Anvilogic high experimental spl

Certutil Obfuscate_Encode Files [splunk-edr]

Certutil can be used to encode files to evade defensive measures. -- Threat Actor Association: APT29/Nobelium/Cozy Bear, Arid Viper/APT C-23, BlackTech - Software Association: Conti

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_edr` ((event_type IN ("childproc","netconn","proc")) 
OR (TERM(ProcessRollup2) 
OR Type=Process) 
OR TERM(DeviceProcessEvents)) ("certutil" (TERM(-encode) 
OR TERM(-encodehex))) 
OR (TERM(-encode) 
OR TERM(-encodehex))
| table _time, host, user, signature_id, process, process_*, parent_*
| bin span=1s
| stats values(*) as * by _time, host
| where match(process, "(?i)-encode") `hec_collect`

Field Validations

Loading…

Comments (0)

Loading comments...