Branch was auto-updated.

detections/endpoint/living_off_the_land.yml

@@ -0,0 +1,68 @@
+name: Living Off The Land
+id: 1be30d80-3a39-4df9-9102-64a467b24abc
+version: 1
+date: '2022-07-08'
+author: Michael Haag, Splunk
+type: Correlation
+datamodel:
+  - Risk
+description: The following correlation identifies a distinct amount of analytics associated with the Living Off The Land analytic story that identify potentially suspicious behavior. 
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Risk.All_Risk where All_Risk.analyticstories="Living Off The Land" All_Risk.risk_object_type="system" by All_Risk.risk_object All_Risk.annotations.mitre_attack.mitre_tactic source 
+  | `drop_dm_object_name(All_Risk)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | stats  values(source) as detection_name values(annotations.mitre_attack.mitre_tactic) as tactics values(firstTime) as firstTime values(lastTime) as lastTime dc(annotations.mitre_attack.mitre_tactic) as distinct_tactics dc(source) as distinct_detection_name by risk_object
+  | where distinct_detection_name >= 2
+  | `living_off_the_land_filter`'
+how_to_implement: To implement this correlation search a user needs to enable all
+  detections in the Living Off The Land Analytic Story and confirm it is generating risk events.
+  A simple search `index=risk analyticstories="Living Off The Land"` should contain
+  events.
+known_false_positives: There are no known false positive for this search, but it could
+  contain false positives as multiple detections can trigger and not have successful
+  exploitation. Modify the static value distinct_detection_name to a higher value. It is also required to tune analytics that are also tagged to ensure volume is never too much.
+references:
+  - https://www.splunk.com/en_us/blog/security/living-off-the-land-threat-research-february-2022-release.html
+  - https://research.splunk.com/stories/living_off_the_land/
+tags:
+  analytic_story:
+  - Living Off The Land
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  dataset:
+    - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1218/living_off_the_land/lolbinrisk.log
+  impact: 90
+  kill_chain_phases:
+  - Reconnaissance
+  - Exploitation
+  message: An increase of Living Off The Land behavior has been detected on $affected_systems$
+  mitre_attack_id:
+  - T1105
+  - T1190
+  - T1059
+  nist:
+  - DE.CM
+  observable:
+  - name: affected_systems
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Risk.analyticstories
+  - All_Risk.risk_object_type
+  - All_Risk.risk_object
+  - All_Risk.annotations.mitre_attack.mitre_tactic
+  - source
+  risk_score: 63
+  security_domain: endpoint

detections/endpoint/windows_identify_protocol_handlers.yml

@@ -0,0 +1,86 @@
+name: Windows Identify Protocol Handlers
+id: bd5c311e-a6ea-48ae-a289-19a3398e3648
+version: 1
+date: '2022-07-11'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: 'The following hunting analytic will identify any protocol handlers utilized on the command-line. A protocol handler is an application that knows how to handle particular types of links: for example, a mail client is a protocol handler for "mailto:" links. When the user clicks a "mailto:" link, the browser opens the application selected as the handler for the "mailto:" protocol (or offers them a choice of handlers, depending on their settings).
+  To identify protocol handlers we can use NirSoft https://www.nirsoft.net/utils/url_protocol_view.html URLProtocolView or query the registry using PowerShell: get-Item Registry::HKEY_CLASSES_ROOT\* | Select-Object "Property","PSChildName" | Where-Object -Property Property -Match "^URL*" #|Export-Csv -path c:\temp\url_all.csv. Note my query is limited to URL in the property to limit the scope of this query to similar handlers as ms-msdt.'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process) as process values(Processes.parent_process) as parent_process from datamodel=Endpoint.Processes  by Processes.dest Processes.user Processes.process_name Processes.process 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `drop_dm_object_name(Processes)` 
+  | lookup windows_protocol_handlers handler AS process OUTPUT handler ishandler | where ishandler="TRUE"
+  | `windows_identify_protocol_handlers_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives will be found. https and http is a URL Protocol handler that will trigger this analytic. Tune based on process or command-line.
+references:
+  - https://www.oreilly.com/library/view/learning-java/1565927184/apas02.html
+  - https://blogs.windows.com/msedgedev/2022/01/20/getting-started-url-protocol-handlers-microsoft-edge/
+  - https://github.com/Mr-Un1k0d3r/PoisonHandler
+  - https://www.mdsec.co.uk/2021/03/phishing-users-to-take-a-test/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-5---protocolhandlerexe-downloaded-a-suspicious-file
+  - https://techcommunity.microsoft.com/t5/windows-it-pro-blog/disabling-the-msix-ms-appinstaller-protocol-handler/ba-p/3119479
+  - https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug
+  - https://parsiya.net/blog/2021-03-17-attack-surface-analysis-part-2-custom-protocol-handlers/
+tags:
+  analytic_story:
+  - Living Off The Land
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 20
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/protocol_handlers/protocolhandlers.log
+  impact: 30
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing a protocol handler. 
+  mitre_attack_id:
+  - T1059
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process Name
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 6
+  security_domain: endpoint
+

lookups/windows_protocol_handlers.csv

@@ -0,0 +1,205 @@
+handler,ishandler
+"*bingmaps:*",TRUE
+"*calculator:*",TRUE
+"*callto:*",TRUE
+"*conf:*",TRUE
+"*DLNA-PLAYSINGLE:*",TRUE
+"*Explorer.AssocActionId.BurnSelection:*",TRUE
+"*Explorer.AssocActionId.EraseDisc:*",TRUE
+"*Explorer.AssocActionId.ZipSelection:*",TRUE
+"*Explorer.AssocProtocol.search-ms:*",TRUE
+"*Explorer.BurnSelection:*",TRUE
+"*Explorer.EraseDisc:*",TRUE
+"*Explorer.ZipSelection:*",TRUE
+"*feed:*",TRUE
+"*feeds:*",TRUE
+"*file:*",TRUE
+"*FirefoxURL-308046B0AF4A39CB:*",TRUE
+"*ftp:*",TRUE
+"*grvopen:*",TRUE
+"*http:*",TRUE
+"*https:*",TRUE
+"*iehistory:*",TRUE
+"*ierss:*",TRUE
+"*im:*",TRUE
+"*LDAP:*",TRUE
+"*Lync15:*",TRUE
+"*Lync15classic:*",TRUE
+"*ma-chan:*",TRUE
+"*ma-filelink:*",TRUE
+"*mailto:*",TRUE
+"*mapi:*",TRUE
+"*mapi15:*",TRUE
+"*mapi16:*",TRUE
+"*mk:*",TRUE
+"*MMS:*",TRUE
+"*ms-access:*",TRUE
+"*ms-actioncenter:*",TRUE
+"*ms-apprep:*",TRUE
+"*ms-availablenetworks:*",TRUE
+"*ms-cortana:*",TRUE
+"*ms-cxh:*",TRUE
+"*ms-device-enrollment:*",TRUE
+"*ms-excel:*",TRUE
+"*ms-msdt:*",TRUE
+"*ms-penworkspace:*",TRUE
+"*ms-powerpoint:*",TRUE
+"*ms-publisher:*",TRUE
+"*ms-settings:*",TRUE
+"*ms-settings-airplanemode:*",TRUE
+"*ms-settings-bluetooth:*",TRUE
+"*ms-settings-cellular:*",TRUE
+"*ms-settings-connectabledevices:*",TRUE
+"*ms-settings-displays-topology:*",TRUE
+"*ms-settings-emailandaccounts:*",TRUE
+"*ms-settings-language:*",TRUE
+"*ms-settings-location:*",TRUE
+"*ms-settings-lock:*",TRUE
+"*ms-settings-mobilehotspot:*",TRUE
+"*ms-settings-notifications:*",TRUE
+"*ms-settings-power:*",TRUE
+"*ms-settings-privacy:*",TRUE
+"*ms-settings-proximity:*",TRUE
+"*ms-settings-screenrotation:*",TRUE
+"*ms-settings-wifi:*",TRUE
+"*ms-settings-workplace:*",TRUE
+"*ms-teams:*",TRUE
+"*ms-windows-search:*",TRUE
+"*ms-word:*",TRUE
+"*mssharepointclient:*",TRUE
+"*msteams:*",TRUE
+"*mswindowsmusic:*",TRUE
+"*mswindowsvideo:*",TRUE
+"*odopen:*",TRUE
+"*OneIndex16:*",TRUE
+"*OneNote:*",TRUE
+"*OneNote.URL.16:*",TRUE
+"*OneNoteDesktop:*",TRUE
+"*OneNoteDesktop.URL.16:*",TRUE
+"*Outlook.URL.feed.15:*",TRUE
+"*Outlook.URL.mailto.15:*",TRUE
+"*Outlook.URL.stssync.15:*",TRUE
+"*Outlook.URL.webcal.15:*",TRUE
+"*res:*",TRUE
+"*rlogin:*",TRUE
+"*search:*",TRUE
+"*search-ms:*",TRUE
+"*sip:*",TRUE
+"*sips:*",TRUE
+"*skypecast15:*",TRUE
+"*stssync:*",TRUE
+"*tbauth:*",TRUE
+"*tel:*",TRUE
+"*telnet:*",TRUE
+"*tn3270:*",TRUE
+"*webcal:*",TRUE
+"*webcals:*",TRUE
+"*windows.tbauth:*",TRUE
+"*WMP11.AssocProtocol.DLNA-PLAYSINGLE:*",TRUE
+"*WMP11.AssocProtocol.MMS:*",TRUE
+"*Word:*",TRUE
+"*xbox-tcui:*",TRUE
+"*appinstaller.oauth2:*",TRUE
+"*bingnews:*",TRUE
+"*bingweather:*",TRUE
+"*feedback-hub:*",TRUE
+"*git-client:*",TRUE
+"*IE.HTTP:*",TRUE
+"*insiderhub:*",TRUE
+"*microsoft-edge:*",TRUE
+"*microsoft-edge-holographic:*",TRUE
+"*microsoft.windows.camera:*",TRUE
+"*microsoft.windows.camera.multipicker:*",TRUE
+"*microsoft.windows.camera.picker:*",TRUE
+"*microsoft.windows.photos.crop:*",TRUE
+"*microsoft.windows.photos.picker:*",TRUE
+"*microsoft.windows.photos.videoedit:*",TRUE
+"*Microsoft.Workfolders:*",TRUE
+"*microsoftvideo:*",TRUE
+"*ms-aad-brokerplugin:*",TRUE
+"*ms-appinstaller:*",TRUE
+"*ms-calculator:*",TRUE
+"*ms-clock:*",TRUE
+"*ms-contact-support:*",TRUE
+"*ms-cortana2:*",TRUE
+"*ms-cxh-full:*",TRUE
+"*ms-default-location:*",TRUE
+"*ms-device-enrollment2:*",TRUE
+"*ms-drive-to:*",TRUE
+"*ms-edu-secureassessment:*",TRUE
+"*ms-eyecontrolspeech:*",TRUE
+"*ms-gamebar:*",TRUE
+"*ms-gamebarservices:*",TRUE
+"*ms-gamingoverlay:*",TRUE
+"*ms-get-started:*",TRUE
+"*ms-getoffice:*",TRUE
+"*ms-inputapp:*",TRUE
+"*ms-insights:*",TRUE
+"*ms-meetnow:*",TRUE
+"*ms-meetnowflyout:*",TRUE
+"*ms-mmsys:*",TRUE
+"*ms-msime-imepad:*",TRUE
+"*ms-msime-imjpdct:*",TRUE
+"*ms-officeapp:*",TRUE
+"*ms-officecmd:*",TRUE
+"*ms-oobenetwork:*",TRUE
+"*ms-people:*",TRUE
+"*ms-perception-simulation:*",TRUE
+"*ms-phone:*",TRUE
+"*ms-photos:*",TRUE
+"*ms-powerautomate:*",TRUE
+"*ms-print-addprinter:*",TRUE
+"*ms-print-printjobs:*",TRUE
+"*ms-quick-assist:*",TRUE
+"*ms-rdx-document:*",TRUE
+"*ms-retaildemo-launchbioenrollment:*",TRUE
+"*ms-retaildemo-launchstart:*",TRUE
+"*ms-screenclip:*",TRUE
+"*ms-screensketch:*",TRUE
+"*ms-search:*",TRUE
+"*ms-sttoverlay:*",TRUE
+"*ms-taskswitcher:*",TRUE
+"*ms-to-do:*",TRUE
+"*ms-todo:*",TRUE
+"*ms-unistore-email:*",TRUE
+"*ms-virtualtouchpad:*",TRUE
+"*ms-walk-to:*",TRUE
+"*ms-wcrv:*",TRUE
+"*ms-windows-store:*",TRUE
+"*ms-windows-store-deskext:*",TRUE
+"*ms-windows-store2:*",TRUE
+"*ms-wpc:*",TRUE
+"*ms-wpdrmv:*",TRUE
+"*ms-wxh:*",TRUE
+"*ms-xbet-survey:*",TRUE
+"*ms-xbl-3d8b930f:*",TRUE
+"*ms-xgpueject:*",TRUE
+"*msgamepass:*",TRUE
+"*msgamingapp:*",TRUE
+"*msnews:*",TRUE
+"*msnnews:*",TRUE
+"*msnweather:*",TRUE
+"*msxbox:*",TRUE
+"*outlookaccounts:*",TRUE
+"*outlookcal:*",TRUE
+"*outlookmail:*",TRUE
+"*read:*",TRUE
+"*vscode:*",TRUE
+"*vsls:*",TRUE
+"*vstfs:*",TRUE
+"*vsweb:*",TRUE
+"*windows-feedback:*",TRUE
+"*windowsdefender:*",TRUE
+"*xboxliveapp-1297287741:*",TRUE
+"*zune:*",TRUE
+"*SecureBrowser.security.getDeviceInfo:*",TRUE
+"*SecureBrowser.security.getMACAddress:*",TRUE
+"*SecureBrowser.security.examineProcessList:*",TRUE
+"*SecureBrowser.security.isRemoteSession:*",TRUE
+"*SecureBrowser.security.isVMSession:*",TRUE
+"*JavaScript:*",TRUE
+"*vbscript:*",TRUE
+"*about:*",TRUE
+"*ms-its:*",TRUE
+"*its:*",TRUE
+"*mk:@MSITStore:*",TRUE

lookups/windows_protocol_handlers.yml

@@ -0,0 +1,7 @@
+description: A list of Windows Protocol Handlers
+filename: windows_protocol_handlers.csv
+name: windows_protocol_handlers
+default_match: 'false'
+match_type: WILDCARD(handler)
+min_matches: 1
+case_sensitive_match: 'false'

tests/endpoint/living_off_the_land.test.yml

@@ -0,0 +1,12 @@
+name: Living Off The Land Unit Test
+tests:
+- name: Living Off The Land
+  file: endpoint/living_off_the_land.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: lolbinrisk.log
+    data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1218/living_off_the_land/lolbinrisk.log
+    source: lotl
+    sourcetype: stash

tests/endpoint/windows_identify_protocol_handlers.test.yml

@@ -0,0 +1,13 @@
+name: Windows Identify Protocol Handlers Unit Test
+tests:
+- name: Windows Identify Protocol Handlers
+  file: endpoint/windows_identify_protocol_handlers.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: msdt.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/protocol_handlers/protocolhandlers.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true