Splunk Enterprise Security

First Time Seen Running Windows Service Alert On Splunk Enterprise Security

burakatabay
Path Finder

Hi Splunkers,

We have realized our "First Time Seen Running Windows Service " Correlation search seen below has been giving alot of false positives. This correlation search came with Splunk ES Content Update.

index=wineventlog eventtype=wineventlog_system signature_id=7036 
| rex field=Message "The (?<serviceName>[\w\s-]*) service entered the (?<action>\w*) state" 
| where action="running" 
| inputlookup append=t previously_seen_running_windows_services 
| multireport 
    [| stats earliest(eval(coalesce(_time, firstTime))) as firstTime, latest(eval(coalesce(_time, lastTime))) as lastTime by serviceName 
    | outputlookup previously_seen_running_windows_services 
    | where fact=fiction] 
    [| eventstats earliest(eval(coalesce(_time, firstTime))) as firstTime, latest(eval(coalesce(_time, lastTime))) as lastTime by serviceName 
    | where firstTime >= relative_time(now(), "-60m@m") AND isnotnull(_time) 
    | stats values(dest) as dest by _time, serviceName] 
| table _time, serviceName, dest

After inspecting every hostname with this alert we have come to conclusion that we have actually seen this service before on the hostname. The alarm actually looks only for the last sixty minutes of the hostname. Is this rule intented that way or is there a method to fix and get cleaner positive results ?

We know that any services ran before, and still is running even though the alarm keeps mentioning that the service was seen running for the first time.

Thanks, Regards .

0 Karma

muralimadhavan
Explorer

I think the logic should be tweaked at the end to negate it at the end from the lookup file or It could be done at the beginning also. Am posting to negate it at the end

eventtype=wineventlog_system signature_id=7036
| rex field=Message "The (?[\w\s-]) service entered the (?\w) state" | where action="running" | inputlookup append=t previously_seen_running_windows_services | multireport [| stats earliest(eval(coalesce(_time, firstTime))) as firstTime, latest(eval(coalesce(_time, lastTime))) as lastTime by serviceName | outputlookup previously_seen_running_windows_services | where fact=fiction ] [| eventstats earliest(eval(coalesce(_time, firstTime))) as firstTime, latest(eval(coalesce(_time, lastTime))) as lastTime by serviceName | where firstTime >= relative_time(now(), "-60m@m") AND isnotnull(_time) | stats values(dest) as dest by _time, serviceName] | table _time, serviceName, dest | search NOT [| inputlookup previously_seen_running_windows_services | fields _time, serviceName, dest]

0 Karma

diogofgm
SplunkTrust
SplunkTrust

the CS is using a lookup (previously_seen_running_windows_services) to check the seen services. Every time search runs splunk get this lookup to compare and records whatever he finds new. Its Ok to look just into the last 60 min since every time the search runs you are also calculating the difference from what you have recorded.

Check if the lookup previously_seen_running_windows_services is been properly written into.

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...