Splunk Search

Looking for processes executions in temp directories with random file names

fdevera
Path Finder

I'm trying to get results which show randomized filenames but it's giving me randomization in the path directory location. I just want to see randomized filenames. Here's what I have so far:

 

 

eventtype=winevent EventCode=4688 (New_Process_Name="C:\\Windows\\TEMP\\*" OR New_Process_Name="C:\\users\\*\\appdata\\local\\temp\\*") NOT New_Process_Name="C:\\Users\\asiaynrf\\AppData\\Local\\Temp\\QIKCache\\*"
| lookup ut_shannon_lookup word as New_Process_Name 
| where ut_shannon > 4.5 
| stats  values(ut_shannon)  as "Shannon Entropy Score" by New_Process_Name,host 
| rename  New_Process_Name as Process,host as Endpoint | sort  -"Shannon Entropy Score"

 

 

 How do I limit randomization to filename and not the whole path?

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

To check the randomization of the filename rather than the whole path, extract the name from the New_Process_Name field.

eventtype=winevent EventCode=4688 (New_Process_Name="C:\\Windows\\TEMP\\*" OR New_Process_Name="C:\\users\\*\\appdata\\local\\temp\\*") NOT New_Process_Name="C:\\Users\\asiaynrf\\AppData\\Local\\Temp\\QIKCache\\*"
| rex field=New_Process_Name "\\\(?<filename>[^\\\]+)$"
| lookup ut_shannon_lookup word as filename
| where ut_shannon > 4.5 
| stats  values(ut_shannon)  as "Shannon Entropy Score" by New_Process_Name,host 
| rename  New_Process_Name as Process,host as Endpoint | sort  -"Shannon Entropy Score"
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

To check the randomization of the filename rather than the whole path, extract the name from the New_Process_Name field.

eventtype=winevent EventCode=4688 (New_Process_Name="C:\\Windows\\TEMP\\*" OR New_Process_Name="C:\\users\\*\\appdata\\local\\temp\\*") NOT New_Process_Name="C:\\Users\\asiaynrf\\AppData\\Local\\Temp\\QIKCache\\*"
| rex field=New_Process_Name "\\\(?<filename>[^\\\]+)$"
| lookup ut_shannon_lookup word as filename
| where ut_shannon > 4.5 
| stats  values(ut_shannon)  as "Shannon Entropy Score" by New_Process_Name,host 
| rename  New_Process_Name as Process,host as Endpoint | sort  -"Shannon Entropy Score"
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!