From 8ec266233b1d4668932cf7ad60292c43435fdd4e Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 12 Jul 2022 14:43:39 -0600 Subject: [PATCH 1/7] Windows Protocol Handler --- .../windows_identify_protocol_handlers.yml | 89 ++++++++ lookups/windows_protocol_handlers.csv | 205 ++++++++++++++++++ lookups/windows_protocol_handlers.yml | 7 + ...indows_identify_protocol_handlers.test.yml | 13 ++ 4 files changed, 314 insertions(+) create mode 100644 detections/endpoint/windows_identify_protocol_handlers.yml create mode 100644 lookups/windows_protocol_handlers.csv create mode 100644 lookups/windows_protocol_handlers.yml create mode 100644 tests/endpoint/windows_identify_protocol_handlers.test.yml diff --git a/detections/endpoint/windows_identify_protocol_handlers.yml b/detections/endpoint/windows_identify_protocol_handlers.yml new file mode 100644 index 0000000000..783604090e --- /dev/null +++ b/detections/endpoint/windows_identify_protocol_handlers.yml @@ -0,0 +1,89 @@ +name: Windows Identify Protocol Handlers +id: bd5c311e-a6ea-48ae-a289-19a3398e3648 +version: 1 +date: '2022-07-11' +author: Michael Haag, Splunk +type: Hunting +datamodel: +- Endpoint +description: 'The following hunting analytic will identify any protocol handlers utilized on the command-line. A protocol handler is an application that knows how to handle particular types of links: for example, a mail client is a protocol handler for "mailto:" links. When the user clicks a "mailto:" link, the browser opens the application selected as the handler for the "mailto:" protocol (or offers them a choice of handlers, depending on their settings). + To identify protocol handlers we can use NirSoft https://www.nirsoft.net/utils/url_protocol_view.html URLProtocolView or query the registry using PowerShell: get-Item Registry::HKEY_CLASSES_ROOT\* | Select-Object "Property","PSChildName" | Where-Object -Property Property -Match "^URL*" #|Export-Csv -path c:\temp\url_all.csv. Note my query is limited to URL in the property to limit the scope of this query to similar handlers as ms-msdt.' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime values(Processes.process) as process values(Processes.parent_process) + as parent_process from datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.process_name + Processes.process + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `drop_dm_object_name(Processes)` + | lookup windows_protocol_handlers handler AS process OUTPUT handler ishandler | where ishandler="TRUE" + | `windows_identify_protocol_handlers_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives will be found. https and http is a URL Protocol handler that will trigger this analytic. Tune based on process or command-line. +references: + - https://www.oreilly.com/library/view/learning-java/1565927184/apas02.html + - https://blogs.windows.com/msedgedev/2022/01/20/getting-started-url-protocol-handlers-microsoft-edge/ + - https://github.com/Mr-Un1k0d3r/PoisonHandler + - https://www.mdsec.co.uk/2021/03/phishing-users-to-take-a-test/ + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-5---protocolhandlerexe-downloaded-a-suspicious-file + - https://techcommunity.microsoft.com/t5/windows-it-pro-blog/disabling-the-msix-ms-appinstaller-protocol-handler/ba-p/3119479 + - https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug + - https://parsiya.net/blog/2021-03-17-attack-surface-analysis-part-2-custom-protocol-handlers/ +tags: + analytic_story: + - Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 20 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - UPDATE_DATASET_URL + impact: 30 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing a protocol handler. + mitre_attack_id: + - T1059 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process Name + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 6 + security_domain: endpoint + diff --git a/lookups/windows_protocol_handlers.csv b/lookups/windows_protocol_handlers.csv new file mode 100644 index 0000000000..4f809b8b61 --- /dev/null +++ b/lookups/windows_protocol_handlers.csv @@ -0,0 +1,205 @@ +handler,ishandler +"*bingmaps:*",TRUE +"*calculator:*",TRUE +"*callto:*",TRUE +"*conf:*",TRUE +"*DLNA-PLAYSINGLE:*",TRUE +"*Explorer.AssocActionId.BurnSelection:*",TRUE +"*Explorer.AssocActionId.EraseDisc:*",TRUE +"*Explorer.AssocActionId.ZipSelection:*",TRUE +"*Explorer.AssocProtocol.search-ms:*",TRUE +"*Explorer.BurnSelection:*",TRUE +"*Explorer.EraseDisc:*",TRUE +"*Explorer.ZipSelection:*",TRUE +"*feed:*",TRUE +"*feeds:*",TRUE +"*file:*",TRUE +"*FirefoxURL-308046B0AF4A39CB:*",TRUE +"*ftp:*",TRUE +"*grvopen:*",TRUE +"*http:*",TRUE +"*https:*",TRUE +"*iehistory:*",TRUE +"*ierss:*",TRUE +"*im:*",TRUE +"*LDAP:*",TRUE +"*Lync15:*",TRUE +"*Lync15classic:*",TRUE +"*ma-chan:*",TRUE +"*ma-filelink:*",TRUE +"*mailto:*",TRUE +"*mapi:*",TRUE +"*mapi15:*",TRUE +"*mapi16:*",TRUE +"*mk:*",TRUE +"*MMS:*",TRUE +"*ms-access:*",TRUE +"*ms-actioncenter:*",TRUE +"*ms-apprep:*",TRUE +"*ms-availablenetworks:*",TRUE +"*ms-cortana:*",TRUE +"*ms-cxh:*",TRUE +"*ms-device-enrollment:*",TRUE +"*ms-excel:*",TRUE +"*ms-msdt:*",TRUE +"*ms-penworkspace:*",TRUE +"*ms-powerpoint:*",TRUE +"*ms-publisher:*",TRUE +"*ms-settings:*",TRUE +"*ms-settings-airplanemode:*",TRUE +"*ms-settings-bluetooth:*",TRUE +"*ms-settings-cellular:*",TRUE +"*ms-settings-connectabledevices:*",TRUE +"*ms-settings-displays-topology:*",TRUE +"*ms-settings-emailandaccounts:*",TRUE +"*ms-settings-language:*",TRUE +"*ms-settings-location:*",TRUE +"*ms-settings-lock:*",TRUE +"*ms-settings-mobilehotspot:*",TRUE +"*ms-settings-notifications:*",TRUE +"*ms-settings-power:*",TRUE +"*ms-settings-privacy:*",TRUE +"*ms-settings-proximity:*",TRUE +"*ms-settings-screenrotation:*",TRUE +"*ms-settings-wifi:*",TRUE +"*ms-settings-workplace:*",TRUE +"*ms-teams:*",TRUE +"*ms-windows-search:*",TRUE +"*ms-word:*",TRUE +"*mssharepointclient:*",TRUE +"*msteams:*",TRUE +"*mswindowsmusic:*",TRUE +"*mswindowsvideo:*",TRUE +"*odopen:*",TRUE +"*OneIndex16:*",TRUE +"*OneNote:*",TRUE +"*OneNote.URL.16:*",TRUE +"*OneNoteDesktop:*",TRUE +"*OneNoteDesktop.URL.16:*",TRUE +"*Outlook.URL.feed.15:*",TRUE +"*Outlook.URL.mailto.15:*",TRUE +"*Outlook.URL.stssync.15:*",TRUE +"*Outlook.URL.webcal.15:*",TRUE +"*res:*",TRUE +"*rlogin:*",TRUE +"*search:*",TRUE +"*search-ms:*",TRUE +"*sip:*",TRUE +"*sips:*",TRUE +"*skypecast15:*",TRUE +"*stssync:*",TRUE +"*tbauth:*",TRUE +"*tel:*",TRUE +"*telnet:*",TRUE +"*tn3270:*",TRUE +"*webcal:*",TRUE +"*webcals:*",TRUE +"*windows.tbauth:*",TRUE +"*WMP11.AssocProtocol.DLNA-PLAYSINGLE:*",TRUE +"*WMP11.AssocProtocol.MMS:*",TRUE +"*Word:*",TRUE +"*xbox-tcui:*",TRUE +"*appinstaller.oauth2:*",TRUE +"*bingnews:*",TRUE +"*bingweather:*",TRUE +"*feedback-hub:*",TRUE +"*git-client:*",TRUE +"*IE.HTTP:*",TRUE +"*insiderhub:*",TRUE +"*microsoft-edge:*",TRUE +"*microsoft-edge-holographic:*",TRUE +"*microsoft.windows.camera:*",TRUE +"*microsoft.windows.camera.multipicker:*",TRUE +"*microsoft.windows.camera.picker:*",TRUE +"*microsoft.windows.photos.crop:*",TRUE +"*microsoft.windows.photos.picker:*",TRUE +"*microsoft.windows.photos.videoedit:*",TRUE +"*Microsoft.Workfolders:*",TRUE +"*microsoftvideo:*",TRUE +"*ms-aad-brokerplugin:*",TRUE +"*ms-appinstaller:*",TRUE +"*ms-calculator:*",TRUE +"*ms-clock:*",TRUE +"*ms-contact-support:*",TRUE +"*ms-cortana2:*",TRUE +"*ms-cxh-full:*",TRUE +"*ms-default-location:*",TRUE +"*ms-device-enrollment2:*",TRUE +"*ms-drive-to:*",TRUE +"*ms-edu-secureassessment:*",TRUE +"*ms-eyecontrolspeech:*",TRUE +"*ms-gamebar:*",TRUE +"*ms-gamebarservices:*",TRUE +"*ms-gamingoverlay:*",TRUE +"*ms-get-started:*",TRUE +"*ms-getoffice:*",TRUE +"*ms-inputapp:*",TRUE +"*ms-insights:*",TRUE +"*ms-meetnow:*",TRUE +"*ms-meetnowflyout:*",TRUE +"*ms-mmsys:*",TRUE +"*ms-msime-imepad:*",TRUE +"*ms-msime-imjpdct:*",TRUE +"*ms-officeapp:*",TRUE +"*ms-officecmd:*",TRUE +"*ms-oobenetwork:*",TRUE +"*ms-people:*",TRUE +"*ms-perception-simulation:*",TRUE +"*ms-phone:*",TRUE +"*ms-photos:*",TRUE +"*ms-powerautomate:*",TRUE +"*ms-print-addprinter:*",TRUE +"*ms-print-printjobs:*",TRUE +"*ms-quick-assist:*",TRUE +"*ms-rdx-document:*",TRUE +"*ms-retaildemo-launchbioenrollment:*",TRUE +"*ms-retaildemo-launchstart:*",TRUE +"*ms-screenclip:*",TRUE +"*ms-screensketch:*",TRUE +"*ms-search:*",TRUE +"*ms-sttoverlay:*",TRUE +"*ms-taskswitcher:*",TRUE +"*ms-to-do:*",TRUE +"*ms-todo:*",TRUE +"*ms-unistore-email:*",TRUE +"*ms-virtualtouchpad:*",TRUE +"*ms-walk-to:*",TRUE +"*ms-wcrv:*",TRUE +"*ms-windows-store:*",TRUE +"*ms-windows-store-deskext:*",TRUE +"*ms-windows-store2:*",TRUE +"*ms-wpc:*",TRUE +"*ms-wpdrmv:*",TRUE +"*ms-wxh:*",TRUE +"*ms-xbet-survey:*",TRUE +"*ms-xbl-3d8b930f:*",TRUE +"*ms-xgpueject:*",TRUE +"*msgamepass:*",TRUE +"*msgamingapp:*",TRUE +"*msnews:*",TRUE +"*msnnews:*",TRUE +"*msnweather:*",TRUE +"*msxbox:*",TRUE +"*outlookaccounts:*",TRUE +"*outlookcal:*",TRUE +"*outlookmail:*",TRUE +"*read:*",TRUE +"*vscode:*",TRUE +"*vsls:*",TRUE +"*vstfs:*",TRUE +"*vsweb:*",TRUE +"*windows-feedback:*",TRUE +"*windowsdefender:*",TRUE +"*xboxliveapp-1297287741:*",TRUE +"*zune:*",TRUE +"*SecureBrowser.security.getDeviceInfo:*",TRUE +"*SecureBrowser.security.getMACAddress:*",TRUE +"*SecureBrowser.security.examineProcessList:*",TRUE +"*SecureBrowser.security.isRemoteSession:*",TRUE +"*SecureBrowser.security.isVMSession:*",TRUE +"*JavaScript:*",TRUE +"*vbscript:*",TRUE +"*about:*",TRUE +"*ms-its:*",TRUE +"*its:*",TRUE +"*mk:@MSITStore:*",TRUE \ No newline at end of file diff --git a/lookups/windows_protocol_handlers.yml b/lookups/windows_protocol_handlers.yml new file mode 100644 index 0000000000..eeec13ffbc --- /dev/null +++ b/lookups/windows_protocol_handlers.yml @@ -0,0 +1,7 @@ +description: A list of Windows Protocol Handlers +filename: windows_protocol_handlers.csv +name: windows_protocol_handlers +default_match: 'false' +match_type: WILDCARD(windows_protocol_handlers) +min_matches: 1 +case_sensitive_match: 'false' \ No newline at end of file diff --git a/tests/endpoint/windows_identify_protocol_handlers.test.yml b/tests/endpoint/windows_identify_protocol_handlers.test.yml new file mode 100644 index 0000000000..1547af337c --- /dev/null +++ b/tests/endpoint/windows_identify_protocol_handlers.test.yml @@ -0,0 +1,13 @@ +name: Windows Identify Protocol Handlers Unit Test +tests: +- name: Windows Identify Protocol Handlers + file: endpoint/windows_identify_protocol_handlers.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: msdt.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From c4ad3d09965e687e4a3bb534f4f87b3e51e14159 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 13 Jul 2022 15:51:47 -0600 Subject: [PATCH 2/7] LOTL --- .../living_off_the_land_correlation.yml | 67 +++++++++++++++++++ tests/endpoint/living_off_the_land.test.yml | 12 ++++ 2 files changed, 79 insertions(+) create mode 100644 detections/endpoint/living_off_the_land_correlation.yml create mode 100644 tests/endpoint/living_off_the_land.test.yml diff --git a/detections/endpoint/living_off_the_land_correlation.yml b/detections/endpoint/living_off_the_land_correlation.yml new file mode 100644 index 0000000000..8a474f9b0b --- /dev/null +++ b/detections/endpoint/living_off_the_land_correlation.yml @@ -0,0 +1,67 @@ +name: Living Off The Land Correlation +id: 1be30d80-3a39-4df9-9102-64a467b24abc +version: 1 +date: '2022-07-08' +author: Michael Haag, Splunk +type: Correlation +datamodel: + - Risk +description: sdfsgt +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Risk.All_Risk where All_Risk.analyticstories="Living Off The Land" All_Risk.risk_object_type="system" by All_Risk.risk_object All_Risk.annotations.mitre_attack.mitre_tactic source + | `drop_dm_object_name(All_Risk)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | stats values(source) as detection_name values(annotations.mitre_attack.mitre_tactic) as tactics values(firstTime) as firstTime values(lastTime) as lastTime dc(annotations.mitre_attack.mitre_tactic) as distinct_tactics dc(source) as distinct_detection_name by risk_object + | where distinct_detection_name >= 2 + | `living_off_the_land_filter`' +how_to_implement: To implement this correlation search a user needs to enable all + detections in the Living Off The Land Analytic Story and confirm it is generating risk events. + A simple search `index=risk analyticstories="Living Off The Land"` should contain + events. +known_false_positives: There are no known false positive for this search, but it could + contain false positives as multiple detections can trigger and not have successful + exploitation. Modify the static value distinct_detection_name to a higher value. It is required to tune analytics that are also tagged to ensure volume is never too much. +references: +- https://www.splunk.com/en_us/blog/security/living-off-the-land-threat-research-february-2022-release.html +tags: + analytic_story: + - Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + dataset: + - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1218/living_off_the_land/lolbinrisk.log + impact: 90 + kill_chain_phases: + - Reconnaissance + - Exploitation + message: An increase of Living Off The Land behavior has been detected on $affected_systems$ + mitre_attack_id: + - T1105 + - T1190 + - T1059 + nist: + - DE.CM + observable: + - name: affected_systems + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - All_Risk.analyticstories + - All_Risk.risk_object_type + - All_Risk.risk_object + - All_Risk.annotations.mitre_attack.mitre_tactic + - source + risk_score: 63 + security_domain: endpoint diff --git a/tests/endpoint/living_off_the_land.test.yml b/tests/endpoint/living_off_the_land.test.yml new file mode 100644 index 0000000000..7b9da94237 --- /dev/null +++ b/tests/endpoint/living_off_the_land.test.yml @@ -0,0 +1,12 @@ +name: Living Off The Land Unit Test +tests: +- name: Living Off The Land + file: endpoint/living_off_the_land.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: lolbinrisk.log + data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1218/living_off_the_land/lolbinrisk.log + source: lotl + sourcetype: stash \ No newline at end of file From b4c6d95acd26cd1076918b2ba9454372211ba800 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 14 Jul 2022 08:42:53 -0600 Subject: [PATCH 3/7] rename --- ...ing_off_the_land_correlation.yml => living_off_the_land.yml} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename detections/endpoint/{living_off_the_land_correlation.yml => living_off_the_land.yml} (98%) diff --git a/detections/endpoint/living_off_the_land_correlation.yml b/detections/endpoint/living_off_the_land.yml similarity index 98% rename from detections/endpoint/living_off_the_land_correlation.yml rename to detections/endpoint/living_off_the_land.yml index 8a474f9b0b..00b7d78b0e 100644 --- a/detections/endpoint/living_off_the_land_correlation.yml +++ b/detections/endpoint/living_off_the_land.yml @@ -1,4 +1,4 @@ -name: Living Off The Land Correlation +name: Living Off The Land id: 1be30d80-3a39-4df9-9102-64a467b24abc version: 1 date: '2022-07-08' From 3c5d118341b232cdda5816a134385d370941d010 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 14 Jul 2022 09:43:00 -0600 Subject: [PATCH 4/7] actual description --- detections/endpoint/living_off_the_land.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/living_off_the_land.yml b/detections/endpoint/living_off_the_land.yml index 00b7d78b0e..6f2cb9d35d 100644 --- a/detections/endpoint/living_off_the_land.yml +++ b/detections/endpoint/living_off_the_land.yml @@ -6,7 +6,7 @@ author: Michael Haag, Splunk type: Correlation datamodel: - Risk -description: sdfsgt +description: The following correlation identifies a distinct amount of analytics associated with the Living Off The Land analytic story that identify potentially suspicious behavior. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Risk.All_Risk where All_Risk.analyticstories="Living Off The Land" All_Risk.risk_object_type="system" by All_Risk.risk_object All_Risk.annotations.mitre_attack.mitre_tactic source | `drop_dm_object_name(All_Risk)` | `security_content_ctime(firstTime)` @@ -20,9 +20,10 @@ how_to_implement: To implement this correlation search a user needs to enable al events. known_false_positives: There are no known false positive for this search, but it could contain false positives as multiple detections can trigger and not have successful - exploitation. Modify the static value distinct_detection_name to a higher value. It is required to tune analytics that are also tagged to ensure volume is never too much. + exploitation. Modify the static value distinct_detection_name to a higher value. It is also required to tune analytics that are also tagged to ensure volume is never too much. references: -- https://www.splunk.com/en_us/blog/security/living-off-the-land-threat-research-february-2022-release.html + - https://www.splunk.com/en_us/blog/security/living-off-the-land-threat-research-february-2022-release.html + - https://research.splunk.com/stories/living_off_the_land/ tags: analytic_story: - Living Off The Land From 0a56c2470f55d28f56db0b299f138bfac097a38c Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 14 Jul 2022 09:50:41 -0600 Subject: [PATCH 5/7] proto fix --- detections/endpoint/windows_identify_protocol_handlers.yml | 5 +---- lookups/windows_protocol_handlers.yml | 2 +- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/windows_identify_protocol_handlers.yml b/detections/endpoint/windows_identify_protocol_handlers.yml index 783604090e..e9706a3817 100644 --- a/detections/endpoint/windows_identify_protocol_handlers.yml +++ b/detections/endpoint/windows_identify_protocol_handlers.yml @@ -8,10 +8,7 @@ datamodel: - Endpoint description: 'The following hunting analytic will identify any protocol handlers utilized on the command-line. A protocol handler is an application that knows how to handle particular types of links: for example, a mail client is a protocol handler for "mailto:" links. When the user clicks a "mailto:" link, the browser opens the application selected as the handler for the "mailto:" protocol (or offers them a choice of handlers, depending on their settings). To identify protocol handlers we can use NirSoft https://www.nirsoft.net/utils/url_protocol_view.html URLProtocolView or query the registry using PowerShell: get-Item Registry::HKEY_CLASSES_ROOT\* | Select-Object "Property","PSChildName" | Where-Object -Property Property -Match "^URL*" #|Export-Csv -path c:\temp\url_all.csv. Note my query is limited to URL in the property to limit the scope of this query to similar handlers as ms-msdt.' -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime values(Processes.process) as process values(Processes.parent_process) - as parent_process from datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.process_name - Processes.process +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process) as process values(Processes.parent_process) as parent_process from datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.process_name Processes.process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` diff --git a/lookups/windows_protocol_handlers.yml b/lookups/windows_protocol_handlers.yml index eeec13ffbc..983403752a 100644 --- a/lookups/windows_protocol_handlers.yml +++ b/lookups/windows_protocol_handlers.yml @@ -2,6 +2,6 @@ description: A list of Windows Protocol Handlers filename: windows_protocol_handlers.csv name: windows_protocol_handlers default_match: 'false' -match_type: WILDCARD(windows_protocol_handlers) +match_type: WILDCARD(handler) min_matches: 1 case_sensitive_match: 'false' \ No newline at end of file From 366e8763c211dbddf9c02bbd676c37c0db026024 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 14 Jul 2022 11:51:36 -0600 Subject: [PATCH 6/7] oh hey data --- detections/endpoint/windows_identify_protocol_handlers.yml | 2 +- tests/endpoint/windows_identify_protocol_handlers.test.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_identify_protocol_handlers.yml b/detections/endpoint/windows_identify_protocol_handlers.yml index e9706a3817..1e2951cc57 100644 --- a/detections/endpoint/windows_identify_protocol_handlers.yml +++ b/detections/endpoint/windows_identify_protocol_handlers.yml @@ -38,7 +38,7 @@ tags: - Source:Endpoint - Stage:Defense Evasion dataset: - - UPDATE_DATASET_URL + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/protocol_handlers/protocolhandlers.log impact: 30 kill_chain_phases: - Exploitation diff --git a/tests/endpoint/windows_identify_protocol_handlers.test.yml b/tests/endpoint/windows_identify_protocol_handlers.test.yml index 1547af337c..eaf8ded377 100644 --- a/tests/endpoint/windows_identify_protocol_handlers.test.yml +++ b/tests/endpoint/windows_identify_protocol_handlers.test.yml @@ -7,7 +7,7 @@ tests: latest_time: now attack_data: - file_name: msdt.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/protocol_handlers/protocolhandlers.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog update_timestamp: true From 89f750135fa8fa8fac6cc5423f648dea124dfa9f Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 19 Jul 2022 14:12:15 -0700 Subject: [PATCH 7/7] Update windows_identify_protocol_handlers.yml --- detections/endpoint/windows_identify_protocol_handlers.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_identify_protocol_handlers.yml b/detections/endpoint/windows_identify_protocol_handlers.yml index 1e2951cc57..a0042656bc 100644 --- a/detections/endpoint/windows_identify_protocol_handlers.yml +++ b/detections/endpoint/windows_identify_protocol_handlers.yml @@ -52,7 +52,7 @@ tags: type: User role: - Victim - - name: Computer + - name: dest type: Hostname role: - Victim