Maps the Mitre Att&ck framework process executions into artifacts. This pack was generated from https://github.com/teoseller/osquery-attck
name: Windows.Attack.Prefetch
description: |
Maps the Mitre Att&ck framework process executions into
artifacts. This pack was generated from
https://github.com/teoseller/osquery-attck
precondition: SELECT OS From info() where OS = 'windows'
sources:
- query: |
SELECT Name, ModTime, Mtime AS modified
FROM glob(globs="C:/Windows/Prefetch/*")
# Reports can be MONITORING_DAILY, CLIENT, SERVER_EVENT
reports:
- type: CLIENT
parameters:
- name: lookupTable
type: csv
default: |
signature,description
attrib,Attrib Execute is usually used to modify file attributes - ATT&CK T1158
schtasks.exe,Schtasks Execute: usaullay used to create a scheduled task - ATT&CK T1053:S0111
taskeng.exe,taskeng Execute: usaullay used to create a scheduled task - ATT&CK T1053
tscon.exe,tscon.exe Execute: usaullay used to Terminal Services Console - ATT&CK T1076
mstsc.exe,mstsc.exe Execute: usaullay used to perform a RDP Session - ATT&CK T1076
at.exe,Schtasks Execute: usaullay used to create a scheduled task - ATT&CK T1053:S0110
tasklist.exe,Tasklist Execute: usaullay used to list task - ATT&CK T1057:T1063:T1007:S0057
taskkill.exe,Taskkill Execute: usaullay used to kill task
mshta.exe,Mshta Execute: is a utility that executes Microsoft HTML Applications (HTA) - ATT&CK T1170
whoami.exe,Whoami Execute: used to prints the effective username of the current user
xcopy.exe,Xcopy Execute: is used for copying multiple files or entire directory trees from one directory to another and for copying files across a network.
esentutl.exe,Esentutl Execute: is a legitimate built-in command-line program it could be used to create a exe from dump raw source.
net.exe,Net Execute: is used in command-line operations for control of users: groups: services: and network connections - ATT&CK T1126:T1087:T1201:T1069:S0039:T1018:T1007:T1124
vssadmin.exe,Vssadmin Execute: usaullay used to execute activity on Volume Shadow copy
InstallUtil.exe,InstallUtil Execute: InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries - ATT&CK T1118
cmstp.exe,CMSTP Execute: The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. - ATT&CK T1191
cmd.exe,Command-Line Interface Execute: CMD execution - ATT&CK T1059
cscript.exe,Command-Line Interface Execute: Cscript execution starts a script so that it runs in a command-line environment. - ATT&CK T1216
powershell.exe,POWERSHELL Execute: is a powerful interactive command-line interface and scripting environment included in the Windows operating system - ATT&CK T1086
regsvr32.exe,POWERSHELL Execute: is a powerful interactive command-line interface and scripting environment included in the Windows operating system - ATT&CK T1117
PsExec.exe,PsExec Execute: is a free Microsoft tool that can be used to execute a program on another computer. - ATT&CK T1035:S0029
runas.exe,Runas Execute: Allows a user to run specific tools and programs with different permissions than the user's current logon provides. - ATT&CK T1134
bitsadmin.exe,Bitsadmin Execute: Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth: asynchronous file transfer mechanism exposed through Component Object Model (COM) - ATT&CK T1197:S0190
certutil.exe,Certutil Execute: Certutil.exe is a legitimate built-in command-line program to manage certificates in Windows - ATT&CK T1105:T1140:T1130:S0160
netsh.exe,Netsh Execute: Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system - ATT&CK T1128:T1063:S0108
netstat.exe,Netstat Execute: is an operating system utility that displays active TCP connections: listening ports: and network statistics. - ATT&CK T1049:S0104
reg.exe,Reg Execute: Reg is a Windows utility used to interact with the Windows Registry. - ATT&CK T1214:T1012:T1063:S0075
regedit.exe,Regedit Execute: is a Windows utility used to interact with the Windows Registry. - ATT&CK T1214
systeminfo.exe,Systeminfo Execute: Systeminfo is a Windows utility that can be used to gather detailed information about a computer. - ATT&CK T1082:S0096
sc.exe,SC.exe Execute: Service Control - Create: Start: Stop: Query or Delete any Windows SERVICE. . - ATT&CK T1007
template: |
{{ .Description }}
The below shows any prefetch files of interest and what they
could potentially mean.
{{ define "query" }}
LET lookup <= SELECT * FROM lookupTable
{{ end }}
{{ define "data"}}
LET data <= SELECT * FROM source()
{{ end }}
{{ range (Query "data" "query" "SELECT * FROM lookup") }}
{{ $rows := Query (printf "SELECT * FROM source() WHERE Name =~ '%v'" (Get . "signature") ) }}
{{ if $rows }}
## {{ Get $rows "0.Name" }}
Modified on {{ Get $rows "0.ModTime" }}.
{{ Get . "description" }}
{{ end }}
{{ end }}
# Timeline
{{ Query "SELECT modified * 1000, Name FROM foreach(row=lookup, query={ SELECT * FROM data WHERE Name =~ signature})" | Timeline }}