Anvilogic medium experimental spl
Process Executed from Downloads Folder - Windows [splunk-winevent]
This use case detects the execution of executable files (.exe) that originate from the Downloads folder of any user profile on a system. This technique is commonly used by threat actors who leverage social engineering or phishing campaigns to trick users into downloading and executing malicious software, which can then be used for a variety of malicious purposes such as gaining unauthorized access, data exfiltration, or delivering additional payloads.
Detection Logic
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688)
OR "EventID>4688<"
OR Type=Process) "C:\\Users\\*\\Downloads\\*"
| regex process_path="(?i)C:\x5cUsers\x5c.+\x5cDownloads\x5c.+\.exe"
| table _time, host, user, process, process_*, parent_process*
| bin span=1s
| stats values(*) as * by _time, host, process_pathField Validations
Loading…
Comments (0)
Loading comments...