Batch File Write to System32

Hypothesis and description

While batch files are not inherently malicious, it is uncommon to see them created after OS installation, especially in the Windows directory. This analytic looks for the suspicious activity of a batch file being created within the C:\Windows\System32 directory tree. There will be only occasional false positives due to administrator actions.

Platforms: Windows
Domain: Analytic
Subtypes: Process
Submitted: 2021-05-11
Contributors: Splunk Threat Research <research@splunk.com>

ATT&CK coverage

Technique	Tactics	Coverage
T1204 User ExecutionT1204.002	Execution	Moderate

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1204User Execution
.002 Malicious File

D3FEND techniques MITRE maps to this analytic

D3-PSA Process Spawn Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

PseudocodePseudocode - Batch file created in the Windows system32 directory treeData model: CAR native

Pseudocode implementation of the Splunk search below

files = search File:create
batch_files = filter files where (
  extension =".bat" AND file_path = "C:\Windows\system32*" )
output batch_files

SplunkSplunk codeData model: Endpoint

You must be ingesting data that records the file-system activity from your hosts to populate the Endpoint file-system data-model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.

| tstats count min(_time) as firstTime max(_time) as lastTime values(Filesystem.dest) as dest values(Filesystem.file_name) as file_name values(Filesystem.user) as user from datamodel=Endpoint.Filesystem by Filesystem.file_path   | rex field=file_name "(?<file_extension>\.[^\.]+)$" | search file_path=*system32* AND file_extension=.bat

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

18 more in the full list

View CAR-2021-05-002 on car.mitre.org

Hypothesis and description

Technique

Tactics

Coverage

T1204 User ExecutionT1204.002

Execution

Moderate

Pseudocode and implementations

PseudocodePseudocode - Batch file created in the Windows system32 directory treeData model: CAR native

Pseudocode implementation of the Splunk search below

files = search File:create
batch_files = filter files where (
  extension =".bat" AND file_path = "C:\Windows\system32*" )
output batch_files

SplunkSplunk codeData model: Endpoint

| tstats count min(_time) as firstTime max(_time) as lastTime values(Filesystem.dest) as dest values(Filesystem.file_name) as file_name values(Filesystem.user) as user from datamodel=Endpoint.Filesystem by Filesystem.file_path   | rex field=file_name "(?<file_extension>\.[^\.]+)$" | search file_path=*system32* AND file_extension=.bat