Detection: Executables Or Script Creation In Suspicious Path

Description

The following analytic identifies the creation of executables or scripts in suspicious file paths on Windows systems. It leverages the Endpoint.Filesystem data model to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in uncommon directories (e.g., \windows\fonts, \users\public). This activity is significant as adversaries often use these paths to evade detection and maintain persistence. If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.

Search

1
2|tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where (Filesystem.file_name = *.exe OR Filesystem.file_name = *.dll OR Filesystem.file_name = *.sys OR Filesystem.file_name = *.com OR Filesystem.file_name = *.vbs OR Filesystem.file_name = *.vbe OR Filesystem.file_name = *.js OR Filesystem.file_name = *.ps1 OR Filesystem.file_name = *.bat OR Filesystem.file_name = *.cmd OR Filesystem.file_name = *.pif) AND ( Filesystem.file_path = *\\windows\\fonts\\* OR Filesystem.file_path = *\\windows\\temp\\* OR Filesystem.file_path = *\\users\\public\\* OR Filesystem.file_path = *\\windows\\debug\\* OR Filesystem.file_path = *\\Users\\Administrator\\Music\\* OR Filesystem.file_path = *\\Windows\\servicing\\* OR Filesystem.file_path = *\\Users\\Default\\* OR Filesystem.file_path = *Recycle.bin* OR Filesystem.file_path = *\\Windows\\Media\\* OR Filesystem.file_path = *\\Windows\\repair\\* OR Filesystem.file_path = *\\AppData\\Local\\Temp* OR Filesystem.file_path = *\\PerfLogs\\*) by Filesystem.file_create_time Filesystem.process_id  Filesystem.file_name Filesystem.user 
3| `drop_dm_object_name(Filesystem)` 
4| `security_content_ctime(firstTime)` 
5| `security_content_ctime(lastTime)` 
6| `executables_or_script_creation_in_suspicious_path_filter`

Data Source

Name	Platform	Sourcetype	Source	Supported App
Sysmon EventID 11	Windows	'xmlwineventlog'	'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'	N/A

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the Endpoint datamodel in the Filesystem node.

Known False Positives

Administrators may allow creation of script or exe in the paths specified. Filter as needed.

Associated Analytic Story

• AcidPour

• AgentTesla

• Amadey

• AsyncRAT

• Azorult

• BlackByte Ransomware

• Brute Ratel C4

• CISA AA23-347A

• Chaos Ransomware

• DarkCrystal RAT

• DarkGate Malware

• Data Destruction

• Double Zero Destructor

• Graceful Wipe Out Attack

• Handala Wiper

• Hermetic Wiper

• IcedID

• Industroyer2

• LockBit Ransomware

• MoonPeak

• NjRAT

• PlugX

• Qakbot

• RedLine Stealer

• Remcos

• Rhysida Ransomware

• Snake Keylogger

• Swift Slicer

• Trickbot

• Volt Typhoon

• Warzone RAT

• WhisperGate

• XMRig

Risk Based Analytics (RBA)

References

• https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/

• https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/

• https://twitter.com/pr0xylife/status/1590394227758104576

• https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 2