Merge branch 'security_content_4' of github.com:splunk/security_content into security_content_4

data_source/endpoint/sysmon_event_code_1.yml

@@ -0,0 +1,54 @@
+name: Sysmon Event Code 1
+id: 035d5583-8d20-4b85-b4fc-a0a8ced1f2f4
+version: 1
+date: '2022-07-05'
+author: Patrick Bareiss, Splunk
+description: The process creation event provides extended information about a newly
+  created process. The full command line provides context on the process execution.
+  The ProcessGUID field is a unique value for this process across a domain to make
+  event correlation easier. The hash is a full hash of the file with the algorithms
+  in the HashType field.
+platform: windows
+log_source: sysmon
+supported_TA:
+  - Splunk_TA_microsoft_sysmon
+references:
+  - https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-1-process-creation
+event_fields:
+  - name: ProcessGuid
+    description: Process Guid of the process that got spawned/created
+    sample_value: '{A98268C1-9C2E-5ACD-0000-0010396CAB00}'
+    cim_mapping: process_guid
+    ossem_mapping: 
+  - name: ProcessId
+    description: Process Id of the process that got spawned/created
+    sample_value: '2134'
+    cim_mapping: process_id
+    ossem_mapping: 
+...
+sample_event: |-
+<EventData>
+<Data Name="RuleName">-</Data> 
+<Data Name="UtcTime">2021-11-03 04:38:27.500</Data> 
+<Data Name="ProcessGuid">{3710b5c6-1243-6182-8303-000000000a00}</Data> 
+<Data Name="ProcessId">4044</Data> 
+<Data Name="Image">C:\Windows\System32\notepad.exe</Data> 
+<Data Name="FileVersion">10.0.19041.1081 (WinBuild.160101.0800)</Data> 
+<Data Name="Description">Notepad</Data> 
+<Data Name="Product">Microsoft® Windows® Operating System</Data> 
+<Data Name="Company">Microsoft Corporation</Data> 
+<Data Name="OriginalFileName">NOTEPAD.EXE</Data> 
+<Data Name="CommandLine">"C:\Windows\system32\notepad.exe"</Data> 
+<Data Name="CurrentDirectory">C:\Users\pedro\</Data> 
+<Data Name="User">DESKTOP-4FPBTEN\pedro</Data> 
+<Data Name="LogonGuid">{3710b5c6-f53c-6181-cabe-120000000000}</Data> 
+<Data Name="LogonId">0x12beca</Data> 
+<Data Name="TerminalSessionId">1</Data> 
+<Data Name="IntegrityLevel">Medium</Data> 
+<Data Name="Hashes">SHA1=66B6158B28CC2B970E454B6A8CF1824DD99E4029,MD5=1C1760ED4D19CDBECB2398216922628B,SHA256=D66458A3EB1B68715B552B3AF32A9D2E889BBF8AC0C23C1AFA8D0982023D1CE2,IMPHASH=670212BD5FAE78855C331EDDEFFDD4EB</Data> 
+<Data Name="ParentProcessGuid">{3710b5c6-f548-6181-8c01-000000000a00}</Data> 
+<Data Name="ParentProcessId">4292</Data> 
+<Data Name="ParentImage">C:\Windows\explorer.exe</Data> 
+<Data Name="ParentCommandLine">C:\Windows\Explorer.EXE</Data> 
+<Data Name="ParentUser">DESKTOP-4FPBTEN\pedro</Data> 
+</EventData>

detections/endpoint/00_detection_wevtutil_usage_to_disable_logs.yml

@@ -0,0 +1,72 @@
+name: Wevtutil Usage To Disable Logs
+id: a4bdc944-cdd9-11eb-ac97-acde48001122
+version: 2
+date: '2021-06-15'
+author: Teoderick Contreras, Splunk
+type: TTP
+status: production
+description: This search is to detect execution of wevtutil.exe to disable logs. This
+  technique was seen in several ransomware to disable the event logs to evade alerts
+  and detections in compromised host.
+logsource:
+  - Windows Security 4688
+  - Sysmon Event Code 1
+  - Carbon Black Process 
+search:
+  selection:
+    CommandLine|contains: 'sl'
+    CommandLine|contains: '/e:false'
+    Image|endswith: 'wevtutil.exe'
+  condition: selection
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts to populate the Endpoint data model in the Processes node. You must also be
+  ingesting logs with both the process name and command line from your endpoints.
+  The command-line arguments are mapped to the "process" field in the Endpoint data
+  model.
+known_false_positives: network operator may disable audit event logs for debugging
+  purposes.
+references:
+- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/
+tags:
+  analytic_story:
+  - Windows Log Manipulation
+  - Ransomware
+  confidence: 90
+  impact: 70
+  message: message here
+  drilldown: drilldown search here (pre generated) (optional field)
+  mitre_attack_id:
+  - T1070
+  - T1070.001
+  product:
+  - Splunk Behavioral Analytics
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 63
+  risk_severity: medium
+  security_domain: endpoint
+  asset_type: Endpoint
+test:
+- name: Wevtutil Usage To Disable Logs SRS
+  product: BA
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: disable_evt.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log
+    source: WinEventLog:Security
+- name: Wevtutil Usage To Disable Logs Sysmon
+  product: ESCU
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+- name: Wevtutil Usage To Disable Logs CarbonBlack
+  product: ESCU
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: carbon-black.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/carbon-black.log
+    sourcetype: cb:events

detections/endpoint/00_srs_wevtutil_usage_to_disable_logs.yml

@@ -0,0 +1,63 @@
+name: Wevtutil Usage To Disable Logs
+id: a4bdc944-cdd9-11eb-ac97-acde48001122
+version: 2
+description: This search is to detect execution of wevtutil.exe to disable logs. This
+  technique was seen in several ransomware to disable the event logs to evade alerts
+  and detections in compromised host.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line, "%/e:false%")
+  AND process_name="wevtutil.exe" | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id,
+  "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts to populate the Endpoint data model in the Processes node. You must also be
+  ingesting logs with both the process name and command line from your endpoints.
+  The command-line arguments are mapped to the "process" field in the Endpoint data
+  model.
+known_false_positives: network operator may disable audit event logs for debugging
+  purposes.
+references:
+- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/
+tags:
+  analytic_story:
+  - Windows Log Manipulation
+  - Ransomware
+  cis20:
+  - CIS 8
+  - CIS 13
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1070
+  - T1070.001
+  nist:
+  - PR.DS
+  - PR.IP
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  risk_score: 63
+  security_domain: endpoint
+  risk_severity: medium
+test:
+  name: Wevtutil Usage To Disable Logs Unit Test
+  tests:
+  - name: Wevtutil Usage To Disable Logs
+    file: endpoint/ssa___wevtutil_usage_to_disable_logs.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: disable_evt.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log
+      source: WinEventLog:Security

detections/endpoint/00_wevtutil_usage_to_disable_logs.yml

@@ -0,0 +1,117 @@
+name: Wevtutil Usage To Disable Logs
+id: a4bdc944-cdd9-11eb-ac97-acde48001122
+version: 2
+date: '2021-06-15'
+author: Teoderick Contreras, Splunk
+type: TTP
+
+<---Remove--->
+datamodel: 
+- Endpoint_Processes
+
+description: This search is to detect execution of wevtutil.exe to disable logs. This
+  technique was seen in several ransomware to disable the event logs to evade alerts
+  and detections in compromised host.
+
+<---Remove--->
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line, "%/e:false%")
+  AND process_name="wevtutil.exe" | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id,
+  "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+
+logsource: -> data source object: defines inputs, outputs, needed TAs, description, normalied fields by schema (OCSF, CIM)
+  product: windows
+  catgeory: process_creation
+search:
+  selection:
+    CommandLine|contains: 'sl'
+    CommandLine|contains: '/e:false'
+    Image|endswith: 'wevtutil.exe'
+  condition: selection
+
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts to populate the Endpoint data model in the Processes node. You must also be
+  ingesting logs with both the process name and command line from your endpoints.
+  The command-line arguments are mapped to the "process" field in the Endpoint data
+  model.
+known_false_positives: network operator may disable audit event logs for debugging
+  purposes.
+references:
+- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/
+tags:
+  analytic_story:
+  - Windows Log Manipulation
+  - Ransomware
+
+  <---Remove---> Is automatically derived from logsource field
+  cis20:
+  - CIS 8
+  - CIS 13
+  
+  confidence: 90
+  impact: 70
+
+  <--- Completely Remove It---> 
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+
+  <---Remove--->
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log
+  
+  <---Remove---> Is automatically derived based on Mitre Attack Information
+  kill_chain_phases:
+  - Exploitation
+  
+  message: A wevtutil process $process_name$ with commandline $cmd_line$ to disable
+    event logs in host $dest_device_id$
+  
+  mitre_attack_id:
+  - T1070
+  - T1070.001
+  
+   <---Remove---> Is automatically derived from logsource field
+  nist:
+  - PR.DS
+  - PR.IP
+  
+   <---Remove---> Output is standardized based on logsource
+  observable:
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  
+  product:
+  - Splunk Behavioral Analytics
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+
+  <---Remove---> Is automatically derived from logsource field
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  
+  risk_score: 63
+  risk_severity: medium
+  security_domain: endpoint
+  asset_type: Endpoint