Detection: Detect Remote Access Software Usage FileInfo

Created: 2024-03-06 Last Updated: 2026-10-08 ID: ccad96d7-a48c-4f13-8b9c-9f6a31cba454 Author: Steven Dick, Onur Mustafa Erdogan, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

The following analytic detects the execution of processes with file or code signing attributes from known remote access software within the environment. It leverages Sysmon EventCode 1 data and cross-references a lookup table of remote access utilities such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. This activity is significant as adversaries often use these tools to maintain unauthorized remote access. If confirmed malicious, this could allow attackers to persist in the environment, potentially leading to data exfiltration or further compromise of the network.

Search

 1`sysmon` EventCode=1
 2
 3[
 4  
 5| inputlookup remote_access_software
 6  
 7| search file_info!=""
 8  
 9| rename file_info as Product
10  
11| table Product
12]
13
14
15| stats count min(_time) as firstTime
16              max(_time) as lastTime
17              values(Company) as Company
18              values(Product) as Product
19
20  BY action dest original_file_name
21     parent_process parent_process_exec parent_process_guid
22     parent_process_id parent_process_name parent_process_path
23     process process_exec process_guid
24     process_hash process_id process_integrity_level
25     process_name process_path user
26     user_id vendor_product
27
28
29| lookup local=t remote_access_software file_info as Product OUTPUT app as signature, category, reference, description
30
31
32| `security_content_ctime(firstTime)`
33
34| `security_content_ctime(lastTime)`
35
36
37| `remote_access_software_usage_exceptions`
38
39
40| `detect_remote_access_software_usage_fileinfo_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 1	Windows	`'XmlWinEventLog'`	`'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'`

Macros Used

Name	Value
remote_access_software_usage_exceptions	`eval exception_asset = CASE(isnotnull(src),src,isnotnull(dest),dest)
detect_remote_access_software_usage_fileinfo_filter	`search *`

detect_remote_access_software_usage_fileinfo_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1219	Remote Access Tools	Command and Control

Command and Control

DE.AE

CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	No
Creates Intermediate Finding (Risk Event)	Yes

Anomaly detections generate Intermediate Findings (Risk Events). They do not generate a Finding (Notable) directly.

Implementation

This analytic relies on Sysmon to be properly installed and utilized in the environment. Ensure that proper logging is setup for Sysmon and data is being ingested into Splunk. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection named "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections.

Known False Positives

Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content

Associated Analytic Story

Intermediate Findings

Message	Entity Field	Entity Type	Risk Score
Known remote access software [$signature$] was observed through file attributes of [$process_name$] process on [$dest$] by [$user$].	user	user	20
Known remote access software [$signature$] was observed through file attributes of [$process_name$] process on [$dest$] by [$user$].	dest	system	20

Threat Objects

Field	Type
signature	signature
process_name	process_name

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`	`XmlWinEventLog`
Integration	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`	`XmlWinEventLog`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 17