Detection rules › Splunk

Spike in File Writes

Author
David Dorsey, Splunk
Source
upstream

The following analytic detects a sharp increase in the number of files written to a specific host. It leverages the Endpoint.Filesystem data model, focusing on 'created' actions and comparing current file write counts against historical averages and standard deviations. This activity is significant as a sudden spike in file writes can indicate malicious activities such as ransomware encryption or data exfiltration. If confirmed malicious, this behavior could lead to significant data loss, system compromise, or further propagation of malware within the network.

Event coverage

ProviderEvent IDTitle
Sysmon11FileCreate

Stages and Predicates

Stage 1: tstats

tstats WHERE Filesystem.action="created" BY _time, Filesystem.dest

Stage 2: search

search

Stage 3: eventstats

eventstats

Stage 4: stats

stats BY "dest"

Stage 5: eval

eval ... using (avg, count, num_data_samples, stdev)

Stage 6: search

search isOutlier=1

Stage 7: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Filesystem.actioneq
  • created corpus 2 (splunk 2)
isOutliereq
  • 1 corpus 16 (splunk 16)