Try in Splunk Security Cloud

Description

The following analytic requires the use of PowerShell inputs to run Get-WebGlobalModule to list out all the IIS Modules installed. The output is a list of Module names and the Image path of the DLL.

  • Type: Hunting

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud

  • Last Updated: 2022-12-20
  • Author: Michael Haag, Splunk
  • ID: 20db5f70-34b4-4e83-8926-fa26119de173

Annotations

ATT&CK

ATT&CK

ID Technique Tactic
T1505.004 IIS Components Persistence
T1505 Server Software Component Persistence
Kill Chain Phase
  • Installation
NIST
  • DE.AE
CIS20
  • CIS 10
CVE 


1
2
3
4
5
6



`iis_get_webglobalmodule` 
| stats count min(_time) as firstTime max(_time) as lastTime by host name image 
| rename host as dest 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `windows_iis_components_get_webglobalmodule_module_query_filter`

Macros

The SPL above uses the following Macros:

:information_source: windows_iis_components_get-webglobalmodule_module_query_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

  • _time
  • host
  • name
  • image

How To Implement

You must ingest the PwSh cmdlet Get-WebGlobalModule in order to utilize this analytic. Follow https://gist.github.com/MHaggis/64396dfd9fc3734e1d1901a8f2f07040

Known False Positives

This analytic is meant to assist with hunting modules across a fleet of IIS servers. Filter and modify as needed.

Associated Analytic Story

RBA

Risk Score Impact Confidence Message
1.0 10 10 IIS Modules have been listed on $dest$.

:information_source: The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1