Merge pull request #2240 from splunk/more-defense-evasion

more-defense-evasion

detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml

@@ -0,0 +1,75 @@
+name: Windows Impair Defense Delete Win Defender Context Menu
+id: 395ed5fe-ad13-4366-9405-a228427bdd91
+version: 1
+date: '2022-06-07'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The search looks for the deletion of Windows Defender context menu within the registry.
+  This is consistent behavior with RAT malware across a fleet of endpoints. This particular
+  behavior is executed when an adversary gains access to an endpoint
+  and begins to perform execution. Usually, a batch (.bat) will be executed and multiple
+  registry and scheduled task modifications will occur. During triage, review parallel
+  processes and identify any further file modifications.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry  
+  where Registry.registry_path = "*\\shellex\\ContextMenuHandlers\\EPP" Registry.action = deleted
+  by  Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.dest Registry.user 
+  | `drop_dm_object_name(Registry)`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_impair_defense_delete_win_defender_context_menu_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node.
+known_false_positives: It is unusual to turn this feature off a Windows system since
+  it is a default security control, although it is not rare for some policies to disable
+  it. Although no false positives have been identified, use the provided filter macro
+  to tune the search.
+references:
+- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
+- https://app.any.run/tasks/45f5d114-91ea-486c-ab01-41c4093d2861/
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  - Windows Registry Abuse
+  asset_type: Endpoint
+  cis20:
+  - CIS 8
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon.log
+  impact: 50
+  kill_chain_phases:
+  - Delivery
+  message: Windows Defender context menu registry key deleted on $dest$.
+  mitre_attack_id:
+  - T1562.001
+  - T1562
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_path
+  - Registry.action
+  risk_score: 25
+  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon

detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml

@@ -0,0 +1,75 @@
+name: Windows Impair Defense Delete Win Defender Profile Registry
+id: 65d4b105-ec52-48ec-ac46-289d0fbf7d96
+version: 1
+date: '2022-06-07'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The search looks for the deletion of Windows Defender main profile within the registry.
+  This was used by RAT malware across a fleet of endpoints. This particular
+  behavior is typically executed when an adversary gains access to an endpoint
+  and beings to perform execution. Usually, a batch (.bat) will be executed and multiple
+  registry and scheduled task modifications will occur. During triage, review parallel
+  processes and identify any further file modifications.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry  
+  where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender" Registry.action = deleted
+  by  Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action  Registry.user Registry.dest
+  | `drop_dm_object_name(Registry)`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_impair_defense_delete_win_defender_profile_registry_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node.
+known_false_positives: It is unusual to turn this feature off a Windows system since
+  it is a default security control, although it is not rare for some policies to disable
+  it. Although no false positives have been identified, use the provided filter macro
+  to tune the search.
+references:
+- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
+- https://app.any.run/tasks/45f5d114-91ea-486c-ab01-41c4093d2861/
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  - Windows Registry Abuse
+  asset_type: Endpoint
+  cis20:
+  - CIS 8
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Delivery
+  message: Windows Defender Logger registry key set to 'disabled' on $dest$.
+  mitre_attack_id:
+  - T1562.001
+  - T1562
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_path
+  - Registry.action
+  risk_score: 64
+  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon

detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml

@@ -0,0 +1,75 @@
+name: Windows Impair Defenses Disable Win Defender Auto Logging
+id: 76406a0f-f5e0-4167-8e1f-337fdc0f1b0c
+version: 1
+date: '2022-06-07'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The search looks for the Registry Key DefenderApiLogger or DefenderAuditLogger set to disable.
+  This is consistent with RAT malware across a fleet of endpoints. This particular
+  behavior is typically executed when an adversary gains access to an endpoint
+  and beings to perform execution. Usually, a batch (.bat) will be executed and multiple
+  registry and scheduled task modifications will occur. During triage, review parallel
+  processes and identify any further file modifications.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
+  where (Registry.registry_path = "*WMI\\Autologger\\DefenderApiLogger\\Start" OR Registry.registry_path = "*WMI\\Autologger\\DefenderAuditLogger\\Start")  Registry.registry_value_data ="0x00000000"
+  by  Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.dest Registry.user
+  | `drop_dm_object_name(Registry)`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_impair_defenses_disable_win_defender_auto_logging_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node.
+known_false_positives: It is unusual to turn this feature off a Windows system since
+  it is a default security control, although it is not rare for some policies to disable
+  it. Although no false positives have been identified, use the provided filter macro
+  to tune the search.
+references:
+- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
+- https://app.any.run/tasks/45f5d114-91ea-486c-ab01-41c4093d2861/
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  - Windows Registry Abuse
+  asset_type: Endpoint
+  cis20:
+  - CIS 8
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable_defender_logging/sysmon.log
+  impact: 30
+  kill_chain_phases:
+  - Delivery
+  message: Windows Defender Logger registry key set to 'disabled' on $dest$.
+  mitre_attack_id:
+  - T1562.001
+  - T1562
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_path
+  - Registry.action
+  risk_score: 24
+  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon

tests/endpoint/windows_impair_defense_delete_win_defender_context_menu.test.yml

@@ -0,0 +1,13 @@
+name: Windows Impair Defense Delete Win Defender Context Menu Unit Test
+tests:
+- name: Windows Impair Defense Delete Win Defender Context Menu
+  file: endpoint/windows_impair_defense_delete_win_defender_context_menu.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_impair_defense_delete_win_defender_profile_registry.test.yml

@@ -0,0 +1,13 @@
+name: Windows Impair Defense Delete Win Defender Profile Registry Unit Test
+tests:
+- name: Windows Impair Defense Delete Win Defender Profile Registry
+  file: endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.test.yml

@@ -0,0 +1,13 @@
+name: Windows Impair Defenses Disable Win Defender Auto Logging Unit Test
+tests:
+- name: Windows Impair Defenses Disable Win Defender Auto Logging
+  file: endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable_defender_logging/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true