Techniques
Sample rules
Windows NirSoft Utilities
- source: splunk
- technicques:
Description
The following analytic identifies the execution of commonly used NirSoft utilities on Windows systems. This activity is significant for a SOC because NirSoft utilities, while legitimate, can be used by adversaries for malicious purposes like credential theft or system reconnaissance. If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or further system compromise. Note that this search does not use a where clause to filter out known benign paths, as NirSoft utilities can be executed from various locations. This might hinder performance in environments with high data volumes. Apply additional filtering as necessary to enhance this.
Detection logic
| tstats `security_content_summariesonly`
count min(_time) as firstTime
max(_time) as lastTime
FROM datamodel=Endpoint.Processes WHERE
Processes.original_file_name = "*.exe"
BY Processes.action Processes.dest Processes.original_file_name Processes.parent_process
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
Processes.parent_process_name Processes.parent_process_path Processes.process
Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id
Processes.process_integrity_level Processes.process_name Processes.process_path
Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name("Processes")`
| search [
| inputlookup nirsoft_utilities_lookup
| search original_file_name=*.exe
| table original_file_name
]
| lookup local=t nirsoft_utilities_lookup original_file_name OUTPUT description
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_nirsoft_utilities_filter`