From e9c7accd0fd5e94eca10e568e55f9c5afbdc8a81 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 2 Mar 2022 11:50:13 +0100 Subject: [PATCH 1/2] hwiper_more_ioc --- ...w_compress_color_and_info_tip_registry.yml | 69 +++++++++++++++++++ ...press_color_and_info_tip_registry.test.yml | 12 ++++ 2 files changed, 81 insertions(+) create mode 100644 detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml create mode 100644 tests/endpoint/windows_modify_show_compress_color_and_info_tip_registry.test.yml diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml new file mode 100644 index 0000000000..125d614440 --- /dev/null +++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml @@ -0,0 +1,69 @@ +name: Windows Modify Show Compress Color And Info Tip Registry +id: b7548c2e-9a10-11ec-99e3-acde48001122 +version: 1 +date: '2022-03-02' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to look for suspicious registry modification related to file compression color and information tips. + This IOC was seen in hermetic wiper where it has a thread that will create this registry entry to change the color of compressed or encrypted files in NTFS + file system as well as the pop up information tips. This is a good indicator that a process tries to modified one of the registry GlobalFolderOptions + related to file compression attribution in terms of color in NTFS file system. +search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry + where Registry.registry_path = "*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced*" + AND Registry.registry_value_name IN("ShowCompColor", "ShowInfoTip") + by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name + Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` + |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` + count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name + Processes.process Processes.dest Processes.parent_process_name Processes.parent_process + Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as + proc_guid | fields _time dest user parent_process_name parent_process process_name + process_path process proc_guid registry_path registry_value_name registry_value_data] + | table _time dest user parent_process_name parent_process process_name process_path + process proc_guid registry_path registry_value_name registry_value_data + | `windows_modify_show_compress_color_and_info_tip_registry_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html +tags: + analytic_story: + - Windows Defense Evasion Tactics + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/globalfolderoptions_reg/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1112 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_name + - Registry.dest Registry.user + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: Registry modification in "ShowCompColor" and "ShowInfoTips" on $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/tests/endpoint/windows_modify_show_compress_color_and_info_tip_registry.test.yml b/tests/endpoint/windows_modify_show_compress_color_and_info_tip_registry.test.yml new file mode 100644 index 0000000000..414d732b9c --- /dev/null +++ b/tests/endpoint/windows_modify_show_compress_color_and_info_tip_registry.test.yml @@ -0,0 +1,12 @@ +name: Windows Modify Show Compress Color And Info Tip Registry Unit Test +tests: +- name: Windows Modify Show Compress Color And Info Tip Registry + file: endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/globalfolderoptions_reg/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 65b497ac5ee391341eb241b69ded55ca4c1db01b Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 2 Mar 2022 11:18:26 -0800 Subject: [PATCH 2/2] yml changes --- ...ows_modify_show_compress_color_and_info_tip_registry.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml index 125d614440..ff86c50101 100644 --- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml +++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml @@ -24,8 +24,10 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `windows_modify_show_compress_color_and_info_tip_registry_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the Filesystem responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. +known_false_positives: unknown references: - https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html tags: