New Path for a Common Filename with Process Launch not working

[jwalzerpitt]

I'm using the New Path for a Common Filename with Process Launch search with Sysmon files and the outliers it finds are file names that run from the directory they should be running from, i.e., explorer.exe from c:\Windows, iexplore.exe from C:\Program Files (x86)\Internet Explorer\ , Firefox from C:\Program Files\Mozilla Firefox\ and so on.

The search is as follows:

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 | search Image=*svchost.exe OR Image=*iexplore.exe OR Image=*cmd.exe OR Image=*firefox.exe OR Image=*explorer.exe | rex field=Image "^(?<path>.*?)(?<filename>[^\\\/]*)$" | stats earliest(_time) as earliest latest(_time) as latest  by filename, path, host | eventstats max(latest) as maxlatest | eval isOutlier=if(earliest >= relative_time(maxlatest, "-1d@d"), 1, 0) | table "filename" "path", host, earliest, latest, maxlatest, isOutlier | convert ctime(earliest) ctime(latest) ctime(maxlatest) | where isOutlier=1

Any ideas as to why the search is producing events that should be ignored?

Thx

[David]

Apologies for the delay in answering this! The design of this search is to look at the path and determine if the earliest time this path was seen was within the last day. It assumes that you're searching for a longer period of time (frequently 30 days or more). If you wanted to adapt this technique without the behavioral element of the search, you could manually exclude the acceptable paths as well -- we have examples of this technique being applied in Splunk Security Essentials 2.0, as well.