Suspicious process pdo pak что это

Suspicious Process File Path

This analytic identifies a suspicious processes running in file paths that are not typically associated with legitimate software. Adversaries often employ this technique to drop and execute malicious executables in accessible locations that do not require administrative privileges. By monitoring for processes running in such unconventional file paths, we can identify potential indicators of compromise and proactively respond to malicious activity. This analytic plays a crucial role in enhancing system security by pinpointing suspicious behaviors commonly associated with malware and unauthorized software execution.

• Type: TTP
• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
• Datamodel: Endpoint
• Last Updated: 2023-06-13
• Author: Teoderick Contreras, Splunk
• ID: 9be25988-ad82-11eb-a14f-acde48001122

Annotations

ATT&CK

Kill Chain Phase

• Installation
• Exploitation

Search

 
1 2 3 4 5 6
| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_path = "*\\windows\\fonts\\*" OR Processes.process_path = "*\\windows\\temp\\*" OR Processes.process_path = "*\\users\\public\\*" OR Processes.process_path = "*\\windows\\debug\\*" OR Processes.process_path = "*\\Users\\Administrator\\Music\\*" OR Processes.process_path = "*\\Windows\\servicing\\*" OR Processes.process_path = "*\\Users\\Default\\*" OR Processes.process_path = "*Recycle.bin*" OR Processes.process_path = "*\\Windows\\Media\\*" OR Processes.process_path = "\\Windows\\repair\\*" OR Processes.process_path = "*\\temp\\*" OR Processes.process_path = "*\\PerfLogs\\*" by Processes.parent_process_name Processes.parent_process Processes.process_path Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_file_path_filter`
Macros
The SPL above uses the following Macros:

security_content_summariesonly
security_content_ctime


  suspicious_process_file_path_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields
List of fields required to use this analytic.

_time
Processes.process_name
Processes.process
Processes.parent_process_name
Processes.parent_process
Processes.process_path
Processes.dest
Processes.user

How To Implement
The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the Processes node of the Endpoint data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
Known False Positives
Administrators may allow execution of specific binaries in non-standard paths. Filter as needed.
Associated Analytic Story

WhisperGate
XMRig
Industroyer2
Remcos
Data Destruction
Hermetic Wiper
Azorult
DarkCrystal RAT
Graceful Wipe Out Attack
IcedID
Swift Slicer
Qakbot
RedLine Stealer
Brute Ratel C4
Prestige Ransomware
AsyncRAT
LockBit Ransomware
AgentTesla
Double Zero Destructor
Volt Typhoon
Chaos Ransomware
Trickbot
Amadey
BlackByte Ransomware
Warzone RAT

RBA


Risk Score
Impact
Confidence
Message




35.0
70
50
Suspicious process $process_name$ running from a suspicious process path- $process_path$ on host- $dest$




  The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/
https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
https://twitter.com/pr0xylife/status/1590394227758104576
https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/

Test Dataset
Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range
 Categories: Endpoint 
 Updated: June 13, 2023
Suspicious process pdo pak что это
Identifies when a process is created and immediately accessed from an unknown memory code region and by the same parent process. This may indicate a code injection attempt.
Rule type : eql
Rule indices :

winlogbeat-*
logs-windows.*

Severity : medium
Risk score : 47
Runs every : 5m
Searches indices from : now-9m (Date Math format, see also Additional look-back time )
Maximum alerts per execution : 100
References : None
Tags :

Domain: Endpoint
OS: Windows
Use Case: Threat Detection
Tactic: Defense Evasion
Resources: Investigation Guide
Data Source: Sysmon Only

Version : 207
Rule authors :
Rule license : Elastic License v2
Investigation guideedit
## Triage and analysis ### Investigating Suspicious Process Creation CallTrace Attackers may inject code into child processes' memory to hide their actual activity, evade detection mechanisms, and decrease discoverability during forensics. This rule looks for a spawned process by Microsoft Office, scripting, and command line applications, followed by a process access event for an unknown memory region by the parent process, which can indicate a code injection attempt. #### Possible investigation steps - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures. - Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes. - Investigate other alerts associated with the user/host during the past 48 hours. - Inspect the host for suspicious or abnormal behavior in the alert timeframe. - Create a memory dump of the child process for analysis. ### False positive analysis - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary. ### Response and remediation - Initiate the incident response process based on the outcome of the triage. - Isolate the involved host to prevent further post-compromise behavior. - Remove and block malicious artifacts identified during triage. - Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components. - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services. - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
Rule queryedit
sequence by host.id with maxspan=1m [process where host.os.type == "windows" and event.code == "1" and /* sysmon process creation */ process.parent.name : ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe", "eqnedt32.exe", "fltldr.exe", "mspub.exe", "msaccess.exe","cscript.exe", "wscript.exe", "rundll32.exe", "regsvr32.exe", "mshta.exe", "wmic.exe", "cmstp.exe", "msxsl.exe") and /* noisy FP patterns */ not (process.parent.name : "EXCEL.EXE" and process.executable : "?:\\Program Files\\Microsoft Office\\root\\Office*\\ADDINS\\*.exe") and not (process.executable : "?:\\Windows\\splwow64.exe" and process.args in ("8192", "12288") and process.parent.name : ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe")) and not (process.parent.name : "rundll32.exe" and process.parent.args : ("?:\\WINDOWS\\Installer\\MSI*.tmp,zzzzInvokeManagedCustomActionOutOfProc", "--no-sandbox")) and not (process.executable : ("?:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\*\\msedgewebview2.exe", "?:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe", "?:\\Windows\\SysWOW64\\DWWIN.EXE") and process.parent.name : ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe")) and not (process.parent.name : "regsvr32.exe" and process.parent.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) ] by process.parent.entity_id, process.entity_id [process where host.os.type == "windows" and event.code == "10" and /* Sysmon process access event from unknown module */ winlog.event_data.CallTrace : "*UNKNOWN*"] by process.entity_id, winlog.event_data.TargetProcessGUID
Framework : MITRE ATT&CK TM

Name: Defense Evasion
ID: TA0005
Reference URL: https://attack.mitre.org/tactics/TA0005/


Name: Process Injection
ID: T1055
Reference URL: https://attack.mitre.org/techniques/T1055/

Suspicious process pdo pak что это
Identifies files written to or modified in the startup folder by commonly abused processes. Adversaries may use this technique to maintain persistence.
Rule type : eql
Rule indices :

winlogbeat-*
logs-endpoint.events.*
logs-windows.*
endgame-*

Severity : medium
Risk score : 47
Runs every : 5m
Searches indices from : now-9m (Date Math format, see also Additional look-back time )
Maximum alerts per execution : 100
References :
Tags :

Domain: Endpoint
OS: Windows
Use Case: Threat Detection
Tactic: Persistence
Resources: Investigation Guide
Data Source: Elastic Endgame
Data Source: Elastic Defend

Version : 107
Rule authors :
Rule license : Elastic License v2
Investigation guideedit
## Triage and analysis ### Investigating Startup Persistence by a Suspicious Process The Windows Startup folder is a special folder in Windows. Programs added to this folder are executed during account logon, without user interaction, providing an excellent way for attackers to maintain persistence. This rule monitors for commonly abused processes writing to the Startup folder locations. > **Note**: > This investigation guide uses the /security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide. #### Possible investigation steps - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures. - Investigate other alerts associated with the user/host during the past 48 hours. - Validate if the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations. - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts. - Examine the host for derived artifacts that indicate suspicious activities: - Analyze the file using a private sandboxed analysis system. - Observe and collect information about the following activities in both the sandbox and the alert subject host: - Attempts to contact external domains and addresses. - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`. - Examine the DNS cache for suspicious or anomalous entries. - !> - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree. - Examine the host services for suspicious or anomalous entries. - !> - !> - !> - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc. - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification. ### False positive analysis - Administrators may add programs to this mechanism via command-line shells. Before the further investigation, verify that this activity is not benign. ### Related rules - Suspicious Startup Shell Folder Modification - c8b150f0-0164-475b-a75e-74b47800a9ff - Persistent Scripts in the Startup Directory - f7c4dc5a-a58d-491d-9f14-9b66507121c0 ### Response and remediation - Initiate the incident response process based on the outcome of the triage. - Isolate the involved host to prevent further post-compromise behavior. - If the triage identified malware, search the environment for additional compromised hosts. - Implement temporary network rules, procedures, and segmentation to contain the malware. - Stop suspicious processes. - Immediately block the identified indicators of compromise (IoCs). - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system. - Remove and block malicious artifacts identified during triage. - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services. - Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components. - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
Rule queryedit
file where host.os.type == "windows" and event.type != "deletion" and user.domain != "NT AUTHORITY" and file.path : ("C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\*") and process.name : ("cmd.exe", "powershell.exe", "wmic.exe", "mshta.exe", "pwsh.exe", "cscript.exe", "wscript.exe", "regsvr32.exe", "RegAsm.exe", "rundll32.exe", "EQNEDT32.EXE", "WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSPUB.EXE", "MSACCESS.EXE", "iexplore.exe", "InstallUtil.exe")
Framework : MITRE ATT&CK TM

Name: Persistence
ID: TA0003
Reference URL: https://attack.mitre.org/tactics/TA0003/


Name: Boot or Logon Autostart Execution
ID: T1547
Reference URL: https://attack.mitre.org/techniques/T1547/


Name: Registry Run Keys / Startup Folder
ID: T1547.001
Reference URL: https://attack.mitre.org/techniques/T1547/001/

Generic.Malware/Suspicious — что это за вирус, как удалить?

 Приветствую. Некоторое антивирусное ПО может найти на ПК файл и посчитать его опасным. Однако отнести его к категории со странным названием, про одно из таких названий сегодня пойдет речь.
Generic.Malware/Suspicious — что это такое?
Группа файлов, являющиеся потенциально опасными, могут быть вирусами либо содержать опасные/вирусные функции.

Generic — общая группа, то есть ничего конкретного не имеется ввиду.
Malware — просто означает вредоносная программа/код.
Suspicious — значит подозрительный тип угрозы.

Данное название использует ПО Malwarebytes при определении угроз, пример:
 
Файл, который так помечен — может быть и легальным ПО, которое не является вирусом, однако содержит подозрительные функции. Такой файл может быть заблокирован до выяснения причин, он может быть помещен в карантин, откуда его можно восстановить, если вы точно уверены в его безопасности.
Что делать с угрозой Generic.Malware/Suspicious?
Как уже выяснили — это может быть ложная тревога. Поэтому лучше извлечь файла из карантина и вручную проверить:

На сайте VirusTotal — нажмите кнопку Choose file, выберите подозрительный файл. Он будет проверен в итоге десятками антивирусными движками и картина в плане опасности станет точно ясной.
Также проверьте на Kaspersky VirusDesk — там также выбираете, нажимаете проверить и он будет проверен силами Каспера.

Проверка на Вирустотал — сперва заходим на сайт, далее выбираем файл:
 
Далее например может быть такой результат — многие антивирусные движки показали что угроз нет, но 4 — все таки обнаружили:
 
С Каспером тоже самое — выбираем, нажимаем Проверить:
 
Далее он проверен будет только Каспером, в результатах будет инфа — результат проверки, дата выпуска антивирусных баз:
 
Заключение

Generic.Malware/Suspicious — тип файлов, которые потенциально могут быть опасными или содержать опасные вирусные функции.
Например часто они могут быт обнаружены в папке установки софта, который был незаконно активирован.
Также это могут быть всякие кряки, кейгены, активаторы и прочие компоненты взлома ПО. Все это потенциально опасные инструменты, которые могут не только выполнять свою задачу, но и втихаря выполнять коварные функции трояна — отправку ваших логинов/паролей хакеру, либо вообще установить вам на ПК майнер.
При подозрениях на вирус очень рекомендую проверить весь ПК лучшими тремя утилитами: Dr.Web CureIT, AdwCleaner, HitmanPro. Первая — против опасных вирусов, вторые две — против рекламного/шпионского ПО.



Похожие публикации:

Snowflake client exe что это
Как перевести из пдф в ворд для редактирования скачать программу бесплатно
Как рассчитать тепловыделение процессора
Какие бывают комментарии