Detection: Executables Or Script Creation In Suspicious Path

Description

The following analytic identifies the creation of executables or scripts in suspicious file paths on Windows systems. It leverages the Endpoint.Filesystem dataset to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in uncommon directories (e.g., \windows\fonts, \users\public). This activity can be significant as adversaries often use these paths to evade detection and maintain persistence. If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.

Search

 1
 2| tstats `security_content_summariesonly`
 3  count min(_time) as firstTime
 4        max(_time) as lastTime
 5
 6from datamodel=Endpoint.Filesystem where
 7
 8Filesystem.file_name IN (
 9  "*.bat",
10  "*.cmd",
11  "*.com",
12  "*.dll",
13  "*.exe",
14  "*.js",
15  "*.msc",
16  "*.pif",
17  "*.ps1",
18  "*.sys",
19  "*.vbe",
20  "*.vbs"
21)
22Filesystem.file_path IN (
23  "*\\PerfLogs\\*",
24  "*\\Users\\Administrator\\Music\\*",
25  "*\\Users\\Default\\*",
26  "*\\Users\\Public\\*",
27  "*\\Windows\\debug\\*",
28  "*\\Windows\\fonts\\*",
29  "*\\Windows\\Media\\*",
30  "*\\Windows\\repair\\*",
31  "*\\Windows\\servicing\\*",
32  "*Recycle.bin*",
33)
34
35by Filesystem.action Filesystem.dest Filesystem.file_access_time
36   Filesystem.file_create_time Filesystem.file_hash
37   Filesystem.file_modify_time Filesystem.file_name
38   Filesystem.file_path Filesystem.file_acl Filesystem.file_size
39   Filesystem.process_guid Filesystem.process_id Filesystem.user
40   Filesystem.vendor_product
41
42| `drop_dm_object_name(Filesystem)`
43
44| `security_content_ctime(firstTime)`
45
46| `security_content_ctime(lastTime)`
47
48| `executables_or_script_creation_in_suspicious_path_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 11	Windows	'XmlWinEventLog'	'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the Endpoint datamodel in the Filesystem node.

Known False Positives

Some false positives may arise from paths like Recycle.bin and \Users\Public. Other than that executable creation and certain script extensions in these suspicious paths should be less common.

Associated Analytic Story

• AcidPour

• AgentTesla

• Amadey

• AsyncRAT

• Azorult

• BlackByte Ransomware

• Brute Ratel C4

• CISA AA23-347A

• Cactus Ransomware

• Castle RAT

• Chaos Ransomware

• China-Nexus Threat Activity

• Crypto Stealer

• DarkCrystal RAT

• DarkGate Malware

• Data Destruction

• Derusbi

• Double Zero Destructor

• Earth Alux

• GhostRedirector IIS Module and Rungan Backdoor

• Graceful Wipe Out Attack

• Handala Wiper

• Hermetic Wiper

• IcedID

• Industroyer2

• Interlock Ransomware

• Interlock Rat

• LockBit Ransomware

• Lokibot

• Meduza Stealer

• MoonPeak

• NailaoLocker Ransomware

• NjRAT

• PlugX

• PromptLock

• Qakbot

• Quasar RAT

• RedLine Stealer

• Remcos

• Rhysida Ransomware

• Salt Typhoon

• SesameOp

• Snake Keylogger

• SnappyBee

• Swift Slicer

• SystemBC

• Trickbot

• ValleyRAT

• Volt Typhoon

• Warzone RAT

• WhisperGate

• WinDealer RAT

• XMRig

Risk Based Analytics (RBA)

Risk Message:

Suspicious executable or scripts with file name $file_name$, $file_path$ and process_id $process_id$ executed in suspicious file path in Windows by $user$

References

• https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/

• https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/

• https://twitter.com/pr0xylife/status/1590394227758104576

• https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 22