From 951517fc63dca8472667683bf1585364e326b0c1 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 21 Jun 2022 16:30:00 +0200 Subject: [PATCH 1/3] WIP --- ...tection_wevtutil_usage_to_disable_logs.yml | 72 +++++++++++ .../00_srs_wevtutil_usage_to_disable_logs.yml | 63 ++++++++++ .../00_wevtutil_usage_to_disable_logs.yml | 117 ++++++++++++++++++ 3 files changed, 252 insertions(+) create mode 100644 detections/endpoint/00_detection_wevtutil_usage_to_disable_logs.yml create mode 100644 detections/endpoint/00_srs_wevtutil_usage_to_disable_logs.yml create mode 100644 detections/endpoint/00_wevtutil_usage_to_disable_logs.yml diff --git a/detections/endpoint/00_detection_wevtutil_usage_to_disable_logs.yml b/detections/endpoint/00_detection_wevtutil_usage_to_disable_logs.yml new file mode 100644 index 0000000000..a38170123c --- /dev/null +++ b/detections/endpoint/00_detection_wevtutil_usage_to_disable_logs.yml @@ -0,0 +1,72 @@ +name: Wevtutil Usage To Disable Logs +id: a4bdc944-cdd9-11eb-ac97-acde48001122 +version: 2 +date: '2021-06-15' +author: Teoderick Contreras, Splunk +type: TTP +status: production +enabled: true +description: This search is to detect execution of wevtutil.exe to disable logs. This + technique was seen in several ransomware to disable the event logs to evade alerts + and detections in compromised host. +logsource: + product: windows + catgeory: process_creation +search: + selection: + CommandLine|contains: 'sl' + CommandLine|contains: '/e:false' + Image|endswith: 'wevtutil.exe' + condition: selection +how_to_implement: You must be ingesting data that records process activity from your + hosts to populate the Endpoint data model in the Processes node. You must also be + ingesting logs with both the process name and command line from your endpoints. + The command-line arguments are mapped to the "process" field in the Endpoint data + model. +known_false_positives: network operator may disable audit event logs for debugging + purposes. +references: +- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/ +tags: + analytic_story: + - Windows Log Manipulation + - Ransomware + confidence: 90 + impact: 70 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log + mitre_attack_id: + - T1070 + - T1070.001 + product: + - Splunk Behavioral Analytics + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 63 + risk_severity: medium + security_domain: endpoint + asset_type: Endpoint +test: +- name: Wevtutil Usage To Disable Logs SRS + type: SRS + pass_condition: '@count_gt(0)' + attack_data: + - file_name: disable_evt.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log + source: WinEventLog:Security +- name: Wevtutil Usage To Disable Logs Sysmon + type: ESCU + pass_condition: '@count_gt(0)' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog +- name: Wevtutil Usage To Disable Logs CarbonBlack + type: ESCU + pass_condition: '@count_gt(0)' + attack_data: + - file_name: carbon-black.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/carbon-black.log + sourcetype: cb:events \ No newline at end of file diff --git a/detections/endpoint/00_srs_wevtutil_usage_to_disable_logs.yml b/detections/endpoint/00_srs_wevtutil_usage_to_disable_logs.yml new file mode 100644 index 0000000000..f94fc8ee9c --- /dev/null +++ b/detections/endpoint/00_srs_wevtutil_usage_to_disable_logs.yml @@ -0,0 +1,63 @@ +name: Wevtutil Usage To Disable Logs +id: a4bdc944-cdd9-11eb-ac97-acde48001122 +version: 2 +description: This search is to detect execution of wevtutil.exe to disable logs. This + technique was seen in several ransomware to disable the event logs to evade alerts + and detections in compromised host. +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line, "%/e:false%") + AND process_name="wevtutil.exe" | eval start_time=timestamp, end_time=timestamp, + entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, + "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id, + "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, + "process_path", process_path]) | into write_ssa_detected_events();' +how_to_implement: You must be ingesting data that records process activity from your + hosts to populate the Endpoint data model in the Processes node. You must also be + ingesting logs with both the process name and command line from your endpoints. + The command-line arguments are mapped to the "process" field in the Endpoint data + model. +known_false_positives: network operator may disable audit event logs for debugging + purposes. +references: +- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/ +tags: + analytic_story: + - Windows Log Manipulation + - Ransomware + cis20: + - CIS 8 + - CIS 13 + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1070 + - T1070.001 + nist: + - PR.DS + - PR.IP + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + risk_score: 63 + security_domain: endpoint + risk_severity: medium +test: + name: Wevtutil Usage To Disable Logs Unit Test + tests: + - name: Wevtutil Usage To Disable Logs + file: endpoint/ssa___wevtutil_usage_to_disable_logs.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: disable_evt.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log + source: WinEventLog:Security diff --git a/detections/endpoint/00_wevtutil_usage_to_disable_logs.yml b/detections/endpoint/00_wevtutil_usage_to_disable_logs.yml new file mode 100644 index 0000000000..ab90d7fec0 --- /dev/null +++ b/detections/endpoint/00_wevtutil_usage_to_disable_logs.yml @@ -0,0 +1,117 @@ +name: Wevtutil Usage To Disable Logs +id: a4bdc944-cdd9-11eb-ac97-acde48001122 +version: 2 +date: '2021-06-15' +author: Teoderick Contreras, Splunk +type: TTP + +<---Remove---> +datamodel: +- Endpoint_Processes + +description: This search is to detect execution of wevtutil.exe to disable logs. This + technique was seen in several ransomware to disable the event logs to evade alerts + and detections in compromised host. + +<---Remove---> +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line, "%/e:false%") + AND process_name="wevtutil.exe" | eval start_time=timestamp, end_time=timestamp, + entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, + "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id, + "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, + "process_path", process_path]) | into write_ssa_detected_events();' + +logsource: + product: windows + catgeory: process_creation +search: + selection: + CommandLine|contains: 'sl' + CommandLine|contains: '/e:false' + Image|endswith: 'wevtutil.exe' + condition: selection + +how_to_implement: You must be ingesting data that records process activity from your + hosts to populate the Endpoint data model in the Processes node. You must also be + ingesting logs with both the process name and command line from your endpoints. + The command-line arguments are mapped to the "process" field in the Endpoint data + model. +known_false_positives: network operator may disable audit event logs for debugging + purposes. +references: +- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/ +tags: + analytic_story: + - Windows Log Manipulation + - Ransomware + + <---Remove---> Is automatically derived from logsource field + cis20: + - CIS 8 + - CIS 13 + + confidence: 90 + impact: 70 + + <---Remove---> Is automatically derived based on logsource and Mitre Attack Information + context: + - Source:Endpoint + - Stage:Defense Evasion + + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log + + <---Remove---> Is automatically derived based on Mitre Attack Information + kill_chain_phases: + - Exploitation + + <---Remove---> Is standardized based on logsource information + message: A wevtutil process $process_name$ with commandline $cmd_line$ to disable + event logs in host $dest_device_id$ + + mitre_attack_id: + - T1070 + - T1070.001 + + <---Remove---> Is automatically derived from logsource field + nist: + - PR.DS + - PR.IP + + <---Remove---> Output is standardized based on logsource + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + - name: dest_user_id + type: User + role: + - Victim + + product: + - Splunk Behavioral Analytics + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + + <---Remove---> Is automatically derived from logsource field + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + + risk_score: 63 + risk_severity: medium + security_domain: endpoint + asset_type: Endpoint From 48f0708c596beb2b2a91e115e5de18e7f84c0c21 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 28 Jun 2022 19:57:33 +0200 Subject: [PATCH 2/3] wip --- ..._detection_wevtutil_usage_to_disable_logs.yml | 16 ++++++++-------- .../00_wevtutil_usage_to_disable_logs.yml | 6 +++--- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/00_detection_wevtutil_usage_to_disable_logs.yml b/detections/endpoint/00_detection_wevtutil_usage_to_disable_logs.yml index a38170123c..2e60cce830 100644 --- a/detections/endpoint/00_detection_wevtutil_usage_to_disable_logs.yml +++ b/detections/endpoint/00_detection_wevtutil_usage_to_disable_logs.yml @@ -5,13 +5,13 @@ date: '2021-06-15' author: Teoderick Contreras, Splunk type: TTP status: production -enabled: true description: This search is to detect execution of wevtutil.exe to disable logs. This technique was seen in several ransomware to disable the event logs to evade alerts and detections in compromised host. logsource: - product: windows - catgeory: process_creation + - Windows Security 4688 + - Sysmon Event Code 1 + - Carbon Black Process search: selection: CommandLine|contains: 'sl' @@ -33,8 +33,8 @@ tags: - Ransomware confidence: 90 impact: 70 - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log + mesage: message here + drilldown: drilldown search here (pre generated) (optional field) mitre_attack_id: - T1070 - T1070.001 @@ -49,14 +49,14 @@ tags: asset_type: Endpoint test: - name: Wevtutil Usage To Disable Logs SRS - type: SRS + product: BA pass_condition: '@count_gt(0)' attack_data: - file_name: disable_evt.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log source: WinEventLog:Security - name: Wevtutil Usage To Disable Logs Sysmon - type: ESCU + product: ESCU pass_condition: '@count_gt(0)' attack_data: - file_name: sysmon.log @@ -64,7 +64,7 @@ test: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog - name: Wevtutil Usage To Disable Logs CarbonBlack - type: ESCU + product: ESCU pass_condition: '@count_gt(0)' attack_data: - file_name: carbon-black.log diff --git a/detections/endpoint/00_wevtutil_usage_to_disable_logs.yml b/detections/endpoint/00_wevtutil_usage_to_disable_logs.yml index ab90d7fec0..74b3121108 100644 --- a/detections/endpoint/00_wevtutil_usage_to_disable_logs.yml +++ b/detections/endpoint/00_wevtutil_usage_to_disable_logs.yml @@ -27,7 +27,7 @@ search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_data "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();' -logsource: +logsource: -> data source object: defines inputs, outputs, needed TAs, description, normalied fields by schema (OCSF, CIM) product: windows catgeory: process_creation search: @@ -59,11 +59,12 @@ tags: confidence: 90 impact: 70 - <---Remove---> Is automatically derived based on logsource and Mitre Attack Information + <--- Completely Remove It---> context: - Source:Endpoint - Stage:Defense Evasion + <---Remove---> dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log @@ -71,7 +72,6 @@ tags: kill_chain_phases: - Exploitation - <---Remove---> Is standardized based on logsource information message: A wevtutil process $process_name$ with commandline $cmd_line$ to disable event logs in host $dest_device_id$ From c96e149cbd11916d0e3da984de945529803c5301 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Fri, 8 Jul 2022 12:50:15 +0200 Subject: [PATCH 3/3] wip --- data_source/endpoint/sysmon_event_code_1.yml | 54 +++++++++++++++++++ ...tection_wevtutil_usage_to_disable_logs.yml | 2 +- 2 files changed, 55 insertions(+), 1 deletion(-) create mode 100644 data_source/endpoint/sysmon_event_code_1.yml diff --git a/data_source/endpoint/sysmon_event_code_1.yml b/data_source/endpoint/sysmon_event_code_1.yml new file mode 100644 index 0000000000..8b5e82ced9 --- /dev/null +++ b/data_source/endpoint/sysmon_event_code_1.yml @@ -0,0 +1,54 @@ +name: Sysmon Event Code 1 +id: 035d5583-8d20-4b85-b4fc-a0a8ced1f2f4 +version: 1 +date: '2022-07-05' +author: Patrick Bareiss, Splunk +description: The process creation event provides extended information about a newly + created process. The full command line provides context on the process execution. + The ProcessGUID field is a unique value for this process across a domain to make + event correlation easier. The hash is a full hash of the file with the algorithms + in the HashType field. +platform: windows +log_source: sysmon +supported_TA: + - Splunk_TA_microsoft_sysmon +references: + - https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-1-process-creation +event_fields: + - name: ProcessGuid + description: Process Guid of the process that got spawned/created + sample_value: '{A98268C1-9C2E-5ACD-0000-0010396CAB00}' + cim_mapping: process_guid + ossem_mapping: + - name: ProcessId + description: Process Id of the process that got spawned/created + sample_value: '2134' + cim_mapping: process_id + ossem_mapping: +... +sample_event: |- + +- +2021-11-03 04:38:27.500 +{3710b5c6-1243-6182-8303-000000000a00} +4044 +C:\Windows\System32\notepad.exe +10.0.19041.1081 (WinBuild.160101.0800) +Notepad +Microsoft® Windows® Operating System +Microsoft Corporation +NOTEPAD.EXE +"C:\Windows\system32\notepad.exe" +C:\Users\pedro\ +DESKTOP-4FPBTEN\pedro +{3710b5c6-f53c-6181-cabe-120000000000} +0x12beca +1 +Medium +SHA1=66B6158B28CC2B970E454B6A8CF1824DD99E4029,MD5=1C1760ED4D19CDBECB2398216922628B,SHA256=D66458A3EB1B68715B552B3AF32A9D2E889BBF8AC0C23C1AFA8D0982023D1CE2,IMPHASH=670212BD5FAE78855C331EDDEFFDD4EB +{3710b5c6-f548-6181-8c01-000000000a00} +4292 +C:\Windows\explorer.exe +C:\Windows\Explorer.EXE +DESKTOP-4FPBTEN\pedro + \ No newline at end of file diff --git a/detections/endpoint/00_detection_wevtutil_usage_to_disable_logs.yml b/detections/endpoint/00_detection_wevtutil_usage_to_disable_logs.yml index 2e60cce830..6c121ebfb3 100644 --- a/detections/endpoint/00_detection_wevtutil_usage_to_disable_logs.yml +++ b/detections/endpoint/00_detection_wevtutil_usage_to_disable_logs.yml @@ -33,7 +33,7 @@ tags: - Ransomware confidence: 90 impact: 70 - mesage: message here + message: message here drilldown: drilldown search here (pre generated) (optional field) mitre_attack_id: - T1070