:warning: THIS IS A EXPERIMENTAL DETECTION

This detection has been marked experimental by the Splunk Threat Research team. This means we have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is NOT supported.

Try in Splunk Security Cloud

Description

This search looks for execution of process outlook.exe where the process is writing a .zip file to the disk.

  • Type: TTP
  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • Last Updated: 2023-2-07
  • Author: Bhavin Patel, Splunk
  • ID: a51bfe1a-94f0-4822-b1e4-16ae10145893

Annotations

ATT&CK

ATT&CK

ID Technique Tactic
T1566 Phishing Initial Access
T1566.001 Spearphishing Attachment Initial Access
Kill Chain Phase
  • Delivery
NIST
  • DE.CM
CIS20
  • CIS 13
CVE 


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17



| tstats `security_content_summariesonly`  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe by _time span=5m Processes.parent_process_id Processes.process_id Processes.dest Processes.process_name Processes.parent_process_name Processes.user 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| rename process_id as malicious_id
| rename parent_process_id as outlook_id
| join malicious_id type=inner[
| tstats `security_content_summariesonly` count values(Filesystem.file_path) as file_path values(Filesystem.file_name) as file_name  FROM datamodel=Endpoint.Filesystem where (Filesystem.file_path=*.zip*   OR Filesystem.file_name=*.lnk ) AND (Filesystem.file_path=C:\\Users* OR Filesystem.file_path=*Local\\Temp*) by  _time span=5m Filesystem.process_id Filesystem.file_hash Filesystem.dest  
| `drop_dm_object_name(Filesystem)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| rename process_id as malicious_id
| fields malicious_id outlook_id dest file_path file_name file_hash count file_id] 
| table firstTime lastTime user malicious_id outlook_id process_name parent_process_name file_name  file_path 
| where file_name != "" 
| `detect_outlook_exe_writing_a_zip_file_filter`

Macros

The SPL above uses the following Macros:

:information_source: detect_outlook_exe_writing_a_zip_file_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

  • _time
  • Processes.process_name
  • Processes.parent_process_id
  • Processes.process_id
  • Processes.dest
  • Processes.parent_process_name
  • Processes.user

How To Implement

You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon.

Known False Positives

It is not uncommon for outlook to write legitimate zip files to the disk.

Associated Analytic Story

RBA

Risk Score Impact Confidence Message
25.0 50 50 tbd

:information_source: The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 4