From 09796e3f673e7f6fdca1e968f70a77bf05cff50c Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 4 Jun 2021 16:07:02 +0200 Subject: [PATCH 01/14] revil --- .../endpoint/conti_common_exec_parameter.yml | 29 +++++++++++ .../delete_shadowcopy_with_powershell.yml | 2 + .../known_services_killed_by_ransomware.yml | 42 ++++++++++++++++ .../endpoint/modification_of_wallpaper.yml | 48 +++++++++++++++++++ .../endpoint/revil_common_exec_parameter.yml | 48 +++++++++++++++++++ detections/endpoint/revil_registry_entry.yml | 48 +++++++++++++++++++ .../wbemprox_com_object_execution.yml | 46 ++++++++++++++++++ stories/ransomware_revil.yml | 25 ++++++++++ .../conti_common_exec_parameter.test.yml | 12 +++++ ...delete_shadowcopy_with_powershell.test.yml | 12 +++++ ...own_services_killed_by_ransomware.test.yml | 15 ++++++ .../modification_of_wallpaper.test.yml | 16 +++++++ .../revil_common_exec_parameter.test.yml | 12 +++++ tests/endpoint/revil_registry_entry.test.yml | 12 +++++ .../wbemprox_com_object_execution.test.yml | 15 ++++++ 15 files changed, 382 insertions(+) create mode 100644 detections/endpoint/conti_common_exec_parameter.yml rename detections/{experimental => endpoint}/delete_shadowcopy_with_powershell.yml (97%) create mode 100644 detections/endpoint/known_services_killed_by_ransomware.yml create mode 100644 detections/endpoint/modification_of_wallpaper.yml create mode 100644 detections/endpoint/revil_common_exec_parameter.yml create mode 100644 detections/endpoint/revil_registry_entry.yml create mode 100644 detections/endpoint/wbemprox_com_object_execution.yml create mode 100644 stories/ransomware_revil.yml create mode 100644 tests/endpoint/conti_common_exec_parameter.test.yml create mode 100644 tests/endpoint/delete_shadowcopy_with_powershell.test.yml create mode 100644 tests/endpoint/known_services_killed_by_ransomware.test.yml create mode 100644 tests/endpoint/modification_of_wallpaper.test.yml create mode 100644 tests/endpoint/revil_common_exec_parameter.test.yml create mode 100644 tests/endpoint/revil_registry_entry.test.yml create mode 100644 tests/endpoint/wbemprox_com_object_execution.test.yml diff --git a/detections/endpoint/conti_common_exec_parameter.yml b/detections/endpoint/conti_common_exec_parameter.yml new file mode 100644 index 0000000000..6f7fdeb33d --- /dev/null +++ b/detections/endpoint/conti_common_exec_parameter.yml @@ -0,0 +1,29 @@ +name: Conti Common Exec parameter +id: 624919bc-c382-11eb-adcc-acde48001122 +version: 1 +date: '2021-06-02' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: UPDATE_DESCRIPTION +search: '| UPDATE_SPL | `conti_common_exec_parameter_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +tags: + analytic_story: + - Ransomware + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1204 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint \ No newline at end of file diff --git a/detections/experimental/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml similarity index 97% rename from detections/experimental/delete_shadowcopy_with_powershell.yml rename to detections/endpoint/delete_shadowcopy_with_powershell.yml index 3ea98860a7..32e8864922 100644 --- a/detections/experimental/delete_shadowcopy_with_powershell.yml +++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml @@ -25,6 +25,8 @@ references: tags: analytic_story: - DarkSide Ransomware + - Ransomware + - Revil Ransomware kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/known_services_killed_by_ransomware.yml b/detections/endpoint/known_services_killed_by_ransomware.yml new file mode 100644 index 0000000000..49dac371a7 --- /dev/null +++ b/detections/endpoint/known_services_killed_by_ransomware.yml @@ -0,0 +1,42 @@ +name: Known Services Killed by Ransomware +id: 3070f8e0-c528-11eb-b2a0-acde48001122 +version: 1 +date: '2021-06-04' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search detects a suspicioous termination of known services killed by ransomware before encrypting files + in a compromised machine. This technique is commonly seen in most of ransomware now a days to avoid exception error while + accessing the targetted files it wants to encrypts because of the open handle of those services to the targetted file. +search: '`wineventlog_system` EventCode=7036 Message IN ("*Volume Shadow Copy*","*VSS*", "*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*") + Message="*service entered the stopped state*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message dest Type + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `known_services_killed_by_ransomware_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the 7036 EventCode ScManager in System audit Logs from your + endpoints. +known_false_positives: admin or installing related updates may did sudden stop to list of services we monitor +references: +- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ +- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ +tags: + analytic_story: + - Ransomware + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1490 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - dest + - Type + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/modification_of_wallpaper.yml b/detections/endpoint/modification_of_wallpaper.yml new file mode 100644 index 0000000000..dc8b8f8d1f --- /dev/null +++ b/detections/endpoint/modification_of_wallpaper.yml @@ -0,0 +1,48 @@ +name: Modification Of Wallpaper +id: accb0712-c381-11eb-8e5b-acde48001122 +version: 1 +date: '2021-06-02' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic identifies suspicious modification of registry to deface or change the wallpaper of a + compromised machines as part of its payload. This technique was commonly seen in ransomware like REVIL where it + create a bitmap file contain a note that the machine was compromised and make it as a wallpaper. +search: '`sysmon` EventCode =13 (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper" AND Image != "*\\explorer.exe") + OR (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper" AND Details = "*\\temp\\*") + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Image TargetObject Details Computer process_guid process_id user_id + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `modification_of_wallpaper_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the Image, TargetObject registry key, registry Details from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: 3rd party tool may used to changed the wallpaper of the machine +references: +- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ +- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ +tags: + analytic_story: + - Ransomware + - Revil Ransomware + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1491 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Image + - TargetObject + - Details + - Computer + - process_guid + - process_id + - user_id + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/revil_common_exec_parameter.yml b/detections/endpoint/revil_common_exec_parameter.yml new file mode 100644 index 0000000000..11fd93263c --- /dev/null +++ b/detections/endpoint/revil_common_exec_parameter.yml @@ -0,0 +1,48 @@ +name: Revil Common Exec Parameter +id: 85facebe-c382-11eb-9c3e-acde48001122 +version: 1 +date: '2021-06-02' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic identifies suspicious commandline parameter that are commonly used by REVIL ransomware + to encrypts the compromise machine. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process = "*-nolan*" OR Processes.process = "*-nolocal*" OR Processes.process = "*-fast*" OR Processes.process = "*-full*" + by Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `revil_common_exec_parameter_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: third party tool may have same command line parameters as revil ransomware. +references: +- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ +- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ +tags: + analytic_story: + - Ransomware + - Revil Ransomware + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1204 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.parent_process + - Processes.dest + - Processes.user + - Processes.process_id + - Processes.process_guid + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml new file mode 100644 index 0000000000..1072f2684c --- /dev/null +++ b/detections/endpoint/revil_registry_entry.yml @@ -0,0 +1,48 @@ +name: Revil Registry Entry +id: e3d3f57a-c381-11eb-9e35-acde48001122 +version: 1 +date: '2021-06-02' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic identifies suspicious modification in registry entry to keep some malware data during its infection. + This technique seen in several apt implant, malware and ransomware like REVIL where it keep some information like the random generated + file extension it uses for all the encrypted files and ransomware notes file name in the compromised host. +search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) + as registry_key_name values(Registry.registry_path) as registry_path min(_time) + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" + AND (Registry.registry_value_name = "\.*" OR Registry.registry_value_name = "Binary Data") + by Registry.registry_value_name Registry.dest Registry.user + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `drop_dm_object_name(Registry)` + | `revil_registry_entry_filter`' +how_to_implement: to successfully implement this search, you need to be ingesting + logs with the Image, TargetObject registry key, registry Details from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ +- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ +tags: + analytic_story: + - Ransomware + - Revil Ransomware + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1112 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.dest + - Registry.user + - Registry.registry_value_name + - Registry.registry_path + - Registry.registry_key_name + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/wbemprox_com_object_execution.yml b/detections/endpoint/wbemprox_com_object_execution.yml new file mode 100644 index 0000000000..abbda880a0 --- /dev/null +++ b/detections/endpoint/wbemprox_com_object_execution.yml @@ -0,0 +1,46 @@ +name: Wbemprox COM Object Execution +id: 9d911ce0-c3be-11eb-b177-acde48001122 +version: 1 +date: '2021-06-02' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is designed to detect potential malicious process loading COM object to wbemprox.dll, +search: '`sysmon` EventCode=7 ImageLoaded IN ("*\\fastprox.dll", "*\\wbemprox.dll", "*\\wbemcomn.dll") + NOT (process_name IN ("wmiprvse.exe", "WmiApSrv.exe", "unsecapp.exe")) NOT(Image IN("*\\windows\\*","*\\program files*", "*\\wbem\\*")) + | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId Hashes IMPHASH + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `wbemprox_com_object_execution_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name and imageloaded executions from your endpoints. If you + are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: legitimate process that are not in the exception list may trigger this event. +references: +- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ +- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ +tags: + analytic_story: + - Ransomware + - Revil Ransomware + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - ImageLoaded + - process_name + - Computer + - EventCode + - Signed + - ProcessId + - Hashes + - IMPHASH + security_domain: endpoint \ No newline at end of file diff --git a/stories/ransomware_revil.yml b/stories/ransomware_revil.yml new file mode 100644 index 0000000000..f9ce340b48 --- /dev/null +++ b/stories/ransomware_revil.yml @@ -0,0 +1,25 @@ +name: Revil Ransomware +id: 817cae42-f54b-457a-8a36-fbf45521e29e +version: 1 +date: '2021-06-04' +author: Teoderick Contreras, Splunk +type: batch +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the Revil ransomware, including looking for file writes associated + with Revil, encrypting network shares, deleting shadow volume storage, registry key modification, + deleting of security logs, and more. +narrative: Revil ransomware is a RaaS,that a single group may operates and manges the development of this ransomware. + It involve the use of ransomware payloads along with exfiltration of data. Malicious actors demand payment for + ransome of data and threaten deletion and exposure of exfiltrated data. +references: +- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ +- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ +tags: + analytic_story: Revil Ransomware + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection diff --git a/tests/endpoint/conti_common_exec_parameter.test.yml b/tests/endpoint/conti_common_exec_parameter.test.yml new file mode 100644 index 0000000000..6869fb9f5b --- /dev/null +++ b/tests/endpoint/conti_common_exec_parameter.test.yml @@ -0,0 +1,12 @@ +name: Conti Common Exec parameter Unit Test +tests: +- name: Conti Common Exec parameter + file: detections/endpoint/conti_common_exec_parameter.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/endpoint/delete_shadowcopy_with_powershell.test.yml b/tests/endpoint/delete_shadowcopy_with_powershell.test.yml new file mode 100644 index 0000000000..3f36a62eff --- /dev/null +++ b/tests/endpoint/delete_shadowcopy_with_powershell.test.yml @@ -0,0 +1,12 @@ +name: Delete ShadowCopy With PowerShell Test +tests: +- name: Delete ShadowCopy With PowerShell + file: endpoint/delete_shadowcopy_with_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/known_services_killed_by_ransomware.test.yml b/tests/endpoint/known_services_killed_by_ransomware.test.yml new file mode 100644 index 0000000000..86b9a6ac3f --- /dev/null +++ b/tests/endpoint/known_services_killed_by_ransomware.test.yml @@ -0,0 +1,15 @@ +name: Known Services Killed by Ransomware Unit Test +tests: +- name: Known Services Killed by Ransomware + file: endpoint/known_services_killed_by_ransomware.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-system.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf3/windows-system.log + source: WinEventLog:System + sourcetype: WinEventLog + + + \ No newline at end of file diff --git a/tests/endpoint/modification_of_wallpaper.test.yml b/tests/endpoint/modification_of_wallpaper.test.yml new file mode 100644 index 0000000000..391f15e302 --- /dev/null +++ b/tests/endpoint/modification_of_wallpaper.test.yml @@ -0,0 +1,16 @@ +name: Modification Of Wallpaper Unit Test +tests: +- name: Modification Of Wallpaper + file: endpoint/modification_of_wallpaper.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + + + + \ No newline at end of file diff --git a/tests/endpoint/revil_common_exec_parameter.test.yml b/tests/endpoint/revil_common_exec_parameter.test.yml new file mode 100644 index 0000000000..07733818de --- /dev/null +++ b/tests/endpoint/revil_common_exec_parameter.test.yml @@ -0,0 +1,12 @@ +name: Revil Common Exec Parameter Unit Test +tests: +- name: Revil Common Exec Parameter + file: detections/endpoint/revil_common_exec_parameter.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/revil_registry_entry.test.yml b/tests/endpoint/revil_registry_entry.test.yml new file mode 100644 index 0000000000..2c0b5347d3 --- /dev/null +++ b/tests/endpoint/revil_registry_entry.test.yml @@ -0,0 +1,12 @@ +name: Revil Registry Entry Unit Test +tests: +- name: Revil Registry Entry + file: detections/endpoint/revil_registry_entry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/wbemprox_com_object_execution.test.yml b/tests/endpoint/wbemprox_com_object_execution.test.yml new file mode 100644 index 0000000000..941f217106 --- /dev/null +++ b/tests/endpoint/wbemprox_com_object_execution.test.yml @@ -0,0 +1,15 @@ +name: Wbemprox COM Object Execution Unit Test +tests: +- name: Wbemprox COM Object Execution + file: endpoint/wbemprox_com_object_execution.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf2/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + + + \ No newline at end of file From 1dc92ffce50fbff1617b6b96e3af8cc241ad62e4 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 4 Jun 2021 16:10:57 +0200 Subject: [PATCH 02/14] revil1 --- tests/endpoint/revil_registry_entry.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/revil_registry_entry.test.yml b/tests/endpoint/revil_registry_entry.test.yml index 2c0b5347d3..51368e34a8 100644 --- a/tests/endpoint/revil_registry_entry.test.yml +++ b/tests/endpoint/revil_registry_entry.test.yml @@ -1,7 +1,7 @@ name: Revil Registry Entry Unit Test tests: - name: Revil Registry Entry - file: detections/endpoint/revil_registry_entry.yml + file: endpoint/revil_registry_entry.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From 1f8cf6ad4c08fd20788c0aa3caf0834aebda8475 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 4 Jun 2021 16:14:09 +0200 Subject: [PATCH 03/14] Update revil_common_exec_parameter.test.yml --- tests/endpoint/revil_common_exec_parameter.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/revil_common_exec_parameter.test.yml b/tests/endpoint/revil_common_exec_parameter.test.yml index 07733818de..fc986ae8e6 100644 --- a/tests/endpoint/revil_common_exec_parameter.test.yml +++ b/tests/endpoint/revil_common_exec_parameter.test.yml @@ -1,7 +1,7 @@ name: Revil Common Exec Parameter Unit Test tests: - name: Revil Common Exec Parameter - file: detections/endpoint/revil_common_exec_parameter.yml + file: endpoint/revil_common_exec_parameter.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From 2af2c593376b61317a3c44b680ca88798067778d Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 4 Jun 2021 16:41:23 +0200 Subject: [PATCH 04/14] revil2 --- .../endpoint/conti_common_exec_parameter.yml | 25 ++++++++++++++++--- .../conti_common_exec_parameter.test.yml | 13 ++++++---- 2 files changed, 29 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/conti_common_exec_parameter.yml b/detections/endpoint/conti_common_exec_parameter.yml index 6f7fdeb33d..0ec39112e4 100644 --- a/detections/endpoint/conti_common_exec_parameter.yml +++ b/detections/endpoint/conti_common_exec_parameter.yml @@ -6,10 +6,20 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: UPDATE_DESCRIPTION -search: '| UPDATE_SPL | `conti_common_exec_parameter_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +description: this search detects the suspicious commandline argument of revil ransomware to encrypt specific or all local drive and network shares + of the compromised machine or host. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process = "*-m local*" OR Processes.process = "*-m net*" OR Processes.process = "*-m all*" OR Processes.process = "*-nomutex*" + by Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `conti_common_exec_parameter_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: 3rd party tool may have the following commandline parameter references: tags: analytic_story: @@ -26,4 +36,11 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.parent_process + - Processes.dest Processes.user + - Processes.process_id + - Processes.process_guid security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/conti_common_exec_parameter.test.yml b/tests/endpoint/conti_common_exec_parameter.test.yml index 6869fb9f5b..aaa068c8ce 100644 --- a/tests/endpoint/conti_common_exec_parameter.test.yml +++ b/tests/endpoint/conti_common_exec_parameter.test.yml @@ -1,12 +1,15 @@ name: Conti Common Exec parameter Unit Test tests: - name: Conti Common Exec parameter - file: detections/endpoint/conti_common_exec_parameter.yml + file: endpoint/conti_common_exec_parameter.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/inf1/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + + + \ No newline at end of file From 20cf0f41106feceb8a54a1d7b5b948aaa9d4ff94 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 4 Jun 2021 16:46:18 +0200 Subject: [PATCH 05/14] Update conti_common_exec_parameter.yml conti param --- detections/endpoint/conti_common_exec_parameter.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/conti_common_exec_parameter.yml b/detections/endpoint/conti_common_exec_parameter.yml index 0ec39112e4..d655df8813 100644 --- a/detections/endpoint/conti_common_exec_parameter.yml +++ b/detections/endpoint/conti_common_exec_parameter.yml @@ -21,6 +21,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin Sysmon TA. known_false_positives: 3rd party tool may have the following commandline parameter references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.conti tags: analytic_story: - Ransomware From 89a202914cfe1d25c200663e626e26251b4dbea8 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 7 Jun 2021 08:01:37 +0000 Subject: [PATCH 06/14] Added detection testing service results inDelete ShadowCopy With PowerShell --- detections/endpoint/delete_shadowcopy_with_powershell.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml index 32e8864922..c6ac90e8f9 100644 --- a/detections/endpoint/delete_shadowcopy_with_powershell.yml +++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml @@ -42,3 +42,6 @@ tags: - ComputerName - User security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-powershell.log From eef40d3a65ce22b5f0daec37bbf855d032b83441 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 7 Jun 2021 08:24:20 +0000 Subject: [PATCH 07/14] Added detection testing service results inRevil Registry Entry --- detections/endpoint/revil_registry_entry.yml | 29 ++++++++++---------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml index 1072f2684c..025747e416 100644 --- a/detections/endpoint/revil_registry_entry.yml +++ b/detections/endpoint/revil_registry_entry.yml @@ -6,22 +6,20 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This analytic identifies suspicious modification in registry entry to keep some malware data during its infection. - This technique seen in several apt implant, malware and ransomware like REVIL where it keep some information like the random generated - file extension it uses for all the encrypted files and ransomware notes file name in the compromised host. +description: This analytic identifies suspicious modification in registry entry to + keep some malware data during its infection. This technique seen in several apt + implant, malware and ransomware like REVIL where it keep some information like the + random generated file extension it uses for all the encrypted files and ransomware + notes file name in the compromised host. search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) - as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" - AND (Registry.registry_value_name = "\.*" OR Registry.registry_value_name = "Binary Data") - by Registry.registry_value_name Registry.dest Registry.user - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `drop_dm_object_name(Registry)` - | `revil_registry_entry_filter`' + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" + AND (Registry.registry_value_name = "\.*" OR Registry.registry_value_name = "Binary + Data") by Registry.registry_value_name Registry.dest Registry.user | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `revil_registry_entry_filter`' how_to_implement: to successfully implement this search, you need to be ingesting - logs with the Image, TargetObject registry key, registry Details from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + logs with the Image, TargetObject registry key, registry Details from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: unknown references: - https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ @@ -45,4 +43,7 @@ tags: - Registry.registry_value_name - Registry.registry_path - Registry.registry_key_name - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log From 254f233475ac0f9d1713e84f0aaffdbf751b4def Mon Sep 17 00:00:00 2001 From: root Date: Mon, 7 Jun 2021 08:41:48 +0000 Subject: [PATCH 08/14] Added detection testing service results inRevil Common Exec Parameter --- .../endpoint/revil_common_exec_parameter.yml | 26 +++++++++++-------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/revil_common_exec_parameter.yml b/detections/endpoint/revil_common_exec_parameter.yml index 11fd93263c..acf29e9078 100644 --- a/detections/endpoint/revil_common_exec_parameter.yml +++ b/detections/endpoint/revil_common_exec_parameter.yml @@ -6,20 +6,21 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This analytic identifies suspicious commandline parameter that are commonly used by REVIL ransomware - to encrypts the compromise machine. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process = "*-nolan*" OR Processes.process = "*-nolocal*" OR Processes.process = "*-fast*" OR Processes.process = "*-full*" - by Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This analytic identifies suspicious commandline parameter that are commonly + used by REVIL ransomware to encrypts the compromise machine. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process = "*-nolan*" + OR Processes.process = "*-nolocal*" OR Processes.process = "*-fast*" OR Processes.process + = "*-full*" by Processes.process_name Processes.process Processes.parent_process_name + Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `revil_common_exec_parameter_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: third party tool may have same command line parameters as revil ransomware. + Sysmon TA. +known_false_positives: third party tool may have same command line parameters as revil + ransomware. references: - https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ @@ -45,4 +46,7 @@ tags: - Processes.user - Processes.process_id - Processes.process_guid - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log From ddc74bece116d0f2395e8348fc5c616e42098712 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 7 Jun 2021 09:14:09 +0000 Subject: [PATCH 09/14] Added detection testing service results inModification Of Wallpaper --- .../endpoint/modification_of_wallpaper.yml | 29 ++++++++++--------- 1 file changed, 16 insertions(+), 13 deletions(-) diff --git a/detections/endpoint/modification_of_wallpaper.yml b/detections/endpoint/modification_of_wallpaper.yml index dc8b8f8d1f..ef7c2a7603 100644 --- a/detections/endpoint/modification_of_wallpaper.yml +++ b/detections/endpoint/modification_of_wallpaper.yml @@ -6,19 +6,19 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This analytic identifies suspicious modification of registry to deface or change the wallpaper of a - compromised machines as part of its payload. This technique was commonly seen in ransomware like REVIL where it - create a bitmap file contain a note that the machine was compromised and make it as a wallpaper. -search: '`sysmon` EventCode =13 (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper" AND Image != "*\\explorer.exe") - OR (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper" AND Details = "*\\temp\\*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Image TargetObject Details Computer process_guid process_id user_id - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This analytic identifies suspicious modification of registry to deface + or change the wallpaper of a compromised machines as part of its payload. This technique + was commonly seen in ransomware like REVIL where it create a bitmap file contain + a note that the machine was compromised and make it as a wallpaper. +search: '`sysmon` EventCode =13 (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper" + AND Image != "*\\explorer.exe") OR (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper" + AND Details = "*\\temp\\*") | stats count min(_time) as firstTime max(_time) as + lastTime by EventCode Image TargetObject Details Computer process_guid process_id + user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `modification_of_wallpaper_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the Image, TargetObject registry key, registry Details from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + logs with the Image, TargetObject registry key, registry Details from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: 3rd party tool may used to changed the wallpaper of the machine references: - https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ @@ -44,5 +44,8 @@ tags: - Computer - process_guid - process_id - - user_id - security_domain: endpoint \ No newline at end of file + - user_id + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log From 3023439042156fa9ab8a592a14c5f79cddadaddc Mon Sep 17 00:00:00 2001 From: root Date: Mon, 7 Jun 2021 09:34:11 +0000 Subject: [PATCH 10/14] Added detection testing service results inWbemprox COM Object Execution --- .../wbemprox_com_object_execution.yml | 23 +++++++++++-------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/wbemprox_com_object_execution.yml b/detections/endpoint/wbemprox_com_object_execution.yml index abbda880a0..698fdcdbda 100644 --- a/detections/endpoint/wbemprox_com_object_execution.yml +++ b/detections/endpoint/wbemprox_com_object_execution.yml @@ -6,17 +6,19 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search is designed to detect potential malicious process loading COM object to wbemprox.dll, -search: '`sysmon` EventCode=7 ImageLoaded IN ("*\\fastprox.dll", "*\\wbemprox.dll", "*\\wbemcomn.dll") - NOT (process_name IN ("wmiprvse.exe", "WmiApSrv.exe", "unsecapp.exe")) NOT(Image IN("*\\windows\\*","*\\program files*", "*\\wbem\\*")) - | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId Hashes IMPHASH - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: this search is designed to detect potential malicious process loading + COM object to wbemprox.dll, +search: '`sysmon` EventCode=7 ImageLoaded IN ("*\\fastprox.dll", "*\\wbemprox.dll", + "*\\wbemcomn.dll") NOT (process_name IN ("wmiprvse.exe", "WmiApSrv.exe", "unsecapp.exe")) + NOT(Image IN("*\\windows\\*","*\\program files*", "*\\wbem\\*")) | stats count min(_time) + as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode + Signed ProcessId Hashes IMPHASH | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wbemprox_com_object_execution_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: legitimate process that are not in the exception list may trigger this event. +known_false_positives: legitimate process that are not in the exception list may trigger + this event. references: - https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ @@ -39,8 +41,11 @@ tags: - process_name - Computer - EventCode - - Signed + - Signed - ProcessId - Hashes - IMPHASH - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf2/windows-sysmon.log From d92b7134977d4ef2cca1ea503d01a099bd6f67e0 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 7 Jun 2021 09:56:10 +0000 Subject: [PATCH 11/14] Added detection testing service results inKnown Services Killed by Ransomware --- .../known_services_killed_by_ransomware.yml | 28 +++++++++++-------- 1 file changed, 16 insertions(+), 12 deletions(-) diff --git a/detections/endpoint/known_services_killed_by_ransomware.yml b/detections/endpoint/known_services_killed_by_ransomware.yml index 49dac371a7..623dc11b6c 100644 --- a/detections/endpoint/known_services_killed_by_ransomware.yml +++ b/detections/endpoint/known_services_killed_by_ransomware.yml @@ -6,19 +6,20 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search detects a suspicioous termination of known services killed by ransomware before encrypting files - in a compromised machine. This technique is commonly seen in most of ransomware now a days to avoid exception error while - accessing the targetted files it wants to encrypts because of the open handle of those services to the targetted file. -search: '`wineventlog_system` EventCode=7036 Message IN ("*Volume Shadow Copy*","*VSS*", "*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*") - Message="*service entered the stopped state*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message dest Type - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` +description: this search detects a suspicioous termination of known services killed + by ransomware before encrypting files in a compromised machine. This technique is + commonly seen in most of ransomware now a days to avoid exception error while accessing + the targetted files it wants to encrypts because of the open handle of those services + to the targetted file. +search: '`wineventlog_system` EventCode=7036 Message IN ("*Volume Shadow Copy*","*VSS*", + "*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*") Message="*service + entered the stopped state*" | stats count min(_time) as firstTime max(_time) as + lastTime by EventCode Message dest Type | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `known_services_killed_by_ransomware_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the 7036 EventCode ScManager in System audit Logs from your - endpoints. -known_false_positives: admin or installing related updates may did sudden stop to list of services we monitor + logs with the 7036 EventCode ScManager in System audit Logs from your endpoints. +known_false_positives: admin or installing related updates may did sudden stop to + list of services we monitor references: - https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ @@ -39,4 +40,7 @@ tags: - Message - dest - Type - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf3/windows-system.log From 54657e9d13d6aa389da8e47ab05dd17c76686e38 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 7 Jun 2021 10:18:21 +0000 Subject: [PATCH 12/14] Added detection testing service results inConti Common Exec parameter --- .../endpoint/conti_common_exec_parameter.yml | 24 ++++++++++--------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/conti_common_exec_parameter.yml b/detections/endpoint/conti_common_exec_parameter.yml index d655df8813..7d78c19edd 100644 --- a/detections/endpoint/conti_common_exec_parameter.yml +++ b/detections/endpoint/conti_common_exec_parameter.yml @@ -6,19 +6,20 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search detects the suspicious commandline argument of revil ransomware to encrypt specific or all local drive and network shares - of the compromised machine or host. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process = "*-m local*" OR Processes.process = "*-m net*" OR Processes.process = "*-m all*" OR Processes.process = "*-nomutex*" - by Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: this search detects the suspicious commandline argument of revil ransomware + to encrypt specific or all local drive and network shares of the compromised machine + or host. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process = "*-m local*" + OR Processes.process = "*-m net*" OR Processes.process = "*-m all*" OR Processes.process + = "*-nomutex*" by Processes.process_name Processes.process Processes.parent_process_name + Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `conti_common_exec_parameter_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: 3rd party tool may have the following commandline parameter references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.conti @@ -26,7 +27,7 @@ tags: analytic_story: - Ransomware dataset: - - UPDATE_DATASET_URL + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/inf1/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -44,4 +45,5 @@ tags: - Processes.dest Processes.user - Processes.process_id - Processes.process_guid - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed From 8eb50cb27ce5fa0ae48da9955d07b45583090d42 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 9 Jun 2021 10:28:51 -0700 Subject: [PATCH 13/14] Update conti_common_exec_parameter.yml --- detections/endpoint/conti_common_exec_parameter.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/conti_common_exec_parameter.yml b/detections/endpoint/conti_common_exec_parameter.yml index 7d78c19edd..2017cc33cf 100644 --- a/detections/endpoint/conti_common_exec_parameter.yml +++ b/detections/endpoint/conti_common_exec_parameter.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search detects the suspicious commandline argument of revil ransomware +description: This search detects the suspicious commandline argument of revil ransomware to encrypt specific or all local drive and network shares of the compromised machine or host. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) @@ -20,7 +20,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: 3rd party tool may have the following commandline parameter +known_false_positives: 3rd party tool may have commandline parameter that can trigger this detection. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.conti tags: From 44b134251f7406f5d93cd391715b1e2497023377 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 9 Jun 2021 10:32:15 -0700 Subject: [PATCH 14/14] Update known_services_killed_by_ransomware.yml --- detections/endpoint/known_services_killed_by_ransomware.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/known_services_killed_by_ransomware.yml b/detections/endpoint/known_services_killed_by_ransomware.yml index 623dc11b6c..5e9008be07 100644 --- a/detections/endpoint/known_services_killed_by_ransomware.yml +++ b/detections/endpoint/known_services_killed_by_ransomware.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search detects a suspicioous termination of known services killed +description: This search detects a suspicioous termination of known services killed by ransomware before encrypting files in a compromised machine. This technique is commonly seen in most of ransomware now a days to avoid exception error while accessing the targetted files it wants to encrypts because of the open handle of those services @@ -18,8 +18,8 @@ search: '`wineventlog_system` EventCode=7036 Message IN ("*Volume Shadow Copy*", | `known_services_killed_by_ransomware_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the 7036 EventCode ScManager in System audit Logs from your endpoints. -known_false_positives: admin or installing related updates may did sudden stop to - list of services we monitor +known_false_positives: Admin activities or installing related updates may do a sudden stop to + list of services we monitor. references: - https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/