Skip to content

Commit 5af5894

Browse files
patel-bhavinpatel-bhavin
authored
Merge pull request #3502 from splunk/deprecate_rmm_hunt
Sebastian Wurl Feedback - Update RMM searches
2 parents a26bfc0 + 7742f51 commit 5af5894

3 files changed

Lines changed: 33 additions & 21 deletions

File tree

detections/endpoint/windows_remote_access_software_hunt.yml renamed to detections/deprecated/windows_remote_access_software_hunt.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
name: Windows Remote Access Software Hunt
22
id: 8bd22c9f-05a2-4db1-b131-29271f28cb0a
3-
version: 7
4-
date: '2025-04-18'
3+
version: 8
4+
date: '2025-04-30'
55
author: Michael Haag, Splunk
6-
status: production
6+
status: deprecated
77
type: Hunting
8-
description: The following analytic identifies the use of remote access software within
8+
description: This search is deprecated in favor of the new detection - Detect Remote Access Software Usage Process. The following analytic identifies the use of remote access software within
99
the environment. It leverages data from Endpoint Detection and Response (EDR) agents,
1010
focusing on process execution logs. This detection is significant as unauthorized
1111
remote access tools can be used by adversaries to maintain persistent access to

‎detections/endpoint/detect_remote_access_software_usage_process.yml‎

Lines changed: 24 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,38 @@
11
name: Detect Remote Access Software Usage Process
22
id: ffd5e001-2e34-48f4-97a2-26dc4bb08178
3-
version: 8
4-
date: '2025-04-18'
5-
author: Steven Dick
3+
version: 9
4+
date: '2025-04-30'
5+
author: Steven Dick, Sebastian Wurl, Splunk Community
66
status: production
77
type: Anomaly
88
description: The following analytic detects the execution of known remote access software
99
within the environment. It leverages data from Endpoint Detection and Response (EDR)
1010
agents, focusing on process names and parent processes mapped to the Endpoint data
11-
model. This activity is significant as adversaries often use remote access tools
12-
like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized access.
11+
model. We then compare with with a list of known remote access software shipped as a lookup file - remote_access_software. This activity is significant as adversaries often use remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized access.
1312
If confirmed malicious, this could allow attackers to control systems remotely,
1413
exfiltrate data, or deploy additional malware, posing a severe threat to the organization's
1514
security.
1615
data_source:
1716
- Sysmon EventID 1
1817
- Windows Event Log Security 4688
1918
- CrowdStrike ProcessRollup2
20-
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
21-
as lastTime values(Processes.parent_process) as parent_process from datamodel=Endpoint.Processes
22-
where Processes.dest!=unknown Processes.process!=unknown by Processes.action Processes.dest
23-
Processes.original_file_name Processes.parent_process Processes.parent_process_exec
24-
Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
25-
Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
26-
Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
27-
Processes.process_path Processes.user Processes.user_id Processes.vendor_product
28-
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)`
29-
| lookup remote_access_software remote_utility AS process_name OUTPUT isutility,
30-
description as signature, comment_reference as desc, category | search isutility
31-
= True | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_process_filter`'
19+
search: |
20+
| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.parent_process) as parent_process
21+
from datamodel=Endpoint.Processes
22+
where
23+
[| inputlookup remote_access_software where isutility=TRUE
24+
| rename remote_utility AS Processes.process_name
25+
| fields Processes.process_name]
26+
AND Processes.dest!="unknown"
27+
AND Processes.user!="unknown"
28+
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
29+
| `security_content_ctime(firstTime)`
30+
| `security_content_ctime(lastTime)`
31+
| `drop_dm_object_name(Processes)`
32+
| lookup remote_access_software remote_utility AS process_name OUTPUT isutility description AS signature comment_reference AS desc category
33+
| search isutility = TRUE
34+
| `remote_access_software_usage_exceptions`
35+
| `detect_remote_access_software_usage_process_filter`
3236
how_to_implement: The detection is based on data that originates from Endpoint Detection
3337
and Response (EDR) agents. These agents are designed to provide security-related
3438
telemetry from the endpoints where the agent is installed. To implement this search,
@@ -107,3 +111,6 @@ tests:
107111
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/screenconnect/screenconnect_sysmon.log
108112
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
109113
sourcetype: XmlWinEventLog
114+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/atomic_red_team/windows-sysmon.log
115+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
116+
sourcetype: XmlWinEventLog

‎removed/deprecation_mapping.YML‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
detections:
2+
- content: Windows Remote Access Software Hunt
3+
removed_in_version: 5.8.0
4+
reason: Detection has been replaced by a new detection with a more specific name and logic
5+
replacement_content:
6+
- Detect Remote Access Software Usage Process
27
- content: CertUtil Download With URLCache and Split Arguments
38
removed_in_version: 5.8.0
49
reason: Detection deprecated in favor of "Windows File Download Via CertUtil", in order to provide a better experience of the alert

0 commit comments

Comments
 (0)