From f18561b7e9c4197c388fe51baddb52979f5e13aa Mon Sep 17 00:00:00 2001 From: Philip Royer <31521707+philroyer-phantom@users.noreply.github.com> Date: Tue, 9 Nov 2021 08:40:12 -0500 Subject: [PATCH 1/4] Update cmdline_tool_not_executed_in_cmd_shell.yml Just some minor editing of the description. Not trying to change the meaning, just make it a little more readable. --- .../cmdline_tool_not_executed_in_cmd_shell.yml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml index 67ac89ff4d..bb22a79941 100644 --- a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml +++ b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml @@ -6,12 +6,12 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a suspicious parent process execution of commandline - tool not in shell commandline. This technique was seen in FIN7 JSSLoader .net compile - payload where it run ipconfig.exe and systeminfo.exe using .net application. This - event cause some good TTP since those tool are commonly run in commandline not by - another application. This TTP is a good indicator for application gather host information - either an attacker or an automated tool made by admin. +description: This search detects a suspicious process execution of a command line tool executed + with a parent process not matching CMD, PowerShell, or Explorer. This technique was seen in FIN7's + JSSLoader .NET payload where it spawned ipconfig.exe and systeminfo.exe. This event stands out as a + TTP since these tools are commonly run with a command line or Explorer parent, and not by another + application. This TTP is a good indicator for an attack gathering host information, but one possible + false positive might be an automated tool used by a system administator. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = "ipconfig.exe" OR Processes.process_name = "systeminfo.exe") AND NOT (Processes.parent_process_name @@ -23,7 +23,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: network operator or admin may create this type of tool to gather +known_false_positives: A network operator or systems administrator may create this type of tool to gather host information references: - https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html From 825c69caeb88d679f02362026069b4d2a73c43a2 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 9 Nov 2021 15:06:29 +0100 Subject: [PATCH 2/4] Update cmdline_tool_not_executed_in_cmd_shell.yml --- detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml index bb22a79941..3cf1f145b1 100644 --- a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml +++ b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This search detects a suspicious process execution of a command line tool executed +description: This search detects a suspicious process execution of a console tool/application executed with a parent process not matching CMD, PowerShell, or Explorer. This technique was seen in FIN7's JSSLoader .NET payload where it spawned ipconfig.exe and systeminfo.exe. This event stands out as a TTP since these tools are commonly run with a command line or Explorer parent, and not by another From 10d9734d739280f80f02b6388f13ce355e6a3cd9 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 9 Nov 2021 09:11:35 -0700 Subject: [PATCH 3/4] Update cmdline_tool_not_executed_in_cmd_shell.yml --- ...cmdline_tool_not_executed_in_cmd_shell.yml | 49 ++++++++++--------- 1 file changed, 27 insertions(+), 22 deletions(-) diff --git a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml index 3cf1f145b1..b35368c68d 100644 --- a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml +++ b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml @@ -6,25 +6,19 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This search detects a suspicious process execution of a console tool/application executed - with a parent process not matching CMD, PowerShell, or Explorer. This technique was seen in FIN7's - JSSLoader .NET payload where it spawned ipconfig.exe and systeminfo.exe. This event stands out as a - TTP since these tools are commonly run with a command line or Explorer parent, and not by another - application. This TTP is a good indicator for an attack gathering host information, but one possible - false positive might be an automated tool used by a system administator. +description: 'The following analytic identifies a non-standard parent process (not matching CMD, PowerShell, or Explorer) spawning `ipconfig.exe` or `systeminfo.exe`. This particular behavior was seen in FIN7''s JSSLoader .NET payload. This is also typically seen when an adversary is injected into another process performing different discovery techniques. + This event stands out as a TTP since these tools are commonly executed with a shell application or Explorer parent, and not by another + application. This TTP is a good indicator for an adversary gathering host information, but one possible + false positive might be an automated tool used by a system administator.' search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = "ipconfig.exe" OR Processes.process_name = "systeminfo.exe") AND NOT (Processes.parent_process_name - = "cmd.exe" OR Processes.parent_process_name = "powershell*" OR Processes.parent_process_name - = "explorer.exe") by Processes.parent_process_name Processes.parent_process Processes.process_name + = "cmd.exe" OR Processes.parent_process_name = "powershell*" OR Processes.parent_process_name="pwsh.exe" OR Processes.parent_process_name + = "explorer.exe") by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name Processes.process_id Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmdline_tool_not_executed_in_cmd_shell_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: A network operator or systems administrator may create this type of tool to gather - host information +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: A network operator or systems administrator may utilize an automated host discovery application that may generate false positives. Filter as needed. references: - https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html - https://attack.mitre.org/groups/G0046/ @@ -41,8 +35,7 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: parent process name $parent_process_name$ with child process $process_name$ - to execute commandline tool in $dest$ + message: A non-standard parent process $parent_process_name$ spawned child process $process_name$ to execute command-line tool on $dest$. mitre_attack_id: - T1059 - T1059.007 @@ -55,18 +48,30 @@ tags: type: User role: - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud required_fields: - _time - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process_id - - Processes.process - Processes.dest - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id risk_score: 56 - security_domain: endpoint + security_domain: endpoint \ No newline at end of file From 8c756bda52e20eb75f9239d67acef0c57fb56f99 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 9 Nov 2021 16:33:22 +0000 Subject: [PATCH 4/4] Added detection testing service results inCmdline Tool Not Executed In CMD Shell --- ...cmdline_tool_not_executed_in_cmd_shell.yml | 42 ++++++++++++------- 1 file changed, 27 insertions(+), 15 deletions(-) diff --git a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml index b35368c68d..36918e047d 100644 --- a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml +++ b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml @@ -6,19 +6,30 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: 'The following analytic identifies a non-standard parent process (not matching CMD, PowerShell, or Explorer) spawning `ipconfig.exe` or `systeminfo.exe`. This particular behavior was seen in FIN7''s JSSLoader .NET payload. This is also typically seen when an adversary is injected into another process performing different discovery techniques. - This event stands out as a TTP since these tools are commonly executed with a shell application or Explorer parent, and not by another - application. This TTP is a good indicator for an adversary gathering host information, but one possible - false positive might be an automated tool used by a system administator.' +description: The following analytic identifies a non-standard parent process (not + matching CMD, PowerShell, or Explorer) spawning `ipconfig.exe` or `systeminfo.exe`. + This particular behavior was seen in FIN7's JSSLoader .NET payload. This is also + typically seen when an adversary is injected into another process performing different + discovery techniques. This event stands out as a TTP since these tools are commonly + executed with a shell application or Explorer parent, and not by another application. + This TTP is a good indicator for an adversary gathering host information, but one + possible false positive might be an automated tool used by a system administator. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = "ipconfig.exe" OR Processes.process_name = "systeminfo.exe") AND NOT (Processes.parent_process_name - = "cmd.exe" OR Processes.parent_process_name = "powershell*" OR Processes.parent_process_name="pwsh.exe" OR Processes.parent_process_name - = "explorer.exe") by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name - Processes.process_id Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)` + = "cmd.exe" OR Processes.parent_process_name = "powershell*" OR Processes.parent_process_name="pwsh.exe" + OR Processes.parent_process_name = "explorer.exe") by Processes.parent_process_name + Processes.parent_process Processes.process_name Processes.original_file_name Processes.process_id + Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmdline_tool_not_executed_in_cmd_shell_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: A network operator or systems administrator may utilize an automated host discovery application that may generate false positives. Filter as needed. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: A network operator or systems administrator may utilize an + automated host discovery application that may generate false positives. Filter as + needed. references: - https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html - https://attack.mitre.org/groups/G0046/ @@ -35,7 +46,8 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: A non-standard parent process $parent_process_name$ spawned child process $process_name$ to execute command-line tool on $dest$. + message: A non-standard parent process $parent_process_name$ spawned child process + $process_name$ to execute command-line tool on $dest$. mitre_attack_id: - T1059 - T1059.007 @@ -64,14 +76,14 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id risk_score: 56 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint