Detection rules › Splunk
Rename System Utilities (Windows Event Log)
Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth |
References
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Security-Auditing | Event ID 4663: An attempt was made to access an object. |
Rule body
id: '5858.6156'
title: Rename System Utilities
description: 'Adversaries may rename legitimate system utilities to try to evade security
mechanisms concerning the usage of those utilities. - Threat Actor Association:
APT29/Nobelium/Cozy Bear, FIN6, FIN6, Lockean, TA551 - Software Association: IcedID,
Nokoyawa'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4663) OR
"<EventID>4663<") TERM(Execute/Traverse) | rename Object_Name as object_name | table
_time, host, user process, process_*, signature_id, parent_*, object_name | bin
span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:masquerading:rename system utilities
technique_id:
- T1036.003
data_category:
- Windows event logs
references:
- https://blog.talosintelligence.com/2017/06/worldwide-ransomware-variant.html
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4663) OR "<EventID>4663<") TERM(Execute/Traverse)
Stage 2: rename
| rename Object_Name as object_name
Stage 3: table
| table _time, host, user process, process_*, signature_id, parent_*, object_name
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventCode | eq |
| field:"EventID" kind:eq value:"4663" |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "<EventID>4663<" |
| 1 | "Execute/Traverse" |