detection.wiki

Detection rules › Splunk

Windows Process Writing File to World Writable Path

Author
Michael Haag, Splunk
Source
upstream

The following analytic identifies a process writing a .txt file to a world writable path. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on file creation events within specific directories. This activity is significant as adversaries often use such techniques to deliver payloads to a system, which is uncommon for legitimate processes. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a significant security risk.

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1218.005 System Binary Proxy Execution: Mshta

Event coverage

ProviderEvent IDTitle
Sysmon11FileCreate

Stages and Predicates

Stage 1: tstats

tstats WHERE Filesystem.file_name="*.txt" Filesystem.file_path IN ("*\\Windows\\PLA\\Reports\\*", "*\\Windows\\PLA\\Reports\\en-US\\*", "*\\Windows\\PLA\\Rules\\*", "*\\Windows\\PLA\\Rules\\en-US\\*", "*\\Windows\\PLA\\Templates\\*", "*\\Windows\\Registration\\CRMLog\\*", "*\\Windows\\SysWOW64\\Com\\dmp\\*", "*\\Windows\\SysWOW64\\Tasks\\*", "*\\Windows\\SysWOW64\\Tasks\\Microsoft\\Windows\\PLA\\*", "*\\Windows\\SysWOW64\\Tasks\\Microsoft\\Windows\\PLA\\System\\*", "*\\Windows\\SysWOW64\\Tasks\\Microsoft\\Windows\\RemoteApp and Desktop Connections Update\\*", "*\\Windows\\System32\\Com\\dmp\\*", "*\\Windows\\System32\\LogFiles\\WMI\\*", "*\\Windows\\System32\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", "*\\Windows\\System32\\Tasks\\*", "*\\Windows\\System32\\Tasks\\Microsoft\\Windows\\RemoteApp and Desktop Connections Update\\*", "*\\Windows\\System32\\spool\\PRINTERS\\*", "*\\Windows\\System32\\spool\\SERVERS\\*", "*\\Windows\\System32\\spool\\drivers\\color\\*", "*\\Windows\\Tasks\\*", "*\\Windows\\Temp\\*", "*\\Windows\\tracing\\*") BY Filesystem.dest, Filesystem.user, Filesystem.file_name, Filesystem.file_path

Stage 2: search

search

Stage 3: search

search

Stage 4: search

search

Stage 5: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Filesystem.file_nameeq
  • *.txt
Filesystem.file_pathin
  • "*\\Windows\\PLA\\Reports\\*" corpus 2 (splunk 2)
  • "*\\Windows\\PLA\\Reports\\en-US\\*"
  • "*\\Windows\\PLA\\Rules\\*" corpus 2 (splunk 2)
  • "*\\Windows\\PLA\\Rules\\en-US\\*"
  • "*\\Windows\\PLA\\Templates\\*" corpus 2 (splunk 2)
  • "*\\Windows\\Registration\\CRMLog\\*" corpus 2 (splunk 2)
  • "*\\Windows\\SysWOW64\\Com\\dmp\\*" corpus 2 (splunk 2)
  • "*\\Windows\\SysWOW64\\Tasks\\*" corpus 2 (splunk 2)
  • "*\\Windows\\SysWOW64\\Tasks\\Microsoft\\Windows\\PLA\\*"
  • "*\\Windows\\SysWOW64\\Tasks\\Microsoft\\Windows\\PLA\\System\\*"
  • "*\\Windows\\SysWOW64\\Tasks\\Microsoft\\Windows\\RemoteApp and Desktop Connections Update\\*"
  • "*\\Windows\\System32\\Com\\dmp\\*" corpus 2 (splunk 2)
  • "*\\Windows\\System32\\LogFiles\\WMI\\*" corpus 2 (splunk 2)
  • "*\\Windows\\System32\\Microsoft\\Crypto\\RSA\\MachineKeys\\*" corpus 2 (splunk 2)
  • "*\\Windows\\System32\\Tasks\\*" corpus 2 (splunk 2)
  • "*\\Windows\\System32\\Tasks\\Microsoft\\Windows\\RemoteApp and Desktop Connections Update\\*"
  • "*\\Windows\\System32\\spool\\PRINTERS\\*" corpus 2 (splunk 2)
  • "*\\Windows\\System32\\spool\\SERVERS\\*" corpus 2 (splunk 2)
  • "*\\Windows\\System32\\spool\\drivers\\color\\*" corpus 2 (splunk 2)
  • "*\\Windows\\Tasks\\*" corpus 2 (splunk 2)
  • "*\\Windows\\Temp\\*" corpus 3 (splunk 3)
  • "*\\Windows\\tracing\\*" corpus 2 (splunk 2)