Anvilogic medium experimental spl

File Execution (Unix) [splunk-unix]

Detect when a file has been executed -- Threat Actor Association: TeamTNT, Winnti Group - Software Association: Mélofée, Ransom Cartel -- Atomics T1548.003 Test#1 Atomics T1548.003 Test#2

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_unix` (type=execve 
OR type=proctitle 
OR sourcetype=bash_history) 
AND ("./" 
OR "/") 
AND NOT ("/usr/bin/" 
OR "/bin/" 
OR "/sbin/" 
OR "/usr/libexec/")
| rex field=_raw "(?i)proctitle\=(?<command_type>\.\/.+)"
| eval process=mvappend(process, command_type)
| regex process="^(\.)?\/.+"
| table _time, host, user process
| bin span=300s
| stats values(*) as * by _time, host,process
| eventstats dc(host) as dc_host, c(process) as c_process by process
| where dc_host=1 and c_process<3

Field Validations

Loading…

Comments (0)

Loading comments...