Problem in logical operator execution order : WHERE vs SEARCH #42
Description
Hello,
It seems there is a problem in tstat searches in terms of logical operator execution order.
I am trying to convert in tstat search the following rule :
title: Windows Schtasks Create Run As System
id: 41a0e58e-884c-11ec-9976-acde48001122
status: stable
description: The analytic identifies the creation of a new task to start and run as an elevated user - SYSTEM using Schtasks.exe.
author: author
date: 2024/01/01
tags:
- attack.execution
- attack.persistence
- attack.privilege_escalation
- attack.t1053.005
logsource:
category: process_creation
product: windows
detection:
selection_1:
CommandLine: "schtasks.exe"
selection_2:
OriginalFileName: "schtasks.exe"
selection_3:
CommandLine|contains: "*/create *"
CommandLine|endswith: "*/ru *system"
condition: (selection_1 or selection_2) and selection_3
type: TTP
level: medium
This give me the following result :
| tstats [...] from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe OR Processes.original_file_name=schtasks.exe Processes.process="*/create *" AND Processes.process="*/ru *" AND Processes.process="*system*" by Processes.dest [...]
The logical operator priority seems to be wrong as i want instead (notice the brackets):
| tstats [...] from datamodel=Endpoint.Processes where (Processes.process_name=schtasks.exe OR Processes.original_file_name=schtasks.exe) Processes.process="*/create *" AND Processes.process="*/ru *" AND Processes.process="*system*" by Processes.dest [...]
There are differences in terms of logical operator priority between SEARCH and WHERE commands in splunk :
https://docs.splunk.com/Documentation/Splunk/8.0.4/Search/Booleanexpressions
Thanks in advance for your return !