Detection rules › Splunk
Esentutl Execution (Sysmon)
Esentutl is a command-line tool that provides database utilities for the Windows Extensible Storage Engine. This use case looks for esentutl execution or from an executable running common process command line switches used by adversaries
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1564 Hide Artifacts |
| Credential Access | T1003.002 OS Credential Dumping: Security Account Manager, T1003.003 OS Credential Dumping: NTDS |
| Lateral Movement | T1570 Lateral Tool Transfer |
| Command & Control | T1105 Ingress Tool Transfer |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
Rule body yaml
id: '6147.10087'
title: Esentutl Execution
description: 'Esentutl is a command-line tool that provides database utilities for
the Windows Extensible Storage Engine. This use case looks for esentutl execution
or from an executable running common process command line switches used by adversaries.
Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN) Threat Actor Association:
Wizard Spider Software Association: Bazar, Conti, Trickbot Atomics T1003.002 Test
#3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
( "esentutl.exe" OR (".exe" "/y" "/d") OR "esentutl" ) | regex process="(?i)(esentutl|\.exe)\"?\s.*\/y\s.*\/d\s"
| table _time, host, user, signature_id, process, process_*, parent_* | bin span=1s
| stats values(*) as * by _time, host '
techniques:
- command-and-control:ingress tool transfer
- credential-access:os credential dumping:security account manager
- credential-access:os credential dumping:ntds
- lateral-movement:lateral tool transfer
- defense-evasion:hide artifacts
technique_id:
- T1105
- T1003.002
- T1003.003
- T1570
- T1564
data_category:
- Process command-line parameters
- Windows Sysmon
references:
- https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<") ( "esentutl.exe" OR (".exe" "/y" "/d") OR "esentutl" )
Stage 2: regex
| regex process="(?i)(esentutl|\.exe)\"?\s.*\/y\s.*\/d\s"
Stage 3: table
| table _time, host, user, signature_id, process, process_*, parent_*
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>1<" |
| 1 | "esentutl.exe" |
| 1 | ".exe" |
| 1 | "/y" |
| 1 | "/d" |
| 1 | "esentutl" |