Detection rules › Splunk
Access Common Package Config file (Windows Event Log)
Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. An Adversary with access could identify or modify configuration of packages in order to execute code and evade defenses.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | |
| Privilege Escalation |
References
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule body
id: '5986.6347'
title: Access Common Package Config file
description: 'Adversaries may establish persistence and/or elevate privileges using
system mechanisms that trigger execution based on specific events. An Adversary
with access could identify or modify configuration of packages in order to execute
code and evade defenses. '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
"<EventID>4688<") (TERM(vi) OR TERM(vim) OR TERM(nano) OR TERM(visudo) OR TERM(edit)
OR (TERM(copy) TERM(con)) OR TERM(cat) OR TERM(more) OR TERM(gc) OR TERM(get-Content)
OR ">>" OR ">") ("requirements.txt" OR "pip.conf" OR "package.json" OR "gemspec"
OR "gemrc") | regex process="(?i)(vi|vim|nano|visudo|edit|copy\s+con|cat|more|gc|get-content|type|\>\>|\>)\s+.+(requirements\.txt|pip\.conf|package.json|\.gemspec|gemrc)"
| table _time, host, user, process, process_*, parent_*, signature_id | bin span=1s
| stats values(*) as * by _time, host '
techniques:
- persistence:event triggered execution
- privilege-escalation:event triggered execution
technique_id:
- T1546
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<") (TERM(vi) OR TERM(vim) OR TERM(nano) OR TERM(visudo) OR TERM(edit) OR (TERM(copy) TERM(con)) OR TERM(cat) OR TERM(more) OR TERM(gc) OR TERM(get-Content) OR ">>" OR ">") ("requirements.txt" OR "pip.conf" OR "package.json" OR "gemspec" OR "gemrc")
Stage 2: regex
| regex process="(?i)(vi|vim|nano|visudo|edit|copy\s+con|cat|more|gc|get-content|type|\>\>|\>)\s+.+(requirements\.txt|pip\.conf|package.json|\.gemspec|gemrc)"
Stage 3: table
| table _time, host, user, process, process_*, parent_*, signature_id
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventCode | eq |
| field:"EventID" kind:eq value:"4688" |
process | regex_match |
| field:"CommandLine" kind:regex_match |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "<EventID>4688<" |
| 1 | vi |
| 1 | vim |
| 1 | nano |
| 1 | visudo |
| 1 | edit |
| 1 | copy |
| 1 | con |
| 1 | cat |
| 1 | more |
| 1 | gc |
| 1 | "get-Content" |
| 1 | ">>" |
| 1 | ">" |
| 1 | "requirements.txt" |
| 1 | "pip.conf" |
| 1 | "package.json" |
| 1 | "gemspec" |
| 1 | "gemrc" |