Detection: Executables Or Script Creation In Temp Path

Description

The following analytic identifies the creation of executables or scripts in temporary file paths on Windows systems. It leverages the Endpoint.Filesystem data set to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in temporary directories (e.g., \windows\Temp, \AppData\Local\Temp). This activity can be significant as adversaries often use these paths to evade detection and maintain persistence. If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.

Search

 1
 2| tstats `security_content_summariesonly`
 3  count min(_time) as firstTime
 4        max(_time) as lastTime
 5
 6from datamodel=Endpoint.Filesystem where
 7
 8Filesystem.action="created"
 9Filesystem.file_name IN (
10  "*.bat",
11  "*.cmd",
12  "*.com",
13  "*.dll",
14  "*.exe",
15  "*.js",
16  "*.msc",
17  "*.pif",
18  "*.ps1",
19  "*.sys",
20  "*.vbe",
21  "*.vbs"
22)
23Filesystem.file_path IN (
24  "*:\\Temp\\*",
25  "*:\\Windows\\Temp\\*",
26  "*\\AppData\\Local\\Temp\\*",
27)
28NOT Filesystem.file_path IN (
29  "*\\__PSScriptPolicyTest_*",
30)
31by Filesystem.action Filesystem.dest Filesystem.file_access_time
32   Filesystem.file_create_time Filesystem.file_hash
33   Filesystem.file_modify_time Filesystem.file_name
34   Filesystem.file_path Filesystem.file_acl Filesystem.file_size
35   Filesystem.process_guid Filesystem.process_id Filesystem.user
36   Filesystem.vendor_product
37
38| `drop_dm_object_name(Filesystem)`
39
40| `security_content_ctime(firstTime)`
41
42| `security_content_ctime(lastTime)`
43
44| `executables_or_script_creation_in_temp_path_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 11	Windows	'XmlWinEventLog'	'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the Endpoint datamodel in the Filesystem node.

Known False Positives

Executable creation and certain script extensions in temporary paths can very common in certain environments and legitimate use cases. It is important to review and filter these events based on your organization's normal activity and policies.

Associated Analytic Story

• APT37 Rustonotto and FadeStealer

• AcidPour

• AgentTesla

• Amadey

• AsyncRAT

• Azorult

• BlackByte Ransomware

• Brute Ratel C4

• CISA AA23-347A

• Chaos Ransomware

• China-Nexus Threat Activity

• Crypto Stealer

• DarkCrystal RAT

• DarkGate Malware

• Data Destruction

• Derusbi

• Double Zero Destructor

• Graceful Wipe Out Attack

• Handala Wiper

• Hermetic Wiper

• IcedID

• Industroyer2

• Interlock Rat

• LockBit Ransomware

• Lokibot

• Meduza Stealer

• MoonPeak

• NjRAT

• PlugX

• PromptFlux

• PromptLock

• Qakbot

• RedLine Stealer

• Remcos

• Rhysida Ransomware

• Salt Typhoon

• SesameOp

• Snake Keylogger

• SnappyBee

• Swift Slicer

• Trickbot

• ValleyRAT

• Volt Typhoon

• Warzone RAT

• WhisperGate

• WinDealer RAT

• XML Runner Loader

• XMRig

Risk Based Analytics (RBA)

Risk Message:

Executable or script with file name $file_name$ located $file_path$ and process_id $process_id$ was created in temporary folder by $user$

References

• https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/

• https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/

• https://twitter.com/pr0xylife/status/1590394227758104576

• https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 19