_network_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=dllhost.exe + Processes.action!="blocked" by host _time span=1h Processes.process_id Processes.process_name + Processes.dest Processes.process_path Processes.process Processes.parent_process_name + Processes.parent_process | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | regex process="(?i)(dllhost\.exe.{0,4}$)" + | rename dest as src | join host process_id [| tstats `security_content_summariesonly` + count latest(All_Traffic.dest) as dest latest(All_Traffic.dest_ip) as dest_ip latest(All_Traffic.dest_port) + as dest_port FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port + != 0 by host All_Traffic.process_id | `drop_dm_object_name(All_Traffic)`] | `dllhost_with_no_command_line_arguments_with_network_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml index 44b2166007..8c82b15f7c 100644 --- a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml @@ -1,7 +1,7 @@ name: GPUpdate with no Command Line Arguments with Network id: 2c853856-a140-11eb-a5b5-acde48001122 -version: 9 -date: '2024-12-10' +version: 10 +date: '2025-04-22' author: Michael Haag, Splunk status: production type: TTP @@ -16,37 +16,24 @@ description: The following analytic detects the execution of gpupdate.exe withou leading to system compromise. data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name=gpupdate.exe by Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid Processes.process_hash - Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path - Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` - | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic where - All_Traffic.dest_port != 0 by All_Traffic.action All_Traffic.app All_Traffic.dest - All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc - All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip - All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product - All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest - original_file_name parent_process parent_process_exec parent_process_guid parent_process_id - parent_process_name parent_process_path process process_exec process_guid process_hash - process_id process_integrity_level process_name process_path user user_id vendor_product - app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port - transport | stats values(action) as action values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) - as dest_port values(direction) as direction values(dvc) as dvc values(protocol) - as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) - as src_ip values(src_port) as src_port values(transport) as transport by process_id - | where isnotnull(process_name) AND isnotnull(dest_port) | `gpupdate_with_no_command_line_arguments_with_network_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=gpupdate.exe + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | regex process="(?i)(gpupdate\.exe.{0,4}$)"| + join process_id [| tstats `security_content_summariesonly` count values(All_Traffic.app) as app values(All_Traffic.dest_ip) as dest_ip + values(All_Traffic.direction) as direction values(All_Traffic.dvc) as dvc values(All_Traffic.protocol) as protocol + values(All_Traffic.protocol_version) as protocol_version values(All_Traffic.src) as src values(All_Traffic.src_ip) as src_ip + values(All_Traffic.src_port) as src_port values(All_Traffic.transport) as transport FROM datamodel=Network_Traffic.All_Traffic + where All_Traffic.dest_port != 0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port + | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] | table _time user dest + parent_process_name process_name process_path process process_id dest_port C2 app dest_ip direction dvc protocol + protocol_version src src_ip src_port transport | + `gpupdate_with_no_command_line_arguments_with_network_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/java_writing_jsp_file.yml b/detections/endpoint/java_writing_jsp_file.yml index aa1648ca7b..4476ff86f3 100644 --- a/detections/endpoint/java_writing_jsp_file.yml +++ b/detections/endpoint/java_writing_jsp_file.yml @@ -1,7 +1,7 @@ name: Java Writing JSP File id: eb65619c-4f8d-4383-a975-d352765d344b -version: 7 -date: '2024-11-13' +version: 8 +date: '2025-04-22' author: Michael Haag, Splunk status: production type: TTP @@ -14,38 +14,24 @@ description: The following analytic detects the Java process writing a .jsp file the affected system, posing a severe security risk. data_source: - Sysmon for Linux EventID 1 AND Sysmon for Linux EventID 11 -search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name - IN ("java","java.exe", "javaw.exe") by Processes.action Processes.dest Processes.original_file_name +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name IN ("java","java.exe", "javaw.exe") by _time Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path - Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` - | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.jsp*" - by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem + where Filesystem.file_name="*.jsp*" by _time Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id - Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | - table action dest original_file_name parent_process parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path process process_exec process_guid - process_hash process_id process_integrity_level process_name process_path user user_id - vendor_product file_access_time file_create_time file_hash file_modify_time file_name - file_path file_acl file_size firstTime lastTime | stats values(action) as action - values(dest) as dest values(original_file_name) as original_file_name values(parent_process) - as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) - as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) - as parent_process_name values(parent_process_path) as parent_process_path values(process) - as process values(process_exec) as process_exec values(process_hash) as process_hash - values(process_id) as process_id values(process_integrity_level) as process_integrity_level - values(process_name) as process_name values(process_path) as process_path values(user) - as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) - as file_access_time values(file_create_time) as file_create_time values(file_hash) - as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name - values(file_path) as file_path values(file_acl) as file_acl values(file_size) as - file_size by process_guid | where isnotnull(process) AND isnotnull(file_name) | - `java_writing_jsp_file_filter`' + Filesystem.user Filesystem.vendor_product + | `drop_dm_object_name(Filesystem)` | fields _time process_guid file_path file_name + file_create_time user dest process_name] | stats count min(_time) as firstTime max(_time) + as lastTime by dest process_name process_guid file_name file_path file_create_time + user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `java_writing_jsp_file_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` diff --git a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml index cfca818b75..d55f428f53 100644 --- a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml +++ b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml @@ -1,7 +1,7 @@ name: Outbound Network Connection from Java Using Default Ports id: d2c14d28-5c47-11ec-9892-acde48001122 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Mauricio Velazco, Lou Stella, Splunk status: production type: TTP @@ -15,39 +15,24 @@ description: "The following analytic detects outbound network connections from J \ further compromise of the affected server." data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where (Processes.process_name="java.exe" OR Processes.process_name=javaw.exe OR Processes.process_name=javaw.exe) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path - Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` - | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic where - (All_Traffic.dest_port= 389 OR All_Traffic.dest_port= 636 OR All_Traffic.dest_port - = 1389 OR All_Traffic.dest_port = 1099 ) by All_Traffic.action All_Traffic.app All_Traffic.dest - All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc - All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip - All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product - All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest - original_file_name parent_process parent_process_exec parent_process_guid parent_process_id - parent_process_name parent_process_path process process_exec process_guid process_hash - process_id process_integrity_level process_name process_path user user_id vendor_product - app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port - transport | stats values(action) as action values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) - as dest_port values(direction) as direction values(dvc) as dvc values(protocol) - as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) - as src_ip values(src_port) as src_port values(transport) as transport by process_id - | where isnotnull(process_name) AND isnotnull(dest_port) | `outbound_network_connection_from_java_using_default_ports_filter`' + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic + where (All_Traffic.dest_port= 389 OR All_Traffic.dest_port= 636 OR All_Traffic.dest_port + = 1389 OR All_Traffic.dest_port = 1099 ) by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out + All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol + All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port + All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.direction All_Traffic.process_id + | `drop_dm_object_name(All_Traffic)` | rename dest as connection_to_CNC] + | table _time dest parent_process_name process_name process_path process dest_port + | `outbound_network_connection_from_java_using_default_ports_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml index a9734a3629..5e74ee67e5 100644 --- a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml @@ -15,37 +15,24 @@ description: The following analytic detects the execution of rundll32.exe withou of the system. data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where `process_rundll32` AND Processes.action!="blocked" by Processes.action Processes.dest - Processes.original_file_name Processes.parent_process Processes.parent_process_exec - Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name - Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name - Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic - where All_Traffic.dest_port != 0 by All_Traffic.action All_Traffic.app All_Traffic.dest - All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc - All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip - All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product - All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest - original_file_name parent_process parent_process_exec parent_process_guid parent_process_id - parent_process_name parent_process_path process process_exec process_guid process_hash - process_id process_integrity_level process_name process_path user user_id vendor_product - app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port - transport | stats values(action) as action values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) - as dest_port values(direction) as direction values(dvc) as dvc values(protocol) - as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) - as src_ip values(src_port) as src_port values(transport) as transport by process_id - | where isnotnull(process_name) AND isnotnull(dest_port) | `rundll32_with_no_command_line_arguments_with_network_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Processes where `process_rundll32` AND Processes.action!="blocked" + by host _time span=1h Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | regex process="(?i)(rundll32\.exe.{0,4}$)" | rename dest as src | join host process_id + [| tstats `security_content_summariesonly` count + FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by host + All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out + All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol + All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port + All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.direction + All_Traffic.process_id | `drop_dm_object_name(All_Traffic)`] + | `rundll32_with_no_command_line_arguments_with_network_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml index d2b24b770d..42bc1bd9e3 100644 --- a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml +++ b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml @@ -15,37 +15,23 @@ description: The following analytic detects instances of searchprotocolhost.exe and control, potentially leading to data exfiltration or further system compromise. data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name=searchprotocolhost.exe by Processes.action Processes.dest - Processes.original_file_name Processes.parent_process Processes.parent_process_exec - Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name - Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name - Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic - where All_Traffic.dest_port != 0 by All_Traffic.action All_Traffic.app All_Traffic.dest - All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc - All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip - All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product - All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest - original_file_name parent_process parent_process_exec parent_process_guid parent_process_id - parent_process_name parent_process_path process process_exec process_guid process_hash - process_id process_integrity_level process_name process_path user user_id vendor_product - app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port - transport | stats values(action) as action values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) - as dest_port values(direction) as direction values(dvc) as dvc values(protocol) - as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) - as src_ip values(src_port) as src_port values(transport) as transport by process_id - | where isnotnull(process_name) AND isnotnull(dest_port) | `searchprotocolhost_with_no_command_line_with_network_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | regex process="(?i)(searchprotocolhost\.exe.{0,4}$)" | join process_id [| tstats + `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic + where All_Traffic.dest_port != 0 by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out + All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol + All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port + All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.direction + All_Traffic.process_id + | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] | table _time dest parent_process_name + process_name process_path process process_id dest_port C2 | `searchprotocolhost_with_no_command_line_with_network_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/spoolsv_writing_a_dll.yml b/detections/endpoint/spoolsv_writing_a_dll.yml index ac3e2aeaef..63852cc5a6 100644 --- a/detections/endpoint/spoolsv_writing_a_dll.yml +++ b/detections/endpoint/spoolsv_writing_a_dll.yml @@ -1,7 +1,7 @@ name: Spoolsv Writing a DLL id: d5bf5cf2-da71-11eb-92c2-acde48001122 -version: 9 -date: '2025-03-27' +version: 10 +date: '2025-04-22' author: Mauricio Velazco, Michael Haag, Splunk status: production type: TTP @@ -16,38 +16,20 @@ description: The following analytic detects `spoolsv.exe` writing a `.dll` file, data_source: - Sysmon EventID 1 AND Sysmon EventID 11 - Windows Event Log Security 4688 AND Sysmon EventID 11 -search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=spoolsv.exe - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process - Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id - Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec - Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.file_path="*\\spool\\drivers\\x64\\*" Filesystem.file_name="*.dll" - by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time - Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path - Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id - Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | - table action dest original_file_name parent_process parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path process process_exec process_guid - process_hash process_id process_integrity_level process_name process_path user user_id - vendor_product file_access_time file_create_time file_hash file_modify_time file_name - file_path file_acl file_size firstTime lastTime | stats values(action) as action - values(dest) as dest values(original_file_name) as original_file_name values(parent_process) - as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) - as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) - as parent_process_name values(parent_process_path) as parent_process_path values(process) - as process values(process_exec) as process_exec values(process_hash) as process_hash - values(process_id) as process_id values(process_integrity_level) as process_integrity_level - values(process_name) as process_name values(process_path) as process_path values(user) - as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) - as file_access_time values(file_create_time) as file_create_time values(file_hash) - as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name - values(file_path) as file_path values(file_acl) as file_acl values(file_size) as - file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name) - | `spoolsv_writing_a_dll_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=spoolsv.exe by _time Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | join process_guid, _time [| + tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\spool\\drivers\\x64\\*" + Filesystem.file_name="*.dll" by _time Filesystem.dest Filesystem.process_guid Filesystem.file_create_time + Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` | + fields _time dest file_create_time file_name file_path process_name process_path + process_guid process] | dedup file_create_time | table dest file_create_time, file_name, + file_path, process_name process_guid | `spoolsv_writing_a_dll_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` diff --git a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml index 9cc0d39dc3..666343c940 100644 --- a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml +++ b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml @@ -1,7 +1,7 @@ name: Suspicious Image Creation In Appdata Folder id: f6f904c4-1ac0-11ec-806b-acde48001122 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP @@ -15,39 +15,21 @@ description: The following analytic detects the creation of image files in the A compromising sensitive information and user privacy. data_source: - Sysmon EventID 1 AND Sysmon EventID 11 -search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=*.exe - Processes.process_path="*\\appdata\\Roaming\\*" by Processes.action Processes.dest - Processes.original_file_name Processes.parent_process Processes.parent_process_exec - Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name - Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name - Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.file_name IN ("*.png","*.jpg","*.bmp","*.gif","*.tiff") Filesystem.file_path="*\\appdata\\Roaming\\*" - by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time - Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path - Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id - Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | - table action dest original_file_name parent_process parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path process process_exec process_guid - process_hash process_id process_integrity_level process_name process_path user user_id - vendor_product file_access_time file_create_time file_hash file_modify_time file_name - file_path file_acl file_size firstTime lastTime | stats values(action) as action - values(dest) as dest values(original_file_name) as original_file_name values(parent_process) - as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) - as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) - as parent_process_name values(parent_process_path) as parent_process_path values(process) - as process values(process_exec) as process_exec values(process_hash) as process_hash - values(process_id) as process_id values(process_integrity_level) as process_integrity_level - values(process_name) as process_name values(process_path) as process_path values(user) - as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) - as file_access_time values(file_create_time) as file_create_time values(file_hash) - as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name - values(file_path) as file_path values(file_acl) as file_acl values(file_size) as - file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name) - | `suspicious_image_creation_in_appdata_folder_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*" + by _time span=1h Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` |rename process_guid as + proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count + min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.file_name IN ("*.png","*.jpg","*.bmp","*.gif","*.tiff") Filesystem.file_path= + "*\\appdata\\Roaming\\*" by _time span=1h Filesystem.dest Filesystem.file_create_time + Filesystem.file_name Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` + |rename process_guid as proc_guid | fields _time dest file_create_time file_name + file_path process_name process_path process proc_guid] | `suspicious_image_creation_in_appdata_folder_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml index 9464b212cf..911dd6035f 100644 --- a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml +++ b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml @@ -1,7 +1,7 @@ name: Suspicious WAV file in Appdata Folder id: 5be109e6-1ac5-11ec-b421-acde48001122 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP @@ -16,39 +16,21 @@ description: The following analytic detects the creation of .wav files in the Ap data_source: - Sysmon EventID 1 AND Sysmon EventID 11 - Windows Event Log Security 4688 AND Sysmon EventID 11 -search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=*.exe - Processes.process_path="*\\appdata\\Roaming\\*" by Processes.action Processes.dest - Processes.original_file_name Processes.parent_process Processes.parent_process_exec - Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name - Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name - Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*" + by _time span=1h Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` |rename process_guid as + proc_guid | join proc_guid, _time [ | tstats `security_content_summariesonly` count + min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.wav") Filesystem.file_path = "*\\appdata\\Roaming\\*" - by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time - Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path - Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id - Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | - table action dest original_file_name parent_process parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path process process_exec process_guid - process_hash process_id process_integrity_level process_name process_path user user_id - vendor_product file_access_time file_create_time file_hash file_modify_time file_name - file_path file_acl file_size firstTime lastTime | stats values(action) as action - values(dest) as dest values(original_file_name) as original_file_name values(parent_process) - as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) - as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) - as parent_process_name values(parent_process_path) as parent_process_path values(process) - as process values(process_exec) as process_exec values(process_hash) as process_hash - values(process_id) as process_id values(process_integrity_level) as process_integrity_level - values(process_name) as process_name values(process_path) as process_path values(user) - as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) - as file_access_time values(file_create_time) as file_create_time values(file_hash) - as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name - values(file_path) as file_path values(file_acl) as file_acl values(file_size) as - file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name) - | `suspicious_wav_file_in_appdata_folder_filter`' + by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name + Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` + |rename process_guid as proc_guid | fields file_name file_path process_name process_path + process dest file_create_time _time proc_guid] | `suspicious_wav_file_in_appdata_folder_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, file_name, file_path and command-line executions from your endpoints. If you are using Sysmon, you must have at least diff --git a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml index ce4e741840..662f188f9f 100644 --- a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml +++ b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml @@ -1,7 +1,7 @@ name: Suspicious writes to windows Recycle Bin id: b5541828-8ffd-4070-9d95-b3da4de924cb -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Rico Valdez, Splunk status: production type: TTP @@ -15,38 +15,20 @@ description: The following analytic detects when a process other than explorer.e tools. data_source: - Sysmon EventID 1 AND Sysmon EventID 11 -search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime values(Filesystem.file_path) as file_path values(Filesystem.file_name) + as file_name FROM datamodel=Endpoint.Filesystem where Filesystem.file_path = "*$Recycle.Bin*" + by Filesystem.process_name Filesystem.process_id Filesystem.dest | `drop_dm_object_name("Filesystem")` + | join process_id [| tstats `security_content_summariesonly` values(Processes.user) + as user values(Processes.process_name) as process_name values(Processes.parent_process_name) + as parent_process_name FROM datamodel=Endpoint.Processes where Processes.process_name != "explorer.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path - Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` - | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path - = "*$Recycle.Bin*" by Filesystem.action Filesystem.dest Filesystem.file_access_time - Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name - Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid - Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` - | table action dest original_file_name parent_process parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path process process_exec process_guid - process_hash process_id process_integrity_level process_name process_path user user_id - vendor_product file_access_time file_create_time file_hash file_modify_time file_name - file_path file_acl file_size firstTime lastTime | stats values(action) as action - values(dest) as dest values(original_file_name) as original_file_name values(parent_process) - as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) - as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) - as parent_process_name values(parent_process_path) as parent_process_path values(process) - as process values(process_exec) as process_exec values(process_hash) as process_hash - values(process_id) as process_id values(process_integrity_level) as process_integrity_level - values(process_name) as process_name values(process_path) as process_path values(user) - as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) - as file_access_time values(file_create_time) as file_create_time values(file_hash) - as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name - values(file_path) as file_path values(file_acl) as file_acl values(file_size) as - file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name) - | `suspicious_writes_to_windows_recycle_bin_filter`' + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name("Processes")` + | table user process_name process_id dest] | `suspicious_writes_to_windows_recycle_bin_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on filesystem and process logs responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` nodes. diff --git a/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml b/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml index b907525320..d7aafa7b1b 100644 --- a/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml +++ b/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml @@ -1,7 +1,7 @@ name: Unknown Process Using The Kerberos Protocol id: c91a0852-9fbb-11ec-af44-acde48001122 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Mauricio Velazco, Splunk status: production type: TTP @@ -15,37 +15,22 @@ description: The following analytic identifies a non-lsass.exe process making an access or lateral movement within the network. data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name!=lsass.exe by Processes.action Processes.dest Processes.original_file_name +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name!=lsass.exe by _time Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path - Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` - | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic where - All_Traffic.dest_port = 88 by All_Traffic.action All_Traffic.app All_Traffic.dest - All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc - All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip - All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product - All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest - original_file_name parent_process parent_process_exec parent_process_guid parent_process_id - parent_process_name parent_process_path process process_exec process_guid process_hash - process_id process_integrity_level process_name process_path user user_id vendor_product - app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port - transport | stats values(action) as action values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) - as dest_port values(direction) as direction values(dvc) as dvc values(protocol) - as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) - as src_ip values(src_port) as src_port values(transport) as transport by process_id - | where isnotnull(process_name) AND isnotnull(dest_port) | `unknown_process_using_the_kerberos_protocol_filter`' + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | join process_id dest [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic + where All_Traffic.dest_port = 88 by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out + All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol + All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port + All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.direction + All_Traffic.process_id + | `drop_dm_object_name(All_Traffic)` | rename src as dest ] | table _time dest + parent_process_name process_name process_path process process_id dest_port | `unknown_process_using_the_kerberos_protocol_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml b/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml index 042d104f0c..2475cef1f1 100644 --- a/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml +++ b/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml @@ -1,7 +1,7 @@ name: Windows Defacement Modify Transcodedwallpaper File id: e11c3d90-5bc7-42ad-94cd-ba75db10d897 -version: 5 -date: '2024-11-13' +version: 6 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,39 +15,21 @@ description: The following analytic identifies modifications to the TranscodedWa potentially leading to further system compromise or data exfiltration. data_source: - Sysmon EventID 1 AND Sysmon EventID 11 -search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path - !="*\\Windows\\Explorer.EXE" by Processes.action Processes.dest Processes.original_file_name +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_path !="*\\Windows\\Explorer.EXE" + by _time span=1h Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path - Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` - | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path - = "*\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper" by Filesystem.action - Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash - Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl - Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user - Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | table action dest - original_file_name parent_process parent_process_exec parent_process_guid parent_process_id - parent_process_name parent_process_path process process_exec process_guid process_hash - process_id process_integrity_level process_name process_path user user_id vendor_product - file_access_time file_create_time file_hash file_modify_time file_name file_path - file_acl file_size firstTime lastTime | stats values(action) as action values(dest) - as dest values(original_file_name) as original_file_name values(parent_process) - as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) - as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) - as parent_process_name values(parent_process_path) as parent_process_path values(process) - as process values(process_exec) as process_exec values(process_hash) as process_hash - values(process_id) as process_id values(process_integrity_level) as process_integrity_level - values(process_name) as process_name values(process_path) as process_path values(user) - as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) - as file_access_time values(file_create_time) as file_create_time values(file_hash) - as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name - values(file_path) as file_path values(file_acl) as file_acl values(file_size) as - file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name) - | `windows_defacement_modify_transcodedwallpaper_file_filter`' + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | join proc_guid, + _time [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem + where Filesystem.file_path = "*\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper" + by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name + Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` + |rename process_guid as proc_guid | fields file_name file_path process_name process_path + process dest file_create_time _time proc_guid] | `windows_defacement_modify_transcodedwallpaper_file_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, diff --git a/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml b/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml index a592e9c308..0bf2151398 100644 --- a/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml +++ b/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml @@ -14,42 +14,24 @@ description: payload impacts. If confirmed malicious, this behavior could lead to significant system damage, loss of critical configurations, and potential disruption of services. data_source: - - Sysmon EventID 1 AND Sysmon EventID 12 - - Sysmon EventID 1 AND Sysmon EventID 13 -search: - '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path - IN ("*\\windows\\*", "*\\program files*") by Processes.action Processes.dest Processes.original_file_name +- Sysmon EventID 1 AND Sysmon EventID 12 +search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry + WHERE Registry.action=deleted BY _time span=1h Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | join process_guid [| tstats + `security_content_summariesonly` count FROM datamodel=Endpoint.Processes WHERE NOT + (Processes.process_path IN ("*\\windows\\*", "*\\program files*")) by _time span=1h + Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path - Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` - | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.action=deleted - by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive - Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name - Registry.registry_value_type Registry.status Registry.user Registry.vendor_product - | `drop_dm_object_name(Registry)` | table action dest original_file_name parent_process - parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path - process process_exec process_guid process_hash process_id process_integrity_level - process_name process_path user user_id vendor_product registry_hive registry_path - registry_key_name registry_value_data registry_value_name registry_value_type status - | stats values(action) as action values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_id) as process_id values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(registry_hive) as registry_hive values(registry_path) as - registry_path values(registry_key_name) as registry_key_name values(registry_value_data) - as registry_value_data values(registry_value_name) as registry_value_name values(registry_value_type) - as registry_value_type values(status) as status by process_guid | where isnotnull(process_path) - AND isnotnull(registry_value_name) | `windows_deleted_registry_by_a_non_critical_process_file_path_filter`' -how_to_implement: - The detection is based on data that originates from Endpoint Detection + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`] + | fields _time parent_process_name parent_process process_name process_path process + process_guid registry_path registry_value_name registry_value_data registry_key_name + action dest user | `windows_deleted_registry_by_a_non_critical_process_file_path_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. diff --git a/detections/endpoint/windows_http_network_communication_from_msiexec.yml b/detections/endpoint/windows_http_network_communication_from_msiexec.yml index 3c9109ccb9..69c7cdc0f2 100644 --- a/detections/endpoint/windows_http_network_communication_from_msiexec.yml +++ b/detections/endpoint/windows_http_network_communication_from_msiexec.yml @@ -15,41 +15,24 @@ description: potentially leading to data exfiltration, command and control (C2) communication, or further malware deployment. data_source: - - Sysmon EventID 1 AND Sysmon EventID 3 -search: - '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where `process_msiexec` by Processes.action Processes.dest Processes.original_file_name +- Sysmon EventID 1 AND Sysmon EventID 3 +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_msiexec` + by _time Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path - Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` - | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic where - All_Traffic.dest_port IN ("80","443") by All_Traffic.action All_Traffic.app All_Traffic.dest - All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc - All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip - All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product - All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest - original_file_name parent_process parent_process_exec parent_process_guid parent_process_id - parent_process_name parent_process_path process process_exec process_guid process_hash - process_id process_integrity_level process_name process_path user user_id vendor_product - app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port - transport | stats values(action) as action values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) - as dest_port values(direction) as direction values(dvc) as dvc values(protocol) - as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) - as src_ip values(src_port) as src_port values(transport) as transport by process_id - | where isnotnull(process_name) AND isnotnull(dest_port) | `windows_http_network_communication_from_msiexec_filter`' -how_to_implement: - The detection is based on data that originates from Endpoint Detection + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic where + All_Traffic.dest_port IN ("80","443") by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out + All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol + All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port + All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.direction All_Traffic.process_id + | `drop_dm_object_name(All_Traffic)` ] + | table _time user dest parent_process_name process_name process_path process process_id dest_port dest_ip + | `windows_http_network_communication_from_msiexec_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. diff --git a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml index aa054d7ff9..26070a5722 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml @@ -18,8 +18,8 @@ data_source: - Sysmon EventID 1 - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*forfiles* - /c *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*forfiles* /c *" + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level diff --git a/detections/endpoint/windows_installutil_remote_network_connection.yml b/detections/endpoint/windows_installutil_remote_network_connection.yml index fcedfa0264..a7c8b70286 100644 --- a/detections/endpoint/windows_installutil_remote_network_connection.yml +++ b/detections/endpoint/windows_installutil_remote_network_connection.yml @@ -1,7 +1,7 @@ name: Windows InstallUtil Remote Network Connection id: 4fbf9270-43da-11ec-9486-acde48001122 -version: 12 -date: '2025-03-27' +version: 13 +date: '2025-04-22' author: Michael Haag, Splunk status: production type: TTP @@ -16,39 +16,31 @@ description: The following analytic detects the Windows InstallUtil.exe binary m of this activity. data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: "| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes\n\ - \ where `process_installutil`\n by Processes.action Processes.dest Processes.original_file_name\ - \ Processes.parent_process Processes.parent_process_exec \n Processes.parent_process_guid\ - \ Processes.parent_process_id Processes.parent_process_name \n Processes.parent_process_path\ - \ Processes.process Processes.process_exec Processes.process_guid Processes.process_hash\ - \ \n Processes.process_id Processes.process_integrity_level Processes.process_name\ - \ Processes.process_path \n Processes.user Processes.user_id Processes.vendor_product\ - \ \n| `drop_dm_object_name(Processes)` \n| tstats prestats=t append=t `security_content_summariesonly`\ - \ count min(_time) as firstTime max(_time)\n as lastTime from datamodel=Network_Traffic.All_Traffic\ - \ where All_Traffic.dest_port!=0\n by All_Traffic.action All_Traffic.app All_Traffic.dest\ - \ All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction \n All_Traffic.dvc\ - \ All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip\ - \ All_Traffic.src_port \n All_Traffic.transport All_Traffic.user All_Traffic.vendor_product\ - \ All_Traffic.process_id\n| `drop_dm_object_name(All_Traffic)` \n| table action\ - \ dest original_file_name parent_process parent_process_exec \n parent_process_guid\ - \ parent_process_id parent_process_name \n parent_process_path process process_exec\ - \ process_guid process_hash \n process_id process_integrity_level process_name\ - \ process_path \n user user_id vendor_product app dest_ip dest_port direction dvc\ - \ protocol \n protocol_version src src_ip src_port transport \n| stats values(action)\ - \ as action values(dest) as dest values(original_file_name) as original_file_name\ - \ values(parent_process) as parent_process \n values(parent_process_exec) as parent_process_exec\ - \ values(parent_process_guid) as parent_process_guid \n values(parent_process_id)\ - \ as parent_process_id values(parent_process_name) as parent_process_name \n values(parent_process_path)\ - \ as parent_process_path values(process) as process \n values(process_exec) as\ - \ process_exec values(process_hash) as process_hash \n values(process_guid) as\ - \ process_guid values(process_integrity_level) as process_integrity_level values(process_name)\ - \ as process_name\n values(process_path) as process_path values(user) as user values(user_id)\ - \ as user_id \n values(vendor_product) as vendor_product values(app) as app values(dest_ip)\ - \ as dest_ip values(dest_port) as dest_port values(direction) as direction\n values(dvc)\ - \ as dvc values(protocol) as protocol values(protocol_version) as protocol_version\ - \ values(src) as src values(src_ip) as src_ip values(src_port) as src_port values(transport)\ - \ as transport by process_id \n| where isnotnull(process_name) AND isnotnull(dest_port)\ - \ \n| `windows_installutil_remote_network_connection_filter`" +search: |- + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where `process_installutil` by _time span=1h Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | join process_id dest + [| tstats `security_content_summariesonly` + count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != + 0 by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out + All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol + All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port + All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.direction All_Traffic.process_id + | `drop_dm_object_name(All_Traffic)` + | rename dest as command_and_control + | rename src as dest] + | table _time user src dest parent_process_name process_name process_path process process_id dest_port command_and_control + | stats count min(_time) as firstTime max(_time) as lastTime values(process) as process values(command_and_control) as command_and_control by user dest process_name process_id dest_port parent_process_name + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `windows_installutil_remote_network_connection_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml index 694f33b26f..f082b063f8 100644 --- a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml +++ b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml @@ -1,7 +1,7 @@ name: Windows InstallUtil Uninstall Option with Network id: 1a52c836-43ef-11ec-a36c-acde48001122 -version: 10 -date: '2025-02-10' +version: 11 +date: '2025-04-22' author: Michael Haag, Splunk status: production type: TTP @@ -15,37 +15,23 @@ description: The following analytic identifies the use of Windows InstallUtil.ex movement within the network. data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where `process_installutil` Processes.process IN ("*/u*", "*uninstall*") by Processes.action - Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec - Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name - Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name - Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic - where All_Traffic.dest_port!=0 by All_Traffic.action All_Traffic.app All_Traffic.dest - All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc - All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip - All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product - All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest - original_file_name parent_process parent_process_exec parent_process_guid parent_process_id - parent_process_name parent_process_path process process_exec process_guid process_hash - process_id process_integrity_level process_name process_path user user_id vendor_product - app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port - transport | stats values(action) as action values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) - as dest_port values(direction) as direction values(dvc) as dvc values(protocol) - as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) - as src_ip values(src_port) as src_port values(transport) as transport by process_id - | where isnotnull(process_name) AND isnotnull(dest_port) | `windows_installutil_uninstall_option_with_network_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where `process_installutil` Processes.process IN ("*/u*", "*uninstall*") by _time + span=1h Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join process_id + [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic + where All_Traffic.dest_port != 0 by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out + All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol + All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port + All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.direction All_Traffic.process_id + | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] | table _time user dest + parent_process_name process_name process_path process process_id dest_port C2 | + `windows_installutil_uninstall_option_with_network_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml b/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml index 5f04acee23..c492ae63e3 100644 --- a/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml +++ b/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml @@ -1,7 +1,7 @@ name: Windows Office Product Dropped Cab or Inf File id: dbdd251e-dd45-4ec9-a555-f5e151391746 -version: 3 -date: '2025-02-10' +version: 4 +date: '2025-04-22' author: Michael Haag, Splunk status: production type: TTP @@ -15,37 +15,21 @@ description: The following analytic detects Office products writing .cab or .inf data_source: - Sysmon EventID 1 AND Sysmon EventID 11 - Windows Event Log Security 4688 AND Sysmon EventID 11 -search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where `process_office_products` - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process - Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id - Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec - Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where `process_office_products` by _time span=1h Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid | join proc_guid, _time [ | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.file_name IN ("*.cab", "*.inf") by Filesystem.action Filesystem.dest - Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time - Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size - Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product - | `drop_dm_object_name(Filesystem)` | table action dest original_file_name parent_process - parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path - process process_exec process_guid process_hash process_id process_integrity_level - process_name process_path user user_id vendor_product file_access_time file_create_time - file_hash file_modify_time file_name file_path file_acl file_size firstTime lastTime - | stats values(action) as action values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_id) as process_id values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(file_access_time) as file_access_time values(file_create_time) - as file_create_time values(file_hash) as file_hash values(file_modify_time) as file_modify_time - values(file_name) as file_name values(file_path) as file_path values(file_acl) as - file_acl values(file_size) as file_size by process_guid | where isnotnull(process) - AND isnotnull(file_name) | `windows_office_product_dropped_cab_or_inf_file_filter`' + where Filesystem.file_name IN ("*.cab", "*.inf") by _time span=1h Filesystem.dest + Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid + | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid | fields _time + dest file_create_time file_name file_path process_name process_path process proc_guid] + | dedup file_create_time | table dest, process_name, process, file_create_time, + file_name, file_path, proc_guid | `windows_office_product_dropped_cab_or_inf_file_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` diff --git a/detections/endpoint/windows_office_product_dropped_uncommon_file.yml b/detections/endpoint/windows_office_product_dropped_uncommon_file.yml index 82da6b59e2..9f178e97e1 100644 --- a/detections/endpoint/windows_office_product_dropped_uncommon_file.yml +++ b/detections/endpoint/windows_office_product_dropped_uncommon_file.yml @@ -1,7 +1,7 @@ name: Windows Office Product Dropped Uncommon File id: 7ac0fced-9eae-4381-a748-90dcd1aa9393 -version: 3 -date: '2025-02-10' +version: 4 +date: '2025-04-22' author: Teoderick Contreras, Michael Haag, Splunk, TheLawsOfChaos, Github status: production type: Anomaly @@ -15,37 +15,20 @@ description: The following analytic detects Microsoft Office applications droppi access, posing a severe threat to the environment. data_source: - Sysmon EventID 1 AND Sysmon EventID 11 -search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where `process_office_products` - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process - Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id - Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec - Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.file_name IN ("*.dll", "*.exe", "*.js", "*.pif", "*.ps1", "*.scr", - "*.vbe", "*.vbs") by Filesystem.action Filesystem.dest Filesystem.file_access_time - Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name - Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid - Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` - | table action dest original_file_name parent_process parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path process process_exec process_guid - process_hash process_id process_integrity_level process_name process_path user user_id - vendor_product file_access_time file_create_time file_hash file_modify_time file_name - file_path file_acl file_size firstTime lastTime | stats values(action) as action - values(dest) as dest values(original_file_name) as original_file_name values(parent_process) - as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) - as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) - as parent_process_name values(parent_process_path) as parent_process_path values(process) - as process values(process_exec) as process_exec values(process_hash) as process_hash - values(process_id) as process_id values(process_integrity_level) as process_integrity_level - values(process_name) as process_name values(process_path) as process_path values(user) - as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) - as file_access_time values(file_create_time) as file_create_time values(file_hash) - as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name - values(file_path) as file_path values(file_acl) as file_acl values(file_size) as - file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name) +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where `process_office_products` by _time span=1h Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | join process_guid, _time [| tstats `security_content_summariesonly` count min(_time) + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name + IN ("*.dll", "*.exe", "*.js", "*.pif", "*.ps1", "*.scr", "*.vbe", "*.vbs") by _time + span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid + Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time + file_name file_path process_name process_path process process_guid] | dedup file_create_time + | table dest, process_name, process, file_create_time, file_name, file_path, process_guid | `windows_office_product_dropped_uncommon_file_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your diff --git a/detections/endpoint/windows_phishing_outlook_drop_dll_in_form_dir.yml b/detections/endpoint/windows_phishing_outlook_drop_dll_in_form_dir.yml index 685c811982..6540a39b8c 100644 --- a/detections/endpoint/windows_phishing_outlook_drop_dll_in_form_dir.yml +++ b/detections/endpoint/windows_phishing_outlook_drop_dll_in_form_dir.yml @@ -1,7 +1,7 @@ name: Windows Phishing Outlook Drop Dll In FORM Dir id: fca01769-5163-4b3a-ae44-de874adfc9bc -version: 5 -date: '2024-11-13' +version: 6 +date: '2025-04-22' author: Teoderick Contreras, Splunk data_source: - Sysmon EventID 1 AND Sysmon EventID 11 @@ -14,38 +14,19 @@ description: The following analytic detects the creation of a DLL file by an out an attempt to exploit CVE-2024-21378, where a custom MAPI form loads a potentially malicious DLL. If confirmed malicious, this could allow an attacker to execute arbitrary code, leading to further system compromise or data exfiltration. -search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process - Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id - Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec - Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.file_name ="*.dll" Filesystem.file_path = "*\\AppData\\Local\\Microsoft\\FORMS\\IPM*" - by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time - Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path - Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id - Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | - table action dest original_file_name parent_process parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path process process_exec process_guid - process_hash process_id process_integrity_level process_name process_path user user_id - vendor_product file_access_time file_create_time file_hash file_modify_time file_name - file_path file_acl file_size firstTime lastTime | stats values(action) as action - values(dest) as dest values(original_file_name) as original_file_name values(parent_process) - as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) - as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) - as parent_process_name values(parent_process_path) as parent_process_path values(process) - as process values(process_exec) as process_exec values(process_hash) as process_hash - values(process_id) as process_id values(process_integrity_level) as process_integrity_level - values(process_name) as process_name values(process_path) as process_path values(user) - as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) - as file_access_time values(file_create_time) as file_create_time values(file_hash) - as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name - values(file_path) as file_path values(file_acl) as file_acl values(file_size) as - file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name) - | `windows_phishing_outlook_drop_dll_in_form_dir_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=outlook.exe by _time span=1h Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | join process_guid, _time [ | tstats `security_content_summariesonly` count min(_time) + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name + ="*.dll" Filesystem.file_path = "*\\AppData\\Local\\Microsoft\\FORMS\\IPM*" by _time + span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path + Filesystem.process_guid | `drop_dm_object_name(Filesystem)` | fields file_name file_path + process_name process_path process dest file_create_time _time process_guid] | `windows_phishing_outlook_drop_dll_in_form_dir_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, diff --git a/detections/endpoint/windows_winlogon_with_public_network_connection.yml b/detections/endpoint/windows_winlogon_with_public_network_connection.yml index 0db48f3747..1aba5bb21d 100644 --- a/detections/endpoint/windows_winlogon_with_public_network_connection.yml +++ b/detections/endpoint/windows_winlogon_with_public_network_connection.yml @@ -1,7 +1,7 @@ name: Windows WinLogon with Public Network Connection id: 65615b3a-62ea-4d65-bb9f-6f07c17df4ea -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Michael Haag, Splunk status: experimental type: Hunting @@ -15,38 +15,20 @@ description: The following analytic detects instances of Winlogon.exe, a critica bootkit attack. This detection is significant as it highlights potential system integrity breaches. If confirmed malicious, attackers could maintain persistence, bypass security measures, and compromise the system at a fundamental level. -search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name IN (winlogon.exe) Processes.process!=unknown by Processes.action - Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec - Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name - Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name - Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN (winlogon.exe) Processes.process!=unknown + by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join process_id + [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 NOT (All_Traffic.dest IN (127.0.0.1,10.0.0.0/8,172.16.0.0/12, - 192.168.0.0/16, 0:0:0:0:0:0:0:1)) by All_Traffic.action All_Traffic.app All_Traffic.dest - All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc - All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip - All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product - All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest - original_file_name parent_process parent_process_exec parent_process_guid parent_process_id - parent_process_name parent_process_path process process_exec process_guid process_hash - process_id process_integrity_level process_name process_path user user_id vendor_product - app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port - transport | stats values(action) as action values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) - as dest_port values(direction) as direction values(dvc) as dvc values(protocol) - as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) - as src_ip values(src_port) as src_port values(transport) as transport by process_id - | where isnotnull(process_name) AND isnotnull(dest_port) | `windows_winlogon_with_public_network_connection_filter`' + 192.168.0.0/16, 0:0:0:0:0:0:0:1)) by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port + | `drop_dm_object_name(All_Traffic)` | rename dest as publicIp ] | table dest parent_process_name + process_name process_path process process_id dest_port publicIp | `windows_winlogon_with_public_network_connection_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search,