diff --git a/.github/workflows/build-and-validate.yml b/.github/workflows/build-and-validate.yml index eed76df8cb..d7a8375d9a 100644 --- a/.github/workflows/build-and-validate.yml +++ b/.github/workflows/build-and-validate.yml @@ -463,9 +463,8 @@ jobs: - name: Generate content version and timestamp JSON run : | - curl -o version-api.json https://api.github.com/repositories/162346001/releases/latest - VERSION_VAL=$(cat version-api.json | jq '.name') - VERSION_TS=$(cat version-api.json | jq '.published_at') + VERSION_VAL=$GITHUB_REF_NAME + VERSION_TS=$(date -u +"%Y-%m-%dT%H:%M:%SZ") echo "{\"version\":{\"name\":$VERSION_VAL,\"published_at\":$VERSION_TS}}" > dist/api/version.json echo "contents of version.json:" cat dist/api/version.json diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml index 839bf47dd3..65fda96aaf 100644 --- a/detections/endpoint/active_setup_registry_autostart.yml +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -1,8 +1,8 @@ name: Active Setup Registry Autostart id: f64579c0-203f-11ec-abcc-acde48001122 -version: 2 -date: '2022-01-26' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -13,25 +13,19 @@ description: This analytic is to detect a suspicious modification of the active do the modification since modification of this registry is not commonly done. check the legitimacy of the file and process involve in this rules to check if it is a valid setup installer that creating or modifying this registry. -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry - where Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active - Setup\\Installed Components*" by _time span=1h Registry.dest Registry.user Registry.registry_path - Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, - _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - Processes.parent_process_name Processes.parent_process Processes.process_guid | - `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time - dest user parent_process_name parent_process process_name process_path process proc_guid - registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name - parent_process process_name process_path process proc_guid registry_path registry_value_name - registry_value_data | `active_setup_registry_autostart_filter`' -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `active_setup_registry_autostart_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: Active setup installer may add or modify this registry. references: - https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3AWin32%2FPoisonivy.E @@ -69,11 +63,21 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest - - Registry.user - - Registry.registry_path - - Registry.registry_key_name - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + - Registry.process_guid risk_score: 64 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml index 86c46d70eb..afa65e912a 100644 --- a/detections/endpoint/add_defaultuser_and_password_in_registry.yml +++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml @@ -1,8 +1,8 @@ name: Add DefaultUser And Password In Registry id: d4a3eb62-0f1e-11ec-a971-acde48001122 -version: 2 -date: '2022-01-26' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint @@ -12,25 +12,20 @@ description: this search is to detect a suspicious registry modification to impl continue encrypting the whole network. This behavior is not a common practice and really a suspicious TTP or alert need to be consider if found within then network premise. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" - AND Registry.registry_value_name= DefaultPassword OR Registry.registry_value_name= - DefaultUserName by _time span=1h Registry.dest Registry.user Registry.registry_path - Registry.registry_value_name Registry.process_guid Registry.registry_value_data - Registry.registry_key_name | `drop_dm_object_name(Registry)` |rename process_guid - as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name] | table _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name | `add_defaultuser_and_password_in_registry_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name= DefaultPassword OR Registry.registry_value_name= DefaultUserName) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `add_defaultuser_and_password_in_registry_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: unknown references: - https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ @@ -62,10 +57,21 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest + - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + - Registry.process_guid risk_score: 25 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml index 8fbd9c0f4b..cf50f27dcd 100644 --- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -1,8 +1,8 @@ name: Allow Inbound Traffic By Firewall Rule Registry id: 0a46537c-be02-11eb-92ca-acde48001122 -version: 3 -date: '2022-07-19' -author: Teoderick Contreras, Splunk +version: 4 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -10,25 +10,20 @@ description: This analytic detects a potential suspicious modification of firewa rule registry allowing inbound traffic in specific port with public profile. This technique was identified when an adversary wants to grant remote access to a machine by allowing the traffic in a firewall rule. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" - Registry.registry_value_data = "*|Action=Allow|*" Registry.registry_value_data = - "*|Dir=In|*" Registry.registry_value_data = "*|LPort=*" by _time span=1h Registry.dest - Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid - Registry.registry_key_name Registry.registry_value_data | `drop_dm_object_name(Registry)` - |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name] | table _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name | `allow_inbound_traffic_by_firewall_rule_registry_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" Registry.registry_value_data = "*|Action=Allow|*" Registry.registry_value_data = "*|Dir=In|*" Registry.registry_value_data = "*|LPort=*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `allow_inbound_traffic_by_firewall_rule_registry_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: network admin may add/remove/modify public inbound firewall rule that may cause this rule to be triggered. references: @@ -68,13 +63,21 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.registry_path + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid + - Registry.dest - Registry.registry_value_name - Registry.registry_key_name + - Registry.registry_path - Registry.registry_value_data - - Registry.action - - Registry.dest - - Registry.user + - Registry.process_guid risk_score: 25 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml index 36c69cc884..5f1507cc18 100644 --- a/detections/endpoint/allow_operation_with_consent_admin.yml +++ b/detections/endpoint/allow_operation_with_consent_admin.yml @@ -1,8 +1,8 @@ name: Allow Operation with Consent Admin id: 7de17d7a-c9d8-11eb-a812-acde48001122 -version: 2 -date: '2022-01-26' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -11,27 +11,20 @@ description: This analytic identifies a potential privilege escalation attempt t Admin` to perform an operation that requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation to the compromise machine. -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry - where Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*" - Registry.registry_value_name = ConsentPromptBehaviorAdmin Registry.registry_value_data - = "0x00000000" by _time span=1h Registry.dest Registry.user Registry.registry_path - Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data - | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, - _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - Processes.parent_process_name Processes.parent_process Processes.process_guid | - `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time - dest user parent_process_name parent_process process_name process_path process proc_guid - registry_path registry_value_name registry_value_data registry_key_name] | table - _time dest user parent_process_name parent_process process_name process_path process - proc_guid registry_path registry_value_name registry_value_data registry_key_name +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*" Registry.registry_value_name = ConsentPromptBehaviorAdmin Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `allow_operation_with_consent_admin_filter`' -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: unknown references: - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/341747f5-6b5d-4d30-85fc-fa1cc04038d4 @@ -69,10 +62,21 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest + - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + - Registry.process_guid risk_score: 25 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/auto_admin_logon_registry_entry.yml b/detections/endpoint/auto_admin_logon_registry_entry.yml index bd73fd27b6..edf78d6a80 100644 --- a/detections/endpoint/auto_admin_logon_registry_entry.yml +++ b/detections/endpoint/auto_admin_logon_registry_entry.yml @@ -1,8 +1,8 @@ name: Auto Admin Logon Registry Entry id: 1379d2b8-0f18-11ec-8ca3-acde48001122 -version: 2 -date: '2020-01-28' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -12,25 +12,20 @@ description: this search is to detect a suspicious registry modification to impl continue encrypting the whole network. This behavior is not a common practice and really a suspicious TTP or alert need to be consider if found within then network premise. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows - NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name=AutoAdminLogon AND - Registry.registry_value_data=1 by _time span=1h Registry.dest Registry.user Registry.registry_path - Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data - | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, - _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - Processes.parent_process_name Processes.parent_process Processes.process_guid | - `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time - dest user parent_process_name parent_process process_name process_path process proc_guid - registry_path registry_value_name registry_value_data registry_key_name] | table - _time dest user parent_process_name parent_process process_name process_path process - proc_guid registry_path registry_value_name registry_value_data registry_key_name +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name=AutoAdminLogon AND Registry.registry_value_data=1) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `auto_admin_logon_registry_entry_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: unknown references: - https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ @@ -63,10 +58,21 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest + - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + - Registry.process_guid risk_score: 63 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml index d5a0409e7c..8afb172c22 100644 --- a/detections/endpoint/disable_amsi_through_registry.yml +++ b/detections/endpoint/disable_amsi_through_registry.yml @@ -1,32 +1,29 @@ name: Disable AMSI Through Registry id: 9c27ec42-d338-11eb-9044-acde48001122 -version: 2 -date: '2022-01-26' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint description: this search is to identify modification in registry to disable AMSI windows feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute - payload with minimal alert as much as possible. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows - Script\\Settings\\AmsiEnable" Registry.registry_value_data = "0x00000000" by _time - span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` - |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data] - | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data | `disable_amsi_through_registry_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. + payload with minimal alert as much as possible. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\AmsiEnable" Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `disable_amsi_through_registry_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: network operator may disable this feature of windows but not so common. references: @@ -58,11 +55,21 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.user + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + - Registry.process_guid security_domain: endpoint asset_type: Endpoint confidence: 50 diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml index 4eb003c6e2..2a58664723 100644 --- a/detections/endpoint/disable_defender_antivirus_registry.yml +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -1,8 +1,8 @@ name: Disable Defender AntiVirus Registry id: aa4f695a-3024-11ec-9987-acde48001122 version: 3 -date: '2022-12-21' -author: Teoderick Contreras, Splunk, Steven Dick +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -12,19 +12,19 @@ description: This particular behavior is typically executed when an adversary or task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid -| `drop_dm_object_name(Processes)` -| join process_guid [ -| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender*" Registry.registry_value_name IN ("DisableAntiSpyware","DisableAntiVirus") Registry.registry_value_data = 0x00000001) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid -| `drop_dm_object_name(Registry)`] -| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid -| where isnotnull(registry_value_data) -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `disable_defender_antivirus_registry_filter`' + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender*" Registry.registry_value_name IN ("DisableAntiSpyware","DisableAntiVirus") Registry.registry_value_data = 0x00000001) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `disable_defender_antivirus_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: admin or user may choose to disable windows defender product references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ @@ -60,12 +60,21 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest - - Registry.user - Registry.registry_value_name - Registry.registry_key_name - Registry.registry_path - Registry.registry_value_data + - Registry.process_guid risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml index ede167e758..f78c4be85c 100644 --- a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml +++ b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml @@ -1,8 +1,8 @@ name: Disable Defender BlockAtFirstSeen Feature id: 2dd719ac-3021-11ec-97b4-acde48001122 -version: 2 -date: '2022-01-26' -author: Teoderick Contreras +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -10,23 +10,20 @@ description: This analytic is intended to detect a suspicious modification of th a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the BlockAtFirstSeen feature where it blocks suspicious files the first time seen on the host. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name - = DisableBlockAtFirstSeen Registry.registry_value_data = 0x00000001 by _time span=1h - Registry.dest Registry.user Registry.registry_path Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` - |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data] - | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data | `disable_defender_blockatfirstseen_feature_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = DisableBlockAtFirstSeen Registry.registry_value_data = 0x00000001) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `disable_defender_blockatfirstseen_feature_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: admin or user may choose to disable windows defender product references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ @@ -63,12 +60,21 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest - - Registry.user - Registry.registry_value_name - Registry.registry_key_name - Registry.registry_path - Registry.registry_value_data + - Registry.process_guid risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml index 0af4d6d4bf..c7ee6e5c3e 100644 --- a/detections/endpoint/disable_defender_enhanced_notification.yml +++ b/detections/endpoint/disable_defender_enhanced_notification.yml @@ -1,8 +1,8 @@ name: Disable Defender Enhanced Notification id: dc65678c-301f-11ec-8e30-acde48001122 -version: 2 -date: '2022-01-26' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -10,23 +10,20 @@ description: This analytic is intended to detect a suspicious modification of re windows defender features. This technique attempts to bypass or evade detection from Windows Defender AV, specifically the Enhanced Notification feature where a user or admin would receive alerts. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path = "*Microsoft\\Windows Defender\\Reporting*" Registry.registry_value_name - = DisableEnhancedNotifications Registry.registry_value_data = 0x00000001 by _time - span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` - |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data] - | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data | `disable_defender_enhanced_notification_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*Microsoft\\Windows Defender\\Reporting*" Registry.registry_value_name = DisableEnhancedNotifications Registry.registry_value_data = 0x00000001) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `disable_defender_antivirus_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the registry value name, registry path, and registry value data executions - from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 - of the Sysmon TA. + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: user may choose to disable windows defender AV references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ @@ -63,12 +60,21 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest - - Registry.user - Registry.registry_value_name - Registry.registry_key_name - Registry.registry_path - Registry.registry_value_data + - Registry.process_guid risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/disable_defender_mpengine_registry.yml b/detections/endpoint/disable_defender_mpengine_registry.yml index eadc698c90..0660f01a82 100644 --- a/detections/endpoint/disable_defender_mpengine_registry.yml +++ b/detections/endpoint/disable_defender_mpengine_registry.yml @@ -1,8 +1,8 @@ name: Disable Defender MpEngine Registry id: cc391750-3024-11ec-955a-acde48001122 -version: 2 -date: '2022-01-26' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -11,23 +11,20 @@ description: This particular behavior is typically executed when an adversary or detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender\\MpEngine*" - Registry.registry_value_name = MpEnablePus Registry.registry_value_data = 0x00000000 - by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` - |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data] - | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data | `disable_defender_mpengine_registry_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender\\MpEngine*" Registry.registry_value_name = MpEnablePus Registry.registry_value_data = 0x00000000) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `disable_defender_mpengine_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: admin or user may choose to disable windows defender product references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ @@ -63,12 +60,21 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest - - Registry.user - Registry.registry_value_name - Registry.registry_key_name - Registry.registry_path - Registry.registry_value_data + - Registry.process_guid risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml index c60602c952..c9eb0e7d6e 100644 --- a/detections/endpoint/disable_defender_spynet_reporting.yml +++ b/detections/endpoint/disable_defender_spynet_reporting.yml @@ -1,31 +1,28 @@ name: Disable Defender Spynet Reporting id: 898debf4-3021-11ec-ba7c-acde48001122 -version: 2 -date: '2022-01-26' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint description: This analytic is intended to detect a suspicious modification of registry to disable Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV product, specifically the spynet reporting for Defender telemetry. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name - = SpynetReporting Registry.registry_value_data = 0x00000000 by _time span=1h Registry.dest - Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as - proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data] - | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data | `disable_defender_spynet_reporting_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = SpynetReporting Registry.registry_value_data = 0x00000000) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `disable_defender_spynet_reporting_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: admin or user may choose to disable windows defender product references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ @@ -63,12 +60,21 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest - - Registry.user - Registry.registry_value_name - Registry.registry_key_name - Registry.registry_path - Registry.registry_value_data + - Registry.process_guid risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml index 516d974a65..28134727c6 100644 --- a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml +++ b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml @@ -1,31 +1,28 @@ name: Disable Defender Submit Samples Consent Feature id: 73922ff8-3022-11ec-bf5e-acde48001122 -version: 2 -date: '2022-01-26' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint description: This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the feature that submits samples for further analysis. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name - = SubmitSamplesConsent Registry.registry_value_data = 0x00000000 by _time span=1h - Registry.dest Registry.user Registry.registry_path Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` - |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data] - | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data | `disable_defender_submit_samples_consent_feature_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = SubmitSamplesConsent Registry.registry_value_data = 0x00000000) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `disable_defender_submit_samples_consent_feature_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: admin or user may choose to disable windows defender product references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ @@ -62,12 +59,21 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest - - Registry.user - Registry.registry_value_name - Registry.registry_key_name - Registry.registry_path - Registry.registry_value_data + - Registry.process_guid risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/disable_etw_through_registry.yml b/detections/endpoint/disable_etw_through_registry.yml index 34708edcd8..6f097aafd2 100644 --- a/detections/endpoint/disable_etw_through_registry.yml +++ b/detections/endpoint/disable_etw_through_registry.yml @@ -1,8 +1,8 @@ name: Disable ETW Through Registry id: f0eacfa4-d33f-11eb-8f9d-acde48001122 -version: 2 -date: '2022-01-27' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -10,23 +10,20 @@ description: this search is to identify modification in registry to disable ETW feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute payload with minimal alert as much as possible. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled" - Registry.registry_value_data = "0x00000000" by _time span=1h Registry.dest Registry.user - Registry.registry_path Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as - proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data] - | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data | `disable_etw_through_registry_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled" Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `disable_etw_through_registry_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: network operator may disable this feature of windows but not so common. references: @@ -57,11 +54,21 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.user + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + - Registry.process_guid security_domain: endpoint asset_type: Endpoint confidence: 50 diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index 60016c024f..fc741d3f69 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -1,8 +1,8 @@ name: Disable Registry Tool id: cd2cf33c-9201-11eb-a10a-acde48001122 -version: 2 -date: '2022-01-27' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -11,23 +11,20 @@ description: This search identifies modification of registry to disable the rege knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" - Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user - Registry.registry_path Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as - proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data] - | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data | `disable_registry_tool_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `disable_registry_tool_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: admin may disable this application for non technical user. references: - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry @@ -61,11 +58,21 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.user + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + - Registry.process_guid risk_score: 40 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/disable_security_logs_using_minint_registry.yml b/detections/endpoint/disable_security_logs_using_minint_registry.yml index 0c268b1755..8f62caf6a5 100644 --- a/detections/endpoint/disable_security_logs_using_minint_registry.yml +++ b/detections/endpoint/disable_security_logs_using_minint_registry.yml @@ -1,8 +1,8 @@ name: Disable Security Logs Using MiniNt Registry id: 39ebdc68-25b9-11ec-aec7-acde48001122 -version: 2 -date: '2022-01-27' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -10,24 +10,20 @@ description: This analytic is to detect a suspicious registry modification to di security audit logs. This technique was shared by a researcher to disable Security logs of windows by adding this registry. The Windows will think it is WinPE and will not log any event to the Security Log -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry - where Registry.registry_path="*\\Control\\MiniNt\\*" by _time span=1h Registry.dest - Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as - proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data] - | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data | `disable_security_logs_using_minint_registry_filter`' -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\Control\\MiniNt\\*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `disable_security_logs_using_minint_registry_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: Unknown. references: - https://twitter.com/0gtweet/status/1182516740955226112 @@ -62,12 +58,21 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest - - Registry.user - Registry.registry_value_name - Registry.registry_key_name - Registry.registry_path - Registry.registry_value_data + - Registry.process_guid risk_score: 80 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml index a1c0aabf8a..b836bf133f 100644 --- a/detections/endpoint/disable_show_hidden_files.yml +++ b/detections/endpoint/disable_show_hidden_files.yml @@ -1,8 +1,8 @@ name: Disable Show Hidden Files id: 6f3ccfa2-91fe-11eb-8f9b-acde48001122 -version: 2 -date: '2022-01-27' -author: Teoderick Contreras, Mauricio Velazco, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -10,25 +10,20 @@ description: The following analytic is to identify a modification in the Windows to prevent users from seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" - OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" - Registry.registry_value_data = "0x00000001") OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" - Registry.registry_value_data = "0x00000000") by _time span=1h Registry.dest Registry.user - Registry.registry_path Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as - proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data] - | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data | `disable_show_hidden_files_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE ((Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" Registry.registry_value_data = "0x00000001") OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" Registry.registry_value_data = "0x00000000")) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `disable_show_hidden_files_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: unknown references: - https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis @@ -65,11 +60,21 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid + - Registry.dest + - Registry.registry_value_name - Registry.registry_key_name - Registry.registry_path - - Registry.user - - Registry.dest - - Registry.registry_value_nam + - Registry.registry_value_data + - Registry.process_guid risk_score: 40 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/disable_uac_remote_restriction.yml b/detections/endpoint/disable_uac_remote_restriction.yml index 5f36ad8bfb..0198c478ba 100644 --- a/detections/endpoint/disable_uac_remote_restriction.yml +++ b/detections/endpoint/disable_uac_remote_restriction.yml @@ -1,8 +1,8 @@ name: Disable UAC Remote Restriction id: 9928b732-210e-11ec-b65e-acde48001122 -version: 2 -date: '2022-01-27' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -11,25 +11,20 @@ description: This analytic is to detect a suspicious modification of registry to attacker may modify this registry value to bypassed UAC feature of windows host. This is a good indicator that some tries to bypassed UAC to suspicious process or gain privilege escalation. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime - max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\CurrentVersion\\Policies\\System*" - Registry.registry_value_name="LocalAccountTokenFilterPolicy" Registry.registry_value_data="0x00000001" - by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` - |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data] - | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data | `disable_uac_remote_restriction_filter`' -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\CurrentVersion\\Policies\\System*" Registry.registry_value_name="LocalAccountTokenFilterPolicy" Registry.registry_value_data="0x00000001" ) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `disable_uac_remote_restriction_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: admin may set this policy for non-critical machine. references: - https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/user-account-control-and-remote-restriction @@ -66,12 +61,21 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest - - Registry.user - - Registry.registry_path - - Registry.registry_key_name - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path - Registry.registry_value_data + - Registry.process_guid risk_score: 80 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml index 17512b19ff..26f8c90e27 100644 --- a/detections/endpoint/disable_windows_app_hotkeys.yml +++ b/detections/endpoint/disable_windows_app_hotkeys.yml @@ -1,8 +1,8 @@ name: Disable Windows App Hotkeys id: 1490f224-ad8b-11eb-8c4f-acde48001122 -version: 2 -date: '2022-01-27' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunkk type: TTP datamodel: - Endpoint @@ -11,27 +11,20 @@ description: This analytic detects a suspicious registry modification to disable used to disable certain or several Windows applications like `taskmgr.exe` and `cmd.exe`. This technique is used to impair the analyst in analyzing and removing the attacker implant in compromised systems. -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry - where Registry.registry_path="*\\Windows NT\\CurrentVersion\\Image File Execution - Options\\*" AND Registry.registry_value_data= "HotKey Disabled" AND Registry.registry_value_name - = "Debugger" by _time span=1h Registry.dest Registry.user Registry.registry_path - Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data - | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, - _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - Processes.parent_process_name Processes.parent_process Processes.process_guid | - `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time - dest user parent_process_name parent_process process_name process_path process proc_guid - registry_path registry_value_name registry_value_data registry_key_name] | table - _time dest user parent_process_name parent_process process_name process_path process - proc_guid registry_path registry_value_name registry_value_data registry_key_name +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\Windows NT\\CurrentVersion\\Image File Execution Options\\*" AND Registry.registry_value_data= "HotKey Disabled" AND Registry.registry_value_name = "Debugger") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `disable_windows_app_hotkeys_filter`' -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: unknown references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ @@ -63,10 +56,21 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid + - Registry.dest + - Registry.registry_value_name - Registry.registry_key_name - Registry.registry_path - - Registry.registry_value_name - - Registry.dest Registry.user + - Registry.registry_value_data + - Registry.process_guidr risk_score: 40 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index 36e847bd62..230c818198 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -1,38 +1,28 @@ name: Disable Windows Behavior Monitoring id: 79439cae-9200-11eb-a4d3-acde48001122 -version: 2 -date: '2022-01-27' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint description: This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time - Protection\\DisableBehaviorMonitoring" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows - Defender\\Real-Time Protection\\DisableOnAccessProtection" OR Registry.registry_path= - "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable" - OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time - Protection\\DisableRealtimeMonitoring" OR Registry.registry_path= "*\\Real-Time - Protection\\DisableIntrusionPreventionSystem" OR Registry.registry_path= "*\\Real-Time - Protection\\DisableIOAVProtection" OR Registry.registry_path= "*\\Real-Time Protection\\DisableScriptScanning" - AND Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user - Registry.registry_path Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as - proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data] - | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data | `disable_windows_behavior_monitoring_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring" OR Registry.registry_path= "*\\Real-Time Protection\\DisableIntrusionPreventionSystem" OR Registry.registry_path= "*\\Real-Time Protection\\DisableIOAVProtection" OR Registry.registry_path= "*\\Real-Time Protection\\DisableScriptScanning" AND Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `disable_windows_behavior_monitoring_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: admin or user may choose to disable this windows features. references: - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html @@ -69,11 +59,21 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.user + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + - Registry.process_guid risk_score: 40 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/disable_windows_smartscreen_protection.yml b/detections/endpoint/disable_windows_smartscreen_protection.yml index 1ec1b145e4..6503a19e35 100644 --- a/detections/endpoint/disable_windows_smartscreen_protection.yml +++ b/detections/endpoint/disable_windows_smartscreen_protection.yml @@ -1,8 +1,8 @@ name: Disable Windows SmartScreen Protection id: 664f0fd0-91ff-11eb-a56f-acde48001122 -version: 2 -date: '2022-01-27' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -11,22 +11,20 @@ description: The following search identifies a modification of registry to disab early warning system against website that might engage in phishing attack or malware distribution. This modification are seen in RAT malware to cover their tracks upon downloading other of its component or other payload. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path= "*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled" Registry.registry_value_data= - "Off" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` - |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data] - | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data | `disable_windows_smartscreen_protection_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled" Registry.registry_value_data= "Off") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `disable_windows_smartscreen_protection_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: admin or user may choose to disable this windows features. references: - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html @@ -64,11 +62,21 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid + - Registry.dest + - Registry.registry_value_name - Registry.registry_key_name - Registry.registry_path - - Registry.user - - Registry.dest - - Registry.registry_value_nam + - Registry.registry_value_data + - Registry.process_guid risk_score: 25 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index 9006a4e342..efaea5399e 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -1,8 +1,8 @@ name: Disabling CMD Application id: ff86077c-9212-11eb-a1e6-acde48001122 -version: 2 -date: '2022-01-27' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -10,24 +10,20 @@ description: this search is to identify modification in registry to disable cmd application. This technique is commonly seen in RAT, Trojan or WORM to prevent triaging or deleting there samples through cmd application which is one of the tool of analyst to traverse on directory and files. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD" - Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user - Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid - Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid - as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name] | table _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name | `disabling_cmd_application_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid +| `drop_dm_object_name(Processes)` +| join process_guid [ +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid +| `drop_dm_object_name(Registry)`] +| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid +| where isnotnull(registry_value_data) +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `disabling_cmd_application_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: admin may disable this application for non technical user. references: - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry @@ -65,11 +61,21 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.user + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + - Registry.process_guid risk_score: 25 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml index fb73ca5935..16accb13b4 100644 --- a/detections/endpoint/disabling_controlpanel.yml +++ b/detections/endpoint/disabling_controlpanel.yml @@ -1,32 +1,29 @@ name: Disabling ControlPanel id: 6ae0148e-9215-11eb-a94a-acde48001122 -version: 2 -date: '2022-01-27' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint description: this search is to identify registry modification to disable control panel window. This technique is commonly seen in malware to prevent their artifacts , persistence removed on the infected machine. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" - Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user - Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid - Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid - as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name] | table _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name | `disabling_controlpanel_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `disabling_controlpanel_filter`' + +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: admin may disable this application for non technical user. references: - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry @@ -64,11 +61,21 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.user + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + - Registry.process_guid risk_score: 25 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/disabling_defender_services.yml b/detections/endpoint/disabling_defender_services.yml index e82bdcb7b3..2250215927 100644 --- a/detections/endpoint/disabling_defender_services.yml +++ b/detections/endpoint/disabling_defender_services.yml @@ -1,8 +1,8 @@ name: Disabling Defender Services id: 911eacdc-317f-11ec-ad30-acde48001122 -version: 2 -date: '2022-01-28' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -11,24 +11,20 @@ description: This particular behavior is typically executed when an adversaries detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path = "*\\System\\CurrentControlSet\\Services\\*" AND (Registry.registry_path - IN("*WdBoot*", "*WdFilter*", "*WdNisDrv*", "*WdNisSvc*","*WinDefend*", "*SecurityHealthService*")) - AND Registry.registry_value_name = Start Registry.registry_value_data = 0x00000004 - by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` - |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data] - | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data | `disabling_defender_services_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\System\\CurrentControlSet\\Services\\*" AND (Registry.registry_path IN("*WdBoot*", "*WdFilter*", "*WdNisDrv*", "*WdNisSvc*","*WinDefend*", "*SecurityHealthService*")) AND Registry.registry_value_name = Start Registry.registry_value_data = 0x00000004) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `disabling_defender_services_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: admin or user may choose to disable windows defender product references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ @@ -64,12 +60,21 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest - - Registry.user - Registry.registry_value_name - Registry.registry_key_name - Registry.registry_path - Registry.registry_value_data + - Registry.process_guid risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/disabling_folderoptions_windows_feature.yml b/detections/endpoint/disabling_folderoptions_windows_feature.yml index 362e10f41e..5714eb29f4 100644 --- a/detections/endpoint/disabling_folderoptions_windows_feature.yml +++ b/detections/endpoint/disabling_folderoptions_windows_feature.yml @@ -1,8 +1,8 @@ name: Disabling FolderOptions Windows Feature id: 83776de4-921a-11eb-868a-acde48001122 -version: 2 -date: '2022-01-28' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -11,24 +11,20 @@ description: This search is to identify registry modification to disable folder used by malware in combination if disabling show hidden files feature to hide their files and also to hide the file extension to lure the user base on file icons or fake file extensions. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" - Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user - Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid - Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid - as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name] | table _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name | `disabling_folderoptions_windows_feature_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `disabling_folderoptions_windows_feature_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: admin may disable this application for non technical user. references: - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry @@ -66,11 +62,21 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.user + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + - Registry.process_guid risk_score: 25 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml index d1bcc23391..f7817d6cf2 100644 --- a/detections/endpoint/disabling_norun_windows_app.yml +++ b/detections/endpoint/disabling_norun_windows_app.yml @@ -1,8 +1,8 @@ name: Disabling NoRun Windows App id: de81bc46-9213-11eb-adc9-acde48001122 -version: 2 -date: '2022-01-28' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -11,24 +11,20 @@ description: This search is to identify modification of registry to disable run OS user to run known application and also to execute some reg or batch script. This technique is used malware to make cleaning of its infection more harder by preventing known application run easily through run shortcut. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" - Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user - Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid - Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid - as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name] | table _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name | `disabling_norun_windows_app_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `disabling_norun_windows_app_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: admin may disable this application for non technical user. references: - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry @@ -68,11 +64,21 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.user + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + - Registry.process_guid risk_score: 25 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index 4f2d135f99..0bbfcc5e73 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -1,8 +1,8 @@ name: Disabling SystemRestore In Registry id: f4f837e2-91fb-11eb-8bf6-acde48001122 -version: 2 -date: '2022-01-28' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -10,27 +10,20 @@ description: The following search identifies the modification of registry relate in disabling the system restore of a machine. This event or behavior are seen in some RAT malware to make the restore of the infected machine difficult and keep their infection on the box. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR" - OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig" - OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableSR" - OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableConfig" - Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user - Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid - Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid - as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name] | table _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name | `disabling_systemrestore_in_registry_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableConfig" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `disabling_systemrestore_in_registry_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: in some cases admin can disable systemrestore on a machine. references: - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html @@ -68,11 +61,21 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.user + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + - Registry.process_guid risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml index 1fedab8198..f0e18f3824 100644 --- a/detections/endpoint/disabling_task_manager.yml +++ b/detections/endpoint/disabling_task_manager.yml @@ -1,8 +1,8 @@ name: Disabling Task Manager id: dac279bc-9202-11eb-b7fb-acde48001122 -version: 2 -date: '2022-01-28' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -10,24 +10,20 @@ description: This search is to identifies modification of registry to disable th task manager of windows operating system. this event or technique are commonly seen in malware such as RAT, Trojan, TrojanSpy or worm to prevent the user to terminate their process. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" - Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user - Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid - Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid - as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name] | table _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name | `disabling_task_manager_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `disabling_task_manager_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: admin may disable this application for non technical user. references: - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry @@ -65,12 +61,21 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.user + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + - Registry.process_guid risk_score: 42 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml index 966883bf51..52da3d4a7e 100644 --- a/detections/endpoint/enable_rdp_in_other_port_number.yml +++ b/detections/endpoint/enable_rdp_in_other_port_number.yml @@ -1,8 +1,8 @@ name: Enable RDP In Other Port Number id: 99495452-b899-11eb-96dc-acde48001122 -version: 2 -date: '2022-01-28' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -10,24 +10,20 @@ description: This search is to detect a modification to registry to enable rdp t a machine with different port number. This technique was seen in some atttacker tries to do lateral movement and remote access to a compromised machine to gain control of it. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal - Server\\WinStations\\RDP-Tcp*" Registry.registry_value_name = "PortNumber" by _time - span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name - Registry.process_guid Registry.registry_key_name | `drop_dm_object_name(Registry)` - |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name] | table _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name | `enable_rdp_in_other_port_number_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp*" Registry.registry_value_name = "PortNumber") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `enable_rdp_in_other_port_number_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: unknown references: - https://www.mvps.net/docs/how-to-secure-remote-desktop-rdp/ @@ -62,10 +58,21 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.registry_path + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest - - Registry.user - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + - Registry.process_guid risk_score: 80 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml index b0a147f085..4e1816e947 100644 --- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -1,8 +1,8 @@ name: Enable WDigest UseLogonCredential Registry id: 0c7d8ffe-25b1-11ec-9f39-acde48001122 -version: 2 -date: '2022-01-28' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -11,27 +11,20 @@ description: This analytic is to detect a suspicious registry modification to en and also by mimikatz to be able to dumpe the a plain text credential to the compromised or target host. This TTP is really a good indicator that someone wants to dump the crendential of the host so it must be a good pivot for credential dumping techniques. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime - max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*" - Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data - = 0x00000001 by _time span=1h Registry.dest Registry.user Registry.registry_path - Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data - | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, - _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - Processes.parent_process_name Processes.parent_process Processes.process_guid | - `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time - dest user parent_process_name parent_process process_name process_path process proc_guid - registry_path registry_value_name registry_value_data registry_key_name] | table - _time dest user parent_process_name parent_process process_name process_path process - proc_guid registry_path registry_value_name registry_value_data registry_key_name +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*" Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data = 0x00000001) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `enable_wdigest_uselogoncredential_registry_filter`' -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: unknown references: - https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html @@ -68,12 +61,21 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest - - Registry.user - Registry.registry_value_name - Registry.registry_key_name - Registry.registry_path - Registry.registry_value_data + - Registry.process_guid risk_score: 80 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml index d613e31276..3cecb3347f 100644 --- a/detections/endpoint/etw_registry_disabled.yml +++ b/detections/endpoint/etw_registry_disabled.yml @@ -1,35 +1,28 @@ name: ETW Registry Disabled id: 8ed523ac-276b-11ec-ac39-acde48001122 -version: 2 -date: '2022-01-28' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint description: This analytic is to detect a registry modification to disable ETW feature of windows. This technique is to evade EDR appliance to evade detections and hide - its execution from audit logs. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime - max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\.NETFramework*" - Registry.registry_value_name = ETWEnabled Registry.registry_value_data=0x00000000 - by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name - Registry.process_guid Registry.registry_key_name Registry.registry_value_data | - `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, - _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - Processes.parent_process_name Processes.parent_process Processes.process_guid | - `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time - dest user parent_process_name parent_process process_name process_path process proc_guid - registry_path registry_value_name registry_value_data registry_key_name] | table - _time dest user parent_process_name parent_process process_name process_path process - proc_guid registry_path registry_value_name registry_value_data registry_key_name + its execution from audit logs. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\SOFTWARE\\Microsoft\\.NETFramework*" Registry.registry_value_name = ETWEnabled Registry.registry_value_data=0x00000000) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `etw_registry_disabled_filter`' -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: unknown references: - https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3 @@ -68,12 +61,21 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest - - Registry.user - - Registry.registry_path - - Registry.registry_key_name - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path - Registry.registry_value_data + - Registry.process_guid risk_score: 90 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml index 57dcf8d724..419f7bb662 100644 --- a/detections/endpoint/eventvwr_uac_bypass.yml +++ b/detections/endpoint/eventvwr_uac_bypass.yml @@ -1,8 +1,8 @@ name: Eventvwr UAC Bypass id: 9cf8fe08-7ad8-11eb-9819-acde48001122 -version: 2 -date: '2022-01-28' -author: Michael Haag, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Michael Haag, Splunk type: TTP datamodel: - Endpoint @@ -12,24 +12,20 @@ description: The following search identifies Eventvwr bypass by identifying the upon eventvwr.msc loading. Upon triage, review the parallel processes that have executed. Identify any additional registry modifications on the endpoint that may look suspicious. Remediate as necessary. -search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) - as registry_key_name values(Registry.registry_path) as registry_path min(_time) - as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*mscfile\\shell\\open\\command\\*" - by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name - Registry.process_guid Registry.registry_key_name Registry.registry_value_data | - `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, - _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - Processes.parent_process_name Processes.parent_process Processes.process_guid | - `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time - dest user parent_process_name parent_process process_name process_path process proc_guid - registry_path registry_value_name registry_value_data registry_key_name] | table - _time dest user parent_process_name parent_process process_name process_path process - proc_guid registry_path registry_value_name registry_value_data registry_key_name +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*mscfile\\shell\\open\\command\\*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `eventvwr_uac_bypass_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: Some false positives may be present and will need to be filtered. references: - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ @@ -72,11 +68,21 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.user + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + - Registry.process_guid risk_score: 80 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml index 7f24e93935..22915bcbdb 100644 --- a/detections/endpoint/hide_user_account_from_sign_in_screen.yml +++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml @@ -1,8 +1,8 @@ name: Hide User Account From Sign-In Screen id: 834ba832-ad89-11eb-937d-acde48001122 -version: 2 -date: '2022-01-28' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -11,27 +11,20 @@ description: This analytic identifies a suspicious registry modification to hide where the adversary will create a hidden user account with Admin privileges in login screen to avoid noticing by the user that they already compromise and to persist on that said machine. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime - max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows - NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist*" AND Registry.registry_value_data - = "0x00000000" by _time span=1h Registry.dest Registry.user Registry.registry_path - Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data - | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, - _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - Processes.parent_process_name Processes.parent_process Processes.process_guid | - `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time - dest user parent_process_name parent_process process_name process_path process proc_guid - registry_path registry_value_name registry_value_data registry_key_name] | table - _time dest user parent_process_name parent_process process_name process_path process - proc_guid registry_path registry_value_name registry_value_data registry_key_name +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist*" AND Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `hide_user_account_from_sign_in_screen_filter`' -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: Unknown. Filter as needed. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ @@ -74,10 +67,21 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid + - Registry.dest + - Registry.registry_value_name - Registry.registry_key_name - Registry.registry_path - - Registry.registry_value_name - - Registry.dest Registry.user + - Registry.registry_value_data + - Registry.process_guid risk_score: 72 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml index bbcccc4b3c..aa1f0729eb 100644 --- a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml +++ b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml @@ -1,8 +1,8 @@ name: Monitor Registry Keys for Print Monitors id: f5f6af30-7ba7-4295-bfe9-07de87c01bbc -version: 3 -date: '2020-01-28' -author: Bhavin Patel, Teoderick Contreras, Splunk +version: 4 +date: '2022-11-14' +author: Steven Dick, Bhavin Patel, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -11,26 +11,20 @@ description: This search looks for registry activity associated with modificatio scenario, an attacker can load an arbitrary .dll into the print-monitor registry by giving the full path name to the after.dll. The system will execute the .dll with elevated (SYSTEM) permissions and will persist after reboot. -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry - where Registry.action=modified AND Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*" - by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name - Registry.process_guid Registry.registry_key_name Registry.registry_value_data | - `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, - _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - Processes.parent_process_name Processes.parent_process Processes.process_guid | - `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time - dest user parent_process_name parent_process process_name process_path process proc_guid - registry_path registry_value_name registry_value_data registry_key_name] | table - _time dest user parent_process_name parent_process process_name process_path process - proc_guid registry_path registry_value_name registry_value_data registry_key_name +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.action=modified AND Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `monitor_registry_keys_for_print_monitors_filter`' -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. - The data used for this search is typically generated via logs that report registry - modifications. +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: You will encounter noise from legitimate print-monitor registry entries. references: [] @@ -74,11 +68,20 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.action - - Registry.registry_path + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest - - Registry.registry_key_name - - Registry.user - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + - Registry.process_guid risk_score: 64 security_domain: endpoint diff --git a/detections/endpoint/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml index 9df5124d27..f0d57284d5 100644 --- a/detections/endpoint/registry_keys_for_creating_shim_databases.yml +++ b/detections/endpoint/registry_keys_for_creating_shim_databases.yml @@ -1,30 +1,27 @@ name: Registry Keys for Creating SHIM Databases id: f5f6af30-7aa7-4295-bfe9-07fe87c01bbb -version: 4 -date: '2020-01-28' -author: Bhavin Patel, Patrick Bareiss, Teoderick Contreras, Splunk +version: 5 +date: '2022-11-14' +author: Steven Dick, Bhavin Patel, Patrick Bareiss, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint description: This search looks for registry activity associated with application compatibility shims, which can be leveraged by attackers for various nefarious purposes. -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry - where Registry.registry_path=*CurrentVersion\\AppCompatFlags\\Custom* OR Registry.registry_path=*CurrentVersion\\AppCompatFlags\\InstalledSDB* - by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` - |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data] - | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data | `registry_keys_for_creating_shim_databases_filter`' -how_to_implement: To successfully implement this search, you must populate the Change_Analysis - data model. This is typically populated via endpoint detection and response product, - such as Carbon Black or other endpoint data sources such as Sysmon. The data used - for this search is typically generated via logs that report reads and writes to - the registry. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path=*CurrentVersion\\AppCompatFlags\\Custom* OR Registry.registry_path=*CurrentVersion\\AppCompatFlags\\InstalledSDB*) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `registry_keys_for_creating_shim_databases_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: There are many legitimate applications that leverage shim databases for compatibility purposes for legacy applications references: [] @@ -68,9 +65,20 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid + - Registry.dest + - Registry.registry_value_name - Registry.registry_key_name - Registry.registry_path - - Registry.dest - - Registry.user + - Registry.registry_value_data + - Registry.process_guid risk_score: 56 security_domain: endpoint diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml index 31b20c5995..6e69227d1f 100644 --- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml +++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml @@ -1,8 +1,8 @@ name: Registry Keys Used For Privilege Escalation id: c9f4b923-f8af-4155-b697-1354f5bcbc5e -version: 5 -date: '2022-01-26' -author: David Dorsey, Teoderick Contreras, Splunk +version: 6 +date: '2022-11-14' +author: Steven Dick, David Dorsey, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -10,27 +10,20 @@ description: This search looks for modifications to registry keys that can be us to elevate privileges. The registry keys under "Image File Execution Options" are used to intercept calls to an executable and can be used to attach malicious binaries to benign system binaries. -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry - where (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File - Execution Options*") AND (Registry.registry_value_name=GlobalFlag OR Registry.registry_value_name=Debugger) - by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name - Registry.registry_value_data Registry.process_guid Registry.registry_key_name | - `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, - _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - Processes.parent_process_name Processes.parent_process Processes.process_guid | - `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time - dest user parent_process_name parent_process process_name process_path process proc_guid - registry_path registry_value_name registry_value_data registry_key_name] | table - _time dest user parent_process_name parent_process process_name process_path process - proc_guid registry_path registry_value_name registry_value_data registry_key_name +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE ((Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*") AND (Registry.registry_value_name=GlobalFlag OR Registry.registry_value_name=Debugger)) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `registry_keys_used_for_privilege_escalation_filter`' -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black, or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: There are many legitimate applications that must execute upon system startup and will use these registry keys to accomplish that task. references: @@ -76,10 +69,21 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.registry_path - - Registry.registry_key_name + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest - - Registry.user + - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + - Registry.process_guid risk_score: 76 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index af7fb3ca92..62f3aefd5c 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -1,29 +1,27 @@ name: Remcos client registry install entry id: f2a1615a-1d63-11ec-97d2-acde48001122 -version: 2 -date: '2022-01-26' -author: Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint description: This search detects registry key license at host where Remcos RAT agent is installed. -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry - where (Registry.registry_key_name=*\\Software\\Remcos*) by _time span=1h Registry.dest - Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as - proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data] - | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data |`remcos_client_registry_install_entry_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_key_name=*\\Software\\Remcos*) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + |`remcos_client_registry_install_entry_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/570 known_false_positives: unknown references: - https://attack.mitre.org/software/S0332/ @@ -55,11 +53,21 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.registry_path - - Registry.registry_key_name - - Registry.process_id + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest - - Registry.user + - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + - Registry.process_guid risk_score: 90 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml index f67169a505..ffaf00bb44 100644 --- a/detections/endpoint/revil_registry_entry.yml +++ b/detections/endpoint/revil_registry_entry.yml @@ -1,8 +1,8 @@ name: Revil Registry Entry id: e3d3f57a-c381-11eb-9e35-acde48001122 -version: 2 -date: '2021-01-26' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -11,22 +11,20 @@ description: This analytic identifies suspicious modification in registry entry implant, malware and ransomware like REVIL where it keep some information like the random generated file extension it uses for all the encrypted files and ransomware notes file name in the compromised host. -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry - where (Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" - OR Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*") by _time - span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` - |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data] - | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data | `revil_registry_entry_filter`' -how_to_implement: to successfully implement this search, you need to be ingesting - logs with the Image, TargetObject registry key, registry Details from your endpoints. - If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" OR Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `revil_registry_entry_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: unknown references: - https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ @@ -64,11 +62,21 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest - - Registry.user - Registry.registry_value_name - - Registry.registry_path - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + - Registry.process_guid risk_score: 60 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/sdclt_uac_bypass.yml b/detections/endpoint/sdclt_uac_bypass.yml index 6e0bfbad04..a905c182f9 100644 --- a/detections/endpoint/sdclt_uac_bypass.yml +++ b/detections/endpoint/sdclt_uac_bypass.yml @@ -1,8 +1,8 @@ name: Sdclt UAC Bypass id: d71efbf6-da63-11eb-8c6e-acde48001122 -version: 2 -date: '2020-01-28' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -10,25 +10,20 @@ description: This search is to detect a suspicious sdclt.exe registry modificati This technique is commonly seen when attacker try to bypassed UAC by using sdclt.exe application by modifying some registry that sdclt.exe tries to open or query with payload file path on it to be executed. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\Windows\\CurrentVersion\\App - Paths\\control.exe*" OR Registry.registry_path= "*\\exefile\\shell\\runas\\command\\*") - (Registry.registry_value_name = "(Default)" OR Registry.registry_value_name = "IsolatedCommand") - by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name - Registry.process_guid Registry.registry_key_name Registry.registry_value_data | - `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, - _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - Processes.parent_process_name Processes.parent_process Processes.process_guid | - `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time - dest user parent_process_name parent_process process_name process_path process proc_guid - registry_path registry_value_name registry_value_data registry_key_name] | table - _time dest user parent_process_name parent_process process_name process_path process - proc_guid registry_path registry_value_name registry_value_data registry_key_name +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE ((Registry.registry_path= "*\\Windows\\CurrentVersion\\App Paths\\control.exe*" OR Registry.registry_path= "*\\exefile\\shell\\runas\\command\\*") (Registry.registry_value_name = "(Default)" OR Registry.registry_value_name = "IsolatedCommand")) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `sdclt_uac_bypass_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: Limited to no false positives are expected. references: - https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/ @@ -66,10 +61,21 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest + - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + - Registry.process_guid risk_score: 63 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml index 2d536fdcbd..3f7eecc36d 100644 --- a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml +++ b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml @@ -1,23 +1,27 @@ name: Set Default PowerShell Execution Policy To Unrestricted or Bypass id: c2590137-0b08-4985-9ec5-6ae23d92f63d -version: 7 -date: '2022-02-18' -author: Patrick Bareiss, Splunk +version: 8 +date: '2022-11-14' +author: Steven Dick, Patrick Bareiss, Splunk type: TTP datamodel: - Endpoint description: Monitor for changes of the ExecutionPolicy in the registry to the values "unrestricted" or "bypass," which allows the execution of malicious scripts. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Registry where Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell* - Registry.registry_value_name=ExecutionPolicy (Registry.registry_value_data=Unrestricted - OR Registry.registry_value_data=Bypass) by Registry.registry_path Registry.registry_value_name - Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`' -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Registry node. You must also be - ingesting logs with the fields registry_path, registry_key_name, and registry_value_name - from your endpoints. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid +| `drop_dm_object_name(Processes)` +| join process_guid [ +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell* Registry.registry_value_name=ExecutionPolicy (Registry.registry_value_data=Unrestricted OR Registry.registry_value_data=Bypass)) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid +| `drop_dm_object_name(Registry)`] +| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid +| where isnotnull(registry_value_data) +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: Administrators may attempt to change the default execution policy on a system for a variety of reasons. However, setting the policy to "unrestricted" or "bypass" as this search is designed to identify, would be unusual. Hits should @@ -65,10 +69,21 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest + - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + - Registry.process_guid risk_score: 48 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/silentcleanup_uac_bypass.yml b/detections/endpoint/silentcleanup_uac_bypass.yml index e5438c4c95..727716c488 100644 --- a/detections/endpoint/silentcleanup_uac_bypass.yml +++ b/detections/endpoint/silentcleanup_uac_bypass.yml @@ -1,8 +1,8 @@ name: SilentCleanup UAC Bypass id: 56d7cfcc-da63-11eb-92d4-acde48001122 -version: 2 -date: '2020-01-28' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -10,24 +10,20 @@ description: This search is to detect a suspicious modification of registry that related to UAC bypassed. This registry will be trigger once the attacker abuse the silentcleanup task schedule to gain high privilege execution that will bypass User control account. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path= "*\\Environment\\windir" Registry.registry_value_data - = "*.exe*" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name - Registry.registry_value_data Registry.process_guid Registry.registry_key_name | - `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, - _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - Processes.parent_process_name Processes.parent_process Processes.process_guid | - `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time - dest user parent_process_name parent_process process_name process_path process proc_guid - registry_path registry_value_name registry_value_data registry_key_name] | table - _time dest user parent_process_name parent_process process_name process_path process - proc_guid registry_path registry_value_name registry_value_data registry_key_name +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\Environment\\windir" Registry.registry_value_data = "*.exe*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `silentcleanup_uac_bypass_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: unknown references: - https://github.com/hfiref0x/UACME @@ -63,10 +59,21 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest + - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + - Registry.process_guid risk_score: 63 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml index 094d60fcf0..30509d46f4 100644 --- a/detections/endpoint/time_provider_persistence_registry.yml +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -1,8 +1,8 @@ name: Time Provider Persistence Registry id: 5ba382c4-2105-11ec-8d8f-acde48001122 -version: 2 -date: '2022-01-26' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -11,25 +11,20 @@ description: This analytic is to detect a suspicious modification of time provid persist on the compromised host and autostart as soon as the machine boot up. This TTP can be a good indicator of suspicious behavior since this registry is not commonly modified by normal user or even an admin. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime - max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path - ="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*" by _time span=1h Registry.dest - Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as - proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data] - | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data | `time_provider_persistence_registry_filter`' -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `time_provider_persistence_registry_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: unknown references: - https://pentestlab.blog/2019/10/22/persistence-time-providers/ @@ -68,11 +63,21 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest - - Registry.user - - Registry.registry_path - - Registry.registry_key_name - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + - Registry.process_guid risk_score: 80 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_defender_exclusion_registry_entry.yml b/detections/endpoint/windows_defender_exclusion_registry_entry.yml index f69a307994..e9779b3a95 100644 --- a/detections/endpoint/windows_defender_exclusion_registry_entry.yml +++ b/detections/endpoint/windows_defender_exclusion_registry_entry.yml @@ -1,8 +1,8 @@ name: Windows Defender Exclusion Registry Entry id: 13395a44-4dd9-11ec-9df7-acde48001122 -version: 1 -date: '2021-11-25' -author: Teoderick Contreras, Splunk +version: 2 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -12,23 +12,20 @@ description: This analytic will detect a suspicious process that modify a regist excluding folder path, file path, process, extensions and etc. from its real time or schedule scan to execute their malicious code. This is a good indicator for a defense evasion and to look further for events after this behavior. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\SOFTWARE\\Policies\\Microsoft\\Windows - Defender\\Exclusions\\*" by _time span=1h Registry.dest Registry.user Registry.registry_path - Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, - _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - Processes.parent_process_name Processes.parent_process Processes.process_guid | - `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time - dest user parent_process_name parent_process process_name process_path process proc_guid - registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name - parent_process process_name process_path process proc_guid registry_path registry_value_name - registry_value_data | `windows_defender_exclusion_registry_entry_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Exclusions\\*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_defender_exclusion_registry_entry_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: admin or user may choose to use this windows features. references: - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html @@ -67,13 +64,21 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.user + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path - Registry.registry_value_data + - Registry.process_guid risk_score: 64 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml b/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml index 74575c024c..221c47cc00 100644 --- a/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml +++ b/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml @@ -1,8 +1,8 @@ name: Windows Deleted Registry By A Non Critical Process File Path id: 15e70689-f55b-489e-8a80-6d0cd6d8aad2 -version: 1 -date: '2022-03-28' -author: Teoderick Contreras, Splunk +version: 2 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint @@ -10,24 +10,16 @@ description: This analytic is to detect deletion of registry with suspicious pro where it will delete all the subkey in HKLM, HKCU and HKU registry hive as part of its destructive payload to the targeted hosts. This anomaly detections can catch possible malware or advesaries deleting registry as part of defense evasion or even payload impact but can also catch for third party application updates or installation. In this scenario false positive filter is needed. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.action=deleted by _time span=1h Registry.dest Registry.user - Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid - Registry.registry_value_data Registry.action | `drop_dm_object_name(Registry)` |rename process_guid - as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes where NOT (Processes.process_path IN ("*\\windows\\*", "*\\program files*")) by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_path - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name action] | table _time parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name action dest user +search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry WHERE Registry.action=deleted BY _time span=1h Registry.dest Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data Registry.action + | `drop_dm_object_name(Registry)` + | join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes WHERE NOT (Processes.process_path IN ("*\\windows\\*", "*\\program files*")) by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.user Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid + | `drop_dm_object_name(Processes)`] + | fields _time parent_process_name parent_process process_name process_path process process_guid registry_path registry_value_name registry_value_data registry_key_name action dest user | `windows_deleted_registry_by_a_non_critical_process_file_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: This detection can catch for third party application updates or installation. In this scenario false positive filter is needed. references: @@ -63,20 +55,20 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid + - Registry.dest + - Registry.registry_value_name - Registry.registry_key_name - Registry.registry_path - - Registry.registry_value_name - - Registry.dest - - Registry.user - - Registry.action - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - - Processes.process_path + - Registry.registry_value_data + - Registry.process_guid risk_score: 36 security_domain: endpoint diff --git a/detections/endpoint/windows_disable_change_password_through_registry.yml b/detections/endpoint/windows_disable_change_password_through_registry.yml index a371b5cff6..4e9d201a00 100644 --- a/detections/endpoint/windows_disable_change_password_through_registry.yml +++ b/detections/endpoint/windows_disable_change_password_through_registry.yml @@ -1,8 +1,8 @@ name: Windows Disable Change Password Through Registry id: 0df33e1a-9ef6-11ec-a1ad-acde48001122 -version: 1 -date: '2022-03-08' -author: Teoderick Contreras, Splunk +version: 2 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint @@ -11,23 +11,20 @@ description: This analytic is to detect a suspicious registry modification to di As a result, users cannot change their Windows password on demand. This technique was seen in some malware family like ransomware to prevent the user to change the password after ownning the network or a system during attack. This windows feature may implemented by administrator to prevent normal user to change the password of a critical host or server, In this type of scenario filter is needed to minimized false positive. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableChangePassword" - Registry.registry_value_data = "0x00000001" - by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as - proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data] - | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableChangePassword" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_disable_change_password_through_registry_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: This windows feature may implemented by administrator to prevent normal user to change the password of a critical host or server, In this type of scenario filter is needed to minimized false positive. references: @@ -48,18 +45,21 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid + - Registry.dest + - Registry.registry_value_name - Registry.registry_key_name - Registry.registry_path - - Registry.registry_value_name - - Registry.dest - - Registry.user - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid + - Registry.registry_value_data + - Registry.process_guid security_domain: endpoint impact: 70 confidence: 70 @@ -80,4 +80,4 @@ tags: - CIS 3 - CIS 5 - CIS 16 - asset_type: Endpoint \ No newline at end of file + asset_type: Endpoint diff --git a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml index 4e4eff11f6..61b804348e 100644 --- a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml +++ b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml @@ -1,8 +1,8 @@ name: Windows Disable Lock Workstation Feature Through Registry id: c82adbc6-9f00-11ec-a81f-acde48001122 -version: 1 -date: '2022-03-08' -author: Teoderick Contreras, Splunk +version: 2 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint @@ -11,22 +11,20 @@ description: This analytic is to detect a suspicious registry modification to di locking its screen or computer that are being abused by several malware for example ransomware. This technique was used by threat actor to make its payload more impactful to the compromised host. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableLockWorkstation" - Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user - Registry.registry_path Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as - proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data] - | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data | `windows_disable_lock_workstation_feature_through_registry_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableLockWorkstation" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_disable_lock_workstation_feature_through_registry_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: unknown references: - https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/ @@ -48,17 +46,21 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid + - Registry.dest + - Registry.registry_value_name - Registry.registry_key_name - Registry.registry_path - - Registry.registry_value_name - - Registry.dest Registry.user - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid + - Registry.registry_value_data + - Registry.process_guid security_domain: endpoint impact: 70 confidence: 70 diff --git a/detections/endpoint/windows_disable_logoff_button_through_registry.yml b/detections/endpoint/windows_disable_logoff_button_through_registry.yml index 0e9dbda9bf..6532f56162 100644 --- a/detections/endpoint/windows_disable_logoff_button_through_registry.yml +++ b/detections/endpoint/windows_disable_logoff_button_through_registry.yml @@ -1,8 +1,8 @@ name: Windows Disable LogOff Button Through Registry id: b2fb6830-9ed1-11ec-9fcb-acde48001122 -version: 1 -date: '2022-03-08' -author: Teoderick Contreras, Splunk +version: 2 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint @@ -15,23 +15,20 @@ description: This analytic is to detect a suspicious registry modification to di made on the machine that needs restart to take effect. This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine and users that can modify this registry is needed. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" - Registry.registry_value_name IN ("NoLogOff", "StartMenuLogOff") Registry.registry_value_data - = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path - Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, - _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - Processes.parent_process_name Processes.parent_process Processes.process_guid | - `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time - dest user parent_process_name parent_process process_name process_path process proc_guid - registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name - parent_process process_name process_path process proc_guid registry_path registry_value_name - registry_value_data | `windows_disable_logoff_button_through_registry_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" Registry.registry_value_name IN ("NoLogOff", "StartMenuLogOff") Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_disable_logoff_button_through_registry_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine and users that can modify this registry is needed. @@ -55,17 +52,21 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid + - Registry.dest + - Registry.registry_value_name - Registry.registry_key_name - Registry.registry_path - - Registry.registry_value_name - - Registry.dest Registry.user - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid + - Registry.registry_value_data + - Registry.process_guid security_domain: endpoint impact: 70 confidence: 70 diff --git a/detections/endpoint/windows_disable_notification_center.yml b/detections/endpoint/windows_disable_notification_center.yml index b5e0d89819..8ff2eea91d 100644 --- a/detections/endpoint/windows_disable_notification_center.yml +++ b/detections/endpoint/windows_disable_notification_center.yml @@ -1,8 +1,8 @@ name: Windows Disable Notification Center id: 1cd983c8-8fd6-11ec-a09d-acde48001122 -version: 1 -date: '2022-02-17' -author: Teoderick Contreras, Splunk +version: 2 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint @@ -11,24 +11,20 @@ description: The following search identifies a modification of registry to disab notification and action center from the notification area on the task bar. This modification are seen in RAT malware to cover their tracks upon downloading other of its component or other payload. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_value_name= "DisableNotificationCenter" - Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user - Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid - Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid - as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name] | table _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name | `windows_disable_notification_center_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_value_name= "DisableNotificationCenter" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_disable_notification_center_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: admin or user may choose to disable this windows features. references: - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html @@ -47,12 +43,21 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid + - Registry.dest + - Registry.registry_value_name - Registry.registry_key_name - Registry.registry_path - - Registry.user - - Registry.dest - - Registry.registry_value_nam + - Registry.registry_value_data + - Registry.process_guid security_domain: endpoint impact: 60 confidence: 80 @@ -76,4 +81,4 @@ tags: - DE.CM cis20: - CIS 8 - asset_type: Endpoint \ No newline at end of file + asset_type: Endpoint diff --git a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml index ed35c9bdca..030cb40e93 100644 --- a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml +++ b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml @@ -1,8 +1,8 @@ name: Windows Disable Shutdown Button Through Registry id: 55fb2958-9ecd-11ec-a06a-acde48001122 -version: 1 -date: '2022-03-08' -author: Teoderick Contreras, Splunk +version: 2 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint @@ -13,23 +13,20 @@ description: This analytic is to detect a suspicious registry modification to di needs restart to take effect. This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine and users that can modify this registry is needed. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\shutdownwithoutlogon" - Registry.registry_value_data = "0x00000000") OR (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose" - Registry.registry_value_data = "0x00000001") by _time span=1h Registry.dest Registry.user - Registry.registry_path Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as - proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data] - | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data | `windows_disable_shutdown_button_through_registry_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE ((Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\shutdownwithoutlogon" Registry.registry_value_data = "0x00000000") OR (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose" Registry.registry_value_data = "0x00000001")) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_disable_shutdown_button_through_registry_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine and users that can modify this registry is needed. @@ -51,17 +48,21 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid + - Registry.dest + - Registry.registry_value_name - Registry.registry_key_name - Registry.registry_path - - Registry.registry_value_name - - Registry.dest Registry.user - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid + - Registry.registry_value_data + - Registry.process_guid security_domain: endpoint impact: 70 confidence: 70 diff --git a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml index 5cf39e490b..46d579f45e 100644 --- a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml +++ b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml @@ -1,8 +1,8 @@ name: Windows Disable Windows Group Policy Features Through Registry id: 63a449ae-9f04-11ec-945e-acde48001122 -version: 1 -date: '2022-03-08' -author: Teoderick Contreras, Splunk +version: 2 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint @@ -13,25 +13,20 @@ description: This analytic is to detect a suspicious registry modification to di hard. Disabling these feature is not so common but can still be implemented by the administrator for security purposes. In this scenario filters for users that are allowed doing this is needed. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" - OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*" - Registry.registry_value_name IN ("NoDesktop", "NoFind", "NoControlPanel", "NoFileMenu", - "NoSetTaskbar", "NoTrayContextMenu", "TaskbarLockAll", "NoThemesTab","NoPropertiesMyDocuments","NoVisualStyleChoice","NoColorChoice","NoPropertiesMyDocuments") - Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user - Registry.registry_path Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as - proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data] - | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data | `windows_disable_windows_group_policy_features_through_registry_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*" Registry.registry_value_name IN ("NoDesktop", "NoFind", "NoControlPanel", "NoFileMenu", "NoSetTaskbar", "NoTrayContextMenu", "TaskbarLockAll", "NoThemesTab","NoPropertiesMyDocuments","NoVisualStyleChoice","NoColorChoice","NoPropertiesMyDocuments") Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_disable_windows_group_policy_features_through_registry_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: unknown references: - https://hybrid-analysis.com/sample/ef1c427394c205580576d18ba68d5911089c7da0386f19d1ca126929d3e671ab?environmentId=120&lang=en @@ -54,17 +49,21 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid + - Registry.dest + - Registry.registry_value_name - Registry.registry_key_name - Registry.registry_path - - Registry.registry_value_name - - Registry.dest Registry.user - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid + - Registry.registry_value_data + - Registry.process_guid security_domain: endpoint impact: 70 confidence: 70 diff --git a/detections/endpoint/windows_hide_notification_features_through_registry.yml b/detections/endpoint/windows_hide_notification_features_through_registry.yml index 8952b7a5ad..4d153515cd 100644 --- a/detections/endpoint/windows_hide_notification_features_through_registry.yml +++ b/detections/endpoint/windows_hide_notification_features_through_registry.yml @@ -1,8 +1,8 @@ name: Windows Hide Notification Features Through Registry id: cafa4bce-9f06-11ec-a7b2-acde48001122 -version: 1 -date: '2022-03-08' -author: Teoderick Contreras, Splunk +version: 2 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint @@ -12,23 +12,20 @@ description: This analytic is to detect a suspicious registry modification to hi by user aside from the encrypted files and ransomware notes. Even this a good anomaly detection, administrator may implement this changes for auditing or security reason. In this scenario filter is needed. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" - Registry.registry_value_name IN ("HideClock", "HideSCAHealth", "HideSCANetwork", - "HideSCAPower", "HideSCAVolume") Registry.registry_value_data = "0x00000001" by - _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` - |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data] - | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data | `windows_hide_notification_features_through_registry_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" Registry.registry_value_name IN ("HideClock", "HideSCAHealth", "HideSCANetwork", "HideSCAPower", "HideSCAVolume") Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_hide_notification_features_through_registry_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: unknown references: - https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Ransom.Win32.ONALOCKER.A/ @@ -49,17 +46,21 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid + - Registry.dest + - Registry.registry_value_name - Registry.registry_key_name - Registry.registry_path - - Registry.registry_value_name - - Registry.dest Registry.user - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid + - Registry.registry_value_data + - Registry.process_guid security_domain: endpoint impact: 70 confidence: 70 diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml index 25a12aebf3..7b5bf14ca2 100644 --- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml +++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml @@ -1,8 +1,8 @@ name: Windows Modify Show Compress Color And Info Tip Registry id: b7548c2e-9a10-11ec-99e3-acde48001122 -version: 1 -date: '2022-03-02' -author: Teoderick Contreras, Splunk +version: 2 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -13,22 +13,20 @@ description: This analytic is to look for suspicious registry modification relat tips. This is a good indicator that a process tries to modified one of the registry GlobalFolderOptions related to file compression attribution in terms of color in NTFS file system. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path = "*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced*" - AND Registry.registry_value_name IN("ShowCompColor", "ShowInfoTip") by _time span=1h - Registry.dest Registry.user Registry.registry_path Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` - |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data] - | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data | `windows_modify_show_compress_color_and_info_tip_registry_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced*" AND Registry.registry_value_name IN("ShowCompColor", "ShowInfoTip")) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_modify_show_compress_color_and_info_tip_registry_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: unknown references: - https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html @@ -67,10 +65,21 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid + - Registry.dest + - Registry.registry_value_name - Registry.registry_key_name - Registry.registry_path - - Registry.registry_value_name - - Registry.dest Registry.user + - Registry.registry_value_data + - Registry.process_guid risk_score: 25 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index 725386a061..3b89301328 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -1,8 +1,8 @@ name: Windows Service Creation Using Registry Entry id: 25212358-948e-11ec-ad47-acde48001122 -version: 1 -date: '2022-02-23' -author: Teoderick Contreras, Splunk +version: 2 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -12,23 +12,20 @@ description: This analytic is to look for suspicious modification or creation of can be executed using reg.exe application or using windows API like for example the CrashOveride malware. This detection is a good indicator that a process is trying to create a service entry using registry ImagePath. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime - max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services*" - Registry.registry_value_name = ImagePath by _time span=1h Registry.dest Registry.user - Registry.registry_path Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as - proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data] - | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data | `windows_service_creation_using_registry_entry_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services*" Registry.registry_value_name = ImagePath) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] + | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_service_creation_using_registry_entry_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: Third party tools may used this technique to create services but not so common. references: @@ -71,18 +68,21 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.user + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest - Registry.registry_value_name - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + - Registry.process_guid risk_score: 64 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/wsreset_uac_bypass.yml b/detections/endpoint/wsreset_uac_bypass.yml index fc659965a8..6a8e4074b0 100644 --- a/detections/endpoint/wsreset_uac_bypass.yml +++ b/detections/endpoint/wsreset_uac_bypass.yml @@ -1,8 +1,8 @@ name: WSReset UAC Bypass id: 8b5901bc-da63-11eb-be43-acde48001122 -version: 2 -date: '2020-01-28' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-11-14' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -10,25 +10,20 @@ description: This search is to detect a suspicious modification of registry rela to UAC bypass. This technique is to modify the registry in this detection, create a registry value with the path of the payload and run WSreset.exe to bypass User account Control. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path= "*\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command*" - AND (Registry.registry_value_name = "(Default)" OR Registry.registry_value_name - = "DelegateExecute") by _time span=1h Registry.dest Registry.user Registry.registry_path - Registry.registry_value_name Registry.registry_value_data Registry.process_guid - Registry.registry_key_name | `drop_dm_object_name(Registry)` |rename process_guid - as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name] | table _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name | `wsreset_uac_bypass_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid +| `drop_dm_object_name(Processes)` +| join process_guid + [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE Registry.registry_path= "*\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command*" AND (Registry.registry_value_name = "(Default)" OR Registry.registry_value_name = "DelegateExecute") by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)`] +| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid +| where isnotnull(registry_value_data) +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `wsreset_uac_bypass_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical + Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: unknown references: - https://github.com/hfiref0x/UACME @@ -66,10 +61,21 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name + - Processes.user + - Processes.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid - Registry.dest + - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + - Registry.process_guid risk_score: 63 security_domain: endpoint supported_tas: