Try in Splunk Security Cloud

Description

This search looks for processes launched from files that have double extensions in the file name. This is typically done to obscure the "real" file extension and make it appear as though the file being accessed is a data file, as opposed to executable content.

  • Type: TTP
  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • Last Updated: 2020-11-18
  • Author: Rico Valdez, Teoderick Contreras, Splunk
  • ID: b06a555e-dce0-417d-a2eb-28a5d8d66ef7

Annotations

ATT&CK

ATT&CK

ID Technique Tactic
T1036 Masquerading Defense Evasion
T1036.003 Rename System Utilities Defense Evasion
Kill Chain Phase
  • Exploitation
NIST
  • DE.CM
CIS20
  • CIS 10
CVE 


1
2
3
4
5
6



| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*.doc.exe", "*.xls.exe","*.ppt.exe", "*.htm.exe", "*.html.exe", "*.txt.exe", "*.pdf.exe", "*.docx.exe", "*.xlsx.exe", "*.pptx.exe","*.one.exe", "*.bat.exe", "*rtf.exe") by Processes.dest Processes.user Processes.process Processes.parent_process 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `drop_dm_object_name(Processes)` 
| `execution_of_file_with_multiple_extensions_filter`

Macros

The SPL above uses the following Macros:

:information_source: execution_of_file_with_multiple_extensions_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

  • _time
  • Processes.process
  • Processes.dest
  • Processes.user
  • Processes.parent_process

How To Implement

To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node.

Known False Positives

None identified.

Associated Analytic Story

RBA

Risk Score Impact Confidence Message
56.0 80 70 process $process$ have double extensions in the file name is executed on $dest$ by $user$

:information_source: The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 3