false positives may be present if a suspicious processname is similar to a benign processname.

Techniques

T1059

Sample rules

Detect suspicious processnames using pretrained model in DSDL

source: splunk
technicques:
- T1059

Description

The following analytic identifies suspicious process names using a pre-trained Deep Learning model. It leverages Endpoint Detection and Response (EDR) telemetry to analyze process names and predict their likelihood of being malicious. The model, a character-level Recurrent Neural Network (RNN), classifies process names as benign or suspicious based on a threshold score of 0.5. This detection is significant as it helps identify malware, such as TrickBot, which often uses randomly generated filenames to evade detection. If confirmed malicious, this activity could indicate the presence of malware capable of propagating across the network and executing harmful actions.

Detection logic


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
  BY Processes.action Processes.dest Processes.original_file_name
     Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
     Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
     Processes.process Processes.process_exec Processes.process_guid
     Processes.process_hash Processes.process_id Processes.process_integrity_level
     Processes.process_name Processes.process_path Processes.user
     Processes.user_id Processes.vendor_product

| `drop_dm_object_name(Processes)`

| rename process_name as text

| fields text, parent_process_name, process, user, dest

| apply detect_suspicious_processnames_using_pretrained_model_in_dsdl

| rename predicted_label as is_suspicious_score

| rename text as process_name

| where is_suspicious_score > 0.5

| `detect_suspicious_processnames_using_pretrained_model_in_dsdl_filter`