Detection rules › Splunk
Rare Remote Thread (Sysmon)
Rare remote threads are anomalies within an organization and are normally worth looking at. Although these kinds of detections can be false positive prone, they can be utilized as supporting evidence or as a last resort to detect malicious activity your other detection content may be missing
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Privilege Escalation | T1055 Process Injection |
| Stealth | T1055 Process Injection |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 8 | CreateRemoteThread |
Rule body yaml
id: '9036.12145'
title: Rare Remote Thread
description: 'Rare remote threads are anomalies within an organization and are normally
worth looking at. Although these kinds of detections can be false positive prone,
they can be utilized as supporting evidence or as a last resort to detect malicious
activity your other detection content may be missing. -- Threat Actor Association:
APT10/menuPass, APT35/Phosphorus/Magic Hound, APT43, FIN8 (Syssphinx), Lancefly,
Lazarus, TA413, Traveling Spider, UAC-0057 (GhostWriter), Vice Society, Wizard Spider
- Software Association: 3LOSH, ALPHV/BlackCat, AsyncRAT, Black Basta, Clop, Conti,
Havex, LimeRAT, LOWZERO, Nefilim, Rhysida, Ryuk'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (EventCode=8 OR "Event>ID>8<")
| table _time, host, user event_id, eventtype, parent_*, process, process_*, user,
user_id | bin span=1s | stats values(*) as * by _time, host | eventstats dc(host)
as dc_host dc(process_path) as dc_process by parent_process_path | eventstats dc(parent_process_path)
as dc_parent by process_path | where (dc_host < 3 AND dc_process < 3) OR dc_parent
< 3 '
techniques:
- defense-evasion:process injection
- privilege-escalation:process injection
technique_id:
- T1055
data_category:
- Process use of network
- Windows Sysmon
references:
- https://materials.rangeforce.com/tutorial/2020/06/10/Sysmon-Process-Injection/
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (EventCode=8 OR "Event>ID>8<")
Stage 2: table
| table _time, host, user event_id, eventtype, parent_*, process, process_*, user, user_id
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Stage 5: eventstats
| eventstats dc(host) as dc_host dc(process_path) as dc_process by parent_process_path
Stage 6: eventstats
| eventstats dc(parent_process_path) as dc_parent by process_path
Stage 7: where
| where (dc_host < 3 AND dc_process < 3) OR dc_parent < 3
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
dc_host | lt |
|
dc_parent | lt |
|
dc_process | lt |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | "Event>ID>8<" |