Techniques
Sample rules
Detect Rare Executables
- source: splunk
- technicques:
- T1204
Description
The following analytic detects the occurrence of rare processes that appear only once across the network within a specified timeframe. It operates by compiling a list of process executions. This detection is crucial for a Security Operations Center (SOC) as it helps in identifying potentially malicious activities or unauthorized software that could indicate a security breach or an ongoing attack. Identifying such rare processes allows for early detection of threats, minimizing the potential impact of an attack which could range from data theft to complete system compromise.
Detection logic
| tstats `security_content_summariesonly` dc(Processes.dest) as dc_dest values(Processes.dest) as dest values(Processes.user) as user min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.process_name
| `drop_dm_object_name(Processes)`
| search dc_dest < 10
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `detect_rare_executables_filter`