Try in Splunk Security Cloud

Description

The following analytic identifies a process execution of Windows OS quser.exe tool. This tool is being abused or used by several post exploitation tool such as winpeas that being used by ransomware prestige to display or gather information about user sessions on a Remote Desktop Session Host server. This command can find out if a specific user is logged on to a specific Remote Desktop Session Host server. This tool can retrieve some RDP information that can be use by attacker for further attack like Name of the user , Name of the session on the Remote Desktop Session Host server, Session ID, State of the session (active or disconnected), Idle time (the number of minutes since the last keystroke or mouse movement at the session) and Date and time the user logged on.

  • Type: Hunting
  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • Last Updated: 2022-11-30
  • Author: Teoderick Contreras, Splunk
  • ID: 0c3f3e09-e47a-410e-856f-a02a5c5fafb0

Annotations

ATT&CK

ATT&CK

ID Technique Tactic
T1033 System Owner/User Discovery Discovery
Kill Chain Phase
  • Exploitation
NIST
  • DE.AE
CIS20
  • CIS 10
CVE 


1
2
3
4
5
6



| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="quser.exe" OR Processes.original_file_name = "quser.exe" by Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `windows_system_user_discovery_via_quser_filter`

Macros

The SPL above uses the following Macros:

:information_source: windows_system_user_discovery_via_quser_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

  • _time
  • Processes.dest
  • Processes.user
  • Processes.parent_process_name
  • Processes.parent_process
  • Processes.original_file_name
  • Processes.process_name
  • Processes.process
  • Processes.process_id
  • Processes.parent_process_path
  • Processes.process_path
  • Processes.parent_process_id
  • Processes.parent_process_guid
  • Processes.process_guid

How To Implement

To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of wermgr.exe may be used.

Known False Positives

network administrator can use this command tool to audit RDP access of user in specific network or host.

Associated Analytic Story

RBA

Risk Score Impact Confidence Message
9.0 30 30 execution of process $process_name$ in $dest$

:information_source: The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1