topic Re: suspicious_writes_lookup Threat Intel in Knowledge Management

suspicious_writes_lookup Threat Intel

Scott_Kudelski — Tue, 29 Sep 2020 15:48:37 GMT

Hi All,

First time poster, so not sure if this is the right location.

Looking for a public feed that would updated the "suspicious_writes_lookup". This lookup is used for "ESCU - Suspicious File Write - Rule" but only contains hidden cobra info by default.

Re: suspicious_writes_lookup Threat Intel

rvany — Tue, 29 Sep 2020 16:54:46 GMT

Is this for Enterprise Security? Maybe you get better results if you add the label accordingly.

Re: suspicious_writes_lookup Threat Intel

richgalloway — Tue, 29 Sep 2020 17:01:32 GMT

The notes for that rule say

You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file system reads and writes. In addition, this search leverages an included lookup file that contains the names of the files to watch for, as well as a note to communicate why that file name is being monitored. This lookup file can be edited to add or remove file the file names you want to monitor.

Notice there is no mention of a public feed. All of the data needed for this rule must come from local sources.

Re: suspicious_writes_lookup Threat Intel

Scott_Kudelski — Tue, 29 Sep 2020 17:44:04 GMT

@richgalloway Thanks for the reply.

I had read the notes about this rule. Since the "stub" lookup has information from "Hidden Cobra", I was hoping to find a feed that would have other files for different APTs.

We are currently working to get our own intel into this file, but was looking for more than just our findings.