Name:Executables Or Script Creation In Suspicious Path id:a7e3f0f0-ae42-11eb-b245-acde48001122 version:5 date:2024-11-28 author:Teoderick Contreras, Splunk status:production type:Anomaly Description:The following analytic identifies the creation of executables or scripts in suspicious file paths on Windows systems. It leverages the Endpoint.Filesystem data model to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in uncommon directories (e.g., \windows\fonts\, \users\public\). This activity is significant as adversaries often use these paths to evade detection and maintain persistence. If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat. Data_source:
-Sysmon EventID 11
search:| tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.ps1", "*.bat", "*.cmd", "*.pif") AND Filesystem.file_path IN ("*\\windows\\fonts\\*", "*\\windows\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", "*\\Windows\\repair\\*", "*\\AppData\\Local\\Temp*", "*\\PerfLogs\\*", "*:\\temp\\*") by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `executables_or_script_creation_in_suspicious_path_filter`
how_to_implement:To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. known_false_positives:Administrators may allow creation of script or exe in the paths specified. Filter as needed. References: -https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -https://twitter.com/pr0xylife/status/1590394227758104576 -https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ drilldown_searches: name:'View the detection results for - "$user$"' search:'%original_detection_search% | search user = "$user$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$user$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' tags: analytic_story: - 'Double Zero Destructor' - 'Graceful Wipe Out Attack' - 'AsyncRAT' - 'WhisperGate' - 'DarkGate Malware' - 'AgentTesla' - 'Brute Ratel C4' - 'NjRAT' - 'RedLine Stealer' - 'Rhysida Ransomware' - 'Swift Slicer' - 'IcedID' - 'DarkCrystal RAT' - 'Chaos Ransomware' - 'PlugX' - 'Industroyer2' - 'Azorult' - 'Remcos' - 'XMRig' - 'Qakbot' - 'Volt Typhoon' - 'Hermetic Wiper' - 'Warzone RAT' - 'Trickbot' - 'Amadey' - 'BlackByte Ransomware' - 'LockBit Ransomware' - 'CISA AA23-347A' - 'Data Destruction' - 'Snake Keylogger' - 'AcidPour' - 'Handala Wiper' - 'MoonPeak' - 'ValleyRAT' - 'Meduza Stealer' asset_type:Endpoint confidence:50 impact:40 message:Suspicious executable or scripts with file name $file_name$, $file_path$ and process_id $process_id$ executed in suspicious file path in Windows by $user$ mitre_attack_id: - 'T1036' observable: name:'user' type:'User' - role: - 'Victim' name:'file_name' type:'File Name' - role: - 'Attacker' product: - 'Splunk Enterprise' - 'Splunk Enterprise Security' - 'Splunk Cloud' required_fields: - '_time' - 'Filesystem.file_path' - 'Filesystem.file_create_time' - 'Filesystem.process_id' - 'Filesystem.file_name' - 'Filesystem.user' risk_score:20 security_domain:endpoint
