Windows Process Accessing IronLanguages Repository On GitHub
Description
The following analytic identifies a process command line referencing the IronLanguages GitHub repository, which hosts .NET implementation of popular scripting engines. Adversaries have downloaded these .NET implementations to avoid getting detected by security controls while executing their payloads. This activity is uncommon in typical enterprise environments outside of software development contexts.
Query · spl
| tstats `security_content_summariesonly`
count min(_time) as firstTime
max(_time) as lastTime
FROM datamodel=Endpoint.Processes WHERE
Processes.process="*/ironlanguages/*"
Processes.process="*github.com*"
by Processes.action Processes.dest Processes.original_file_name
Processes.parent_process Processes.parent_process_exec
Processes.parent_process_guid Processes.parent_process_id
Processes.parent_process_name Processes.parent_process_path
Processes.process Processes.process_exec Processes.process_guid
Processes.process_hash Processes.process_id
Processes.process_integrity_level Processes.process_name
Processes.process_path Processes.user Processes.user_id
Processes.vendor_product
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_process_accessing_ironlanguages_repository_on_github_filter`
Implementation guide
The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents
are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement
this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally,
you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk
Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the Processes node
of the Endpoint data model. Use the Splunk Common Information Model (CIM) to normalize the field names and
speed up the data modeling process.
Known false positives
- Software developers or DevOps personnel may legitimately clone or download the IronPython repository from GitHub for development purposes. Filter as needed based on known developer hosts or users in your environment.
Analyst notes
Known false positives: Software developers or DevOps personnel may legitimately clone or download the IronPython repository from GitHub for development purposes. Filter as needed based on known developer hosts or users in your environment.