Anvilogic high experimental spl

1 or 2 Character Executable [splunk-winevent]

Adversaries have been known to occasionally use executable files named with only 1 or 2 word characters. - Threat Actor Association: Lotus Blossom, OilRig, Trigona, Volt Typhoon

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) 
OR "<EventID>4688<" 
OR Type=Process 
OR TERM(ingress.event.procstart)) NOT "sc.exe"
| where match(parent_process_name, "(?i)^\w{1,2}\.exe") 
OR match(process_name, "(?i)^\w{1,2}\.exe")
| table _time, host, user, signature_id, process, process_*, parent_process_*
| bin span=1s
| stats values(*) as * by _time, host

Field Validations

Loading…

Comments (0)

Loading comments...