Detection: Anomalous usage of Archive Tools

Date: 2021-11-22 ID: 63614a58-10e2-4c6c-ae81-ea1113681439 Author: Patrick Bareiss, Splunk Type: Anomaly Product: Splunk User Behavior Analytics

The following detection identifies the usage of archive tools from the command line.

No annotations available.

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.

False positives can be ligitmate usage of archive tools from the command line.

Associated Analytic Story

Risk Message Risk Score Impact Confidence
An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading of 7zip. 42 70 60
The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Version: 4