Knowledge Management

suspicious_writes_lookup Threat Intel

Scott_Kudelski
Explorer

Hi All,

First time poster, so not sure if this is the right location.

 

Looking for a public feed that would updated the "suspicious_writes_lookup".  This lookup is used for "ESCU - Suspicious File Write - Rule" but only contains hidden cobra info by default.

 

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The notes for that rule say 

You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file system reads and writes. In addition, this search leverages an included lookup file that contains the names of the files to watch for, as well as a note to communicate why that file name is being monitored. This lookup file can be edited to add or remove file the file names you want to monitor.

 Notice there is no mention of a public feed.  All of the data needed for this rule must come from local sources.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The notes for that rule say 

You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file system reads and writes. In addition, this search leverages an included lookup file that contains the names of the files to watch for, as well as a note to communicate why that file name is being monitored. This lookup file can be edited to add or remove file the file names you want to monitor.

 Notice there is no mention of a public feed.  All of the data needed for this rule must come from local sources.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Scott_Kudelski
Explorer

@richgalloway  Thanks for the reply.

I had read the notes about this rule.  Since the "stub" lookup has information from "Hidden Cobra", I was hoping to find a feed that would have other files for different APTs. 

We are currently working to get our own intel into this file, but was looking for more than just our findings.

0 Karma

rvany
Communicator

Is this for Enterprise Security? Maybe you get better results if you add the label accordingly.

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!