You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Enter plugin contents []: !{investigate{"label":"Alerts associated with the host in the last 48h","providers":[[{"field":"event.kind","excluded":false,"queryType":"phrase","value":"signal","valueType":"string"},{"field":"host.name","excluded":false,"queryType":"phrase","value":"{{host.name}}","valueType":"string"}]],"relativeFrom":"now-48h/h","relativeTo":"now"}}
27
+
[transform]
28
+
29
+
[[transform.investigate]]
30
+
label = "Alerts associated with the host in the last 48h"
@@ -55,18 +87,22 @@ This rule looks for processes outside known legitimate program locations communi
55
87
56
88
> **Note**:
57
89
> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
90
+
> This investigation guide uses the [Investigate Markdown Plugin](https://www.elastic.co/guide/en/security/master/interactive-investigation-guides.html) introduced in Elastic Stack version 8.8.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
58
91
59
92
#### Possible investigation steps
60
93
61
-
- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
94
+
- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
62
95
- Investigate other alerts associated with the user/host during the past 48 hours.
96
+
- $investigate_0
97
+
- $investigate_1
63
98
- Verify whether the digital signature exists in the executable.
64
99
- Identify the operation type (upload, download, tunneling, etc.).
65
100
- Examine the host for derived artifacts that indicate suspicious activities:
66
101
- Analyze the process executable using a private sandboxed analysis system.
67
102
- Observe and collect information about the following activities in both the sandbox and the alert subject host:
68
103
- Attempts to contact external domains and addresses.
69
104
- Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
105
+
- $investigate_2
70
106
- Examine the DNS cache for suspicious or anomalous entries.
71
107
- $osquery_0
72
108
- Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
@@ -75,7 +111,6 @@ This rule looks for processes outside known legitimate program locations communi
75
111
- $osquery_2
76
112
- $osquery_3
77
113
- Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
78
-
- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
@@ -53,20 +84,24 @@ The `Desktopimgdownldr.exe` utility is used to to configure lockscreen/desktop i
53
84
54
85
> **Note**:
55
86
> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
87
+
> This investigation guide uses the [Investigate Markdown Plugin](https://www.elastic.co/guide/en/security/master/interactive-investigation-guides.html) introduced in Elastic Stack version 8.8.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
56
88
57
89
#### Possible investigation steps
58
90
59
91
- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
60
92
- Identify the user account that performed the action and whether it should perform this kind of action.
61
93
- Contact the account owner and confirm whether they are aware of this activity.
62
94
- Investigate other alerts associated with the user/host during the past 48 hours.
95
+
- $investigate_0
96
+
- $investigate_1
63
97
- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
64
98
- Check the reputation of the domain or IP address used to host the downloaded file or if the user downloaded the file from an internal system.
65
99
- Examine the host for derived artifacts that indicate suspicious activities:
66
100
- Analyze the file using a private sandboxed analysis system.
67
101
- Observe and collect information about the following activities in both the sandbox and the alert subject host:
68
102
- Attempts to contact external domains and addresses.
69
103
- Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
104
+
- $investigate_2
70
105
- Examine the DNS cache for suspicious or anomalous entries.
71
106
- $osquery_0
72
107
- Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
@@ -50,19 +81,23 @@ The `MpCmdRun.exe` is a command-line tool part of Windows Defender and is used t
50
81
51
82
> **Note**:
52
83
> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
84
+
> This investigation guide uses the [Investigate Markdown Plugin](https://www.elastic.co/guide/en/security/master/interactive-investigation-guides.html) introduced in Elastic Stack version 8.8.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
53
85
54
86
#### Possible investigation steps
55
87
56
88
- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
57
89
- Identify the user account that performed the action and whether it should perform this kind of action.
58
90
- Contact the account owner and confirm whether they are aware of this activity.
59
91
- Investigate other alerts associated with the user/host during the past 48 hours.
92
+
- $investigate_0
93
+
- $investigate_1
60
94
- Check the reputation of the domain or IP address used to host the downloaded file.
61
95
- Examine the host for derived artifacts that indicate suspicious activities:
62
96
- Analyze the file using a private sandboxed analysis system.
63
97
- Observe and collect information about the following activities in both the sandbox and the alert subject host:
64
98
- Attempts to contact external domains and addresses.
65
99
- Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
100
+
- $investigate_2
66
101
- Examine the DNS cache for suspicious or anomalous entries.
67
102
- $osquery_0
68
103
- Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?v=4&size=40){kind=avatar}
0 commit comments