From 066ac9ffb3496faf39587f54d7644fbbd5f438fb Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 7 Jun 2022 11:50:27 +0200 Subject: [PATCH 1/5] more-defense-evasion --- ...nses_disable_win_defender_auto_logging.yml | 74 +++++++++++++++++++ ...disable_win_defender_auto_logging.test.yml | 13 ++++ 2 files changed, 87 insertions(+) create mode 100644 detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml create mode 100644 tests/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.test.yml diff --git a/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml b/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml new file mode 100644 index 0000000000..0916e2333b --- /dev/null +++ b/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml @@ -0,0 +1,74 @@ +name: Windows Impair Defenses Disable Win Defender Auto Logging +id: 76406a0f-f5e0-4167-8e1f-337fdc0f1b0c +version: 1 +date: '2022-06-07' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The search looks for the Registry Key DefenderApiLogger or DefenderAuditLogger set to disable. + This is consistent with RAT malware across a fleet of endpoints. This particular + behavior is typically executed when an malware actor gains access to an endpoint + and beings to perform execution. Usually, a batch (.bat) will be executed and multiple + registry and scheduled task modifications will occur. During triage, review parallel + processes and identify any further file modifications. Endpoint should be isolated. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry + where (Registry.registry_path = "*WMI\\Autologger\\DefenderApiLogger\\Start" OR Registry.registry_path = "*WMI\\Autologger\\DefenderAuditLogger\\Start") Registry.registry_value_data ="0x00000000" + by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.dest Registry.user + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_impair_defenses_disable_win_defender_auto_logging_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. +known_false_positives: It is unusual to turn this feature off a Windows system since + it is a default security control, although it is not rare for some policies to disable + it. Although no false positives have been identified, use the provided filter macro + to tune the search. +references: +- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ +- https://app.any.run/tasks/45f5d114-91ea-486c-ab01-41c4093d2861/ +tags: + analytic_story: + - Windows Defense Evasion Tactics + - Windows Registry Abuse + asset_type: Endpoint + cis20: + - CIS 8 + confidence: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable_defender_logging/sysmon.log + impact: 30 + kill_chain_phases: + - Delivery + message: Windows Defender Logger registry key set to 'disabled' on $dest$ + mitre_attack_id: + - T1562.001 + - T1562 + nist: + - PR.PT + - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.dest + - Registry.user + - Registry.registry_path + risk_score: 24 + security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon \ No newline at end of file diff --git a/tests/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.test.yml b/tests/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.test.yml new file mode 100644 index 0000000000..cde741f1e6 --- /dev/null +++ b/tests/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.test.yml @@ -0,0 +1,13 @@ +name: Windows Impair Defenses Disable Win Defender Auto Logging Unit Test +tests: +- name: Windows Impair Defenses Disable Win Defender Auto Logging + file: endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable_defender_logging/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From 7c2dd368cdc3011b0f2c100574f51d4cf2cc0ec5 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 7 Jun 2022 12:53:31 +0200 Subject: [PATCH 2/5] more-defense-evasion --- ...fense_delete_win_defender_context_menu.yml | 74 +++++++++++++++++++ ..._delete_win_defender_context_menu.test.yml | 13 ++++ 2 files changed, 87 insertions(+) create mode 100644 detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml create mode 100644 tests/endpoint/windows_impair_defense_delete_win_defender_context_menu.test.yml diff --git a/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml b/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml new file mode 100644 index 0000000000..9a15e14a7b --- /dev/null +++ b/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml @@ -0,0 +1,74 @@ +name: Windows Impair Defense Delete Win Defender Context Menu +id: 395ed5fe-ad13-4366-9405-a228427bdd91 +version: 1 +date: '2022-06-07' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: The search looks for the deletion of windows defender context menu registry. + This is consistent with RAT malware across a fleet of endpoints. This particular + behavior is typically executed when an malware actor gains access to an endpoint + and beings to perform execution. Usually, a batch (.bat) will be executed and multiple + registry and scheduled task modifications will occur. During triage, review parallel + processes and identify any further file modifications. Endpoint should be isolated. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry + where Registry.registry_path = "*\\shellex\\ContextMenuHandlers\\EPP" Registry.action = deleted + by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.dest Registry.user + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_impair_defense_delete_win_defender_context_menu_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. +known_false_positives: It is unusual to turn this feature off a Windows system since + it is a default security control, although it is not rare for some policies to disable + it. Although no false positives have been identified, use the provided filter macro + to tune the search. +references: +- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ +- https://app.any.run/tasks/45f5d114-91ea-486c-ab01-41c4093d2861/ +tags: + analytic_story: + - Windows Defense Evasion Tactics + - Windows Registry Abuse + asset_type: Endpoint + cis20: + - CIS 8 + confidence: 50 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon.log + impact: 50 + kill_chain_phases: + - Delivery + message: Windows Defender context menu registry key deleted on $dest$ + mitre_attack_id: + - T1562.001 + - T1562 + nist: + - PR.PT + - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.dest + - Registry.user + - Registry.registry_path + risk_score: 25 + security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon \ No newline at end of file diff --git a/tests/endpoint/windows_impair_defense_delete_win_defender_context_menu.test.yml b/tests/endpoint/windows_impair_defense_delete_win_defender_context_menu.test.yml new file mode 100644 index 0000000000..d565f72755 --- /dev/null +++ b/tests/endpoint/windows_impair_defense_delete_win_defender_context_menu.test.yml @@ -0,0 +1,13 @@ +name: Windows Impair Defense Delete Win Defender Context Menu Unit Test +tests: +- name: Windows Impair Defense Delete Win Defender Context Menu + file: endpoint/windows_impair_defense_delete_win_defender_context_menu.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From bc57962c0c441bd3398f9200459b27f3186696c1 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 7 Jun 2022 13:13:02 +0200 Subject: [PATCH 3/5] more-defense-evasion --- ...fense_delete_win_defender_context_menu.yml | 1 + ...e_delete_win_defender_profile_registry.yml | 75 +++++++++++++++++++ ...nses_disable_win_defender_auto_logging.yml | 1 + ...ete_win_defender_profile_registry.test.yml | 13 ++++ 4 files changed, 90 insertions(+) create mode 100644 detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml create mode 100644 tests/endpoint/windows_impair_defense_delete_win_defender_profile_registry.test.yml diff --git a/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml b/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml index 9a15e14a7b..53f8d45a9e 100644 --- a/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml +++ b/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml @@ -68,6 +68,7 @@ tags: - Registry.dest - Registry.user - Registry.registry_path + - Registry.action risk_score: 25 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml b/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml new file mode 100644 index 0000000000..9053e9090b --- /dev/null +++ b/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml @@ -0,0 +1,75 @@ +name: Windows Impair Defense Delete Win Defender Profile Registry +id: 65d4b105-ec52-48ec-ac46-289d0fbf7d96 +version: 1 +date: '2022-06-07' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The search looks for the deletion of windows defender main profile registry. + This was used by RAT malware across a fleet of endpoints. This particular + behavior is typically executed when an malware actor gains access to an endpoint + and beings to perform execution. Usually, a batch (.bat) will be executed and multiple + registry and scheduled task modifications will occur. During triage, review parallel + processes and identify any further file modifications. Endpoint should be isolated. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry + where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender" Registry.action = deleted + by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.user Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_impair_defense_delete_win_defender_profile_registry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. +known_false_positives: It is unusual to turn this feature off a Windows system since + it is a default security control, although it is not rare for some policies to disable + it. Although no false positives have been identified, use the provided filter macro + to tune the search. +references: +- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ +- https://app.any.run/tasks/45f5d114-91ea-486c-ab01-41c4093d2861/ +tags: + analytic_story: + - Windows Defense Evasion Tactics + - Windows Registry Abuse + asset_type: Endpoint + cis20: + - CIS 8 + confidence: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon.log + impact: 80 + kill_chain_phases: + - Delivery + message: Windows Defender Logger registry key set to 'disabled' on $dest$ + mitre_attack_id: + - T1562.001 + - T1562 + nist: + - PR.PT + - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.action + risk_score: 64 + security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon \ No newline at end of file diff --git a/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml b/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml index 0916e2333b..9fc4c91fc9 100644 --- a/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml +++ b/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml @@ -68,6 +68,7 @@ tags: - Registry.dest - Registry.user - Registry.registry_path + - Registry.action risk_score: 24 security_domain: endpoint supported_tas: diff --git a/tests/endpoint/windows_impair_defense_delete_win_defender_profile_registry.test.yml b/tests/endpoint/windows_impair_defense_delete_win_defender_profile_registry.test.yml new file mode 100644 index 0000000000..98d360eb71 --- /dev/null +++ b/tests/endpoint/windows_impair_defense_delete_win_defender_profile_registry.test.yml @@ -0,0 +1,13 @@ +name: Windows Impair Defense Delete Win Defender Profile Registry Unit Test +tests: +- name: Windows Impair Defense Delete Win Defender Profile Registry + file: endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From d8c3d523b5372da9a7fb57bc2503965d94d8044d Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 7 Jun 2022 07:10:27 -0600 Subject: [PATCH 4/5] touchup --- ...pair_defense_delete_win_defender_context_menu.yml | 12 ++++++------ ..._defense_delete_win_defender_profile_registry.yml | 8 ++++---- ...ir_defenses_disable_win_defender_auto_logging.yml | 6 +++--- 3 files changed, 13 insertions(+), 13 deletions(-) diff --git a/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml b/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml index 53f8d45a9e..79175bf985 100644 --- a/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml +++ b/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml @@ -6,12 +6,12 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: The search looks for the deletion of windows defender context menu registry. - This is consistent with RAT malware across a fleet of endpoints. This particular - behavior is typically executed when an malware actor gains access to an endpoint - and beings to perform execution. Usually, a batch (.bat) will be executed and multiple +description: The search looks for the deletion of Windows Defender context menu within the registry. + This is consistent behavior with RAT malware across a fleet of endpoints. This particular + behavior is executed when an adversary gains access to an endpoint + and begins to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel - processes and identify any further file modifications. Endpoint should be isolated. + processes and identify any further file modifications. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\shellex\\ContextMenuHandlers\\EPP" Registry.action = deleted by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.dest Registry.user @@ -45,7 +45,7 @@ tags: impact: 50 kill_chain_phases: - Delivery - message: Windows Defender context menu registry key deleted on $dest$ + message: Windows Defender context menu registry key deleted on $dest$. mitre_attack_id: - T1562.001 - T1562 diff --git a/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml b/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml index 9053e9090b..c8f7a347bd 100644 --- a/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml +++ b/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml @@ -6,12 +6,12 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: The search looks for the deletion of windows defender main profile registry. +description: The search looks for the deletion of Windows Defender main profile within the registry. This was used by RAT malware across a fleet of endpoints. This particular - behavior is typically executed when an malware actor gains access to an endpoint + behavior is typically executed when an adversary gains access to an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel - processes and identify any further file modifications. Endpoint should be isolated. + processes and identify any further file modifications. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender" Registry.action = deleted by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.user Registry.dest @@ -45,7 +45,7 @@ tags: impact: 80 kill_chain_phases: - Delivery - message: Windows Defender Logger registry key set to 'disabled' on $dest$ + message: Windows Defender Logger registry key set to 'disabled' on $dest$. mitre_attack_id: - T1562.001 - T1562 diff --git a/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml b/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml index 9fc4c91fc9..3701411852 100644 --- a/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml +++ b/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml @@ -8,10 +8,10 @@ datamodel: - Endpoint description: The search looks for the Registry Key DefenderApiLogger or DefenderAuditLogger set to disable. This is consistent with RAT malware across a fleet of endpoints. This particular - behavior is typically executed when an malware actor gains access to an endpoint + behavior is typically executed when anadversary gains access to an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel - processes and identify any further file modifications. Endpoint should be isolated. + processes and identify any further file modifications. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path = "*WMI\\Autologger\\DefenderApiLogger\\Start" OR Registry.registry_path = "*WMI\\Autologger\\DefenderAuditLogger\\Start") Registry.registry_value_data ="0x00000000" by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.dest Registry.user @@ -45,7 +45,7 @@ tags: impact: 30 kill_chain_phases: - Delivery - message: Windows Defender Logger registry key set to 'disabled' on $dest$ + message: Windows Defender Logger registry key set to 'disabled' on $dest$. mitre_attack_id: - T1562.001 - T1562 From 8d040371251a059a413b3d3fe033fd0e8f43942a Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 21 Jun 2022 16:28:05 -0700 Subject: [PATCH 5/5] Update windows_impair_defenses_disable_win_defender_auto_logging.yml --- ...dows_impair_defenses_disable_win_defender_auto_logging.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml b/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml index 3701411852..ec4d4bf177 100644 --- a/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml +++ b/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml @@ -8,7 +8,7 @@ datamodel: - Endpoint description: The search looks for the Registry Key DefenderApiLogger or DefenderAuditLogger set to disable. This is consistent with RAT malware across a fleet of endpoints. This particular - behavior is typically executed when anadversary gains access to an endpoint + behavior is typically executed when an adversary gains access to an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. @@ -72,4 +72,4 @@ tags: risk_score: 24 security_domain: endpoint supported_tas: - - Splunk_TA_microsoft_sysmon \ No newline at end of file + - Splunk_TA_microsoft_sysmon