Please help me in tuning this search..

[AL3Z]

Hi,

Could anyone please help me in fine tuning this search as it is raising lot of alerts

| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wmiprvse.exe OR Processes.parent_process_name=services.exe OR Processes.parent_process_name=svchost.exe OR Processes.parent_process_name=wsmprovhost.exe OR Processes.parent_process_name=mmc.exe) (Processes.process_name=powershell.exe OR (Processes.process_name=cmd.exe AND Processes.process=*powershell.exe*) OR Processes.process_name=pwsh.exe OR (Processes.process_name=cmd.exe AND Processes.process=*pwsh.exe*)) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
| rename Processes.* as *
| eval firstTime = strftime(firstTime, "%F %T")
| eval lastTime = strftime(lastTime, "%F %T")

thanks

[richgalloway]

What do you want from the alert?  What problem are you trying to solve?  Once we know the objective we can help you tune the alert.

As it stands now, the alert is triggered for every PowerShell or command line process, anything launched by one of those processes, or any service.  That's a lot of processes, not all of which are interesting.

[AL3Z]

@richgalloway 

This is to identify possible lateral movement attacks that involve the spawning of a PowerShell process as a child or grandchild process of commonly abused processes. These processes include services.exe, wmiprsve.exe, svchost.exe, wsmprovhost.exe, and mmc.exe.

Such behavior is indicative of legitimate Windows features such as the Service Control Manager, Windows Management Instrumentation, Task Scheduler, Windows Remote Management, and the DCOM protocol being abused to start a process on a remote endpoint. This behavior is often seen during lateral movement techniques where adversaries or red teams abuse these services for lateral movement and remote code execution.

thanks

[richgalloway]

I'm not familiar enough with Windows to discuss lateral movement on that platform.  I believe, however, the first step should be filtering out known-good events.

Also, Splunk's User Behavior Analytics (UBA) product may be useful for this.

[AL3Z]

@richgalloway ,

Can you pls share the possible search from your side if possible !

[richgalloway]

I have no search to share.