Try in Splunk Security Cloud

Description

This search looks for command-line arguments that use a /c parameter to execute a command that has not previously been seen.

  • Type: Hunting
  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • Last Updated: 2020-07-21
  • Author: Bhavin Patel, Splunk
  • ID: a1b6e73f-98d5-470f-99ac-77aacd578473

Annotations

ATT&CK
ID Technique Tactic
T1059.001 PowerShell Execution
T1059.003 Windows Command Shell Execution
Kill Chain Phase
  • Command & Control
  • Actions on Objectives
NIST
  • PR.PT
  • DE.CM
  • PR.IP
CIS20
  • CIS 3
  • CIS 8
CVE 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = cmd.exe Processes.process = "* /c *" by Processes.process Processes.process_name Processes.parent_process_name Processes.dest
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| search [
| tstats `security_content_summariesonly` earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = cmd.exe Processes.process = "* /c *" by Processes.process 
| `drop_dm_object_name(Processes)` 
| inputlookup append=t previously_seen_cmd_line_arguments 
| stats min(firstTime) as firstTime, max(lastTime) as lastTime by process 
| outputlookup previously_seen_cmd_line_arguments 
| eval newCmdLineArgument=if(firstTime >= relative_time(now(), "-70m@m"), 1, 0) 
| where newCmdLineArgument=1 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| table process] 
| `first_time_seen_command_line_argument_filter`

Macros

The SPL above uses the following Macros:

Note that first_time_seen_command_line_argument_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Lookups

The SPL above uses the following Lookups:

Required field

  • _time
  • Processes.process_name
  • Processes.process
  • Processes.parent_process_name
  • Processes.dest

How To Implement

You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the “process” field in the Endpoint data model. Please make sure you run the support search “Previously seen command line arguments,”—which creates a lookup file called previously_seen_cmd_line_arguments.csv—a historical baseline of all command-line arguments. You must also validate this list. For the search to do accurate calculation, ensure the search scheduling is the same value as the relative_time evaluation function.

Known False Positives

Legitimate programs can also use command-line arguments to execute. Please verify the command-line arguments to check what command/program is being executed. We recommend customizing the first_time_seen_cmd_line_filter macro to exclude legitimate parent_process_name

Associated Analytic story

RBA

Risk Score Impact Confidence Message
25.0 50 50 tbd

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 5