Techniques
Sample rules
Suspicious Process Executed From Container File
- source: splunk
- technicques:
Description
The following analytic identifies a suspicious process executed from within common container/archive file types such as ZIP, ISO, IMG, and others. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it is a common technique used by adversaries to execute scripts or evade defenses. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or persist within the environment, posing a significant security risk.
Detection logic
| tstats `security_content_summariesonly`
count
min(_time) as firstTime
max(_time) as lastTime
from datamodel=Endpoint.Processes
where Processes.process IN (
"*.ZIP\\*",
"*.ISO\\*",
"*.IMG\\*",
"*.CAB\\*",
"*.TAR\\*",
"*.GZ\\*",
"*.RAR\\*",
"*.7Z\\*"
)
AND Processes.action="allowed"
by
Processes.action
Processes.dest
Processes.original_file_name
Processes.parent_process
Processes.parent_process_exec
Processes.parent_process_guid
Processes.parent_process_id
Processes.parent_process_name
Processes.parent_process_path
Processes.process
Processes.process_exec
Processes.process_guid
Processes.process_hash
Processes.process_id
Processes.process_integrity_level
Processes.process_name
Processes.process_path
Processes.user
Processes.user_id
Processes.vendor_product
| `drop_dm_object_name(Processes)`
| regex process="(?i).*\.(zip
|iso
|img
|cab
|tar
|gz
|rar
|7z)\\\\.+\.(bat
|bin
|cab
|cmd
|com
|cpl
|ex_
|exe
|gadget
|inf1
|ins
|inx
|htm
|html
|isu
|jar
|job
|js
|jse
|lnk
|msc
|msi
|msp
|mst
|paf
|pif
|ps1
|reg
|rgs
|scr
|sct
|shb
|shs
|u3p
|vb
|vbe
|vbs
|vbscript
|ws
|wsf
|wsh)\"?$"
| rex field=process "(?i).+\\\\(?<file_name>[^\\\\]+\.(?:zip
|iso
|img
|cab
|tar
|gz
|rar
|7z))\\\\(?:.+\\\\)?(?<container_file_name>[^\\\\\"]+\.(?:bat
|bin
|cab
|cmd
|com
|cpl
|ex_
|exe
|gadget
|inf1
|ins
|inx
|htm
|html
|isu
|jar
|job
|js
|jse
|lnk
|msc
|msi
|msp
|mst
|paf
|pif
|ps1
|reg
|rgs
|scr
|sct
|shb
|shs
|u3p
|vb
|vbe
|vbs
|vbscript
|ws
|wsf
|wsh))\"?$"
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `suspicious_process_executed_from_container_file_filter`