diff --git a/detections/endpoint/conti_common_exec_parameter.yml b/detections/endpoint/conti_common_exec_parameter.yml new file mode 100644 index 0000000000..2017cc33cf --- /dev/null +++ b/detections/endpoint/conti_common_exec_parameter.yml @@ -0,0 +1,49 @@ +name: Conti Common Exec parameter +id: 624919bc-c382-11eb-adcc-acde48001122 +version: 1 +date: '2021-06-02' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search detects the suspicious commandline argument of revil ransomware + to encrypt specific or all local drive and network shares of the compromised machine + or host. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process = "*-m local*" + OR Processes.process = "*-m net*" OR Processes.process = "*-m all*" OR Processes.process + = "*-nomutex*" by Processes.process_name Processes.process Processes.parent_process_name + Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `conti_common_exec_parameter_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: 3rd party tool may have commandline parameter that can trigger this detection. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.conti +tags: + analytic_story: + - Ransomware + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/inf1/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1204 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.parent_process + - Processes.dest Processes.user + - Processes.process_id + - Processes.process_guid + security_domain: endpoint + automated_detection_testing: passed diff --git a/detections/experimental/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml similarity index 88% rename from detections/experimental/delete_shadowcopy_with_powershell.yml rename to detections/endpoint/delete_shadowcopy_with_powershell.yml index 3ea98860a7..c6ac90e8f9 100644 --- a/detections/experimental/delete_shadowcopy_with_powershell.yml +++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml @@ -25,6 +25,8 @@ references: tags: analytic_story: - DarkSide Ransomware + - Ransomware + - Revil Ransomware kill_chain_phases: - Exploitation mitre_attack_id: @@ -40,3 +42,6 @@ tags: - ComputerName - User security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-powershell.log diff --git a/detections/endpoint/known_services_killed_by_ransomware.yml b/detections/endpoint/known_services_killed_by_ransomware.yml new file mode 100644 index 0000000000..5e9008be07 --- /dev/null +++ b/detections/endpoint/known_services_killed_by_ransomware.yml @@ -0,0 +1,46 @@ +name: Known Services Killed by Ransomware +id: 3070f8e0-c528-11eb-b2a0-acde48001122 +version: 1 +date: '2021-06-04' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search detects a suspicioous termination of known services killed + by ransomware before encrypting files in a compromised machine. This technique is + commonly seen in most of ransomware now a days to avoid exception error while accessing + the targetted files it wants to encrypts because of the open handle of those services + to the targetted file. +search: '`wineventlog_system` EventCode=7036 Message IN ("*Volume Shadow Copy*","*VSS*", + "*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*") Message="*service + entered the stopped state*" | stats count min(_time) as firstTime max(_time) as + lastTime by EventCode Message dest Type | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` + | `known_services_killed_by_ransomware_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the 7036 EventCode ScManager in System audit Logs from your endpoints. +known_false_positives: Admin activities or installing related updates may do a sudden stop to + list of services we monitor. +references: +- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ +- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ +tags: + analytic_story: + - Ransomware + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1490 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - dest + - Type + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf3/windows-system.log diff --git a/detections/endpoint/modification_of_wallpaper.yml b/detections/endpoint/modification_of_wallpaper.yml new file mode 100644 index 0000000000..ef7c2a7603 --- /dev/null +++ b/detections/endpoint/modification_of_wallpaper.yml @@ -0,0 +1,51 @@ +name: Modification Of Wallpaper +id: accb0712-c381-11eb-8e5b-acde48001122 +version: 1 +date: '2021-06-02' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic identifies suspicious modification of registry to deface + or change the wallpaper of a compromised machines as part of its payload. This technique + was commonly seen in ransomware like REVIL where it create a bitmap file contain + a note that the machine was compromised and make it as a wallpaper. +search: '`sysmon` EventCode =13 (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper" + AND Image != "*\\explorer.exe") OR (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper" + AND Details = "*\\temp\\*") | stats count min(_time) as firstTime max(_time) as + lastTime by EventCode Image TargetObject Details Computer process_guid process_id + user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `modification_of_wallpaper_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the Image, TargetObject registry key, registry Details from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: 3rd party tool may used to changed the wallpaper of the machine +references: +- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ +- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ +tags: + analytic_story: + - Ransomware + - Revil Ransomware + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1491 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Image + - TargetObject + - Details + - Computer + - process_guid + - process_id + - user_id + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log diff --git a/detections/endpoint/revil_common_exec_parameter.yml b/detections/endpoint/revil_common_exec_parameter.yml new file mode 100644 index 0000000000..acf29e9078 --- /dev/null +++ b/detections/endpoint/revil_common_exec_parameter.yml @@ -0,0 +1,52 @@ +name: Revil Common Exec Parameter +id: 85facebe-c382-11eb-9c3e-acde48001122 +version: 1 +date: '2021-06-02' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic identifies suspicious commandline parameter that are commonly + used by REVIL ransomware to encrypts the compromise machine. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process = "*-nolan*" + OR Processes.process = "*-nolocal*" OR Processes.process = "*-fast*" OR Processes.process + = "*-full*" by Processes.process_name Processes.process Processes.parent_process_name + Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `revil_common_exec_parameter_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: third party tool may have same command line parameters as revil + ransomware. +references: +- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ +- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ +tags: + analytic_story: + - Ransomware + - Revil Ransomware + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1204 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.parent_process + - Processes.dest + - Processes.user + - Processes.process_id + - Processes.process_guid + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml new file mode 100644 index 0000000000..025747e416 --- /dev/null +++ b/detections/endpoint/revil_registry_entry.yml @@ -0,0 +1,49 @@ +name: Revil Registry Entry +id: e3d3f57a-c381-11eb-9e35-acde48001122 +version: 1 +date: '2021-06-02' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic identifies suspicious modification in registry entry to + keep some malware data during its infection. This technique seen in several apt + implant, malware and ransomware like REVIL where it keep some information like the + random generated file extension it uses for all the encrypted files and ransomware + notes file name in the compromised host. +search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) + as registry_key_name values(Registry.registry_path) as registry_path min(_time) + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" + AND (Registry.registry_value_name = "\.*" OR Registry.registry_value_name = "Binary + Data") by Registry.registry_value_name Registry.dest Registry.user | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `revil_registry_entry_filter`' +how_to_implement: to successfully implement this search, you need to be ingesting + logs with the Image, TargetObject registry key, registry Details from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: unknown +references: +- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ +- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ +tags: + analytic_story: + - Ransomware + - Revil Ransomware + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1112 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.dest + - Registry.user + - Registry.registry_value_name + - Registry.registry_path + - Registry.registry_key_name + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log diff --git a/detections/endpoint/wbemprox_com_object_execution.yml b/detections/endpoint/wbemprox_com_object_execution.yml new file mode 100644 index 0000000000..698fdcdbda --- /dev/null +++ b/detections/endpoint/wbemprox_com_object_execution.yml @@ -0,0 +1,51 @@ +name: Wbemprox COM Object Execution +id: 9d911ce0-c3be-11eb-b177-acde48001122 +version: 1 +date: '2021-06-02' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is designed to detect potential malicious process loading + COM object to wbemprox.dll, +search: '`sysmon` EventCode=7 ImageLoaded IN ("*\\fastprox.dll", "*\\wbemprox.dll", + "*\\wbemcomn.dll") NOT (process_name IN ("wmiprvse.exe", "WmiApSrv.exe", "unsecapp.exe")) + NOT(Image IN("*\\windows\\*","*\\program files*", "*\\wbem\\*")) | stats count min(_time) + as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode + Signed ProcessId Hashes IMPHASH | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `wbemprox_com_object_execution_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name and imageloaded executions from your endpoints. If you + are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: legitimate process that are not in the exception list may trigger + this event. +references: +- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ +- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ +tags: + analytic_story: + - Ransomware + - Revil Ransomware + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - ImageLoaded + - process_name + - Computer + - EventCode + - Signed + - ProcessId + - Hashes + - IMPHASH + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf2/windows-sysmon.log diff --git a/stories/ransomware_revil.yml b/stories/ransomware_revil.yml new file mode 100644 index 0000000000..f9ce340b48 --- /dev/null +++ b/stories/ransomware_revil.yml @@ -0,0 +1,25 @@ +name: Revil Ransomware +id: 817cae42-f54b-457a-8a36-fbf45521e29e +version: 1 +date: '2021-06-04' +author: Teoderick Contreras, Splunk +type: batch +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the Revil ransomware, including looking for file writes associated + with Revil, encrypting network shares, deleting shadow volume storage, registry key modification, + deleting of security logs, and more. +narrative: Revil ransomware is a RaaS,that a single group may operates and manges the development of this ransomware. + It involve the use of ransomware payloads along with exfiltration of data. Malicious actors demand payment for + ransome of data and threaten deletion and exposure of exfiltrated data. +references: +- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ +- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ +tags: + analytic_story: Revil Ransomware + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection diff --git a/tests/endpoint/conti_common_exec_parameter.test.yml b/tests/endpoint/conti_common_exec_parameter.test.yml new file mode 100644 index 0000000000..aaa068c8ce --- /dev/null +++ b/tests/endpoint/conti_common_exec_parameter.test.yml @@ -0,0 +1,15 @@ +name: Conti Common Exec parameter Unit Test +tests: +- name: Conti Common Exec parameter + file: endpoint/conti_common_exec_parameter.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/inf1/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + + + \ No newline at end of file diff --git a/tests/endpoint/delete_shadowcopy_with_powershell.test.yml b/tests/endpoint/delete_shadowcopy_with_powershell.test.yml new file mode 100644 index 0000000000..3f36a62eff --- /dev/null +++ b/tests/endpoint/delete_shadowcopy_with_powershell.test.yml @@ -0,0 +1,12 @@ +name: Delete ShadowCopy With PowerShell Test +tests: +- name: Delete ShadowCopy With PowerShell + file: endpoint/delete_shadowcopy_with_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/known_services_killed_by_ransomware.test.yml b/tests/endpoint/known_services_killed_by_ransomware.test.yml new file mode 100644 index 0000000000..86b9a6ac3f --- /dev/null +++ b/tests/endpoint/known_services_killed_by_ransomware.test.yml @@ -0,0 +1,15 @@ +name: Known Services Killed by Ransomware Unit Test +tests: +- name: Known Services Killed by Ransomware + file: endpoint/known_services_killed_by_ransomware.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-system.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf3/windows-system.log + source: WinEventLog:System + sourcetype: WinEventLog + + + \ No newline at end of file diff --git a/tests/endpoint/modification_of_wallpaper.test.yml b/tests/endpoint/modification_of_wallpaper.test.yml new file mode 100644 index 0000000000..391f15e302 --- /dev/null +++ b/tests/endpoint/modification_of_wallpaper.test.yml @@ -0,0 +1,16 @@ +name: Modification Of Wallpaper Unit Test +tests: +- name: Modification Of Wallpaper + file: endpoint/modification_of_wallpaper.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + + + + \ No newline at end of file diff --git a/tests/endpoint/revil_common_exec_parameter.test.yml b/tests/endpoint/revil_common_exec_parameter.test.yml new file mode 100644 index 0000000000..fc986ae8e6 --- /dev/null +++ b/tests/endpoint/revil_common_exec_parameter.test.yml @@ -0,0 +1,12 @@ +name: Revil Common Exec Parameter Unit Test +tests: +- name: Revil Common Exec Parameter + file: endpoint/revil_common_exec_parameter.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/revil_registry_entry.test.yml b/tests/endpoint/revil_registry_entry.test.yml new file mode 100644 index 0000000000..51368e34a8 --- /dev/null +++ b/tests/endpoint/revil_registry_entry.test.yml @@ -0,0 +1,12 @@ +name: Revil Registry Entry Unit Test +tests: +- name: Revil Registry Entry + file: endpoint/revil_registry_entry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/wbemprox_com_object_execution.test.yml b/tests/endpoint/wbemprox_com_object_execution.test.yml new file mode 100644 index 0000000000..941f217106 --- /dev/null +++ b/tests/endpoint/wbemprox_com_object_execution.test.yml @@ -0,0 +1,15 @@ +name: Wbemprox COM Object Execution Unit Test +tests: +- name: Wbemprox COM Object Execution + file: endpoint/wbemprox_com_object_execution.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf2/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + + + \ No newline at end of file