diff --git a/detections/endpoint/csc_net_on_the_fly_compilation.yml b/detections/endpoint/csc_net_on_the_fly_compilation.yml new file mode 100644 index 0000000000..ae91b068f7 --- /dev/null +++ b/detections/endpoint/csc_net_on_the_fly_compilation.yml @@ -0,0 +1,72 @@ +name: CSC Net On The Fly Compilation +id: ea73128a-43ab-11ec-9753-acde48001122 +version: 1 +date: '2021-11-12' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: this analytic is to detect a suspicious compile before delivery approach + of .net compiler csc.exe. This technique was seen in several adversaries, malware + and even in red teams to take advantage the csc.exe .net compiler tool to compile + on the fly a malicious .net code to evade detection from security product. This + is a good hunting query to check further the file or process created after this + event and check the file path that passed to csc.exe which is the .net code. Aside + from that, powershell is capable of using this compiler in executing .net code in + a powershell script so filter on that case is needed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_csc` Processes.process + = "*/noconfig*" Processes.process = "*/fullpaths*" Processes.process = "*@*" by + Processes.dest Processes.user Processes.parent_process_name Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `csc_net_on_the_fly_compilation_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: A network operator or systems administrator may utilize an + automated powershell script taht execute .net code that may generate false positive. + filter is needed. +references: +- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/ +- https://tccontre.blogspot.com/2019/06/maicious-macro-that-compile-c-code-as.html +tags: + analytic_story: + - Windows Defense Evasion Tactics + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1027.004 + - T1027 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: csc.exe with commandline $process$ to compile .net code on $dest$ by $user$ + observable: + - name: dest + type: Endpoint + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/firewall_allowed_program_enable.yml b/detections/endpoint/firewall_allowed_program_enable.yml new file mode 100644 index 0000000000..daef9a0a4b --- /dev/null +++ b/detections/endpoint/firewall_allowed_program_enable.yml @@ -0,0 +1,69 @@ +name: Firewall Allowed Program Enable +id: 9a8f63a8-43ac-11ec-904c-acde48001122 +version: 1 +date: '2021-11-12' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic detects a potential suspicious modification of firewall + rule allowing to execute specific application. This technique was identified when + an adversary and red teams to bypassed firewall file execution restriction in a + targetted host. Take note that this event or command can run by administrator during + testing or allowing legitimate tool or application. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process = "*firewall*" + Processes.process = "*allowedprogram*" Processes.process = "*add*" Processes.process + = "*ENABLE*" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `firewall_allowed_program_enable_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: A network operator or systems administrator may utilize an + automated or manual execution of this firewall rule that may generate false positives. + Filter as needed. +references: +- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/# +tags: + analytic_story: + - Windows Defense Evasion Tactics + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1562.004 + - T1562 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: firewall allowed program commandline $process$ of $process_name$ on $dest$ + by $user$ + observable: + - name: dest + type: Endpoint + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml b/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml new file mode 100644 index 0000000000..34b767180b --- /dev/null +++ b/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml @@ -0,0 +1,69 @@ +name: High Frequency Copy Of Files In Network Share +id: 40925f12-4709-11ec-bb43-acde48001122 +version: 1 +date: '2021-11-16' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic is to detect a suspicious high frequency copying/moving + of files in network share as part of information sabotage. This anomaly event can + be a good indicator of insider trying to sabotage data by transfering classified + or internal files within network share to exfitrate it after or to lure evidence + of insider attack to other user. This behavior may catch several noise if network + share is a common place for classified or internal document processing. +search: '`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.doc","*.docx","*.xls","*.xlsx","*.ppt","*.pptx","*.log","*.txt","*.db","*.7z","*.zip","*.rar","*.tar","*.gz","*.jpg","*.gif","*.png","*.bmp","*.pdf","*.rtf","*.key") + Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask= + "0x2" | bucket _time span=5m | stats values(Relative_Target_Name) as valRelativeTargetName, + values(Share_Name) as valShareName, values(Object_Type) as valObjectType, values(Access_Mask) + as valAccessmask, values(src_port) as valSrcPort, values(Source_Address) as valSrcAddress + count as numShareName by dest, _time, EventCode, user | eventstats avg(numShareName) + as avgShareName, stdev(numShareName) as stdShareName, count as numSlots by dest, + _time, EventCode, user | eval upperThreshold=(avgShareName + stdShareName *3) | eval + isOutlier=if(avgShareName > 20 and avgShareName >= upperThreshold, 1, 0) | search + isOutlier=1 | `high_frequency_copy_of_files_in_network_share_filter`' +how_to_implement: o successfully implement this search, you need to be ingesting Windows + Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. + Also enable the object Audit access success/failure in your group policy. +known_false_positives: this behavior may seen in normal transfer of file within network + if network share is common place for sharing documents. +references: +- https://attack.mitre.org/techniques/T1537/ +tags: + analytic_story: + - Information Sabotage + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/high_copy_files_in_net_share/security.log + kill_chain_phases: + - Exfiltration + mitre_attack_id: + - T1537 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Share_Name + - Relative_Target_Name + - Object_Type + - Access_Mask + - user + - src_port + - Source_Address + security_domain: endpoint + impact: 30 + confidence: 30 + risk_score: 9 + context: + - Source:Endpoint + - Stage:Exfiltration + message: high frequency copy of document in network share $Share_Name$ from $Source_Address$ + by $user$ + observable: + - name: user + type: User + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/loading_of_dynwrapx_module.yml b/detections/endpoint/loading_of_dynwrapx_module.yml new file mode 100644 index 0000000000..0424a4d064 --- /dev/null +++ b/detections/endpoint/loading_of_dynwrapx_module.yml @@ -0,0 +1,74 @@ +name: Loading Of Dynwrapx Module +id: eac5e8ba-4857-11ec-9371-acde48001122 +version: 1 +date: '2021-11-18' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: DynamicWrapperX is an ActiveX component that can be used in a script + to call Windows API functions, but it requires the dynwrapx.dll to be installed + and registered. With that, registering or loading dynwrapx.dll to a host highly + suspect. Why is it needed? In most malicious instances, During triage, review parallel + processes and pivot on the process_guid. Review the registry for any suspicious + modifications meant to load dynwrapx.dll. Identify any suspicious module loads of + dynwrapx.dll. This will identify the process that will invoke vbs/wscript/cscript. +search: '`sysmon` EventCode=7 (ImageLoaded = "*\\dynwrapx.dll" OR OriginalFileName + = "dynwrapx.dll" OR Product = "DynamicWrapperX") | stats count min(_time) as firstTime + max(_time) as lastTime by Image ImageLoaded OriginalFileName Product process_name + Computer EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `loading_of_dynwrapx_module_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` + node. In addition, confirm the latest CIM App 4.20 or higher is installed and the + latest TA for the endpoint product. +known_false_positives: False positives should be limited, however it is possible to + filter by Processes.process_name and specific processes (ex. wscript.exe). Filter + as needed. This may need modification based on EDR telemetry and how it brings in + registry data. For example, removal of (Default). +references: +- https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/ +- https://www.script-coding.com/dynwrapx_eng.html +- https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/ +- https://tria.ge/210929-ap75vsddan +- https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89 +tags: + analytic_story: + - Remcos + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_dynwrapx/sysmon_dynwraper.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1055 + - T1055.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - ImageLoaded + - OriginalFileName + - Product + - process_name + - Computer + - EventCode + - Signed + - ProcessId + security_domain: endpoint + impact: 80 + confidence: 100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: dynwrapx.dll loaded by process $process_name$ on $Computer$ + observable: + - name: Computer + type: Endpoint + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/network_discovery_using_route_windows_app.yml b/detections/endpoint/network_discovery_using_route_windows_app.yml new file mode 100644 index 0000000000..94a9e73975 --- /dev/null +++ b/detections/endpoint/network_discovery_using_route_windows_app.yml @@ -0,0 +1,66 @@ +name: Network Discovery Using Route Windows App +id: dd83407e-439f-11ec-ab8e-acde48001122 +version: 1 +date: '2021-11-12' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This analytic look for a spawned process of route.exe windows application. + Adversaries and red teams alike abuse this application the recon or do a network + discovery on a target host. but one possible false positive might be an automated + tool used by a system administator or a powershell script in amazon ec2 config services. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_route` by Processes.dest + Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `network_discovery_using_route_windows_app_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: A network operator or systems administrator may utilize an + automated host discovery application that may generate false positives or an amazon + ec2 script that uses this application. Filter as needed. +references: +- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/# +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1016 + - T1016.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 30 + confidence: 30 + risk_score: 9 + context: + - Source:Endpoint + - Stage:Discovery + - Stage:Recon + message: Network Connection discovery on $dest$ by $user$ + observable: + - name: dest + type: Endpoint + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/runas_execution_in_commandline.yml b/detections/endpoint/runas_execution_in_commandline.yml new file mode 100644 index 0000000000..5fdc2249db --- /dev/null +++ b/detections/endpoint/runas_execution_in_commandline.yml @@ -0,0 +1,68 @@ +name: Runas Execution in CommandLine +id: 4807e716-43a4-11ec-a0e7-acde48001122 +version: 1 +date: '2021-11-12' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This analytic look for a spawned runas.exe process with a administrator + user option parameter. This parameter was abused by adversaries, malware author + or even red teams to gain elevated privileges in target host. This is a good hunting + query to figure out privilege escalation tactics that may used for different stages + like lateral movement but take note that administrator may use this command in purpose + so its better to see other event context before and after this analytic. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_runas` AND Processes.process + = "*/user:*" AND Processes.process = "*admin*" by Processes.dest Processes.user + Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `runas_execution_in_commandline_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: A network operator or systems administrator may utilize an + automated or manual execute this command that may generate false positives. filter + is needed. +references: +- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/# +tags: + analytic_story: + - Windows Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1134 + - T1134.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - Source:Endpoint + - stage:Privilege Escalation + message: elevated process using runas on $dest$ by $user$ + observable: + - name: dest + type: Endpoint + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml new file mode 100644 index 0000000000..5531d26ba7 --- /dev/null +++ b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml @@ -0,0 +1,68 @@ +name: Suspicious Process DNS Query Known Abuse Web Services +id: 3cf0dc36-484d-11ec-a6bc-acde48001122 +version: 1 +date: '2021-11-18' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a suspicious process having a dns query on + known abuse text paste web services, or VoIP, instant messaging and digital distribution + platform to download some files. This technique is abused by adversaries, malware + attacker and red team to download a malicious file on the target host. This is a + good TTP indicator for possible initial access technique. Noise and false positive + can be seen if the following instant messaging is allowed or common application + in corporate network. +search: '`sysmon` EventCode=22 QueryName IN ("*pastebin*", "*discord*", "*telegram*", + "*t.me*") process_name IN ("cmd.exe", "*powershell*", "pwsh.exe", "wscript.exe", + "cscript.exe") | stats count min(_time) as firstTime max(_time) as lastTime by Image + QueryName QueryStatus process_name QueryResults Computer | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `suspicious_process_dns_query_known_abuse_web_services_filter`' +how_to_implement: his detection relies on sysmon logs with the Event ID 7, Driver + loaded. Please tune your sysmon config that you DriverLoad event for SolarWinds.Orion.Core.BusinessLayer.dll + is captured by Sysmon. Additionally, you need sysmon logs for Event ID 22, DNS Query. + We suggest to run this detection at least once a day over the last 14 days. +known_false_positives: Noise and false positive can be seen if the following instant + messaging is allowed to use within corporate network. filter is needed. +references: +- https://urlhaus.abuse.ch/url/1798923/ +tags: + analytic_story: + - Remcos + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_pastebin_download/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1059.005 + - T1059 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - QueryName + - QueryStatus + - process_name + - QueryResults + - Computer + security_domain: endpoint + impact: 80 + confidence: 80 + risk_score: 64 + context: + - Source:Endpoint + - Stage:Execution + message: suspicious process $process_name$ has a dns query in $QueryName$ on $Computer$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: process_name + type: process name + role: + - Attacker + automated_detection_testing: passed diff --git a/macros/process_csc.yml b/macros/process_csc.yml new file mode 100644 index 0000000000..c545b6208f --- /dev/null +++ b/macros/process_csc.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name=csc.exe OR Processes.original_file_name=csc.exe) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_csc \ No newline at end of file diff --git a/macros/process_route.yml b/macros/process_route.yml new file mode 100644 index 0000000000..f319fbf134 --- /dev/null +++ b/macros/process_route.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name=route.exe OR Processes.original_file_name=route.exe) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_route \ No newline at end of file diff --git a/macros/process_runas.yml b/macros/process_runas.yml new file mode 100644 index 0000000000..eeb06a9867 --- /dev/null +++ b/macros/process_runas.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name=runas.exe OR Processes.original_file_name=runas.exe) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_runas \ No newline at end of file diff --git a/tests/endpoint/csc_net_on_the_fly_compilation.test.yml b/tests/endpoint/csc_net_on_the_fly_compilation.test.yml new file mode 100644 index 0000000000..983c1f10a8 --- /dev/null +++ b/tests/endpoint/csc_net_on_the_fly_compilation.test.yml @@ -0,0 +1,12 @@ +name: CSC Net On The Fly Compilation Unit Test +tests: +- name: CSC Net On The Fly Compilation + file: endpoint/csc_net_on_the_fly_compilation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-30d' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/firewall_allowed_program_enable.test.yml b/tests/endpoint/firewall_allowed_program_enable.test.yml new file mode 100644 index 0000000000..23ebd31f6d --- /dev/null +++ b/tests/endpoint/firewall_allowed_program_enable.test.yml @@ -0,0 +1,12 @@ +name: Firewall Allowed Program Enable Unit Test +tests: +- name: Firewall Allowed Program Enable + file: endpoint/firewall_allowed_program_enable.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-30d' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/high_frequency_copy_of_files_in_network_share.test.yml b/tests/endpoint/high_frequency_copy_of_files_in_network_share.test.yml new file mode 100644 index 0000000000..66b0e63cbe --- /dev/null +++ b/tests/endpoint/high_frequency_copy_of_files_in_network_share.test.yml @@ -0,0 +1,12 @@ +name: High Frequency Copy Of Files In Network Share Unit Test +tests: +- name: High Frequency Copy Of Files In Network Share + file: endpoint/high_frequency_copy_of_files_in_network_share.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-30d' + latest_time: 'now' + attack_data: + - file_name: security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/high_copy_files_in_net_share/security.log + source: WinEventLog:Security + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/loading_of_dynwrapx_module.test.yml b/tests/endpoint/loading_of_dynwrapx_module.test.yml new file mode 100644 index 0000000000..c8b1472965 --- /dev/null +++ b/tests/endpoint/loading_of_dynwrapx_module.test.yml @@ -0,0 +1,12 @@ +name: Loading Of Dynwrapx Module Unit Test +tests: +- name: Loading Of Dynwrapx Module + file: endpoint/loading_of_dynwrapx_module.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_dynwraper.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_dynwrapx/sysmon_dynwraper.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/network_discovery_using_route_windows_app.test.yml b/tests/endpoint/network_discovery_using_route_windows_app.test.yml new file mode 100644 index 0000000000..0389608b65 --- /dev/null +++ b/tests/endpoint/network_discovery_using_route_windows_app.test.yml @@ -0,0 +1,12 @@ +name: Network Discovery Using Route Windows App Unit Test +tests: +- name: Network Discovery Using Route Windows App + file: endpoint/network_discovery_using_route_windows_app.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-30d' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/runas_execution_in_commandline.test.yml b/tests/endpoint/runas_execution_in_commandline.test.yml new file mode 100644 index 0000000000..df59958ca8 --- /dev/null +++ b/tests/endpoint/runas_execution_in_commandline.test.yml @@ -0,0 +1,12 @@ +name: Runas Execution in CommandLine Unit Test +tests: +- name: Runas Execution in CommandLine + file: endpoint/runas_execution_in_commandline.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-30d' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/suspicious_process_dns_query_known_abuse_web_services.test.yml b/tests/endpoint/suspicious_process_dns_query_known_abuse_web_services.test.yml new file mode 100644 index 0000000000..6bb663c2a7 --- /dev/null +++ b/tests/endpoint/suspicious_process_dns_query_known_abuse_web_services.test.yml @@ -0,0 +1,12 @@ +name: Suspicious Process DNS Query Known Abuse Web Services Unit Test +tests: +- name: Suspicious Process DNS Query Known Abuse Web Services + file: endpoint/suspicious_process_dns_query_known_abuse_web_services.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_pastebin_download/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file