Suspicious File written to Disk [splunk-winevent]
Adversaries may transfer tools or other files from an external system into a compromised environment. As seen with Solorigate when backdoor activates, the executing process (usually SolarWinds.BusinessLayerHost.exe) creates two files on disk. This use case looks for when dlls or vbs files added to Disk. -- Threat Actor Association: APT29/Nobelium/Cozy Bear, APT31, APT34/OilRig, APT41, FIN7, Gamaredon (aka. Armageddon, UAC-0010), Gorgon Group, Harvester, Lazarus, Night Spider, TA413, TA551, Turla (akaSecret Blizzard, KRYPTON, and UAC-0003), UNC2465, Wizard Spider -- Software Association: ALPHV/BlackCat, Bazar, Black Basta, Clop, DirtyMoe, Dridex, Hive, IcedID, LOWZERO, PowerShortShell, Quantum, Qakbot/Qbot, RATDispenser, Remcos, Royal, Ryuk, SmokedHAM, Soul, VawTrak, Vidar Stealer, XingLocker
Detection Logic
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4656)
OR "<EventID>4656<") (TERM(dll)
OR TERM(vbs)) NOT DELETE
| regex Object_Name="(?i)\.(dll
| vbs)"
| rename Object_Name as file_path
| table _time, host, user, event_id, file_path, process_name, process_path, signature_id
| bin span=60s
| stats values(*) as * by _time, host
| eventstats dc(file_path) as dc_file_path by process_name
| where dc_file_path < 3 and event_count < 4Field Validations
Loading…
Comments (0)
Loading comments...