This analytic identifies excessive usage of
net1.exe within a bucket of time (1 minute). This behavior was seen in a Monero incident where the adversary attempts to create many users, delete and disable users as part of its malicious behavior.
- Type: Anomaly
- Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- Datamodel: Endpoint
- Last Updated: 2021-05-06
- Author: Teoderick Contreras, Splunk
- ID: 45e52536-ae42-11eb-b5c6-acde48001122
|T1531||Account Access Removal||Impact|
| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` by Processes.process_name Processes.parent_process_name Processes.original_file_name Processes.dest Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_net_app_filter`
Associated Analytic Story
How To Implement
To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the
Endpoint datamodel in the
Processes node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
Kill Chain Phase
Known False Positives
unknown. Filter as needed. Modify the time span as needed.
|28.0||40||70||Excessive usage of net1.exe or net.exe within 1m, with command line $process$ has been detected on $dest$ by $user$|
source | version: 2