diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md new file mode 100644 index 0000000000..94da8b2900 --- /dev/null +++ b/.github/CONTRIBUTING.md @@ -0,0 +1,132 @@ +This document is the single source of truth on how to contribute to this codebase. Please feel free to browse the open issues and file new ones. All feedback is welcome! + +---- + +## Topics + +* [Prerequisites](#prerequisites) + * [Contributor License Agreement](#contributor-license-agreement) + * [Code of Conduct](#code-of-conduct) + * [Setup Development Environment](#setup-development-environment) +* [Contribution Workflow](#contribution-workflow) + * [Feature Requests and Bug Reports](#feature-requests-and-bug-reports) + * [Fixing Issues](#fixing-issues) + * [Pull Requests](#pull-requests) + * [Code Review](#code-review) + * [Documentation](#documentation) +* [Maintainers](#maintainers) + +---- + +## Prerequisites +When contributing to this repository, please first discuss the change you wish to make via a GitHub issue, Slack message, email, or via other channels with the owners of this repository. + +##### Contributor License Agreement +At the moment, we can only accept pull requests submitted from either: +* Splunk employees or +* Individuals that have signed our contributors' agreement + +If you wish to be a contributing member of our community, please see the agreement [for individuals](https://www.splunk.com/goto/individualcontributions) or [for organizations](https://www.splunk.com/goto/contributions). + +##### Code of Conduct +Please make sure to read and observe our [Code of Conduct](https://github.com/splunk/security_content/wiki/Code-of-Conduct). Please follow it in all of your interactions involving the project. + +##### Setup Development Environment +see [Developing Content](https://github.com/splunk/security_content/wiki/Developing-Content) + +## Contribution Workflow +Help is always welcome! For example, documentation can always use improvement. There's always code that can be clarified, functionality that can be extended, and tests to be added to guarantee behavior. If you see something you think should be fixed, don't be afraid to own it. + +##### Feature Requests and Bug Reports +Have ideas on improvements? See something that needs work? While the community encourages everyone to contribute code, it is also appreciated when someone reports an issue. Please report any issues or bugs you find through [GitHub's issue tracker](https://github.com/splunk/security_content/issues). + +If you are reporting a bug, please include: + +* Your operating system name and version +* Any details about your local setup that might be helpful in troubleshooting (ex. Python interpreter version, Splunk version, etc.) +* Detailed steps to reproduce the bug + +We'd also like to hear about your propositions and suggestions. Feel free to submit them as issues and: + +* Explain in detail how they should work +* Note that keeping the scope as narrow as possible will make the suggestion easier to implement + +##### Fixing Issues +Look through our [issue tracker](https://github.com/splunk/security_content/issues) to find problems to fix! Feel free to comment and tag corresponding stakeholders or full-time maintainers of this project with any questions or concerns. + +##### Pull Requests +What is a "pull request"? It informs the project's core developers about the changes you want to review and merge. Once you submit a pull request, it enters a stage of code review where you and others can discuss its potential modifications and maybe even add more commits to it later on. + +If you want to learn more, please consult this [tutorial on how pull requests work](https://help.github.com/articles/using-pull-requests/) in the [GitHub Help Center](https://help.github.com/). + +Here's an overview of how you can make a pull request against this project: + +1. Fill out the [Splunk Contribution Agreement](https://www.splunk.com/goto/contributions). +2. Fork the [security_content GitHub repository](https://github.com/splunk/security_content) +3. Clone your fork using git and create a branch off of develop + + ``` + $ git clone git@github.com:YOUR_GITHUB_USERNAME/security_content.git + $ cd security_content + + # This project uses 'develop' for all development activity, so create your branch off that + $ git checkout -b your-bugfix-branch-name develop + ``` + +4. Make your changes, commit, and push (once your tests have passed) + + ``` + $ cd security_content + $ git commit -m "" + $ git push + ``` + +5. Submit a pull request through the GitHub website, using the changes from your forked codebase. +6. We utilize [pre-commit hooks](https://pre-commit.com/) to ensure consistent formatting and as an additional method of preventing credentials from ending up in our repo accidentally. We highly suggest you also install `pre-commit` and the hooks for this project. + +##### Code Review +There are two aspects of code review: giving and receiving. + +To make it easier for your PR to receive reviews, keep in mind that the reviewers will need you to: +* Follow the project coding conventions +* Write good commit messages +* Break large changes into a logical series of smaller patches which individually make easily understandable changes, and in aggregate solve a broader issue + +Reviewers, the people providing the review, are highly encouraged to revisit the [Code of Conduct](https://github.com/splunk/security_content/wiki/Code-of-Conduct) and must go above and beyond to promote a collaborative, respectful community. + +When reviewing PRs from others, [The Gentle Art of Patch Review](http://sage.thesharps.us/2014/09/01/the-gentle-art-of-patch-review/) suggests an iterative series of focuses designed to lead new contributors to positive collaboration, such as: + +* Is the idea behind the contribution sound? +* Is the contribution architected correctly? +* Is the contribution polished? + +For this project, we require at least one approval. A build from our continuous integration system must also be successful off of your branch. Please note that any new changes made with your existing pull request during review will automatically unapproved and re-trigger another build/round of tests. + +##### Documentation +We can always use improvements to our documentation! Anyone can contribute to these docs--whether youโ€™re new to the project, youโ€™ve been around a long time, or if you just canโ€™t stand seeing typos. + +Here's what's needed? + +1. More complementary documentation. Have you something unclear? +2. More examples or generic templates that others can use. +3. Blog posts, articles, and such are all very appreciated. + +You can also edit documentation files directly in the GitHub web interface, without creating a local copy. This can be convenient for small typos or grammar fixes. + +## Maintainers + +If you need help, feel free to tag one of the active maintainers of this project in a post or comment. We'll do our best to reach out to you as quickly as we can. + +``` +# Active maintainers marked with (*) + +(*) Bhavin Patel +(*) Michael Haag +(*) Jose Hernandez +(*) Lou Stella +(*) Patrick Bareib +(*) Eric McGinnis +(*) Rod Soto +(*) Teoderick Contreras +(*) Gowtham Rajendran +``` diff --git a/.github/labeler.yml b/.github/labeler.yml new file mode 100644 index 0000000000..81eac35c58 --- /dev/null +++ b/.github/labeler.yml @@ -0,0 +1,20 @@ +Detections: +- changed-files: + - any-glob-to-any-file: + - detections/** + +Stories: +- changed-files: + - any-glob-to-any-file: stories/* + +Playbooks: +- changed-files: + - any-glob-to-any-file: playbooks/* + +Macros: +- changed-files: + - any-glob-to-any-file: macros/* + +Lookups: +- changed-files: + - any-glob-to-any-file: lookups/* \ No newline at end of file diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml new file mode 100644 index 0000000000..57c9873004 --- /dev/null +++ b/.github/workflows/build.yml @@ -0,0 +1,40 @@ +name: build +on: + pull_request: + types: [opened, reopened, synchronize] + push: + branches: + - develop +jobs: + build: + #Note that the CircleCI job used a Container. The way to do this with Github Actions + #is to first start up a Virtual Machine, then we can by following: + # https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idcontainer + runs-on: ubuntu-latest + steps: + - name: Check out the repository code + uses: actions/checkout@v4 + + - uses: actions/setup-python@v5 + with: + python-version: '3.11' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy + architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified + + + - name: Install Python Dependencies and ContentCTL and Atomic Red Team + run: | + pip install contentctl==4.1.5 + git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git + + - name: Running build with enrichments + run: | + contentctl build --enrichments + mkdir artifacts + mv dist/DA-ESS-ContentUpdate-latest.tar.gz artifacts/ + + - name: store_artifacts + uses: actions/upload-artifact@v4 + with: + name: content-latest + path: | + artifacts/DA-ESS-ContentUpdate-latest.tar.gz \ No newline at end of file diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml deleted file mode 100644 index df6254ce12..0000000000 --- a/.github/workflows/detection-testing.yml +++ /dev/null @@ -1,347 +0,0 @@ -# name: detection-testing -# on: -# push: -# pull_request: -# types: [opened, reopened] -# schedule: -# - cron: "44 4 * * *" -# jobs: - -# validate-tag-if-present: -# runs-on: ubuntu-latest - -# steps: -# - name: TAGGED, Validate that the tag is in the correct format - -# run: | -# echo "The GITHUB_REF: $GITHUB_REF" -# #First check to see if the release is a tag -# if [[ $GITHUB_REF =~ refs/tags/* ]]; then -# #Yes, this is a tag, so we need to test to make sure that the tag -# #is in the correct format (like v1.10.20) -# if [[ $GITHUB_REF =~ refs/tags/v[0-9]+.[0-9]+.[0-9]+ ]]; then -# echo "PASS: Tagged release with good format" -# exit 0 -# else -# echo "FAIL: Tagged release with bad format" -# exit 1 -# fi -# else -# echo "PASS: Not a tagged release" -# exit 0 -# fi - -# quit-for-dependabot: -# runs-on: ubuntu-latest -# if: github.actor != 'dependabot[bot]' && github.actor != 'dependabot-preview[bot]' -# steps: -# - name: "Placeholder" -# run: | -# echo "yes it ran" - -# docker-detection-testing-setup: -# runs-on: ubuntu-latest -# if: "!contains(github.ref, 'refs/tags/')" #don't run on tags - future steps won't run either since they depend on this job -# needs: [validate-tag-if-present, quit-for-dependabot] -# steps: -# - name: Get branch and PR required for detection testing main.py -# id: vars -# run: | -# echo "::set-output name=branch::${GITHUB_REF#refs/heads/}" - -# - name: Checkout Repo -# uses: actions/checkout@v2 -# #with: -# # ref: develop - - - -# - uses: actions/setup-python@v2 -# with: -# python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy -# architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified -# cache: 'pip' - -# - name: Install Python Dependencies -# run: | -# python -m venv .venv -# source .venv/bin/activate -# python -m pip install wheel -# python -m pip install -r requirements.txt - -# - name: Run the CI -# run: | -# source .venv/bin/activate -# cd bin/docker_detection_tester -# echo "github.event.issue.pull_request : [${{ github.event.issue.pull_request }}]" -# echo "github.event.pull_request.number : [${{ github.event.pull_request.number }}]" -# echo "steps.vars.outputs.branch : [${{ steps.vars.outputs.branch }}]" -# echo "github.event.pull_request.head.ref : [${{ github.event.pull_request.head.ref }}]" -# echo "github.event_name : [${{ github.event_name }}]" - - -# if [[ ${{ github.event_name }} == schedule ]]; then -# # Note that scheduled actions ONLY run on the default branch, so it won't run on all other branches! -# echo "Running a nightly test on all detections OR a commit was made directly to develop" -# python detection_testing_execution.py run --branch develop --mode all --mock --config_file test_config_github_actions.json -# elif [[ ! -z "${{ github.event.pull_request.head.ref }}" && ! -z "${{ github.event.pull_request.number }}" ]]; then -# echo "Pull request from source branch [${{ github.event.pull_request.head.ref }}] for PR number [${{ github.event.issue.number }}]" -# python detection_testing_execution.py run --branch ${{ github.event.pull_request.head.ref }} --pr_number ${{ github.event.pull_request.number }} --mode changes --mock --config_file test_config_github_actions.json -# else -# echo "Push from branch [${{ steps.vars.outputs.branch }}]" -# python detection_testing_execution.py run --branch ${{ steps.vars.outputs.branch }} --mode changes --mock --config_file test_config_github_actions.json -# fi - -# mv *-test-run.json replicate_test.json -# - name: Upload Test Results Files -# uses: actions/upload-artifact@v2 -# with: -# name: testing-results-config -# path: | -# bin/docker_detection_tester/prior_config/apps/DA-ESS-ContentUpdate-latest.tar.gz -# bin/docker_detection_tester/prior_config/config_tests_0.json -# bin/docker_detection_tester/prior_config/config_tests_1.json -# bin/docker_detection_tester/prior_config/config_tests_2.json -# bin/docker_detection_tester/prior_config/config_tests_3.json -# bin/docker_detection_tester/prior_config/config_tests_4.json -# bin/docker_detection_tester/prior_config/config_tests_5.json -# bin/docker_detection_tester/prior_config/config_tests_6.json -# bin/docker_detection_tester/prior_config/config_tests_7.json -# bin/docker_detection_tester/prior_config/config_tests_8.json -# bin/docker_detection_tester/prior_config/config_tests_9.json - -# - name: Upload File to Enable Replication of the Test at a Different Time or Place -# uses: actions/upload-artifact@v2 -# with: -# name: replicate_test -# path: | -# bin/docker_detection_tester/replicate_test.json - -# docker-detection-testing-execution: -# runs-on: ubuntu-latest -# if: "!contains(github.ref, 'refs/tags/')" #don't run on tags - future steps won't run either since they depend on this job -# needs: [docker-detection-testing-setup] -# strategy: -# matrix: -# manifest_filename: ["config_tests_0.json", -# "config_tests_1.json", -# "config_tests_2.json", -# "config_tests_3.json", -# "config_tests_4.json", -# "config_tests_5.json", -# "config_tests_6.json", -# "config_tests_7.json", -# "config_tests_8.json", -# "config_tests_9.json"] -# steps: -# - name: Get branch and PR required for detection testing main.py -# id: vars -# run: | -# echo "::set-output name=branch::${GITHUB_REF#refs/heads/}" - -# - name: Checkout Repo -# uses: actions/checkout@v2 -# #with: -# # ref: develop - -# - name: Download artifacts -# uses: actions/download-artifact@v2 -# with: -# name: testing-results-config -# path: bin/docker_detection_tester/prior_config - - -# - uses: actions/setup-python@v2 -# with: -# python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy -# architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified -# cache: 'pip' - -# - name: Install Python Dependencies -# run: | -# python -m venv .venv -# source .venv/bin/activate -# python -m pip install wheel -# python -m pip install -r requirements.txt - -# - name: Run the CI -# run: | -# source .venv/bin/activate -# cd bin/docker_detection_tester - - -# python detection_testing_execution.py run -c prior_config/${{ matrix.manifest_filename}} - - -# - name: Upload Test Results Files -# uses: actions/upload-artifact@v2 -# with: -# name: ${{ matrix.manifest_filename}}.results -# path: | -# bin/docker_detection_tester/test_results/success.csv -# bin/docker_detection_tester/test_results/error.csv -# bin/docker_detection_tester/test_results/failure.csv -# bin/docker_detection_tester/test_results/combined.csv -# bin/docker_detection_tester/test_results/success.json -# bin/docker_detection_tester/test_results/error.json -# bin/docker_detection_tester/test_results/failure.json -# bin/docker_detection_tester/test_results/combined.json - -# bin/docker_detection_tester/test_results/summary.json - -# docker-detection-testing-execution-merge-results: -# runs-on: ubuntu-latest -# if: "!contains(github.ref, 'refs/tags/')" #don't run on tags - future steps won't run either since they depend on this job -# needs: [docker-detection-testing-setup, docker-detection-testing-execution] - -# steps: -# - name: Get branch and PR required for detection testing main.py -# id: vars -# run: | -# echo "::set-output name=branch::${GITHUB_REF#refs/heads/}" - -# - name: Checkout Repo -# uses: actions/checkout@v2 -# #with: -# # ref: develop - -# - name: Download artifacts -# uses: actions/download-artifact@v2 -# with: -# name: config_tests_0.json.results -# path: bin/docker_detection_tester/results_0 -# - name: Download artifacts -# uses: actions/download-artifact@v2 -# with: -# name: config_tests_1.json.results -# path: bin/docker_detection_tester/results_1 -# - name: Download artifacts -# uses: actions/download-artifact@v2 -# with: -# name: config_tests_2.json.results -# path: bin/docker_detection_tester/results_2 -# - name: Download artifacts -# uses: actions/download-artifact@v2 -# with: -# name: config_tests_3.json.results -# path: bin/docker_detection_tester/results_3 -# - name: Download artifacts -# uses: actions/download-artifact@v2 -# with: -# name: config_tests_4.json.results -# path: bin/docker_detection_tester/results_4 -# - name: Download artifacts -# uses: actions/download-artifact@v2 -# with: -# name: config_tests_5.json.results -# path: bin/docker_detection_tester/results_5 -# - name: Download artifacts -# uses: actions/download-artifact@v2 -# with: -# name: config_tests_6.json.results -# path: bin/docker_detection_tester/results_6 -# - name: Download artifacts -# uses: actions/download-artifact@v2 -# with: -# name: config_tests_7.json.results -# path: bin/docker_detection_tester/results_7 -# - name: Download artifacts -# uses: actions/download-artifact@v2 -# with: -# name: config_tests_8.json.results -# path: bin/docker_detection_tester/results_8 -# - name: Download artifacts -# uses: actions/download-artifact@v2 -# with: -# name: config_tests_9.json.results -# path: bin/docker_detection_tester/results_9 - -# - uses: actions/setup-python@v2 -# with: -# python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy -# architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified -# cache: 'pip' - -# - name: Install Python Dependencies -# run: | -# python -m venv .venv -# source .venv/bin/activate -# python -m pip install wheel -# python -m pip install -r requirements.txt - -# - name: Merge Detections into single File -# run: | -# source .venv/bin/activate -# cd bin/docker_detection_tester -# python summarize_json.py --files results_*/summary.json --output_filename summary_test_results.json - - -# - name: Upload Summary Test Results JSON -# uses: actions/upload-artifact@v2 -# if: always() -# with: -# name: SummaryTestResults -# path: | -# bin/docker_detection_tester/summary_test_results.json - -# - name: Upload Failures Manifest on Failure -# uses: actions/upload-artifact@v2 -# if: failure() -# with: -# name: DetectionFailureManifest -# path: | -# bin/docker_detection_tester/detection_failure_manifest.json - - -# #Always clean these up, they make the output messy -# - name: Clean up intermediate Files -# uses: geekyeggo/delete-artifact@v1 -# if: always() -# with: -# name: | -# config_tests_0.json.results -# config_tests_1.json.results -# config_tests_2.json.results -# config_tests_3.json.results -# config_tests_4.json.results -# config_tests_5.json.results -# config_tests_6.json.results -# config_tests_7.json.results -# config_tests_8.json.results -# config_tests_9.json.results - -# - name: Log in to S3 for Artifact Uploads -# if: ${{ github.event_name == 'schedule' }} -# uses: aws-actions/configure-aws-credentials@v1 -# with: -# aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} -# aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - -# aws-region: us-west-2 - -# - name: Upload S3 Badge and Summary Artifacts for Nightly Scheduled Run -# if: ${{ github.event_name == 'schedule' }} -# run: | -# cd bin/docker_detection_tester -# python generate_detection_coverage_badge.py --input_summary_file summary_test_results.json --output_badge_file detection_coverage.svg --badge_string "Pass Rate" - - -# #Upload artifact (summary test results) -# aws s3 cp summary_test_results.json s3://security-content/reporting/summary_test_results.json - -# #Since these reside in a public bucket, no need to explicitly mark as public -# # make the file public since it is not by default -# #aws s3api put-object-acl --bucket security-content --key reporting/summary_test_results.json --acl public-read - - -# #Upload artifact (test results coverage badge) -# aws s3 cp detection_coverage.svg s3://security-content/reporting/detection_coverage.svg - -# #Since these reside in a public bucket, no need to explicitly mark as public -# # make the file public since it is not by default -# #aws s3api put-object-acl --bucket security-content --key reporting/detection_coverage.svg --acl public-read - - - - - diff --git a/.github/workflows/format_test_results.py b/.github/workflows/format_test_results.py new file mode 100644 index 0000000000..d142af3321 --- /dev/null +++ b/.github/workflows/format_test_results.py @@ -0,0 +1,67 @@ +""" +A simple script formatting test_results/summary.yml to display on github actions +""" + +import yaml +import re +import os +import sys + +def main(): + + # Define the path to the YAML file + # yaml_file_path = 'summary.yml' + yaml_file_path = '/home/runner/work/security_content/security_content/test_results/summary.yml' + + # Check if the YAML file exists + if not os.path.exists(yaml_file_path): + print(f"Error: The file {yaml_file_path} does not exist.") + exit(1) # Exit with an error code + + # Load the YAML file + with open(yaml_file_path, 'r') as file: + data = yaml.safe_load(file) + + # Extract total_fail value and debug print it + total_fail = data['summary']['total_fail'] + total_detections = data['summary']['total_detections'] + print("**Download the job artifacts of this run and view complete summary in test_results/summary.yml for troubleshooting failures.**\n") + print(" ๐Ÿ“ **Experimental or manual_test detections are not tested** ๐Ÿ“ **\n") + print(f"Extracted total_fail: [{total_fail}]\n") + + # Print all unit test details first + print(" ๐Ÿ—๏ธโš’๏ธ **Unit Test Details:**\n") + print(f"{'Name':<80} | {'Status':<6} | {'Test Type':<10} | {'Exception':<50}") + print(f"{'----':<80} | {'------':<6} | {'---------':<10} | {'---------':<50}") + for detection in data['tested_detections']: + for test in detection['tests']: + if test['test_type'].strip() == "unit": # Check if the test type is "unit" + name = detection['name'].strip() + status = 'PASS' if test['success'] else 'FAIL' + test_type = test['test_type'].strip() + exception = test.get('exception', 'N/A') # Get exception if exists, else 'N/A' + if status == 'FAIL': + print(f"{name:<80} | ๐Ÿ”ด {status:<6} | {test_type:<10} | {exception:<50}") + else: + print(f"{name:<80} | ๐ŸŸข {status:<6} | {test_type:<10} | {'-':<50}") + # Print table footer + # print(f"{'----':<80} | {'------':<6} | {'---------':<10} | {'---------':<50}") + + # Check if total_fail is a valid integer and greater than or equal to one + print("\n") # Print a newline for separation + print("**Overall Status**") + print("-------------------------------") + # Continue with additional prints or other logic + if int(total_fail) >=1: + # Print the message in bold + print("๐Ÿ”ด - **CI Failure: There are failed tests.**\n\n") + sys.exit(1) + if int(total_fail) < 1: + print("๐ŸŸข - **CI Success: No failed tests.**\n\n") + sys.exit(0) + if int(total_detections) < 1: + print("๐Ÿ”ต - **CI Success: No detections to test**\n\n") + sys.exit(0) + +if __name__ == "__main__": + main() \ No newline at end of file diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml new file mode 100644 index 0000000000..d847ab278d --- /dev/null +++ b/.github/workflows/labeler.yml @@ -0,0 +1,18 @@ +name: "Pull Request Labeler" +on: +- pull_request_target + +jobs: + labeler: + permissions: + contents: read + pull-requests: write + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: + repository: "splunk/security_content" + - uses: actions/labeler@v5 + with: + sync-labels: true + configuration-path: '.github/labeler.yml' \ No newline at end of file diff --git a/.github/workflows/unit-testing.yml b/.github/workflows/unit-testing.yml new file mode 100644 index 0000000000..1535f2d09e --- /dev/null +++ b/.github/workflows/unit-testing.yml @@ -0,0 +1,68 @@ +name: unit-testing +on: + pull_request: + types: [opened, reopened, synchronize] +jobs: + unit-testing: + runs-on: ubuntu-latest + if: "!contains(github.ref, 'refs/tags/')" #don't run on tags - future steps won't run either since they depend on this job + # needs: [validate-tag-if-present, quit-for-dependabot] + steps: + #For fork PRs, always check out security_content and the PR target in security content! + - name: Check out the repository code + uses: actions/checkout@v4 + with: + repository: 'splunk/security_content' #this should be the TARGET repo of the PR. we hardcode it for now + ref: ${{ github.base_ref }} + + + - uses: actions/setup-python@v5 + with: + python-version: '3.11' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy + architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified + + - name: Install Python Dependencies and ContentCTL + run: | + python -m pip install --upgrade pip + pip install contentctl==4.1.5 + + # Running contentctl test with a few arguments, before running the command make sure you checkout into the current branch of the pull request. This step only performs unit testing on all the changes against the target-branch. In most cases this target branch will be develop + # Make sure we check out the PR, even if it actually lives in a fork + # Instructions for pulling a PR were taken from: + # https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally + - name: Run ContentCTL test for changes against target branch + run: | + + echo "Current Branch (Head Ref): ${{ github.head_ref }}" + echo "Target Branch (Base Ref): ${{ github.base_ref }}" + git pull > /dev/null 2>&1 + git fetch origin pull/${{ github.event.pull_request.number }}/head:${{ github.head_ref }} + #We must specifically get the PR's target branch from security_content, not the one that resides in the fork PR's forked repo + git switch ${{ github.head_ref }} + #git checkout ${{ github.head_ref }} + #echo "The target branch for this PR is ${{ github.base_ref }}" + contentctl test --disable-tqdm --no-enable-integration-testing --post-test-behavior never_pause mode:changes --mode.target-branch ${{ github.base_ref }} + echo "contentctl test - COMPLETED" + continue-on-error: true + + # Store test_results/summary.yml and dist/DA-ESS-ContentUpdate-latest.tar.gz to job artifact-test_summary_results.zip + - name: store_artifacts + uses: actions/upload-artifact@v4 + with: + name: test_summary_results + path: | + test_results/summary.yml + dist/DA-ESS-ContentUpdate-latest.tar.gz + continue-on-error: true + + # Print entire result summary so that the users can view it in the Github Actions logs + - name: Print entire test_results/summary.yml + run: cat test_results/summary.yml + continue-on-error: true + + # Run a simple custom script created to pretty print results in a markdown friendly format in Github Actions Summary + - name: Check the test_results/summary.yml for pass/fail. + run: | + echo "This job will fail if there are failures in unit-testing" + python .github/workflows/format_test_results.py >> $GITHUB_STEP_SUMMARY + echo "The Unit testing is completed. See details in the unit-testing job summary UI " \ No newline at end of file diff --git a/.github/workflows/validate-and-build.yml b/.github/workflows/validate-and-build.yml deleted file mode 100644 index a3476f84cc..0000000000 --- a/.github/workflows/validate-and-build.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: validate-and-build -on: - push: - pull_request: - types: [opened, reopened] -jobs: - - validate-and-build: - #Note that the CircleCI job used a Container. The way to do this with Github Actions - #is to first start up a Virtual Machine, then we can by following: - # https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idcontainer - runs-on: ubuntu-latest - steps: - - name: Check out the repository code - uses: actions/checkout@v3 - - - uses: actions/setup-python@v4 - with: - python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy - architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified - - - name: Install System Packages - run: | - sudo apt update -qq - sudo apt install jq -qq - - - - name: Install Python Dependencies and ContentCTL - run: | - pip3 install poetry - git submodule update --init contentctl - cd contentctl - git checkout main - poetry install - - - name: content_ctl validate - run: | - cd contentctl - poetry run contentctl -p ../ validate - - - name: contentctl generate - run: | - cd contentctl - poetry run contentctl -p ../ build - cd .. - mkdir artifacts - mv dist/DA-ESS-ContentUpdate-latest.tar.gz artifacts/ - - - name: store_artifacts - uses: actions/upload-artifact@v3 - with: - name: content-latest - path: | - artifacts/DA-ESS-ContentUpdate-latest.tar.gz \ No newline at end of file diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index b46d0df484..82acb2c4d9 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,12 +1,15 @@ repos: -- repo: https://github.com/pre-commit/pre-commit-hooks - rev: v2.1.0 # Use the ref you want to point at - hooks: - - id: check-executables-have-shebangs - exclude: 'package/bin/da_ess_contentupdate/|package/bin/splunklib/|venv/' - - id: check-json - - id: check-symlinks - - id: check-yaml - - id: pretty-format-json - args: [--autofix] - - id: requirements-txt-fixer + - repo: https://github.com/pre-commit/pre-commit-hooks + rev: v4.6.0 # Use the ref you want to point at + hooks: + - id: check-executables-have-shebangs + exclude: "package/bin/da_ess_contentupdate/|package/bin/splunklib/|venv/" + - id: check-json + - id: check-symlinks + - id: check-yaml + - id: pretty-format-json + args: [--autofix] + - id: requirements-txt-fixer + - id: detect-aws-credentials + - id: detect-private-key + - id: forbid-submodules diff --git a/CODEOWNERS b/CODEOWNERS deleted file mode 100644 index 419a194bf5..0000000000 --- a/CODEOWNERS +++ /dev/null @@ -1,2 +0,0 @@ -# Set a default so everything is owned by a codeowner -* @okta-groups/sg-apps-strt-admin \ No newline at end of file diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000000..565a74586b --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,3 @@ +# Code Of Conduct + +The Code of Conduct for this repository can be found online [in our wiki](https://github.com/splunk/security_content/wiki/Code-of-Conduct). \ No newline at end of file diff --git a/README.md b/README.md index 430dc16520..9b2e22e0e9 100644 --- a/README.md +++ b/README.md @@ -2,8 +2,8 @@

- - + + @@ -74,7 +74,7 @@ To view an up-to-date detection coverage map for all the content tagged with MIT * [data_sources/](data_sources/): Defines the data sources, the necessary TA or App to collect them and the fields provided that can be used by the detections. # Contribution ๐Ÿฅฐ -We welcome feedback and contributions from the community! Please see our [contributing to the project](https://github.com/splunk/security_content/wiki/Contributing-to-the-Project) for more information on how to get involved. +We welcome feedback and contributions from the community! Please see our [contributing to the project](./.github/CONTRIBUTING.md) for more information on how to get involved. ## Support ๐Ÿ’ช If you are a Splunk Enterprise customer with a valid support entitlement contract and have a Splunk-related question, you can open a support case on the https://www.splunk.com/ support portal. @@ -100,4 +100,3 @@ distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. - diff --git a/app_template/default/app.conf b/app_template/default/app.conf index 2e30316206..c6991ff55b 100644 --- a/app_template/default/app.conf +++ b/app_template/default/app.conf @@ -8,7 +8,6 @@ build = 16367 [triggers] reload.analytic_stories = simple -reload.usage_searches = simple reload.use_case_library = simple reload.correlationsearches = simple reload.analyticstories = simple diff --git a/app_template/default/usage_searches.conf b/app_template/default/usage_searches.conf deleted file mode 100644 index 0c8aa32c0a..0000000000 --- a/app_template/default/usage_searches.conf +++ /dev/null @@ -1,73 +0,0 @@ -[escu-metrics-usage] -action.email.useNSSubject = 1 -alert.digest_mode = True -alert.suppress = 0 -alert.track = 0 -auto_summarize.dispatch.earliest_time = -1d@h -dispatchAs = user -search = index=_audit sourcetype="audittrail" \ -"ESCU - "\ -`comment("Find all the search names in the audittrail.")`\ -| stats count(search) by search savedsearch_name user\ -| eval usage=(if(savedsearch_name=="","Adhoc","Scheduled")) \ -`comment("If the savedsearch_name field in the audittrail is empty, the search was run adhoc. Otherwise it was run as a scheduled search")`\ -| rex field=search "\"(?.*)\""\ -`comment("Extract the name of the search from the search string")`\ -| table savedsearch_name count(search) usage user | join savedsearch_name max=0 type=left [search sourcetype="manifests" | spath searches{} | mvexpand searches{} | spath input=searches{} | table category search_name | rename search_name as savedsearch_name | dedup savedsearch_name] | search category=* - -[escu-metrics-search] -action.email.useNSSubject = 1 -alert.suppress = 0 -alert.track = 0 -auto_summarize.dispatch.earliest_time = -1d@h -enableSched = 1 -cron_schedule = 0 0 * * * -dispatch.earliest_time = -4h@h -dispatch.latest_time = -1h@h -search = index=_audit action=search | transaction search_id maxspan=3m | search ESCU | stats sum(total_run_time) avg(total_run_time) max(total_run_time) sum(result_count) - -[escu-metrics-search-events] -action.email.useNSSubject = 1 -alert.digest_mode = True -alert.suppress = 0 -alert.track = 0 -auto_summarize.dispatch.earliest_time = -1d@h -cron_schedule = 0 0 * * * -enableSched = 1 -dispatch.earliest_time = -4h@h -dispatch.latest_time = -1h@h -search = [search index=_audit sourcetype="audittrail" \"ESCU NOT "index=_audit" | where search !="" | dedup search_id | rex field=search "\"(?.*)\"" | rex field=_raw "user=(?[a-zA-Z0-9_\-]+)" | eval usage=if(savedsearch_name!="", "scheduled", "adhoc") | eval savedsearch_name=if(savedsearch_name != "", savedsearch_name, search_name) | table savedsearch_name search_id user _time usage | outputlookup escu_search_id.csv | table search_id] index=_audit total_run_time event_count result_count NOT "index=_audit" | lookup escu_search_id.csv search_id | stats count(savedsearch_name) AS search_count avg(total_run_time) AS search_avg_run_time sum(total_run_time) AS search_total_run_time sum(result_count) AS search_total_results earliest(_time) AS firsts latest(_time) AS lasts by savedsearch_name user usage| eval first_run=strftime(firsts, "%B %d %Y") | eval last_run=strftime(lasts, "%B %d %Y") - -[escu-metrics-search-longest-runtime] -action.email.useNSSubject = 1 -alert.digest_mode = True -alert.suppress = 0 -alert.track = 0 -auto_summarize.dispatch.earliest_time = -1d@h -enableSched = 1 -cron_schedule = 0 0 * * * -disabled = 1 -dispatch.earliest_time = -4h@h -dispatch.latest_time = -1h@h -search = index=_* ESCU [search index=_* action=search latest=-2h earliest=-1d| transaction search_id maxspan=3m | search ESCU | stats values(total_run_time) AS run by search_id | sort -run | head 1| table search_id] | table search search_id - -[escu-metrics-usage-search] -action.email.useNSSubject = 1 -alert.digest_mode = True -alert.suppress = 0 -alert.track = 0 -auto_summarize.dispatch.earliest_time = -1d@h -cron_schedule = 0 0 * * * -dispatch.earliest_time = -4h@h -dispatch.latest_time = -1h@h -enableSched = 1 -dispatchAs = user -search = index=_audit sourcetype="audittrail" \ -"ESCU - "\ -`comment("Find all the search names in the audittrail. Ignore the last few minutes so we can exclude this search's text from the result.")`\ -| stats count(search) by search savedsearch_name user\ -| eval usage=(if(savedsearch_name=="","Adhoc","Scheduled")) \ -`comment("If the savedsearch_name field in the audittrail is empty, the search was run adhoc. Otherwise it was run as a scheduled search")`\ -| rex field=search "\"(?.*)\""\ -`comment("Extract the name of the search from the search string")`\ -| table savedsearch_name count(search) usage user | join savedsearch_name max=0 type=left [search sourcetype="manifests" | spath searches{} | mvexpand searches{} | spath input=searches{} | table category search_name | rename search_name as savedsearch_name | dedup savedsearch_name] | search category=* diff --git a/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml b/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml deleted file mode 100644 index 47f8f861b7..0000000000 --- a/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml +++ /dev/null @@ -1,85 +0,0 @@ -name: Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline -id: 273df2f7-643a-451a-8d4d-637e39eadc87 -version: 1 -date: '2022-05-27' -author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk -type: Baseline -datamodel: -- Splunk_Audit -description: 'This search supports an analyst looking for abuse or misuse of the risky commands listed here: https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning -This is accomplished by using the time spent executing one of these risky commands as a proxy for misuse/abuse of interest during investigation and/or hunting. -The search builds a model utilizes the MLTK DensityFunction algorithm on Splunk app audit log data. The model uses the past 7 days of user history executing the above referenced commands then aggregates the total search run time for each hour as indicator of user behavior. -The model identifies the top 0.1% of user search run time, indicating a risky use of these commands. Users can adjust this threshold 0.1% as interested however this will correlate to missed/false positive rates. This search should be scheduled to run at least every 7 days. The name of machine learning model generated is "risky_command_abuse" and should be configured to be globally shared (not private) in MLTK app as documented here: -https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Models#Sharing_models_from_other_Splunk_apps -unless the same account of training this model will be used to perform inference using this model for anomaly -detection.' -search: '| tstats sum(Search_Activity.total_run_time) as run_time, count - FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") - AND (Search_Activity.total_run_time>1) AND (earliest=-7d@d latest=now) - AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", - "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscolle*")) - AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) - BY _time, Search_Activity.user span=1h - | fit DensityFunction "run_time" dist=auto lower_threshold=0.000001 upper_threshold=0.001 show_density=true - by Search_Activity.user into "risky_command_abuse" ' -how_to_implement: The corresponding detection of using this model is "Splunk Command and Scripting Interpreter Risky - SPL MLTK". This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ - and it assumes Splunk accelerated audit data model is available. For large enterprises, training the model might - take significant computing resources. It might require dedicated search head. The underlined machine learning - algorithm this detection used is DensityFunction. It might need to increase its settings default values, such as - max_fit_time, max_groups, etc. More details of achieving optimal performance and configuring DensityFunction - parameters can be found here - https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Configurefitandapply - Users can modify earliest=-7d@d in the search to other value so that the search can collect enough data points - to build a good baseline model. Users can also modify list of risky commands in "Search_Activity.search IN" to better - suit users' violation policy and their usage environment. -known_false_positives: If the run time of a search exceeds the boundaries of outlier defined by the fitted density - function model, false positives can occur, incorrectly labeling a long running search as potentially risky. -references: -- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Web Server - cis20: - - CIS 3 - - CIS 6 - confidence: 40 - cve: - - CVE-2022-32154 - context: - - Source: Endpoint - dataset: - - https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt - impact: 50 - kill_chain_phases: - - Actions on Objectives - message: ML model "risky_command_abuse" training is completed. - mitre_attack_id: - - T1059 - nist: - - DE.AE - observable: - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Search_Activity.search - - Search_Activity.total_run_time - - Search_Activity.user - - Search_Activity.search_type - risk_score: 20 - security_domain: audit - detections: - - Splunk Command and Scripting Interpreter Risky SPL MLTK -deployment: - scheduling: - cron_schedule: 55 * * * * - earliest_time: -70m@m - latest_time: -10m@m - schedule_window: auto diff --git a/contentctl.yml b/contentctl.yml index e223fd167b..93279c5acc 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -13,7 +13,7 @@ app: enrichments: false build_app: true build_api: true -build_ssa: true +build_ssa: false build_path: dist test_instance: splunk_app_username: admin diff --git a/data_sources/AWS_CloudWatchLogs_VPCflow.yml b/data_sources/AWS_CloudWatchLogs_VPCflow.yml deleted file mode 100644 index b25ef8f89e..0000000000 --- a/data_sources/AWS_CloudWatchLogs_VPCflow.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: AWS CloudWatchLogs VPCflow -id: 38a34fc4-e128-4478-a8f4-7835d51d5135 -version: 1 -author: Bhavin Patel, Splunk -date: '2024-07-18' -description: Data source object for AWS CloudWatchLogs VPCflow -source: aws_cloudwatchlogs_vpcflow -sourcetype: aws:cloudwatchlogs:vpcflow -separator: eventName -supported_TA: - - name: Splunk Add-on for Amazon Web Services (AWS) - version: 7.4.1 - url: https://splunkbase.splunk.com/app/1876 -fields: -- _raw -- _time -- account_id -- action -- app -- aws_account_id -- bytes -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- dest -- dest_ip -- dest_port -- duration -- dvc -- end_time -- eventtype -- host -- index -- interface_id -- linecount -- log_status -- packets -- protocol -- protocol_code -- protocol_full_name -- protocol_version -- punct -- region -- source -- sourcetype -- splunk_server -- splunk_server_group -- src -- src_ip -- src_port -- start_time -- tag -- tag::action -- tag::eventtype -- timeendpos -- timestartpos -- transport -- user_id -- vendor_account -- vendor_product -- version -- vpcflow_action -example_log: '2 123397614277 eni-0b0f9f261f45e6489 10.0.1.30 10.0.1.1 47254 22 17 2 98 1697608042 1697608070 ACCEPT OK' diff --git a/data_sources/Windows_Event_Log_System_4728.yml b/data_sources/Windows_Event_Log_System_4728.yml deleted file mode 100644 index ad6e0b6a33..0000000000 --- a/data_sources/Windows_Event_Log_System_4728.yml +++ /dev/null @@ -1,99 +0,0 @@ -name: Windows Event Log System 4728 -id: 4549f0ac-3df9-4bfb-bea5-1459690c8040 -version: 1 -date: '2024-07-18' -author: Patrick Bareiss, Splunk -description: Data source object for Windows Event Log System 4728 -source: XmlWinEventLog:System -sourcetype: xmlwineventlog -separator: EventCode -supported_TA: -- name: Splunk Add-on for Microsoft Windows - url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 -fields: -- _time -- Account_Domain -- Account_Name -- CategoryString -- ComputerName -- Error_Code -- EventCode -- EventType -- Keywords -- LogName -- Logon_ID -- Message -- OpCode -- RecordNumber -- Security_ID -- SourceName -- Subject_Account_Domain -- Subject_Account_Name -- Subject_Logon_ID -- Subject_Security_ID -- Target_Account_Domain -- Target_Account_Name -- Target_Security_ID -- TaskCategory -- Type -- action -- app -- body -- category -- change_type -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- dest -- dest_nt_domain -- dest_nt_host -- dvc -- dvc_nt_host -- event_id -- eventtype -- host -- id -- index -- linecount -- member_dn -- member_id -- member_nt_domain -- msad_action -- name -- object -- object_attrs -- object_category -- object_id -- product -- punct -- result -- session_id -- severity -- severity_id -- signature -- signature_id -- source -- sourcetype -- splunk_server -- src_nt_domain -- src_user -- src_user_name -- status -- subject -- ta_windows_action -- ta_windows_security_CategoryString -- tag -- tag::eventtype -- timeendpos -- timestartpos -- user -- user_group -- user_name -- vendor -- vendor_product diff --git a/detections/application/detect_risky_spl_using_pretrained_ml_model.yml b/detections/application/detect_risky_spl_using_pretrained_ml_model.yml deleted file mode 100644 index 3f2c32c442..0000000000 --- a/detections/application/detect_risky_spl_using_pretrained_ml_model.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Detect Risky SPL using Pretrained ML Model -id: b4aefb5f-1037-410d-a149-1e091288ba33 -version: 2 -date: '2024-05-26' -author: Abhinav Mishra, Kumar Sharad, Namratha Sreekanta and Xiao Lin, Splunk -status: experimental -type: Anomaly -description: The following analytic identifies potentially risky SPL commands executed - by users. It leverages a pretrained machine learning text classifier that analyzes - command text, user, and search type to assign a risk score between 0 and 1. This - detection is significant as it helps identify suspicious or unauthorized search - activities that could indicate malicious intent or misuse of the Splunk environment. - If confirmed malicious, such activity could lead to unauthorized data access, data - exfiltration, or further exploitation of the system. -data_source: [] -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search_type=adhoc - Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.user - Search_Activity.search_type | eval spl_text = ''Search_Activity.search''. " " .''Search_Activity.user''. - " " .''Search_Activity.search_type''| dedup spl_text | apply risky_spl_pre_trained_model - | where risk_score > 0.5 | `drop_dm_object_name(Search_Activity)` | table search, - user, search_type, risk_score | `detect_risky_spl_using_pretrained_ml_model_filter`' -how_to_implement: This detection depends on the MLTK app which can be found here - - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can - be found here - https://splunkbase.splunk.com/app/1621/. Additionally, you need - to be ingesting logs which include Search_Activity.search, Search_Activity.user, - Search_Activity.search_type from your endpoints. The risk score threshold should - be adjusted based on the environment. The detection uses a custom MLTK model hence - we need a few more steps for deployment, as outlined here - https://gist.github.com/ksharad-splunk/be2a62227966049047f5e5c4f2adcabb. -known_false_positives: False positives may be present if suspicious behavior is observed, - as determined by frequent usage of risky keywords. -references: -- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Web Server - confidence: 40 - cve: - - CVE-2022-32154 - impact: 50 - message: A potentially risky Splunk command has been run by $user$, kindly review. - mitre_attack_id: - - T1059 - observable: - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Search_Activity.search - - Search_Activity.user - - Search_Activity.search_type - risk_score: 20 - security_domain: audit -tests: -- name: True Positive Test - attack_data: - - data: - https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt - source: audittrail - sourcetype: audittrail - update_timestamp: true - custom_index: _audit diff --git a/detections/application/path_traversal_spl_injection.yml b/detections/application/path_traversal_spl_injection.yml deleted file mode 100644 index 7f112a5d53..0000000000 --- a/detections/application/path_traversal_spl_injection.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Path traversal SPL injection -id: dfe55688-82ed-4d24-a21b-ed8f0e0fda99 -version: 3 -date: '2024-05-26' -author: Rod Soto, Splunk -status: production -type: TTP -description: The following analytic identifies attempts at path traversal in search - parameters, which can lead to SPL injection. It detects this activity by searching - for specific patterns in the `_internal` index that indicate path traversal attempts - (e.g., "../../../../"). This activity is significant for a SOC because it can allow - an attacker to manipulate the application to load data from incorrect endpoints, - potentially running arbitrary SPL queries. If confirmed malicious, this could lead - to unauthorized data access, code execution, or further exploitation of the Splunk - environment. -data_source: -- Splunk -search: ' `path_traversal_spl_injection` | search "\/..\/..\/..\/..\/..\/..\/..\/..\/..\/" | - stats count by host status clientip method uri_path uri_query | `path_traversal_spl_injection_filter`' -how_to_implement: This detection does not require you to ingest any new data. The - detection does require the ability to search the _internal index. This search will - provide search UI requests with path traversal parameter ("../../../../../../../../../") - which shows exploitation attempts. This detection is meant for on premise environments, - and if executed on internet facing servers without a WAF may produce a lot of results. - This detection will not work against obfuscated path traversal requests. -known_false_positives: This search may find additional path traversal exploitation - attempts. -references: -- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0506.html -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 80 - cve: - - CVE-2022-26889 - impact: 50 - message: Path traversal exploitation attempt from $clientip$ - mitre_attack_id: - - T1083 - observable: - - name: host - type: Hostname - role: - - Victim - - name: clientip - type: IP Address - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - required_fields: - - status - - clientip - - method - - uri_path - - uri_query - risk_score: 40 - security_domain: threat -tests: -- name: True Positive Test - attack_data: - - data: - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/path_traversal_spl_injection.txt - source: splunkd_ui_access.log - sourcetype: splunkd_ui_access - custom_index: _internal diff --git a/detections/application/persistent_xss_in_rapiddiag_through_user_interface_views.yml b/detections/application/persistent_xss_in_rapiddiag_through_user_interface_views.yml deleted file mode 100644 index 8b68f351f7..0000000000 --- a/detections/application/persistent_xss_in_rapiddiag_through_user_interface_views.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Persistent XSS in RapidDiag through User Interface Views -id: ce6e1268-e01c-4df2-a617-0f034ed49a43 -version: 2 -date: "2024-05-24" -author: Rod Soto, Splunk -type: TTP -status: production -data_source: -- Splunk -description: The following analytic identifies potential persistent Cross-Site Scripting - (XSS) attacks in Splunk Enterprise 9.0 versions before 9.0.4 through user interface - views. It leverages audit logs from the `audit_searches` data source to detect actions - involving Base64-encoded images in error messages. This activity is significant - because it can allow attackers to inject malicious scripts that execute in the context - of other users, leading to unauthorized actions or data exposure. If confirmed malicious, - this could result in persistent control over the affected Splunk instance, compromising - its integrity and confidentiality. -search: "`audit_searches` path=/opt/splunk/etc/users/*/search/local/data/ui/views/* - action=* |table user action roles info roles path | dedup user action | `persistent_xss_in_rapiddiag_through_user_interface_views_filter`" -how_to_implement: This detection does not require you to ingest any new data. The - detection does require the ability to search the _internal index -known_false_positives: This is a hunting search, it will not deobfuscate base64 payload, - it provides however it will provide what user added the view artifact and what user - opened it. It will require further investigation based on the information presented - by this hunting search. -references: -- https://www.splunk.com/en_us/product-security.html -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - cve: - - CVE-2023-22932 - confidence: 50 - context: - - Source:Endpoint - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_persistent_xss_in_rapiddiag_through_user_interface_views_data.log - impact: 50 - message: A potential XSS attempt has been detected from $user$ - mitre_attack_id: - - T1189 - observable: - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - user - - action - - roles - - info - - roles - - path - risk_score: 25 - security_domain: threat -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_persistent_xss_in_rapiddiag_through_user_interface_views_data.log - source: audittrail - sourcetype: audittrail - custom_index: _audit diff --git a/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml b/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml deleted file mode 100644 index 0e8f595778..0000000000 --- a/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Splunk Absolute Path Traversal Using runshellscript -id: 356bd3fe-f59b-4f64-baa1-51495411b7ad -version: 2 -date: '2024-05-17' -author: Rod Soto -status: production -type: Hunting -data_source: -- Splunk -description: The following analytic detects the exploitation of an absolute path traversal - vulnerability in Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, - where an attacker can execute arbitrary code located on a separate disk. It leverages - logs from the `splunk_python` macro, specifically looking for the `runshellscript` - command with a specific argument count and path pattern. This activity is significant - as it indicates a potential exploitation attempt that could lead to unauthorized - code execution. If confirmed malicious, this could allow an attacker to gain control - over the Splunk instance, leading to data breaches or further system compromise. -search: >- - `splunk_python` *runshellscript* | eval log_split=split(_raw, "runshellscript: - ") - | eval array_raw = mvindex(log_split,1) - | eval data_cleaned=replace(replace(replace(array_raw,"\[",""),"\]",""),"'","") - | eval array_indices=split(data_cleaned,",") - | eval runshellscript_args_count=mvcount(array_indices) - | where runshellscript_args_count = 10 - | eval interpreter=mvindex(array_indices,0) - | eval targetScript=mvindex(array_indices,1) - | eval targetScript != "*C:*" - | stats count min(_time) as firstTime max(_time) as lastTime by splunk_server interpreter - targetScript - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` - | `splunk_absolute_path_traversal_using_runshellscript_filter` -how_to_implement: Must have access to internal indexes. Only applies to Splunk on - Windows versions. -known_false_positives: The command runshellscript can be used for benign purposes. - Analyst will have to review the searches and determined maliciousness specially - by looking at targeted script. -references: -- https://advisory.splunk.com/advisories/SVD-2023-0806 -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 70 - impact: 50 - message: Possible attack against splunk_server $splunk_server$ through abuse of - the runshellscript command - mitre_attack_id: - - T1083 - cve: - - CVE-2023-40597 - observable: - - name: splunk_server - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - required_fields: - - search - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/splunk_absolute_path_traversal_using_runshellscript_splunk_python.log - source: python.log - sourcetype: splunk_python - custom_index: _internal diff --git a/detections/application/splunk_account_discovery_drilldown_dashboard_disclosure.yml b/detections/application/splunk_account_discovery_drilldown_dashboard_disclosure.yml deleted file mode 100644 index 6ccf92f332..0000000000 --- a/detections/application/splunk_account_discovery_drilldown_dashboard_disclosure.yml +++ /dev/null @@ -1,53 +0,0 @@ -name: Splunk Account Discovery Drilldown Dashboard Disclosure -id: f844c3f6-fd99-43a2-ba24-93e35fe84be6 -version: 2 -date: '2024-05-15' -author: Marissa Bower, Rod Soto, Splunk -status: experimental -type: TTP -description: The following analytic identifies the presence of environment variables - in Splunk dashboard drilldown URLs. It uses the REST API to query dashboards for - specific patterns in the XML data. This activity is significant because it can expose - sensitive tokens from privileged users if an attacker shares a malicious dashboard. - If confirmed malicious, this could allow an attacker to detokenize variables and - potentially gain unauthorized access to sensitive information or escalate privileges - within the Splunk environment. -data_source: [] -search: '| rest splunk_server=local /servicesNS/-/-/data/ui/views | search eai:data="*$env:*" - eai:data="*url*" eai:data="*options*" | rename author AS Author eai:acl.sharing - AS Permissions eai:appName AS App eai:data AS "Dashboard XML" | fields Author Permissions - App "Dashboard XML" | `splunk_account_discovery_drilldown_dashboard_disclosure_filter`' -how_to_implement: This search uses REST function to query for dashboards with environment - variables present in URL options. -known_false_positives: This search may reveal non malicious URLs with environment - variables used in organizations. -references: -- https://www.splunk.com/en_us/product-security.html -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 80 - cve: - - CVE-2022-37438 - impact: 50 - message: Potential exposure of environment variables from url embedded in dashboard - mitre_attack_id: - - T1087 - observable: - - name: author - type: User - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - eai:data - - splunk_server - - author - - eai:acl.sharing - - eai:appName - risk_score: 40 - security_domain: threat diff --git a/detections/application/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml b/detections/application/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml deleted file mode 100644 index 245923c5c8..0000000000 --- a/detections/application/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Splunk App for Lookup File Editing RCE via User XSLT -id: a053e6a6-2146-483a-9798-2d43652f3299 -version: 2 -date: '2024-05-16' -author: Rod Soto, Splunk -status: experimental -type: Hunting -data_source: [] -description: The following analytic identifies the creation of lookup files in Splunk, - which could indicate an attempt to exploit remote code execution via user-supplied - XSLT. It leverages REST API queries to monitor the creation of these lookups, focusing - on fields such as title, author, and access control lists. This activity is significant - because it targets a known vulnerability in Splunk versions 9.1.x, potentially allowing - attackers to execute arbitrary code. If confirmed malicious, this could lead to - unauthorized code execution, compromising the integrity and security of the Splunk - environment. -search: '| rest splunk_server=local /services/data/lookup-table-files/ | fields title - author disabled eai:acl.app eai:acl.owner eai:acl.sharing eai:appName eai:data | - `splunk_app_for_lookup_file_editing_rce_via_user_xslt_filter`' -how_to_implement: Because there is no way to detect the payload, this search only - provides the ability to monitor the creation of lookups which are the base of this - exploit. An operator must then investigate suspicious lookups. This search requires - ability to perform REST queries. Note that if the Splunk App for Lookup File Editing - is not, or was not, installed in the Splunk environment then it is not necessary - to run the search as the enviornment was not vulnerable. -known_false_positives: This search will provide information for investigation and - hunting of lookup creation via user-supplied XSLT which may be indications of possible - exploitation. There will be false positives as it is not possible to detect the - payload executed via this exploit. -references: -- https://advisory.splunk.com/advisories/SVD-2023-1104 -cve: -- CVE-2023-46214 -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 2 - impact: 50 - message: Please review $eai:acl.app$ for possible malicious lookups - mitre_attack_id: - - T1210 - observable: - - name: eai:acl.app - type: Other - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 1 - required_fields: - - title - - author - - disabled - - ea:acl.app - - eai:acl.owner - - eai:acl.sharing - - eai:appName - - eai:data - security_domain: endpoint diff --git a/detections/application/splunk_authentication_token_exposure_in_debug_log.yml b/detections/application/splunk_authentication_token_exposure_in_debug_log.yml deleted file mode 100644 index fa004a85b2..0000000000 --- a/detections/application/splunk_authentication_token_exposure_in_debug_log.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Splunk Authentication Token Exposure in Debug Log -id: 9a67e749-d291-40dd-8376-d422e7ecf8b5 -version: 2 -date: '2024-05-25' -author: Rod Soto, Chase Franklin -type: TTP -status: production -data_source: [] -description: The following analytic identifies exposed authentication tokens in debug - logs within Splunk Enterprise. It leverages logs from the `splunkd` component with - a DEBUG log level, specifically searching for event messages that validate tokens. - This activity is significant because exposed tokens can be exploited by attackers - to gain unauthorized access to the Splunk environment. If confirmed malicious, this - exposure could lead to unauthorized data access, privilege escalation, and potential - compromise of the entire Splunk infrastructure. Monitoring and addressing this vulnerability - is crucial for maintaining the security and integrity of the Splunk deployment. -search: '`splunkd` component=JsonWebToken log_level=DEBUG eventtype="splunkd-log" - event_message="Validating token:*" | rex "Validating token: (?.*)\.$" | search - token!=None | stats count min(_time) as firstTime max(_time) as lastTime values(log_level) - as log_level values(event_message) as event_message by index, sourcetype, host, - token | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `splunk_authentication_token_exposure_in_debug_log_filter`' -how_to_implement: Requires access to internal Splunk indexes. -known_false_positives: Only applies to affected versions of Splunk Enterprise below - 9.2.1, 9.1.4, and 9.0.9 -references: -- https://advisory.splunk.com/advisories/SVD-2024-0301 -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Splunk Server - confidence: 100 - cve: - - CVE-2024-29945 - impact: 50 - message: Possible JsonWebToken exposure, please investigate affected $host$ - mitre_attack_id: - - T1654 - observable: - - name: host - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Cloud - required_fields: - - component - - log_level - - eventtype - - event_message - - host - risk_score: 50 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1654/splunk/jsonwebtokenplaintokensvd_splunkd.log - source: /opt/splunk/var/log/splunk/splunkd.log - sourcetype: splunkd - custom_index: _internal diff --git a/detections/application/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml b/detections/application/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml deleted file mode 100644 index 5911352019..0000000000 --- a/detections/application/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Splunk Code Injection via custom dashboard leading to RCE -id: b06b41d7-9570-4985-8137-0784f582a1b3 -version: 2 -date: '2024-05-24' -author: Rod Soto -status: experimental -type: Hunting -description: The following analytic identifies attempts to exploit a vulnerability - in Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, where an authenticated - user can execute arbitrary code via the dashboard PDF generation component. It detects - this activity by analyzing events in the _internal index with the file=export parameter. - This behavior is significant because it indicates a potential code injection attack, - which could lead to remote code execution (RCE). If confirmed malicious, an attacker - could gain unauthorized access, execute arbitrary commands, and potentially compromise - the entire Splunk environment. -data_source: [] -search: '`splunkd_ui` uri_path=*/data/ui/views/* OR uri_path=*saved/searches/* | dedup - uri_path | eval URL=urldecode("uri_path")| rex field=URL "\/saved\/searches\/(?[^\/]*)" - | rex field=URL "\/data\/ui\/views\/(?[^\/]*)" | eval NAME=NAME."( Saved - Search )",NAME1=NAME1."( Dashboard )" | eval NAME=coalesce(NAME,NAME1) | eval STATUS=case(match(status,"2\d+"),"SUCCESS",match(status,"3\d+"),"REDIRECTION",match(status,"4\d+") - OR match(status,"5\d+"),"ERROR") | stats list(NAME) as DASHBOARD_TITLE,list(method) - as HTTP_METHOD,list(status) as Status_Code,list(STATUS) as STATUS by user | rename - user as User | `splunk_code_injection_via_custom_dashboard_leading_to_rce_filter`' -how_to_implement: This detection does not require you to ingest any new data. The - detection does require the ability to search the _internal index. -known_false_positives: Not all exports and downloads are malicious, special attention - must be put as well on /en-US/splunkd/__raw/services/pdfgen/render in the context - of this search. -references: -- https://www.splunk.com/en_us/product-security.html -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 50 - cve: - - CVE-2022-43571 - impact: 50 - message: Potential exploitation of Code Injection via Dashboard PDF generation. - mitre_attack_id: - - T1210 - observable: - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - user - - clientip - - uri - - uri_path - - method - - status - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/splunk_code_injection_via_custom_dashboard_leading_to_rce.txt - source: /opt/splunk/var/log/splunk/splunkd_ui_access.log - sourcetype: splunkd_ui_access - custom_index: _internal - update_timestamp: true diff --git a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml deleted file mode 100644 index 4398016fff..0000000000 --- a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Splunk Command and Scripting Interpreter Delete Usage -id: 8d3d5d5e-ca43-42be-aa1f-bc64375f6b04 -version: 2 -date: '2024-05-21' -author: Michael Haag, Splunk -status: production -type: Anomaly -description: The following analytic detects the use of the 'delete' command in Splunk, - which can be used to remove queried data. This detection leverages the Splunk Audit - data model, specifically monitoring ad-hoc searches containing the 'delete' command - by non-system users. This activity is significant because the 'delete' command is - rarely used and can indicate potential data tampering or unauthorized data removal. - If confirmed malicious, this activity could lead to the loss of critical log data, - hindering incident investigations and compromising the integrity of the monitoring - environment. -data_source: -- Splunk -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search - IN ("*| delete*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user - by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user - Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `splunk_command_and_scripting_interpreter_delete_usage_filter`' -how_to_implement: To successfully implement this search acceleration is recommended - against the Search_Activity datamodel that runs against the splunk _audit index. - In addition, this analytic requires the Common Information Model App which includes - the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. -known_false_positives: False positives may be present if this command is used as a - common practice. Filter as needed. -references: -- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Web Server - confidence: 30 - cve: - - CVE-2022-32154 - impact: 90 - message: $user$ executed the 'delete' command, if this is unexpected it should be - reviewed. - mitre_attack_id: - - T1059 - observable: - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Search_Activity.search - - Search_Activity.info - - Search_Activity.total_run_time - - Search_Activity.user - - Search_Activity.savedsearch_name - - Search_Activity.search_type - risk_score: 27 - security_domain: audit -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log - source: audittrail - sourcetype: audittrail - update_timestamp: true - custom_index: _audit diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml deleted file mode 100644 index 07ce527149..0000000000 --- a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml +++ /dev/null @@ -1,81 +0,0 @@ -name: Splunk Command and Scripting Interpreter Risky Commands -id: 1cf58ae1-9177-40b8-a26c-8966040f11ae -version: 2 -date: '2024-05-19' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following analytic identifies the execution of risky commands within - the Splunk platform, such as `runshellscript`, `delete`, and `sendemail`. It leverages - the Search_Activity data model to detect ad hoc searches containing these commands, - excluding those run by the splunk-system-user. This activity is significant because - it may indicate attempts at data exfiltration, deletion, or other unauthorized actions - by a malicious user. If confirmed malicious, this could lead to data loss, unauthorized - data transfer, or system compromise, severely impacting the organization's security - posture. -data_source: -- Splunk -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search - IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv - *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail - *", "*| tscolle*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user - by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user - Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `splunk_command_and_scripting_interpreter_risky_commands_filter`' -how_to_implement: To successfully implement this search acceleration is recommended - against the Search_Activity datamodel that runs against the splunk _audit index. In - addition, this analytic requires the Common Information Model App which includes - the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. Splunk SOAR - customers can find a SOAR workbook that walks an analyst through the process of - running these hunting searches in the references list of this detection. In order - to use this workbook, a user will need to run a curl command to post the file to - their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template - -d @splunk_psa_0622.json". A user should then create an empty container or case, - attach the workbook, and begin working through the tasks. -known_false_positives: False positives will be present until properly filtered by - Username and search name. -references: -- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning -- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json -- https://advisory.splunk.com/advisories/SVD-2024-0302 -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Web Server - confidence: 40 - cve: - - CVE-2022-32154 - - CVE-2024-29946 - impact: 50 - message: A risky Splunk command has ran by $user$ and should be reviewed. - mitre_attack_id: - - T1059 - observable: - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Search_Activity.search - - Search_Activity.info - - Search_Activity.total_run_time - - Search_Activity.user - - Search_Activity.savedsearch_name - - Search_Activity.search_type - risk_score: 20 - security_domain: audit -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log - source: audittrail - sourcetype: audittrail - update_timestamp: true - custom_index: _audit diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml deleted file mode 100644 index cfaee91656..0000000000 --- a/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml +++ /dev/null @@ -1,74 +0,0 @@ -name: Splunk Command and Scripting Interpreter Risky SPL MLTK -id: 19d0146c-2eae-4e53-8d39-1198a78fa9ca -version: 2 -date: '2024-05-15' -author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk -status: production -type: Anomaly -description: The following analytic identifies the execution of risky SPL commands - with abnormally long run times by leveraging a machine learning model named "risky_command_abuse." - It uses the Splunk Audit data model to compare current search activities against - a baseline of the past seven days. This activity is significant for a SOC as it - can indicate potential misuse or abuse of powerful SPL commands, which could lead - to unauthorized data access or system manipulation. If confirmed malicious, this - activity could allow an attacker to execute arbitrary scripts, delete data, or exfiltrate - sensitive information. -data_source: -- Splunk -search: '| tstats sum(Search_Activity.total_run_time) AS run_time, values(Search_Activity.search) - as searches, count FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") - AND (Search_Activity.total_run_time>1) AND (earliest=-1h@h latest=now) AND (Search_Activity.search - IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv - *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail - *", "*| tscolle*")) AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) - BY _time, Search_Activity.user span=1h | apply risky_command_abuse | fields _time, - Search_Activity.user, searches, run_time, IsOutlier(run_time) | rename IsOutlier(run_time) - as isOutlier, _time as timestamp | where isOutlier>0.5 | `splunk_command_and_scripting_interpreter_risky_spl_mltk_filter`' -how_to_implement: This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ - and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. - Baseline model needs to be built using "Splunk Command and Scripting Interpreter - Risky SPL MLTK Baseline" before this search can run. Please note that the current - search only finds matches exactly one space between separator bar and risky commands. -known_false_positives: If the run time of a search exceeds the boundaries of outlier - defined by the fitted density function model, false positives can occur, incorrectly - labeling a long running search as potentially risky. -references: -- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Web Server - confidence: 40 - cve: - - CVE-2022-32154 - impact: 50 - message: Abnormally long run time for risk SPL command seen by user $(Search_Activity.user). - mitre_attack_id: - - T1059 - observable: - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Search_Activity.search - - Search_Activity.total_run_time - - Search_Activity.user - - Search_Activity.search_type - risk_score: 20 - security_domain: audit - manual_test: This search has a baseline and timestamps hard coded into the search. -tests: -- name: True Positive Test - attack_data: - - data: - https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt - source: audittrail - sourcetype: audittrail - update_timestamp: true - custom_index: _audit diff --git a/detections/application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml b/detections/application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml deleted file mode 100644 index a01e1d3649..0000000000 --- a/detections/application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Splunk CSRF in the SSG kvstore Client Endpoint -id: 4742d5f7-ce00-45ce-9c79-5e98b43b4410 -version: 3 -date: '2024-07-01' -author: Rod Soto -status: production -type: TTP -description: The following analytic identifies attempts to exploit a cross-site request - forgery (CSRF) vulnerability in the Splunk Secure Gateway (SSG) app's kvstore_client - endpoint. It detects GET requests to the vulnerable endpoint using internal index - data, focusing on specific URI paths and HTTP methods. This activity is significant - because it can allow unauthorized updates to SSG KV store collections, potentially - leading to data manipulation or unauthorized access. If confirmed malicious, this - could enable attackers to alter critical configurations or exfiltrate sensitive - information, compromising the integrity and security of the Splunk environment. -data_source: -- Splunk -search: '`splunkda` uri_path="/*/splunkd/__raw/services/ssg/kvstore_client" method="GET" - delete_field_value="spacebridge_server" status="200" | table splunk_server status - uri delete_field_value method post_data | `splunk_csrf_in_the_ssg_kvstore_client_endpoint_filter`' -how_to_implement: Requires access to internal index. -known_false_positives: This hunting search only applies to the affected versions and - setup mentioned in the description of this search, it does not extract payload so - it requires manual investigation after executing search. This search will produce - false positives. -references: -- https://advisory.splunk.com/advisories/SVD-2023-0212 -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 50 - cve: - - CVE-2023-22942 - impact: 50 - message: Potential CSRF exploitation attempt from $splunk_server$ - mitre_attack_id: - - T1189 - observable: - - name: splunk_server - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - splunk_server - - status - - uri - - delete_field_value - - method - - post_data - risk_score: 25 - security_domain: threat -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_csrf_in_the_ssg_kvstore_client_endpoint_data.log - source: splunkd_access.log - sourcetype: splunkd_access - custom_index: _internal diff --git a/detections/application/splunk_data_exfiltration_from_analytics_workspace_using_sid_query.yml b/detections/application/splunk_data_exfiltration_from_analytics_workspace_using_sid_query.yml deleted file mode 100644 index 2e53d18f26..0000000000 --- a/detections/application/splunk_data_exfiltration_from_analytics_workspace_using_sid_query.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Splunk Data exfiltration from Analytics Workspace using sid query -id: b6d77c6c-f011-4b03-8650-8f10edb7c4a8 -version: 2 -date: '2024-05-25' -author: Rod Soto, Eric McGinnis -status: production -type: Hunting -description: The following analytic identifies attempts to exfiltrate data by executing - a prepositioned malicious search ID in Splunk's Analytic Workspace. It leverages - the `audit_searches` data source to detect suspicious `mstats` commands indicative - of injection attempts. This activity is significant as it may indicate a phishing-based - attack where an attacker compels a victim to initiate a malicious request, potentially - leading to unauthorized data access. If confirmed malicious, this could result in - significant data exfiltration, compromising sensitive information and impacting - the organization's security posture. -data_source: -- Splunk -search: '`audit_searches` info=granted search NOT ("audit_searches") search NOT ("security_content_summariesonly") - AND ((search="*mstats*[*]*" AND provenance="N/A") OR (search="*mstats*\\\"*[*]*\\\"*"))| - eval warning=if(match(search,"\\\\\""), "POTENTIAL INJECTION STAGING", "POTENTIAL - INJECTION EXECUTION") | table search, user, warning, timestamp | `splunk_data_exfiltration_from_analytics_workspace_using_sid_query_filter`' -how_to_implement: The vulnerability affects only instances with Splunk Web Enabled. After - running this search, please run "Splunk Command and Scripting Interpreter Risky - SPL MLTK" to gain more insight into potentially risky commands which could lead - to data exfiltration. -known_false_positives: This search may produce false positives. This detection does - not require you to ingest any new data. The detection does require the ability to - search the _audit index. Special attention must be paid to "/en-US/app/search/analytics_workspace?sid=[sid]" - which is where the malicious code will be inserted to trigger attack at victim. -references: -- https://www.splunk.com/en_us/product-security.html -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 50 - cve: - - CVE-2022-43566 - impact: 50 - message: Potential data exfiltration attack using SID query by $user$ - mitre_attack_id: - - T1567 - observable: - - name: user - type: User - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - action - - info - - user - - search_id - - metadata - - user - - _time - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1567/splunk/splunk_data_exfiltration_from_analytics_workspace_using_sid_query.txt - source: audittrail - sourcetype: audittrail - custom_index: _audit - update_timestamp: true diff --git a/detections/application/splunk_digital_certificates_infrastructure_version.yml b/detections/application/splunk_digital_certificates_infrastructure_version.yml deleted file mode 100644 index 15c43c0e3b..0000000000 --- a/detections/application/splunk_digital_certificates_infrastructure_version.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Splunk Digital Certificates Infrastructure Version -id: 3c162281-7edb-4ebc-b9a4-5087aaf28fa7 -version: 2 -date: '2024-05-27' -author: Lou Stella, Splunk -status: production -type: Hunting -description: The following analytic identifies improper TLS validation configuration - on Splunk search heads and peers post version 9. It leverages REST API calls to - retrieve server information and SSL configuration settings, checking fields like - `sslVerifyServerCert` and `sslVerifyServerName`. This activity is significant for - a SOC as improper TLS settings can expose the infrastructure to man-in-the-middle - attacks and data breaches. If confirmed malicious, attackers could intercept or - manipulate data, compromising the integrity and confidentiality of communications - within the Splunk environment. -data_source: -- Splunk -search: '| rest /services/server/info | table splunk_server version server_roles | - join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="sslConfig"| - table splunk_server sslVerifyServerCert sslVerifyServerName serverCert] | fillnull - value="Not Set" | rename sslVerifyServerCert as "Server.conf:SslConfig:sslVerifyServerCert", - sslVerifyServerName as "Server.conf:SslConfig:sslVerifyServerName", serverCert as - "Server.conf:SslConfig:serverCert" | `splunk_digital_certificates_infrastructure_version_filter`' -how_to_implement: The user running this search is required to have a permission allowing - them to dispatch REST requests to indexers (the `dispatch_rest_to_indexers` capability) - in some architectures. Splunk SOAR customers can find a SOAR workbook that walks - an analyst through the process of running these hunting searches in the references - list of this detection. In order to use this workbook, a user will need to run a - curl command to post the file to their SOAR instance such as "curl -u username:password - https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". - A user should then create an empty container or case, attach the workbook, and begin - working through the tasks. -known_false_positives: No known at this time. -references: -- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_Splunk-to-Splunk_communication -- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0602.html -- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 100 - cve: - - CVE-2022-32153 - impact: 50 - message: $splunk_server$ may not be properly validating TLS Certificates - mitre_attack_id: - - T1587.003 - observable: - - name: splunk_server - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - none - risk_score: 50 - security_domain: threat -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log - source: audittrail - sourcetype: audittrail - update_timestamp: true - custom_index: _audit diff --git a/detections/application/splunk_digital_certificates_lack_of_encryption.yml b/detections/application/splunk_digital_certificates_lack_of_encryption.yml deleted file mode 100644 index edaab43ed3..0000000000 --- a/detections/application/splunk_digital_certificates_lack_of_encryption.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Splunk Digital Certificates Lack of Encryption -id: 386a7ebc-737b-48cf-9ca8-5405459ed508 -version: 2 -date: '2024-05-18' -author: Lou Stella, Splunk -status: production -type: Anomaly -description: The following analytic identifies Splunk forwarder connections that are - not using TLS encryption. It leverages data from the `splunkd` logs, specifically - looking for connections where the `ssl` field is set to "false". This activity is - significant because unencrypted connections can expose sensitive data and allow - unauthorized access, posing a security risk. If confirmed malicious, an attacker - could exploit this vulnerability to download or publish forwarder bundles, potentially - leading to arbitrary code execution and further compromise of the environment. -data_source: -- Splunk -search: '`splunkd` group="tcpin_connections" ssl="false" | stats values(sourceIp) - latest(fwdType) latest(version) by hostname | `splunk_digital_certificates_lack_of_encryption_filter`' -how_to_implement: This anomaly search looks for forwarder connections that are not - currently using TLS. It then presents the source IP, the type of forwarder, and - the version of the forwarder. You can also remove the "ssl=false" argument from - the initial stanza in order to get a full list of all your forwarders that are sending - data, and the version of Splunk software they are running, for audit purposes. Splunk - SOAR customers can find a SOAR workbook that walks an analyst through the process - of running these hunting searches in the references list of this detection. In order - to use this workbook, a user will need to run a curl command to post the file to - their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template - -d @splunk_psa_0622.json". A user should then create an empty container or case, - attach the workbook, and begin working through the tasks. -known_false_positives: None at this time -references: -- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html -- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0601.html -- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 80 - cve: - - CVE-2022-32151 - impact: 25 - message: $hostname$ is not using TLS when forwarding data - mitre_attack_id: - - T1587.003 - observable: - - name: hostname - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - group - - ssl - - sourceIp - - fwdType - - version - - hostname - risk_score: 20 - security_domain: threat -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1587.003/splunk_fwder/splunkd.log - source: /opt/splunk/var/log/splunk/metrics.log - sourcetype: splunkd - update_timestamp: false - custom_index: _internal diff --git a/detections/application/splunk_dos_using_malformed_saml_request.yml b/detections/application/splunk_dos_using_malformed_saml_request.yml deleted file mode 100644 index 669a282909..0000000000 --- a/detections/application/splunk_dos_using_malformed_saml_request.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Splunk DoS Using Malformed SAML Request -id: 8e8a86d5-f323-4567-95be-8e817e2baee6 -version: 2 -date: '2024-05-29' -author: Rod Soto -status: production -type: Hunting -data_source: -- Splunk -description: The following analytic detects a denial of service (DoS) attempt using - a malformed SAML request targeting the /saml/acs REST endpoint in Splunk Enterprise - versions lower than 9.0.6 and 8.2.12. It leverages `splunkd` logs, specifically - looking for error messages containing "xpointer" in the `expr` field. This activity - is significant because it can cause the Splunk daemon to crash or hang, disrupting - service availability. If confirmed malicious, this attack could lead to prolonged - downtime, impacting the organization's ability to monitor and respond to security - events. -search: '`splunkd` event_message=*error* expr=*xpointer* | stats count min(_time) - as firstTime max(_time) as lastTime by component expr splunk_server event_message - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `splunk_dos_using_malformed_saml_request_filter`' -how_to_implement: To run this search, you must have access to the _internal index. -known_false_positives: This search will show false positives. The analyst must look - for errors and a pointer indicating a malicious file. -references: -- https://advisory.splunk.com/advisories/SVD-2023-0802 -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 30 - impact: 50 - message: Possible DoS attack against Splunk Server $splunk_server$ - mitre_attack_id: - - T1498 - observable: - - name: splunk_server - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - required_fields: - - component - - expr - - host - - event_message - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1498/splunk/splunk_dos_using_malformed_saml_request_splunkd.log - source: splunkd.log - sourcetype: splunkd - custom_index: _internal diff --git a/detections/application/splunk_dos_via_dump_spl_command.yml b/detections/application/splunk_dos_via_dump_spl_command.yml deleted file mode 100644 index 837837033e..0000000000 --- a/detections/application/splunk_dos_via_dump_spl_command.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Splunk DOS Via Dump SPL Command -id: fb0e6823-365f-48ed-b09e-272ac4c1dad6 -version: 2 -date: '2024-05-03' -author: Rod Soto -status: production -type: Hunting -data_source: -- Splunk -description: The following analytic identifies a potential Denial of Service (DoS) - attack exploiting the dump SPL command in vulnerable Splunk Enterprise versions. - It detects this activity by searching the `splunk_crash_log` for segmentation fault - entries, indicating a crash of the Splunk daemon. This activity is significant for - a SOC because it can disrupt the availability of Splunk services, impacting monitoring - and incident response capabilities. If confirmed malicious, this attack could render - Splunk Enterprise unusable, severely hindering an organization's ability to detect - and respond to other security threats. -search: '`splunk_crash_log` "*Segmentation fault*" | stats count by host _time | `splunk_dos_via_dump_spl_command_filter`' -how_to_implement: This search does not require additional ingestion of data. Requires - the ability to search _internal index and monitor segmentation faults. -known_false_positives: Segmentation faults may occur due to other causes, so this - search may produce false positives -references: -- https://advisory.splunk.com/ -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - atomic_guid: [] - confidence: 100 - impact: 100 - message: Possible denial of service attack with Victim $host$ - mitre_attack_id: - - T1499.004 - observable: - - name: host - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - risk_score: 100 - required_fields: - - host - - source - - event_message - - status - - _time - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499.004/splunk/splunk_dos_via_dump_spl_command.log - source: /opt/splunk/var/log/splunk/splunkd.log - sourcetype: splunkd_crash_log - custom_index: _internal diff --git a/detections/application/splunk_dos_via_malformed_s2s_request.yml b/detections/application/splunk_dos_via_malformed_s2s_request.yml deleted file mode 100644 index a195ee0823..0000000000 --- a/detections/application/splunk_dos_via_malformed_s2s_request.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Splunk DoS via Malformed S2S Request -id: fc246e56-953b-40c1-8634-868f9e474cbd -version: 3 -date: '2024-05-27' -author: Lou Stella, Splunk -status: production -type: TTP -description: The following analytic identifies attempts to exploit a Denial of Service - (DoS) vulnerability in the Splunk-to-Splunk (S2S) protocol by detecting malformed - S2S requests. It leverages `splunkd` logs, specifically looking for "ERROR" level - logs from the "TcpInputProc" component with the thread name "FwdDataReceiverThread" - and the message "Invalid _meta atom." This activity is significant as it targets - a known vulnerability that could disrupt Splunk services. If confirmed malicious, - this could lead to service outages, impacting the availability and reliability of - Splunk for monitoring and analysis. -data_source: -- Splunk -search: '`splunkd` log_level="ERROR" component="TcpInputProc" thread_name="FwdDataReceiverThread" - "Invalid _meta atom" | table host, src | `splunk_dos_via_malformed_s2s_request_filter`' -how_to_implement: This detection does not require you to ingest any new data. The - detection does require the ability to search the _internal index. This detection - will only find attempted exploitation on versions of Splunk already patched for - CVE-2021-3422. -known_false_positives: None. -references: -- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 100 - cve: - - CVE-2021-3422 - impact: 50 - message: An attempt to exploit CVE-2021-3422 was detected from $src$ against $host$ - mitre_attack_id: - - T1498 - observable: - - name: host - type: Hostname - role: - - Victim - - name: src - type: IP Address - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - host - - src - - log_level - - component - - thread_name - risk_score: 50 - security_domain: threat -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1498/splunk_indexer_dos/splunkd.log - source: /opt/splunk/var/log/splunk/splunkd.log - sourcetype: splunkd - update_timestamp: true - custom_index: _internal diff --git a/detections/application/splunk_dos_via_post_request_datamodel_endpoint.yml b/detections/application/splunk_dos_via_post_request_datamodel_endpoint.yml deleted file mode 100644 index 8a6bc12244..0000000000 --- a/detections/application/splunk_dos_via_post_request_datamodel_endpoint.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Splunk DoS via POST Request Datamodel Endpoint -id: 45766810-dbb2-44d4-b889-b4ba3ee0d1f5 -version: 1 -status: production -date: '2024-07-01' -author: Rod Soto -type: Hunting -data_source: [] -description: The following is a hunting search that allows investigation of error messages indicating Splunk HTTP engine shutdown as a result of a crafted posted request against '/datamodel/model' endpoint. -search: >- - `splunkd_webs` log_level=INFO message="ENGINE: HTTP Server cherrypy._cpwsgi_server.CPWSGIServer(('127.0.0.1', 8065)) shut down" - | stats count min(_time) as firstTime max(_time) as lastTime by splunk_server message - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `splunk_dos_via_post_request_datamodel_endpoint_filter` -how_to_implement: Need access to the internal indexes. -known_false_positives: This is a hunting search and will produce false positives as other causes can also shut down splunk HTTP engine, however this denial of service error is associated to a request to the datamodel/model endpoing which operator can research and find proximity of request and message in logs. -references: -- https://advisory.splunk.com/advisories/SVD-2024-0710 -cve: -- CVE-2024-36986 -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Splunk Server - cis20: - - CIS 3 - - CIS 5 - - CIS 16 - confidence: 50 - impact: 100 - kill_chain_phases: - - Exploitation - message: Possible Denial of Service attack against $splunk_server$ - mitre_attack_id: - - T1499 - nist: - - DE.CM - observable: - - name: splunk_server - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - required_fields: - - UPDATE - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk/SVD-2024-0710_web_service_splunk_web_service.log - source: /opt/splunk/var/log/splunk/web_service.log - sourcetype: splunk_web_service - custom_index: _internal \ No newline at end of file diff --git a/detections/application/splunk_dos_via_printf_search_function.yml b/detections/application/splunk_dos_via_printf_search_function.yml deleted file mode 100644 index 2b7d790800..0000000000 --- a/detections/application/splunk_dos_via_printf_search_function.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Splunk DOS via printf search function -id: 78b48d08-075c-4eac-bd07-e364c3780867 -version: 2 -date: '2024-05-25' -author: Rod Soto, Eric McGinnis, Splunk -status: production -type: Hunting -data_source: -- Splunk -description: The following analytic identifies the use of the `printf` SPL function - in Splunk searches, which can be exploited for a denial of service (DoS) attack. - It detects this activity by querying the `audit_searches` data source for specific - patterns involving `makeresults`, `eval`, `fieldformat`, and `printf` functions, - excluding searches by the `splunk_system_user`. This activity is significant because - it targets a known vulnerability in Splunk Enterprise versions lower than 8.1.14, - 8.2.12, 9.0.6, and 9.1.1, potentially disrupting the availability of the Splunk - instance. If confirmed malicious, this could lead to service outages and impact - the monitoring and logging capabilities of the organization. -search: '`audit_searches` "*makeresults * eval * fieldformat *printf*" user!="splunk_system_user" - search!="*audit_searches*" | stats count by user splunk_server host search | convert - ctime(*time) |`splunk_dos_via_printf_search_function_filter`' -how_to_implement: This search requires the ability to search internal indexes. -known_false_positives: This search may produces false positives, analyst most focuse - in the use of printf conversion function of eval to craft an expression that splunkd - cannot interpret correctly causing it to crash. -references: -- https://advisory.splunk.com/ -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 100 - impact: 100 - message: Possible denial of service attack against $host$ - cve: - - CVE-2023-40594 - mitre_attack_id: - - T1499.004 - observable: - - name: host - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 100 - required_fields: - - user - - splunk_server - - host - - search - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499.004/splunk/splunk_printf_abuse.log - source: audittrail - sourcetype: audittrail - custom_index: _audit diff --git a/detections/application/splunk_edit_user_privilege_escalation.yml b/detections/application/splunk_edit_user_privilege_escalation.yml deleted file mode 100644 index f2dc76e668..0000000000 --- a/detections/application/splunk_edit_user_privilege_escalation.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Splunk Edit User Privilege Escalation -id: 39e1c326-67d7-4c0d-8584-8056354f6593 -version: 2 -date: '2024-05-15' -author: Rod Soto, Chase Franklin -status: production -type: Hunting -data_source: -- Splunk -description: The following analytic identifies attempts by low-privilege users to - escalate their privileges to admin by exploiting the edit_user capability. It detects - this activity by analyzing audit trail logs for specific actions such as "change_own_password" - and "edit_password" where the info field is "granted" and the user is not an admin - or system user. This activity is significant because it indicates potential privilege - escalation, which is a critical security concern. If confirmed malicious, this could - allow an attacker to gain administrative access, leading to full control over the - Splunk environment and potential data breaches. -search: '`audittrail` action IN ("change_own_password","password_change","edit_password") - AND info="granted" AND NOT user IN (admin, splunk-system-user) | stats earliest(_time) - as event_time values(index) as index values(sourcetype) as sourcetype values(action) - as action values(info) as info by user | `splunk_edit_user_privilege_escalation_filter`' -how_to_implement: This detection does not require you to ingest any new data. The - detection does require the ability to search the _audit index. This detection may - assist in efforts to discover abuse of edit_user privilege. -known_false_positives: This search may produce false positives as password changing - actions may be part of normal behavior. Operator will need to investigate these - actions in order to discern exploitation attempts. -references: -- https://advisory.splunk.com/ -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - atomic_guid: [] - confidence: 80 - impact: 80 - cve: - - CVE-2023-32707 - message: Possible attempt to abuse edit_user function by $user$ - mitre_attack_id: - - T1548 - observable: - - name: user - type: User - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - required_fields: - - user - - action - - info - - _time - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_edit_user_privilege_escalation.log - source: audittrail - sourcetype: audittrail - custom_index: _audit diff --git a/detections/application/splunk_endpoint_denial_of_service_dos_zip_bomb.yml b/detections/application/splunk_endpoint_denial_of_service_dos_zip_bomb.yml deleted file mode 100644 index f3e483dc5d..0000000000 --- a/detections/application/splunk_endpoint_denial_of_service_dos_zip_bomb.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Splunk Endpoint Denial of Service DoS Zip Bomb -id: b237d393-2f57-4531-aad7-ad3c17c8b041 -version: 2 -date: '2024-05-27' -author: Marissa Bower, Rod Soto, Splunk -status: production -type: TTP -description: The following analytic identifies crashes in the Splunk search app caused - by specially crafted ZIP files, affecting Universal Forwarder versions 8.1.11 and - 8.2 versions below 8.2.7.1. It detects this activity by monitoring Universal Forwarder - error logs for specific messages indicating invalid or binary file issues. This - activity is significant because it can disrupt Splunk operations, leading to potential - data loss or monitoring gaps. If confirmed malicious, this attack could result in - a denial of service, hindering the organization's ability to monitor and respond - to other security incidents effectively. -data_source: -- Splunk -search: '`splunkd` component=FileClassifierManager event_message=*invalid* event_message=*binary* - |stats count by host component event_message | `splunk_endpoint_denial_of_service_dos_zip_bomb_filter`' -how_to_implement: Need to monitor Splunkd data from Universal Forwarders. -known_false_positives: This search may reveal non malicious zip files causing errors - as well. -references: -- https://en.wikipedia.org/wiki/ZIP_(file_format) -- https://www.splunk.com/en_us/product-security.html -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 75 - cve: - - CVE-2022-37439 - impact: 100 - message: Potential exposure of environment variables from url embedded in dashboard - mitre_attack_id: - - T1499 - observable: - - name: host - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - source - - component - - event_message - - host - risk_score: 75 - security_domain: threat -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk/splunk_zip_bomb_vulnerability.log - source: /opt/splunkforwarder/var/log/splunk/splunkd.log - sourcetype: splunkd - custom_index: _internal diff --git a/detections/application/splunk_enterprise_kv_store_incorrect_authorization.yml b/detections/application/splunk_enterprise_kv_store_incorrect_authorization.yml deleted file mode 100644 index d9a3f8b1ab..0000000000 --- a/detections/application/splunk_enterprise_kv_store_incorrect_authorization.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Splunk Enterprise KV Store Incorrect Authorization -id: 8f0e8380-a835-4f2b-b749-9ce119364df0 -version: 2 -date: '2024-05-10' -author: Rod Soto, Eric McGinnis, Chase Franklin -status: production -type: Hunting -data_source: -- Splunk -description: The following analytic detects unauthorized attempts to reload Splunk - KV Store collections via the REST API. It leverages internal index logs to identify - POST requests to the `/servicesNS/nobody/search/admin/collections-conf/_reload` - endpoint, focusing on status codes starting with '2'. This activity is significant - as it may indicate improper permission handling, potentially leading to unauthorized - deletion of KV Store collections. If confirmed malicious, this could result in data - loss or unauthorized data manipulation, impacting the integrity and availability - of critical Splunk data. -search: '`splunkda` uri=/servicesNS/nobody/search/admin/collections-conf/_reload status=2* - method="POST" user=* file=_reload | stats count min(_time) as firstTime max(_time) - as lastTime values(status) as status by host clientip file method | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `splunk_enterprise_kv_store_incorrect_authorization_filter`' -how_to_implement: Requires access to internal indexes and REST API enabled instances. -known_false_positives: This is a hunting search and will produce false positives. - Operator must follow results into instances where curl requests coming from actual - users may indicate intent of exploitation. -references: -- https://advisory.splunk.com/advisories/SVD-2024-0105 -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Splunk Server - confidence: 50 - impact: 50 - message: Possible attempt to access KV Store collections at $host$ - mitre_attack_id: - - T1548 - cve: - - CVE-2024-23675 - observable: - - name: host - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Cloud - risk_score: 25 - required_fields: - - uri - - status - - method - - file - - clientip - - host - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_enterprise_kv_store_incorrect_authorization_splunkd_access.log - source: /opt/splunk/var/log/splunk/splunkd_access.log - sourcetype: splunkd_access - custom_index: _internal diff --git a/detections/application/splunk_enterprise_windows_deserialization_file_partition.yml b/detections/application/splunk_enterprise_windows_deserialization_file_partition.yml deleted file mode 100644 index e4a4c772cd..0000000000 --- a/detections/application/splunk_enterprise_windows_deserialization_file_partition.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Splunk Enterprise Windows Deserialization File Partition -id: 947d4d2e-1b64-41fc-b32a-736ddb88ce97 -version: 3 -date: '2024-07-01' -author: Rod Soto, Eric McGinnis, Chase Franklin -status: production -type: TTP -data_source: -- Splunk -description: The following analytic identifies attempts to exploit a deserialization - vulnerability in Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3. It - detects irregular path file executions by analyzing `splunk_python` logs and extracting - file paths and names. This activity is significant because it indicates potential - exploitation of a known vulnerability, which could lead to arbitrary code execution. - If confirmed malicious, an attacker could gain unauthorized access, execute arbitrary - code, and potentially compromise the entire Splunk environment, leading to data - breaches and further system exploitation. -search: '`splunk_python` request_path="/*/app/search/C:\\Program" *strings* | - rex "request_path=(?[^\"]+)" | rex field=file_path "[^\"]+/(?[^\"\''\s/\\\\]+)" - | stats min(_time) as firstTime max(_time) as lastTime values(file_path) as file_path - values(file_name) as file_name by index, sourcetype, host | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `splunk_enterprise_windows_deserialization_file_partition_filter`' -how_to_implement: Requires access to internal indexes. This detection search will - display irregular path file execution, which will display exploit attempts. Only - applies to Microsoft Windows Splunk versions. -known_false_positives: Irregular path with files that may be purposely called for - benign reasons may produce false positives. -references: -- https://advisory.splunk.com/advisories/SVD-2024-0108 -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Splunk Server - confidence: 90 - impact: 100 - message: Possible Windows Deserialization exploitation via irregular path file against - $host$ - mitre_attack_id: - - T1190 - cve: - - CVE-2024-23678 - observable: - - name: host - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - risk_score: 90 - required_fields: - - request_path - - field - - file_name - - host - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/splunk/splunk_enterprise_windows_deserialization_file_partition_splunk_python.log - source: C:\Program File\Splunk\var\log\splunk\python.log - sourcetype: splunk_python - custom_index: _internal diff --git a/detections/application/splunk_es_dos_investigations_manager_via_investigation_creation.yml b/detections/application/splunk_es_dos_investigations_manager_via_investigation_creation.yml deleted file mode 100644 index b4fd15ff4f..0000000000 --- a/detections/application/splunk_es_dos_investigations_manager_via_investigation_creation.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Splunk ES DoS Investigations Manager via Investigation Creation -id: 7f6a07bd-82ef-46b8-8eba-802278abd00e -version: 2 -date: '2024-05-25' -author: Rod Soto, Eric McGinnis, Chase Franklin -status: production -type: TTP -data_source: -- Splunk -description: The following analytic detects the creation of malformed Investigations - in Splunk Enterprise Security (ES) versions lower than 7.1.2, which can lead to - a denial of service (DoS). It leverages internal Splunk logs, specifically monitoring - the `splunkd_investigation_rest_handler` with error statuses during investigation - creation. This activity is significant as it can disrupt the functionality of the - Investigations manager, hindering incident response efforts. If confirmed malicious, - this could prevent security teams from accessing critical investigation data, severely - impacting their ability to manage and respond to security incidents effectively. -search: '`splunkd_investigation_rest_handler` method=put msg=*investigation* status=error - | stats count min(_time) as firstTime max(_time) as lastTime by user host method - msg | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | - `splunk_es_dos_investigations_manager_via_investigation_creation_filter`' -how_to_implement: This search requires access to internal indexes. Only affects Splunk - Enterprise Security versions lower than 7.1.2. -known_false_positives: The vulnerability requires an authenticated session and access - to create an Investigation. It only affects the availability of the Investigations - manager, but without the manager, the Investigations functionality becomes unusable - for most users. This search gives the exact offending event. -references: -- https://advisory.splunk.com/advisories/SVD-2024-0102 -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 100 - impact: 100 - message: Denial of Service Attack against Splunk ES Investigation Manager by $user$ - cve: - - CVE-2024-22165 - mitre_attack_id: - - T1499 - observable: - - name: user - type: User - role: - - Victim - - name: host - type: Hostname - role: - - Victim - product: - - Splunk Enterprise Security - risk_score: 100 - required_fields: - - method - - msg - - status - - user - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk/splunk_cve_2024_22165_investigation_rest_handler.log - source: /opt/splunk/var/log/splunk/investigation_handler.log - sourcetype: investigation_rest_handler - custom_index: _internal diff --git a/detections/application/splunk_es_dos_through_investigation_attachments.yml b/detections/application/splunk_es_dos_through_investigation_attachments.yml deleted file mode 100644 index 4cb6dfc441..0000000000 --- a/detections/application/splunk_es_dos_through_investigation_attachments.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Splunk ES DoS Through Investigation Attachments -id: bb85b25e-2d6b-4e39-bd27-50db42edcb8f -version: 2 -date: '2024-05-29' -author: Rod Soto, Eric McGinnis, Chase Franklin -status: production -type: TTP -data_source: -- Splunk -description: The following analytic detects attempts to perform a denial of service - (DoS) attack through investigation attachments in Splunk Enterprise Security (ES) - versions below 7.1.2. It leverages internal Splunk logs, specifically monitoring - the `splunkd_investigation_rest_handler` for error statuses related to investigation - objects. This activity is significant because it can render the Investigation feature - inaccessible, disrupting incident response and forensic analysis. If confirmed malicious, - this attack could prevent security teams from effectively managing and investigating - security incidents, leading to prolonged exposure and potential data breaches. -search: '`splunkd_investigation_rest_handler` status=error object=investigation | - stats min(_time) as firstTime max(_time) as lastTime values(status) as status values(msg) - as msg values(id) as investigation_id by user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `splunk_es_dos_through_investigation_attachments_filter`' -how_to_implement: This search requires access to internal indexes, only affects Enterprise - Security versions below 7.1.2. -known_false_positives: This search will show the exact DoS event via error message - and investigation id. The error however does not point exactly at the uploader as - any users associated with the investigation will be affected. Operator must investigate - using investigation id the possible origin of the malicious upload. Attack only - affects specific investigation not the investigation manager. -references: -- https://advisory.splunk.com/advisories/SVD-2024-0101 -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 100 - impact: 100 - cve: - - CVE-2024-22164 - message: Denial of Service detected at Splunk ES affecting $user$ - mitre_attack_id: - - T1499 - observable: - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise Security - risk_score: 100 - required_fields: - - user - - status - - msg - - id - - object - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk/splunk_cve_2024_22164_investigation_rest_handler.log - source: /opt/splunk/var/log/splunk/investigation_handler.log - sourcetype: investigation_rest_handler - custom_index: _internal diff --git a/detections/application/splunk_http_response_splitting_via_rest_spl_command.yml b/detections/application/splunk_http_response_splitting_via_rest_spl_command.yml deleted file mode 100644 index 283e7c0c90..0000000000 --- a/detections/application/splunk_http_response_splitting_via_rest_spl_command.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Splunk HTTP Response Splitting Via Rest SPL Command -id: e615a0e1-a1b2-4196-9865-8aa646e1708c -version: 2 -date: '2024-05-27' -author: Rod Soto, Chase Franklin -status: production -type: Hunting -data_source: -- Splunk -description: The following analytic identifies attempts to exploit an HTTP response - splitting vulnerability via the rest SPL command in Splunk. It detects this activity - by analyzing audit logs for specific search commands that include REST methods like - POST, PUT, PATCH, or DELETE. This behavior is significant because it indicates a - potential attempt to access restricted REST endpoints, which could lead to unauthorized - access to sensitive information. If confirmed malicious, this activity could allow - an attacker to access restricted content, such as password files, by injecting commands - into HTTP requests. -search: '`audit_searches` AND search IN ("*|*rest*POST*","*|*rest*PUT*","*|*rest*PATCH*","*|*rest*DELETE*") - AND NOT search="*audit_searches*" | table user info has_error_msg search _time | - `splunk_http_response_splitting_via_rest_spl_command_filter`' -how_to_implement: This detection does not require you to ingest any new data. The - detection does require the ability to search the _audit index. This search may assist - in detecting possible http response splitting exploitation attemptss. -known_false_positives: This search may have produce false positives as malformed or - erroneous requests made to this endpoint may be executed willingly or erroneously - by operators. -references: -- https://advisory.splunk.com/ -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - atomic_guid: [] - confidence: 50 - impact: 50 - message: Suspicious access by $user$ - mitre_attack_id: - - T1027.006 - observable: - - name: user - type: URL String - role: - - Victim - product: - - Splunk Enterprise - risk_score: 25 - required_fields: - - search - - testing_endpoint - - info - - has_error_msg - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027.006/splunk/splunk_http_response_splitting_via_rest_spl_command.log - source: audittrail - sourcetype: audittrail - custom_index: _audit diff --git a/detections/application/splunk_improperly_formatted_parameter_crashes_splunkd.yml b/detections/application/splunk_improperly_formatted_parameter_crashes_splunkd.yml deleted file mode 100644 index a3d3ea9d91..0000000000 --- a/detections/application/splunk_improperly_formatted_parameter_crashes_splunkd.yml +++ /dev/null @@ -1,53 +0,0 @@ -name: Splunk Improperly Formatted Parameter Crashes splunkd -id: 08978eca-caff-44c1-84dc-53f17def4e14 -version: 2 -date: '2024-05-14' -author: Chase Franklin, Rod Soto, Splunk -status: experimental -type: TTP -description: The following analytic detects the execution of improperly formatted - INGEST_EVAL parameters in Splunk Enterprise, which can crash the splunkd service. - It leverages the Splunk_Audit.Search_Activity datamodel to identify ad-hoc searches - containing specific keywords. This activity is significant because it can disrupt - Splunk operations, leading to potential data loss and service downtime. If confirmed - malicious, an attacker could exploit this to cause a denial of service, impacting - the availability and reliability of the Splunk environment. -data_source: [] -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Splunk_Audit.Search_Activity where (Search_Activity.search="*makeresults*"AND - Search_Activity.search="*ingestpreview*transforms*") Search_Activity.search_type=adhoc - Search_Activity.search!="*splunk_improperly_formatted_parameter_crashes_splunkd_filter*" - Search_Activity.user!=splunk-system-user by Search_Activity.search, Search_Activity.info, - Search_Activity.total_run_time, Search_Activity.user, Search_Activity.search_type - | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)` | - `security_content_ctime(lastTime)` | `splunk_improperly_formatted_parameter_crashes_splunkd_filter`' -how_to_implement: Requires access to audittrail and use of Splunk_Audit.Search_Activity - datamodel. -known_false_positives: This is a hunting search it should be focused on affected products, - otherwise it is likely to produce false positives. -references: -- https://www.splunk.com/en_us/product-security.html -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 100 - cve: - - CVE-2023-22941 - impact: 100 - message: An attempt to exploit ingest eval parameter was detected from $user$ - mitre_attack_id: - - T1499 - observable: - - name: user - type: User - role: - - Attacker - product: - - Splunk Enterprise - required_fields: - - user - - count - - info - risk_score: 100 - security_domain: threat diff --git a/detections/application/splunk_information_disclosure_in_splunk_add_on_builder.yml b/detections/application/splunk_information_disclosure_in_splunk_add_on_builder.yml deleted file mode 100644 index 89b6401a59..0000000000 --- a/detections/application/splunk_information_disclosure_in_splunk_add_on_builder.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Splunk Information Disclosure in Splunk Add-on Builder -id: b7b82980-4a3e-412e-8661-4531d8758735 -version: 2 -date: '2024-05-20' -author: Rod Soto, Eric McGinnis -status: production -type: Hunting -data_source: -- Splunk -description: The following analytic identifies the presence of vulnerable versions - of Splunk Add-on Builder (below 4.1.4) that write sensitive information to internal - log files. It uses REST API queries to check installed app versions and flags those - below the secure threshold. This activity is significant because it exposes sensitive - data, which could be exploited by attackers. If confirmed malicious, this vulnerability - could lead to unauthorized access to sensitive information, compromising the security - and integrity of the Splunk environment. Immediate updates to version 4.1.4 or higher - are recommended. -search: '| rest /services/apps/local | search disabled=0 core=0 label="Splunk Add-on - Builder" | dedup label | search version < 4.1.4 | eval WarningMessage="Splunk Add-on - Builder Versions older than v4.1.4 contain a critical vulnerability. Update to Splunk - Add-on Builder v4.1.4 or higher immediately. For more information about this vulnerability, - please refer to https://advisory.splunk.com/advisories/SVD-2024-0111" | table label - version WarningMessage | `splunk_information_disclosure_in_splunk_add_on_builder_filter`' -how_to_implement: This search should be run on search heads where Splunk Add-on Builder - may be installed. The results of this search will conclusively show whether or - not a vulnerable version of Splunk Add-on Builder is currently installed. -known_false_positives: This search is highly specific for vulnerable versions of Splunk - Add-on Builder. There are no known false positives. -references: -- https://advisory.splunk.com/advisories/SVD-2024-0111 -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Splunk Server - confidence: 100 - impact: 100 - message: Vulnerable $version$ of Splunk Add-on Builder found - Upgrade Immediately. - mitre_attack_id: - - T1082 - observable: - - name: version - type: Other - role: - - Other - product: - - Splunk Enterprise - risk_score: 100 - required_fields: - - disabled - - core - - version - - label - security_domain: endpoint - manual_test: This search uses a REST call against a running Splunk instance to fetch - the versions of installed apps. It cannot be replicated with a normal test or - attack data. - diff --git a/detections/application/splunk_information_disclosure_on_account_login.yml b/detections/application/splunk_information_disclosure_on_account_login.yml deleted file mode 100644 index a517fdaecd..0000000000 --- a/detections/application/splunk_information_disclosure_on_account_login.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Splunk Information Disclosure on Account Login -id: 2bae5d19-6d1b-4db0-82ab-0af5ac5f836c -version: 1 -date: '2024-07-01' -author: Rod Soto -status: production -type: Hunting -data_source: -- Splunk -description: This is a composed hunting search that looks for possible user enumeration attempts when SAML is enabled on a Splunk instance by capturing different responses from server. -search: '`splunkd` component=UiAuth status=failure action=login TcpChannelThread - | stats count min(_time) as firstTime max(_time) as lastTime by user status action clientip - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `splunk_information_disclosure_on_account_login_filter`' -how_to_implement: Requires access to internal indexes _internal. -known_false_positives: This is a hunting search and requires operator to search for large number of login failures from several users indicating possible user enumeration attempts. May capture genuine login failures. -references: -- https://advisory.splunk.com/SVD-2024-0716 -cve: -- CVE-2024-36996 -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Splunk Server - cis20: - - CIS 3 - - CIS 5 - - CIS 16 - confidence: 50 - impact: 10 - kill_chain_phases: - - Exploitation - message: Possible user enumeration attack against $clientip$ - mitre_attack_id: - - T1087 - nist: - - DE.CM - observable: - - name: clientip - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - required_fields: - - user - - action - - status - - clientip - - host - risk_score: 5 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087/splunk/SVD-2024-0716_splunkd_splunkd.log - source: /opt/splunk/var/log/splunk/splunkd.log - sourcetype: splunkd - custom_index: _internal \ No newline at end of file diff --git a/detections/application/splunk_list_all_nonstandard_admin_accounts.yml b/detections/application/splunk_list_all_nonstandard_admin_accounts.yml deleted file mode 100644 index ef97675e46..0000000000 --- a/detections/application/splunk_list_all_nonstandard_admin_accounts.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Splunk list all nonstandard admin accounts -id: 401d689c-8596-4c6b-a710-7b6fdca296d3 -version: 2 -date: '2024-05-21' -author: Rod Soto -status: experimental -type: Hunting -description: 'The following analytic identifies nonstandard Splunk accounts with administrative - rights on the instance, excluding the default admin account. It uses REST API calls - to retrieve user data and filters for accounts with admin capabilities. This activity - is significant as unauthorized admin accounts can indicate potential security breaches - or misconfigurations. If confirmed malicious, attackers could leverage these accounts - to execute commands, escalate privileges, or persist within the environment, posing - a significant risk to the integrity and security of the Splunk instance.' -data_source: -- Splunk -search: '| rest splunk_server=local /services/authentication/users |search capabilities=admin* - OR imported_capabilities=admin* title!=admin | table title roles capabilities splunk_server - | `splunk_list_all_nonstandard_admin_accounts_filter`' -how_to_implement: The user running this search is required to have a permission allowing - them to dispatch REST requests to indexers (the `dispatch_rest_to_indexers` capability) - in some architectures. If there have been admin account, in addition to the standard - admin account, intentionally created on this server, then edit the filter macro - to exclude them. -known_false_positives: It is not possible to discern from the user table whether or - not users with admin rights have been created intentionally, accidentally, or as - a result of exploitation. Each user with these rights should be investigated and, - if legitimate, added to the filter macro above. If a user is not believed to be - legitimate, then further investigation should take place. -references: -- https://www.splunk.com/en_us/product-security.html -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 50 - cve: - - CVE-2023-22933 - impact: 50 - message: Potential stored XSS attempt from $host$ - mitre_attack_id: - - T1189 - observable: - - name: splunk_server - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - capabilities - - splunk_server - - title - risk_score: 25 - security_domain: endpoint diff --git a/detections/application/splunk_low_privilege_user_can_view_hashed_splunk_password.yml b/detections/application/splunk_low_privilege_user_can_view_hashed_splunk_password.yml deleted file mode 100644 index e58f7adafe..0000000000 --- a/detections/application/splunk_low_privilege_user_can_view_hashed_splunk_password.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Splunk Low Privilege User Can View Hashed Splunk Password -id: a1be424d-e59c-4583-b6f9-2dcc23be4875 -version: 2 -date: '2024-05-29' -author: Rod Soto, Eric McGinnis, Chase Franklin -status: production -type: Hunting -data_source: -- Splunk -description: The following analytic identifies low-privilege users attempting to view - hashed Splunk passwords by querying the conf-user-seed REST endpoint. It leverages - data from the `splunkd_web` logs, specifically monitoring access to the conf-user-seed - endpoint. This activity is significant because it can indicate an attempt to escalate - privileges by obtaining hashed credentials, potentially leading to admin account - takeover. If confirmed malicious, this could allow an attacker to gain administrative - control over the Splunk instance, compromising the entire environment's security. -search: '`splunkd_web` uri="*/servicesNS/nobody/system/configs/conf-user-seed*" | - stats earliest(_time) as event_time values(method) as method values(status) as status - values(clientip) as clientip values(useragent) as useragent values(file) as file - by user | convert ctime(*time) | `splunk_low_privilege_user_can_view_hashed_splunk_password_filter`' -how_to_implement: This detection does not require you to ingest any new data. The - detection does require the ability to search the _audit index. This detection may - assist in efforts to discover attempts to access con-user-seed file content. -known_false_positives: This search may produce false positives as accounts with high - privileges may access this file. Operator will need to investigate these actions - in order to discern exploitation attempts. -references: -- https://advisory.splunk.com/ -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - atomic_guid: [] - confidence: 90 - impact: 90 - message: Attempt to access Splunk hashed password file from $clientip$ - mitre_attack_id: - - T1212 - observable: - - name: clientip - type: IP Address - role: - - Attacker - product: - - Splunk Enterprise - risk_score: 81 - required_fields: - - _time - - clientip - - useragent - - file - - user - - method - - status - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/splunk/splunk_low_privilege_user_can_view_hashed_splunk_password.log - source: /opt/splunk/var/log/splunk/web_access.log - sourcetype: splunk_web_access - custom_index: _internal diff --git a/detections/application/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml b/detections/application/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml deleted file mode 100644 index 5ca71945e7..0000000000 --- a/detections/application/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Splunk Path Traversal In Splunk App For Lookup File Edit -id: 8ed58987-738d-4917-9e44-b8ef6ab948a6 -version: 2 -date: '2024-05-22' -author: Rod Soto, Eric McGinnis -status: production -type: Hunting -data_source: -- Splunk -description: The following analytic identifies path traversal attempts in the Splunk - App for Lookup File Editing. It detects specially crafted web requests targeting - lookup files by analyzing the `uri_query` field in the `_internal` index. This activity - is significant because it allows low-privilege users to read and write to restricted - areas of the Splunk installation directory, potentially accessing sensitive files - like password hashes. If confirmed malicious, this could lead to unauthorized access, - data breaches, and further exploitation of the Splunk environment. -search: '`splunkda` uri_query=*lookup_file* | table clientip uri_query lookup_file - owner namespace version | stats count by clientip namespace lookup_file uri_query - | `splunk_path_traversal_in_splunk_app_for_lookup_file_edit_filter`' -how_to_implement: This detection does not require you to ingest any new data. The - detection does require the ability to search the _internal index. This detection - is meant for on premise environments, and if executed on internet facing servers - without a WAF may produce a lot of results. This detection will not work against - obfuscated path traversal requests. -known_false_positives: This search may find additional path traversal exploitation - attempts or malformed requests. -references: -- https://advisory.splunk.com/ -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - atomic_guid: [] - confidence: 80 - impact: 50 - message: Path traversal exploitation attempt from $clientip$ - mitre_attack_id: - - T1083 - observable: - - name: clientip - type: IP Address - role: - - Attacker - product: - - Splunk Enterprise - risk_score: 40 - required_fields: - - clientip - - uri_query - - event_message - - lookup_file - - owner - - method - - user - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.log - source: splunkd_access - sourcetype: splunkd_access - custom_index: _internal diff --git a/detections/application/splunk_persistent_xss_via_url_validation_bypass_w_dashboard.yml b/detections/application/splunk_persistent_xss_via_url_validation_bypass_w_dashboard.yml deleted file mode 100644 index 70038513f5..0000000000 --- a/detections/application/splunk_persistent_xss_via_url_validation_bypass_w_dashboard.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Splunk Persistent XSS Via URL Validation Bypass W Dashboard -id: 8a43558f-a53c-4ee4-86c1-30b1e8ef3606 -version: 2 -date: '2024-05-20' -author: Rod Soto -status: production -type: Hunting -data_source: -- Splunk -description: The following analytic detects attempts to bypass URL validation in Splunk - Enterprise versions below 9.0.4, 8.2.10, and 8.1.13 by targeting the vulnerable - bootstrap version 2.3.1. It leverages `splunkd_web` logs, specifically monitoring - GET requests to JavaScript files within the vulnerable bootstrap path. This activity - is significant as it can allow a low-privileged user to perform path traversal, - potentially accessing restricted and confidential information. If confirmed malicious, - this could lead to unauthorized data access and compromise of sensitive information, - including targeting admin users. -search: '`splunkd_web` method=GET uri_path="*bootstrap-2.3.1*" file="*.js" | table - _time clientip uri_path file status | `splunk_persistent_xss_via_url_validation_bypass_w_dashboard_filter`' -how_to_implement: This search does not require additional data to be ingested. This - search requires ability to search _internal index. This search helps discover access - to vulnerable bootstrap versions. -known_false_positives: This search will produce numerous false positives as it shows - ANY accesses to vulnerable bootstrap Javascript files. Accesses to these files - occur during normal Splunk usage. To reduce or eliminate false positives, update - the a version of Splunk which has addressed the vulnerability. -references: -- https://advisory.splunk.com/ -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - atomic_guid: [] - confidence: 20 - impact: 80 - cve: - - CVE-2019-8331 - message: Attempted access to vulnerable bootstrap file by $clientip$ - mitre_attack_id: - - T1189 - observable: - - name: clientip - type: IP Address - role: - - Attacker - product: - - Splunk Enterprise - risk_score: 16 - required_fields: - - file - - uri - - clientip - - user - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_persistent_xss_via_url_validation_bypass_w_dashboard.log - source: /opt/splunk/var/log/splunk/web_access.log - sourcetype: splunk_web_access - custom_index: _internal diff --git a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml deleted file mode 100644 index 522879fb7d..0000000000 --- a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Splunk Process Injection Forwarder Bundle Downloads -id: 8ea57d78-1aac-45d2-a913-0cd603fb6e9e -version: 2 -date: '2024-05-23' -author: Lou Stella, Splunk -status: production -type: Hunting -description: The following analytic identifies unauthorized forwarder bundle downloads - from Splunk Deployment Servers. It leverages native Splunk logs, specifically the - `splunkd` component "PackageDownloadRestHandler," to detect instances where an unauthenticated - client may have downloaded forwarder bundles. This activity is significant because - it could indicate a potential security breach, allowing unauthorized access to sensitive - configurations and applications. If confirmed malicious, an attacker could gain - insights into the deployment server's environment, potentially leading to further - exploitation or lateral movement within the network. -data_source: -- Splunk -search: '`splunkd` component="PackageDownloadRestHandler" | stats values(app) values(serverclass) - by peer, host | `splunk_process_injection_forwarder_bundle_downloads_filter`' -how_to_implement: This hunting search uses native logs produced when a deployment - server is within your environment. Splunk SOAR customers can find a SOAR workbook - that walks an analyst through the process of running these hunting searches in the - references list of this detection. In order to use this workbook, a user will need - to run a curl command to post the file to their SOAR instance such as "curl -u username:password - https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". - A user should then create an empty container or case, attach the workbook, and begin - working through the tasks. -known_false_positives: None at this time. -references: -- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html -- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 70 - cve: - - CVE-2022-32157 - impact: 50 - message: $peer$ downloaded apps from $host$ - mitre_attack_id: - - T1055 - observable: - - name: host - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - component - - app - - serverclass - - peer - - host - risk_score: 35 - security_domain: threat -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/splunk_ds/splunkd.log - source: /opt/splunk/var/log/splunk/splunkd.log - sourcetype: splunkd - update_timestamp: false - custom_index: _internal diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml deleted file mode 100644 index 0af3c5f19f..0000000000 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ /dev/null @@ -1,74 +0,0 @@ -name: Splunk Protocol Impersonation Weak Encryption Configuration -id: 900892bf-70a9-4787-8c99-546dd98ce461 -version: 2 -date: '2024-05-28' -author: Lou Stella, Splunk -status: production -type: Hunting -description: The following analytic identifies weak encryption configurations in Splunk - related to TLS validation within the httplib and urllib Python libraries. It uses - REST API calls to check specific configuration settings on the search head and its - peers, ensuring compliance with security advisories. This activity is significant - for a SOC as weak encryption can be exploited for protocol impersonation attacks, - leading to unauthorized access. If confirmed malicious, attackers could intercept - and manipulate data, compromising the integrity and confidentiality of the Splunk - environment. -data_source: -- Splunk -search: '| rest /services/server/info | table splunk_server version server_roles | - join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="PythonSslClientConfig" - | table splunk_server sslVerifyServerCert sslVerifyServerName] | join splunk_server - [| rest /servicesNS/nobody/search/configs/conf-web/settings | table splunk_server - serverCert sslVersions] | rename sslVerifyServerCert as "Server.conf:PythonSSLClientConfig:sslVerifyServerCert", - sslVerifyServerName as "Server.conf:PythonSSLClientConfig:sslVerifyServerName", - serverCert as "Web.conf:Settings:serverCert", sslVersions as "Web.conf:Settings:sslVersions" - | `splunk_protocol_impersonation_weak_encryption_configuration_filter`' -how_to_implement: The user running this search is required to have a permission allowing - them to dispatch REST requests to indexers (The `dispatch_rest_to_indexers` capability). - Splunk SOAR customers can find a SOAR workbook that walks an analyst through the - process of running these hunting searches in the references list of this detection. - In order to use this workbook, a user will need to run a curl command to post the - file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template - -d @splunk_psa_0622.json". A user should then create an empty container or case, - attach the workbook, and begin working through the tasks. -known_false_positives: While all of the settings on each device returned by this search - may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY - in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python - configuration. -references: -- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation -- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0601.html -- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 100 - cve: - - CVE-2022-32151 - impact: 50 - message: $splunk_server$ may not be properly validating TLS Certificates - mitre_attack_id: - - T1001.003 - observable: - - name: splunk_server - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - none - risk_score: 50 - security_domain: threat -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log - source: audittrail - sourcetype: audittrail - update_timestamp: true - custom_index: _audit diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml deleted file mode 100644 index 937cee121e..0000000000 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Splunk protocol impersonation weak encryption selfsigned -id: c76c7a2e-df49-414a-bb36-dce2683770de -version: 2 -date: '2024-05-21' -author: Rod Soto, Splunk -status: production -type: Hunting -description: The following analytic identifies the use of Splunk's default self-signed - certificates, which are flagged as insecure. It detects events from the `splunkd` - log where the event message indicates that an X509 certificate should not be used. - This activity is significant because using weak encryption and self-signed certificates - can expose the system to man-in-the-middle attacks and other security vulnerabilities. - If confirmed malicious, attackers could impersonate Splunk services, intercept sensitive - data, and compromise the integrity of the Splunk environment. -data_source: -- Splunk -search: '`splunkd` certificate event_message="X509 certificate* should not be used*" - | stats count by host CN component log_level | `splunk_protocol_impersonation_weak_encryption_selfsigned_filter`' -how_to_implement: Must upgrade to Splunk version 9 and Configure TLS in order to apply - this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst - through the process of running these hunting searches in the references list of - this detection. In order to use this workbook, a user will need to run a curl command - to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template - -d @splunk_psa_0622.json". A user should then create an empty container or case, - attach the workbook, and begin working through the tasks. -known_false_positives: This searches finds self signed certificates issued by Splunk - which are not recommended from Splunk version 9 forward. -references: -- https://www.splunk.com/en_us/product-security -- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation -- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 80 - cve: - - CVE-2022-32152 - impact: 50 - message: Splunk default issued certificate at $host$ - mitre_attack_id: - - T1588.004 - observable: - - name: host - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - host - - CN - - event_message - risk_score: 40 - security_domain: threat -tests: -- name: True Positive Test - attack_data: - - data: - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splunk_protocol_impersonation_weak_encryption_selfsigned.txt - source: /opt/splun/var/log/splunk/splunkd.log - sourcetype: splunkd - custom_index: _internal diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml deleted file mode 100644 index 9bb646dc3c..0000000000 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Splunk protocol impersonation weak encryption simplerequest -id: 839d12a6-b119-4d44-ac4f-13eed95412c8 -version: 2 -date: '2024-05-23' -author: Rod Soto, Splunk -status: production -type: Hunting -description: The following analytic identifies instances where Splunk's Python3 client - libraries fail to validate SSL certificates properly. It leverages logs from `splunk_python` - to detect when "simpleRequest SSL certificate validation is enabled without hostname - verification." This activity is significant because improper SSL certificate validation - can expose the system to man-in-the-middle attacks, allowing attackers to intercept - or alter data. If confirmed malicious, this vulnerability could lead to unauthorized - access, data breaches, and potential system compromise. Upgrading to Splunk version - 9 and configuring TLS hostname validation is recommended to mitigate this risk. -data_source: -- Splunk -search: '`splunk_python` "simpleRequest SSL certificate validation is enabled without - hostname verification" | stats count by host path | `splunk_protocol_impersonation_weak_encryption_simplerequest_filter`' -how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation - for Splunk Python modules in order to apply this search. Splunk SOAR customers can - find a SOAR workbook that walks an analyst through the process of running these - hunting searches in the references list of this detection. In order to use this - workbook, a user will need to run a curl command to post the file to their SOAR - instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template - -d @splunk_psa_0622.json". A user should then create an empty container or case, - attach the workbook, and begin working through the tasks. -known_false_positives: This search tries to address validation of server and client - certificates within Splunk infrastructure, it might produce results from accidental - or unintended requests to port 8089. -references: -- https://www.splunk.com/en_us/product-security -- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation -- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 80 - cve: - - CVE-2022-32152 - impact: 50 - message: Failed to validate certificate on $host$ - mitre_attack_id: - - T1588.004 - observable: - - name: host - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - host - - event_message - - path - risk_score: 40 - security_domain: threat -tests: -- name: True Positive Test - attack_data: - - data: - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splk_protocol_impersonation_weak_encryption_simplerequest.txt - source: /opt/splunk/var/log/splunk/splunkd.log - sourcetype: splunk_python - custom_index: _internal diff --git a/detections/application/splunk_rbac_bypass_on_indexing_preview_rest_endpoint.yml b/detections/application/splunk_rbac_bypass_on_indexing_preview_rest_endpoint.yml deleted file mode 100644 index 03859d0886..0000000000 --- a/detections/application/splunk_rbac_bypass_on_indexing_preview_rest_endpoint.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Splunk RBAC Bypass On Indexing Preview REST Endpoint -id: bbe26f95-1655-471d-8abd-3d32fafa86f8 -version: 2 -date: '2024-05-15' -author: Rod Soto -status: production -type: Hunting -data_source: -- Splunk -description: The following analytic identifies unauthorized attempts to use the /services/indexing/preview - REST endpoint in Splunk. It detects POST requests to this endpoint by monitoring - the _internal index for specific URI patterns. This activity is significant because - it indicates a potential RBAC (Role-Based Access Control) bypass, allowing unauthorized - users to overwrite search results if they know the search ID (SID) of an existing - job. If confirmed malicious, this could lead to data manipulation, unauthorized - access to sensitive information, and compromised integrity of search results. -search: '`splunkda` method="POST" uri="*/services/indexing/preview*" | table host - clientip status useragent user uri_path | `splunk_rbac_bypass_on_indexing_preview_rest_endpoint_filter`' -how_to_implement: This search does not require additional data ingestion. It requires - the ability to search _internal index. -known_false_positives: This is a hunting search which provides verbose results against - this endpoint. Operator must consider things such as IP address, useragent and user(specially - low privelege) and host to investigate possible attack. -references: -- https://advisory.splunk.com/ -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - atomic_guid: [] - confidence: 50 - impact: 30 - message: Review $clientip$ access to indexing preview endpoint from low privilege - user - mitre_attack_id: - - T1134 - observable: - - name: clientip - type: IP Address - role: - - Attacker - product: - - Splunk Enterprise - risk_score: 15 - required_fields: - - host - - clientip - - status - - useragent - - user - - uri_path - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134/splunk/splunk_rbac_bypass_on_indexing_preview_rest_endpoint.log - source: splunkd_access.log - sourcetype: splunkd_access - custom_index: _internal diff --git a/detections/application/splunk_rce_pdfgen_render.yml b/detections/application/splunk_rce_pdfgen_render.yml deleted file mode 100644 index cc3cb6a0d0..0000000000 --- a/detections/application/splunk_rce_pdfgen_render.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Splunk RCE PDFgen Render -id: bc2b7437-0400-438b-9537-21ab5b7d2d53 -version: 1 -date: '2024-07-01' -status: production -author: Rod Soto, Chase Franklin -type: TTP -data_source: -- Splunk -description: This is a hunting search designed to find and discover exploitation attempts against Splunk pdfgen render endpoint which results in remote -search: 'index=_internal sourcetype=splunk_pdfgen _raw IN ("*base64*", "*lambda*", "*system*") - | stats count min(_time) as firstTime max(_time) as lastTime by index, sourcetype, host, _raw - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `splunk_rce_pdfgen_render_filter`' -how_to_implement: Requires access to internal indexes. -known_false_positives: This search will hunt for exploitation attempts against Splunk PDFgen render function, and not all requests are necesarily malicious so there will be false positives. -references: -- https://advisory.splunk.com/advisories/SVD-2024-0701 -cve: -- CVE-2024-36982 -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Splunk Server - cis20: - - CIS 3 - - CIS 5 - - CIS 16 - confidence: 100 - impact: 80 - kill_chain_phases: - - Exploitation - message: Possible exploitation against $host$ - mitre_attack_id: - - T1210 - nist: - - DE.CM - observable: - - name: host - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - required_fields: - - host - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/SVD-2024-0701_pdfgen_log_splunk_pdfgen.log - source: /opt/splunk/var/log/splunk/pdfgen.log - sourcetype: splunk_pdfgen - custom_index: _internal - diff --git a/detections/application/splunk_rce_via_external_lookup_copybuckets.yml b/detections/application/splunk_rce_via_external_lookup_copybuckets.yml deleted file mode 100644 index 33011e33fd..0000000000 --- a/detections/application/splunk_rce_via_external_lookup_copybuckets.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Splunk RCE via External Lookup Copybuckets -id: 8598f9de-bba8-42a4-8ef0-12e1adda4131 -version: 1 -date: '2024-07-01' -status: production -author: Rod Soto, Chase Franklin -type: Hunting -data_source: -- Splunk -description: The following detection provides the ability to detect remote code execution attempts against a script named copybuckets present within the splunk_archiver application by calling this script as an external lookup. -search: 'index=_internal sourcetype="splunk_archiver-too_small" *.csv - | rex field=_raw "Invoking command:\s(?.*)" - | stats min(_time) as firstTime max(_time) as lastTime values(command) as command values(severity) as severity by host - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `splunk_rce_via_external_lookup_copybuckets_filter`' -how_to_implement: Requires access to internal indexes -known_false_positives: An operator must identify elements indicatives of command execution requests by looking at regex data being extracted from the log. Not all the requests will be malicious. -references: -- https://advisory.splunk.com/advisories/SVD-2024-0705 -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Splunk Server - cis20: - - CIS 3 - - CIS 5 - - CIS 16 - confidence: 100 - impact: 80 - kill_chain_phases: - - Exploitation - message: Possible exploitation attempt against $host$ - mitre_attack_id: - - T1210 - nist: - - DE.CM - observable: - - name: host - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - required_fields: - - host - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/SVD-2024-0705_splunk_archiver_splunk_archiver-too_small.log - source: /opt/splunk/var/log/splunk/splunk_archiver.log - sourcetype: splunk_archiver-too_small - update_timestamp: true - custom_index: _internal \ No newline at end of file diff --git a/detections/application/splunk_rce_via_serialized_session_payload.yml b/detections/application/splunk_rce_via_serialized_session_payload.yml deleted file mode 100644 index e7e417f810..0000000000 --- a/detections/application/splunk_rce_via_serialized_session_payload.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Splunk RCE via Serialized Session Payload -id: d1d8fda6-874a-400f-82cf-dcbb59d8e4db -version: 2 -date: '2024-05-26' -author: Chase Franklin, Rod Soto, Eric McGinnis, Splunk -status: production -type: Hunting -description: The following analytic detects the execution of a specially crafted query - using the 'collect' SPL command in Splunk Enterprise versions lower than 8.2.12, - 9.0.6, and 9.1.1. It leverages audit logs to identify searches containing both 'makeresults' - and 'collect' commands. This activity is significant because it can indicate an - attempt to serialize untrusted data, potentially leading to arbitrary code execution. - If confirmed malicious, this could allow an attacker to execute code within the - Splunk environment, leading to unauthorized access and control over the system. -data_source: -- Splunk -search: '`audit_searches` file=* (search="*makeresults*" AND search="*collect*") | - stats count min(_time) as firstTime max(_time) as lastTime by action file user splunk_server - search | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `splunk_rce_via_serialized_session_payload_filter`' -how_to_implement: Requires access to the _audit index. -known_false_positives: There are numerous many uses of the 'makeresults' and 'collect' - SPL commands. Please evaluate the results of this search for potential abuse. -references: -- https://www.splunk.com/en_us/product-security.html -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 50 - cve: - - CVE-2023-40595 - impact: 50 - message: Potential abuse of the 'collect' SPL command against $splunk_server$ by - detected by $user$ - mitre_attack_id: - - T1190 - observable: - - name: user - type: User - role: - - Attacker - - name: splunk_server - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - search - - info - - user - - search_type - - count - risk_score: 25 - security_domain: threat -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/splunk/splunk_rce_via_serialized_session_payload_audittrail.log - source: audittrail - sourcetype: audittrail - custom_index: _audit diff --git a/detections/application/splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature.yml b/detections/application/splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature.yml deleted file mode 100644 index 0786aaca54..0000000000 --- a/detections/application/splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Splunk RCE via Splunk Secure Gateway Splunk Mobile alerts feature -id: baa41f09-df48-4375-8991-520beea161be -version: 2 -date: '2024-05-16' -author: Rod Soto -status: production -type: Hunting -description: The following analytic identifies potential exploitation attempts against - the Splunk Secure Gateway App's Mobile Alerts feature in Splunk versions 9.0, 8.2.x, - and 8.1.x. It detects suspicious activity by monitoring requests to the mobile alerts - endpoint using specific URI paths and query parameters. This activity is significant - because an authenticated user could exploit this vulnerability to execute arbitrary - operating system commands remotely. If confirmed malicious, this could lead to unauthorized - code execution, compromising the integrity and security of the Splunk environment. -data_source: -- Splunk -search: '`splunkda` uri_path="/servicesNS/nobody/splunk_secure_gateway/storage/collections/data/mobile_alerts*" - sort="notification.created_at:-1" | table clientip file host method uri_query sort - | `splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature_filter`' -how_to_implement: This search only applies if Splunk Mobile Gateway is deployed in - the vulnerable Splunk versions. -known_false_positives: This detection does not require you to ingest any new data. - The detection does require the ability to search the _internal index. Focus of this - search is - "uri_path=/servicesNS/nobody/splunk_secure_gateway/storage/collections/data/mobile_alerts*" - which is the injection point. -references: -- https://www.splunk.com/en_us/product-security.html -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 90 - cve: - - CVE-2022-43567 - impact: 90 - message: Possible exploitation attempt from $clientip$ - mitre_attack_id: - - T1210 - observable: - - name: clientip - type: IP Address - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - uri_path - - clientip - - file - - host - - method - - sort - risk_score: 81 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/splunk_rce_via_secure_gateway_splunk_mobile_alerts_feature.txt - source: /opt/splunk/var/log/splunk/splunkd_access.log - sourcetype: splunkd_access - custom_index: _internal - update_timestamp: true diff --git a/detections/application/splunk_rce_via_user_xslt.yml b/detections/application/splunk_rce_via_user_xslt.yml deleted file mode 100644 index f6bd1063f7..0000000000 --- a/detections/application/splunk_rce_via_user_xslt.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Splunk RCE via User XSLT -id: 6cb7e011-55fb-48e3-a98d-164fa854e37e -version: 2 -date: '2024-05-16' -author: Marissa Bower, Chase Franklin, Rod Soto, Bhavin Patel, Eric McGinnis, Splunk -status: production -type: Hunting -data_source: [] -description: The following analytic identifies potential remote code execution (RCE) - attempts via user-supplied Extensible Stylesheet Language Transformations (XSLT) - in Splunk versions 9.1.x. It detects this activity by analyzing `splunkd_ui` logs - for specific URI patterns and status codes indicative of XSLT injection attempts. - This activity is significant because successful exploitation could allow an attacker - to execute arbitrary code on the Splunk server. If confirmed malicious, this could - lead to full system compromise, unauthorized data access, and further lateral movement - within the network. -search: '`splunkd_ui` ((uri="*NO_BINARY_CHECK=1*" AND "*input.path=*.xsl*") OR uri="*dispatch*.xsl*") - AND uri!= "*splunkd_ui*" | rex field=uri "(?=\s*([\S\s]+))" | eval decoded_field=urldecode(string) - | eval action=case(match(status,"200"),"Allowed",match(status,"303|500|401|403|404|301|406"),"Blocked",1=1,"Unknown") - | stats count min(_time) as firstTime max(_time) as lastTime by clientip useragent - uri decoded_field action host | rename clientip as src, uri as dest_uri | iplocation - src | fillnull value="N/A" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | table firstTime, lastTime src, useragent, action, count, Country, Region, City, dest_uri, decoded_field - | `splunk_rce_via_user_xslt_filter`' -how_to_implement: This detection does not require you to ingest any new data. The - detection does require the ability to search the _internal index. -known_false_positives: This search will provide information for investigation and - hunting possible abuse of user-supplied XSLT. There may be false positives and results - should individually evaluated. Please evaluate the source IP and useragent responsible - for creating the requests. -references: -- https://advisory.splunk.com/advisories/SVD-2023-1104 -cve: -- CVE-2023-46214 -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 80 - impact: 80 - message: Potential Remote Code Execution via XLST from $src$ using useragent - $useragent$ - mitre_attack_id: - - T1210 - observable: - - name: src - type: IP Address - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - required_fields: - - uri - - clientip - - useragent - - action - - host - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/splunk_rce_via_user_xslt_splunkd_ui_access.log - source: /opt/splunk/var/log/splunk/splunkd_ui_access.log - sourcetype: splunkd_ui_access - custom_index: _internal diff --git a/detections/application/splunk_reflected_xss_in_the_templates_lists_radio.yml b/detections/application/splunk_reflected_xss_in_the_templates_lists_radio.yml deleted file mode 100644 index e0f74708a6..0000000000 --- a/detections/application/splunk_reflected_xss_in_the_templates_lists_radio.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Splunk Reflected XSS in the templates lists radio -id: d532d105-c63f-4049-a8c4-e249127ca425 -version: 2 -date: '2024-05-23' -author: Rod Soto, Chase Franklin -status: production -type: Hunting -description: The following analytic identifies potential reflected cross-site scripting - (XSS) attempts in Splunk versions below 8.1.12, 8.2.9, and 9.0.2. It detects when - a query parameter with `output_mode=radio` is used in a URI, leveraging `splunkd_webx` - logs with status 200 and non-null URI queries. This activity is significant as it - can indicate an attempt to exploit a known vulnerability, potentially allowing attackers - to execute arbitrary JavaScript in the context of the user's browser. If confirmed - malicious, this could lead to unauthorized actions, data theft, or further compromise - of the affected Splunk instance. -data_source: -- Splunk -search: '`splunkd_webx` user=admin status=200 uri=*/lists/entities/x/ui/views* uri_query!=null - | stats count earliest(_time) as event_time values(status) as status values(clientip) - as clientip by index, sourcetype, _time, host, user, uri | `splunk_reflected_xss_in_the_templates_lists_radio_filter`' -how_to_implement: This vulnerability only affects instances with Splunk Web enabled. - This detection does not require you to ingest any new data. The detection does require - the ability to search the _internal index. -known_false_positives: This search may produce false positives as it is difficult - to pinpoint all possible XSS injection characters in a single search string. Special - attention is required to "en-US/list/entities/x/ui/views" which is the vulnerable - injection point. -references: -- https://research.splunk.com/stories/splunk_vulnerabilities/ -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 50 - cve: - - CVE-2022-43568 - impact: 50 - message: Potential XSS exploitation against radio template by $user$ - mitre_attack_id: - - T1189 - observable: - - name: user - type: User - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - host - - clientip - - status - - user - - uri - - uri_query - - uri_path - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_reflected_xss_in_templates_lists_radio.txt - source: /opt/splunk/var/log/splunk/web_access.log - sourcetype: splunk_web_access - custom_index: _internal - update_timestamp: true diff --git a/detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml b/detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml deleted file mode 100644 index 012f3aa620..0000000000 --- a/detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Splunk Reflected XSS on App Search Table Endpoint -id: 182f9080-4137-4629-94ac-cb1083ac981a -version: 2 -date: '2024-05-23' -author: Rod Soto -status: production -type: Hunting -data_source: -- Splunk -description: The following analytic identifies attempts to exploit a reflected cross-site - scripting (XSS) vulnerability on the app search table endpoint in Splunk Enterprise - versions below 9.1.1, 9.0.6, and 8.2.12. It detects this activity by analyzing web - request logs for specific dataset commands (`makeresults`, `count`, `eval`, `baseSPL`) - within the `splunkd_web` index. This activity is significant because successful - exploitation can lead to the execution of arbitrary commands on the Splunk platform, - potentially compromising the entire instance. If confirmed malicious, attackers - could gain unauthorized access, execute arbitrary code, and manipulate data within - the Splunk environment. -search: '`splunkd_web` (dataset_commands="*makeresults*" AND dataset_commands="*count*" - AND dataset_commands="*eval*" AND dataset_commands="*baseSPL*") | stats count min(_time) - as firstTime max(_time) as lastTime by clientip status user view root uri_path | - `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `splunk_reflected_xss_on_app_search_table_endpoint_filter`' -how_to_implement: Need access to the internal indexes. -known_false_positives: This search will produce false positives. It is necessary to - also look at uri_query parameter to determine the possible malicious intention of - inserting makeresults within the uri string. -references: -- https://advisory.splunk.com/advisories/SVD-2023-0801 -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 40 - impact: 30 - message: Possible XSS attack against from $user$ - mitre_attack_id: - - T1189 - observable: - - name: user - type: User - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 12 - required_fields: - - dataset_commands - - clientip - - status - - user - - view - - root - - uri_path - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_reflected_xss_on_app_search_table_endpoint_splunk_web_access.log - source: web_access.log - sourcetype: splunk_web_access - custom_index: _internal diff --git a/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml b/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml deleted file mode 100644 index 2bdba936e6..0000000000 --- a/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml +++ /dev/null @@ -1,101 +0,0 @@ -name: Splunk risky Command Abuse disclosed february 2023 -id: ee69374a-d27e-4136-adac-956a96ff60fd -version: 4 -date: '2024-07-01' -author: Chase Franklin, Rod Soto, Eric McGinnis, Splunk -status: production -type: Hunting -description: The following analytic identifies the execution of high-risk commands - associated with various Splunk vulnerability disclosures. It leverages the Splunk_Audit.Search_Activity - datamodel to detect ad-hoc searches by non-system users that match known risky commands. - This activity is significant for a SOC as it may indicate attempts to exploit known - vulnerabilities within Splunk, potentially leading to unauthorized access or data - exfiltration. If confirmed malicious, this could allow attackers to execute arbitrary - code, escalate privileges, or persist within the environment, posing a severe threat - to the organization's security posture. -data_source: -- Splunk -search: '| tstats fillnull_value="N/A" count min(_time) as firstTime max(_time) as - lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search_type=adhoc - Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info - Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type - | `drop_dm_object_name(Search_Activity)` | lookup splunk_risky_command splunk_risky_command - as search output splunk_risky_command description vulnerable_versions CVE other_metadata - | where splunk_risky_command != "false" | `security_content_ctime(firstTime)` | - `security_content_ctime(lastTime)` | `splunk_risky_command_abuse_disclosed_february_2023_filter`' -how_to_implement: Requires implementation of Splunk_Audit.Search_Activity datamodel. -known_false_positives: This search encompasses many commands. -references: -- https://advisory.splunk.com/advisories -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Splunk Server - confidence: 50 - cve: - - CVE-2023-22931 - - CVE-2023-22934 - - CVE-2023-22935 - - CVE-2023-22936 - - CVE-2023-22939 - - CVE-2023-22940 - - CVE-2023-40598 - - CVE-2023-40598 - - CVE-2023-46214 - - CVE-2024-23676 - - CVE-2024-36984 - impact: 50 - message: Use of risky splunk command $splunk_risky_command$ detected by $user$ - mitre_attack_id: - - T1548 - - T1202 - observable: - - name: user - type: User - role: - - Attacker - - name: splunk_risky_command - type: Other - role: - - Other - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - search - - info - - user - - search_type - - count - risk_score: 25 - security_domain: threat -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_createrss_command_abuse.log - source: audittrail - sourcetype: audittrail - custom_index: _audit -- name: True Positive Test runshellscript abuse - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_runshellscript_abuse.log - source: audittrail - sourcetype: audittrail - custom_index: _audit -- name: True Positive Test Additional runshellscript abuse - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/splunk/splunk_cmd_injection_using_external_lookups_audittrail.log - source: audittrail - sourcetype: audittrail - custom_index: _audit -- name: True Positive Test mrollup abuse - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/splunk/splunk_mrollup_abuse_audittrail.log - source: audittrail - sourcetype: audittrail - custom_index: _audit diff --git a/detections/application/splunk_stored_xss_conf_web_settings_on_premises.yml b/detections/application/splunk_stored_xss_conf_web_settings_on_premises.yml deleted file mode 100644 index 5138e9dde6..0000000000 --- a/detections/application/splunk_stored_xss_conf_web_settings_on_premises.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Splunk Stored XSS conf-web Settings on Premises -id: ed1209ef-228d-4dab-9856-be9369925a5c -version: 1 -date: '2024-07-01' -author: Rod Soto, Chase Franklin -status: production -type: Hunting -data_source: -- Splunk -description: This hunting detection provides information on exploitation of stored XSS against /configs/conf-web/settings by an admin level user. -search: '`splunk_python` *script* *eval* - | stats min(_time) as firstTime max(_time) as lastTime by index, sourcetype, host - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `splunk_stored_xss_conf_web_settings_on_premises_filter`' -how_to_implement: Requires access to internal indexes. -known_false_positives: This is a hunting search and will produce false positives, operator must identify XSS elemetns in the splunk_python log related to the vulnerable endpoint. -references: -- https://advisory.splunk.com/advisories/SVD-2024-0717 -cve: -- CVE-2024-36987 -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Splunk Server - cis20: - - CIS 3 - - CIS 5 - - CIS 16 - confidence: 100 - impact: 20 - kill_chain_phases: - - Exploitation - message: Possible XSS attack against $host$ - mitre_attack_id: - - T1189 - nist: - - DE.CM - observable: - - name: host - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - required_fields: - - UPDATE - risk_score: 20 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/SVD-2024-0717_python_log_splunk_python.log - source: /opt/splunk/var/log/splunk/python.log - sourcetype: splunk_python - custom_index: _internal - diff --git a/detections/application/splunk_stored_xss_via_data_model_objectname_field.yml b/detections/application/splunk_stored_xss_via_data_model_objectname_field.yml deleted file mode 100644 index aa8e2659ec..0000000000 --- a/detections/application/splunk_stored_xss_via_data_model_objectname_field.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Splunk Stored XSS via Data Model objectName Field -id: 062bff76-5f9c-496e-a386-cb1adcf69871 -version: 3 -date: '2024-07-01' -author: Rod Soto -status: production -type: Hunting -description: The following analytic identifies attempts to exploit a stored cross-site - scripting (XSS) vulnerability in Splunk Enterprise via the Data Model object name - field. It detects this activity by analyzing web access logs (`splunkd_webx`) for - specific URI patterns and non-null query parameters. This activity is significant - because it allows authenticated users to inject and store malicious scripts, leading - to persistent XSS attacks. If confirmed malicious, this could enable attackers to - execute arbitrary scripts in the context of other users, potentially leading to - data theft, session hijacking, or further compromise of the Splunk environment. -data_source: -- Splunk -search: '`splunkd_webx` uri=/*/splunkd/__raw/servicesNS/*/launcher/datamodel/model* - uri_query!=null | stats count by _time host status clientip user uri | `splunk_stored_xss_via_data_model_objectname_field_filter`' -how_to_implement: This vulnerability only affects Splunk Web enabled instances. This - detection does not require you to ingest any new data. The detection does require - the ability to search the _internal index. -known_false_positives: This search may produce false positives and does not cover - exploitation attempts via code obfuscation, focus of search is suspicious requests - against "/en-US/splunkd/__raw/servicesNS/*/launcher/datamodel/model" which is the - injection point. -references: -- https://advisory.splunk.com/advisories/SVD-2022-1109 -- https://portswigger.net/web-security/cross-site-scripting/cheat-sheet -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 50 - cve: - - CVE-2022-43569 - impact: 50 - message: A potential XSS attempt has been detected from $user$ - mitre_attack_id: - - T1189 - observable: - - name: user - type: User - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - uri - - uri_query - - host - - status - - clientip - - user - - uri_path - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_stored_xss_via_data_model_objectname_field.txt - source: /opt/splunk/var/log/splunk/web_access.log - sourcetype: splunk_web_access - custom_index: _internal - update_timestamp: true diff --git a/detections/application/splunk_stored_xss_via_specially_crafted_bulletin_message.yml b/detections/application/splunk_stored_xss_via_specially_crafted_bulletin_message.yml deleted file mode 100644 index ce34029438..0000000000 --- a/detections/application/splunk_stored_xss_via_specially_crafted_bulletin_message.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Splunk Stored XSS via Specially Crafted Bulletin Message -id: fd852b27-1882-4505-9f2c-64dfb96f4fc1 -version: 1 -date: '2024-07-01' -author: Rod Soto -status: production -type: Hunting -data_source: -- Splunk -description: The following hunting detection provides fields related to /service/messages endpoints where specially crafted bulletin message can exploit stored XSS. -search: '| rest /services/messages - | search message="*http*" - | table id author message title - | `splunk_stored_xss_via_specially_crafted_bulletin_message_filter`' -how_to_implement: Need access to Splunk REST api data via search. -known_false_positives: Must look at messages field and find malicious suspicious characters or hyperlinks. Not all requests to this endpoint will be malicious. -references: -- https://advisory.splunk.com/SVD-2024-0713 -cve: -- CVE-2024-36993 -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Splunk Server - cis20: - - CIS 3 - - CIS 5 - - CIS 16 - confidence: 50 - impact: 10 - kill_chain_phases: - - Exploitation - message: Please investigate $message for possible XSS attack in bulletin message $message$ - mitre_attack_id: - - T1189 - nist: - - DE.CM - observable: - - name: message - type: Other - role: - - Other - product: - - Splunk Enterprise - required_fields: - - table - - id - - author - - message - - title - risk_score: 5 - security_domain: endpoint - manual_test: This search uses a REST call against a running Splunk instance to fetch - messages that have been created on the instance. It cannot be replicated with a normal test or - attack data as this data cannot be "replayed" into a Splunk instance. -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/SVD-2024-0713_json_json.log - source: _json - sourcetype: _json - custom_index: _internal diff --git a/detections/application/splunk_unauthenticated_dos_via_null_pointer_references.yml b/detections/application/splunk_unauthenticated_dos_via_null_pointer_references.yml deleted file mode 100644 index 07b080a9fc..0000000000 --- a/detections/application/splunk_unauthenticated_dos_via_null_pointer_references.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Splunk Unauthenticated DoS via Null Pointer References -id: d67594fe-c317-41b8-9319-ec8428d5c2ea -version: 1 -date: '2024-07-01' -author: Rod Soto -status: production -type: Hunting -data_source: -- Splunk -description: The following hunting search provides information on splunkd crash as a result of a Denial of Service Exploitation via null pointer references which targets 'services/cluster/config' endpoint. -search: '`splunk_crash_log` "Segmentation fault" "POST /services/cluster/config" - | stats count min(_time) as firstTime max(_time) as lastTime by host - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `splunk_unauthenticated_dos_via_null_pointer_references_filter`' -how_to_implement: Requires access to internal indexes. -known_false_positives: This is a hunting search and will produce false positives. An operator needs to find proximity and detail of requests targeting cluster config endpoint and subsequent Segmentation fault in splunk crash log. -references: -- https://advisory.splunk.com/advisories/SVD-2024-0702 -cve: -- CVE-2024-36983 -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Splunk Server - cis20: - - CIS 3 - - CIS 5 - - CIS 16 - confidence: 50 - impact: 100 - kill_chain_phases: - - Exploitation - message: Possible exploitation attack against $host$ - mitre_attack_id: - - T1499 - nist: - - DE.CM - observable: - - name: host - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - required_fields: - - sourcetype - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk/SVD-2024-0702_splunkd_crash_log_splunkd_crash_log.log - source: /opt/splunk/var/log/splunk/crash-*.log - sourcetype: splunkd_crash_log - custom_index: _internal diff --git a/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml b/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml deleted file mode 100644 index b69f9adcfb..0000000000 --- a/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Splunk Unauthenticated Log Injection Web Service Log -id: de3908dc-1298-446d-84b9-fa81d37e959b -version: 2 -date: '2024-05-19' -author: Rod Soto -status: production -type: Hunting -data_source: -- Splunk -description: The following analytic identifies potential log injection attempts into - the Splunk server via specially crafted web URLs. It detects ANSI escape codes within - the `uri_path` field of `splunkd_webx` logs. This activity is significant as it - can lead to log file manipulation, potentially obfuscating malicious actions or - misleading analysts. If confirmed malicious, an attacker could manipulate log files - to hide their tracks or execute further attacks, compromising the integrity of the - logging system and making incident response more challenging. -search: '`splunkd_webx` uri_path IN ("*\x1B*", "*\u001b*", "*\033*", "*\0x9*", "*\0x8*") - | stats count by uri_path method host status clientip | `splunk_unauthenticated_log_injection_web_service_log_filter`' -how_to_implement: This only affects web enabled Splunk instances. The detection does - require the ability to search the _internal index. -known_false_positives: This hunting search will produce false positives if ANSI escape - characters are included in URLs either voluntarily or by accident. This search will - not detect obfuscated ANSI characters. -references: -- https://advisory.splunk.com/advisories/SVD-2023-0606 -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 30 - impact: 30 - message: Possible Splunk unauthenticated log injection web service log exploitation - attempt against $host$ from $clientip$ - cve: - - CVE-2023-32712 - mitre_attack_id: - - T1190 - observable: - - name: host - type: Hostname - role: - - Victim - - name: clientip - type: IP Address - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - required_fields: - - method - - uri_path - - host - - status - - clientip - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/splunk/web_access.log - source: /opt/splunk/var/log/splunk/web_access.log - custom_index: _internal - sourcetype: splunk_web_access - diff --git a/detections/application/splunk_unauthenticated_path_traversal_modules_messaging.yml b/detections/application/splunk_unauthenticated_path_traversal_modules_messaging.yml deleted file mode 100644 index 0a785637a9..0000000000 --- a/detections/application/splunk_unauthenticated_path_traversal_modules_messaging.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Splunk Unauthenticated Path Traversal Modules Messaging -id: e7c2b064-524e-4d65-8002-efce808567aa -version: 1 -date: '2024-07-01' -author: Rod Soto, Chase Franklin -status: production -type: Hunting -data_source: -- Splunk -description: This hunting search provides information on exploitation attempts against /modules/messaging endpoint, the exploit can be clearly seen as the ../ which signals an attempt to traverse target directories. -search: '`splunkd_web` method=GET uri_path="/*/modules/messaging/*..*" - | stats min(_time) as firstTime max(_time) as lastTime values(method) as method values(uri_path) as uri_path by host - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `splunk_unauthenticated_path_traversal_modules_messaging_filter`' -how_to_implement: Only applies to Microsoft Windows installations of Splunk. -known_false_positives: May catch other exploitation attempts using path traversal related characters. -references: -- https://advisory.splunk.com/SVD-2024-0711 -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Splunk Server - cis20: - - CIS 3 - - CIS 5 - - CIS 16 - confidence: 100 - impact: 20 - kill_chain_phases: - - Exploitation - message: Possible directory traversal attack against $host$ - mitre_attack_id: - - T1083 - nist: - - DE.CM - observable: - - name: host - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - required_fields: - - method - - uri_path - - host - risk_score: 20 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/SVD-2024-0711_web_access_splunk_web_access.log - source: C:\\Program Files\\Splunk\\var\\log\\splunk\\web_access.log - sourcetype: splunk_web_access - custom_index: _internal - diff --git a/detections/application/splunk_unauthorized_experimental_items_creation.yml b/detections/application/splunk_unauthorized_experimental_items_creation.yml deleted file mode 100644 index fc8b249333..0000000000 --- a/detections/application/splunk_unauthorized_experimental_items_creation.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Splunk Unauthorized Experimental Items Creation -id: 84afda04-0cd6-466b-869e-70d6407d0a34 -version: 1 -date: '2024-07-01' -author: Rod Soto, Chase Franklin -status: production -type: Hunting -data_source: -- Splunk -description: This hunting search provides information on finding possible creation of unauthorized items against /experimental endpoint. -search: '`splunkda` */experimental/* method=POST - | stats count min(_time) as firstTime max(_time) as lastTime by clientip method uri_path uri status - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `splunk_unauthorized_experimental_items_creation_filter`' -how_to_implement: Requires access to internal indexes. -known_false_positives: Not all requests are going to be malicious, there will be false positives, however operator must find suspicious items that might have been created by an unauthorized user. -references: -- https://advisory.splunk.com/SVD-2024-0715 -cve: -- CVE-2024-36995 -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Splunk Server - cis20: - - CIS 3 - - CIS 5 - - CIS 16 - confidence: 100 - impact: 5 - kill_chain_phases: - - Exploitation - message: Possible unauthorized creation of experimental items from $clientip$ - mitre_attack_id: - - T1189 - nist: - - DE.CM - observable: - - name: clientip - type: IP Address - role: - - Attacker - product: - - Splunk Enterprise - required_fields: - - clientip - - method - - uri_path - - uri - - status - risk_score: 5 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/SVD-2024-0715_splunkd_splunkd_access.log - source: /opt/splunk/var/log/splunk/splunkd_access.log - sourcetype: splunkd_access - custom_index: _internal \ No newline at end of file diff --git a/detections/application/splunk_unauthorized_notification_input_by_user.yml b/detections/application/splunk_unauthorized_notification_input_by_user.yml deleted file mode 100644 index c2338f4b81..0000000000 --- a/detections/application/splunk_unauthorized_notification_input_by_user.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Splunk Unauthorized Notification Input by User -id: 4b7f368f-4322-47f8-8363-2c466f0b7030 -version: 1 -date: '2024-07-01' -author: Rod Soto -status: experimental -type: Hunting -data_source: -- Splunk -description: This hunting search provides information to track possible exploitation of a lower privilege user able to push notifications that may include malicious code as notifications for all users in Splunk. -search: '| rest /services/messages | table title message severity timeCreated_iso published splunk_server author | `splunk_unauthorized_notification_input_by_user_filter`' -how_to_implement: Requires access to Splunk rest data. -known_false_positives: This search will produce false positives which may include benign notifications from other Splunk entities, attention to suspicious or anomalous elements in notifications helps identify actual exploitation of this vulnerability. -references: -- https://advisory.splunk.com/advisories/SVD-2024-0709 -cve: -- CVE-2023-33733 -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Splunk Server - cis20: - - CIS 3 - - CIS 5 - - CIS 16 - confidence: 100 - impact: 20 - kill_chain_phases: - - Exploitation - message: Please review messages at $splunk_server for possible unauthorized notification input. - mitre_attack_id: - - T1548 - nist: - - DE.CM - observable: - - name: splunk_server - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - required_fields: - - message - - title - - splunk_server - - author - risk_score: 12 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/SVD-2024-0709_json_json.json - source: _json - sourcetype: _json - custom_index: _internal - diff --git a/detections/application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml b/detections/application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml deleted file mode 100644 index e54983f982..0000000000 --- a/detections/application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Splunk unnecessary file extensions allowed by lookup table uploads -id: b7d1293f-e78f-415e-b5f6-443df3480082 -version: 2 -date: "2024-05-28" -author: Rod Soto, Splunk -type: TTP -status: production -data_source: -- Splunk -description: The following analytic identifies user activity related to uploading - lookup tables with unnecessary filename extensions in Splunk Enterprise versions - below 8.1.13, 8.2.10, and 9.0.4. It detects this activity by monitoring HTTP methods - (POST, DELETE) and specific URI paths in the internal `splunkd_access` logs. This - behavior is significant because it can indicate attempts to upload potentially malicious - files disguised as lookup tables. If confirmed malicious, this activity could allow - an attacker to execute unauthorized code or manipulate data within the Splunk environment, - leading to potential data breaches or system compromise. -search: '`splunkda` method IN ("POST", "DELETE") uri_path=/servicesNS/*/ui/views/* - | eval activity = case( method=="POST" AND like( uri_path , "%/acl" ) , "Permissions - Update", method=="POST" AND NOT like( uri_path , "%/acl" ) , "Edited" , method=="DELETE" - , "Deleted" ) | rex field=uri_path "(?.*?)\/ui\/views/(?.*)" - | eval dashboard = urldecode( dashboard_encoded ) | table _time, uri_path, user, - dashboard, activity, uri_path | `splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads_filter`' -how_to_implement: Requires access to internal splunkd_access. -known_false_positives: This is a hunting search, the search provides information on - upload, edit, and delete activity on Lookup Tables. Manual investigation is necessary - after executing search. This search will produce false positives as payload cannot - be directly discerned. -references: -- https://www.splunk.com/en_us/product-security.html -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - cve: - - CVE-2023-22937 - confidence: 50 - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.log - impact: 50 - message: Potential lookup template injection attempt from $user$ on lookup table - at path $uri_path$ - mitre_attack_id: - - T1189 - observable: - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - user - - method - - uri_path - risk_score: 25 - security_domain: threat -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.log - source: /opt/splunk/var/log/splunk/splunkd_access.log - sourcetype: splunkd_access - custom_index: _internal diff --git a/detections/application/splunk_user_enumeration_attempt.yml b/detections/application/splunk_user_enumeration_attempt.yml deleted file mode 100644 index d4fcbacb3a..0000000000 --- a/detections/application/splunk_user_enumeration_attempt.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Splunk User Enumeration Attempt -id: 25625cb4-1c4d-4463-b0f9-7cb462699cde -version: 3 -date: '2024-05-21' -author: Lou Stella, Splunk -status: production -type: TTP -description: The following analytic identifies attempts to enumerate usernames in - Splunk by detecting multiple failed authentication attempts from the same source. - It leverages data from the `_audit` index, specifically focusing on failed authentication - events. This activity is significant for a SOC because it can indicate an attacker - trying to discover valid usernames, which is a precursor to more targeted attacks - like password spraying or brute force attempts. If confirmed malicious, this activity - could lead to unauthorized access, compromising the security of the Splunk environment - and potentially exposing sensitive data. -data_source: -- Splunk -search: ' `splunkd_failed_auths` | stats count(user) as auths by user, src | where - auths>5 | stats values(user) as user, sum(auths) as TotalFailedAuths by src | `splunk_user_enumeration_attempt_filter`' -how_to_implement: This detection does not require you to ingest any new data. The - detection does require the ability to search the _audit index. This detection may - assist in efforts to find password spraying or brute force authorization attempts - in addition to someone enumerating usernames. -known_false_positives: Automation executing authentication attempts against your Splunk - infrastructure with outdated credentials may cause false positives. -references: -- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0502.html -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 80 - cve: - - CVE-2021-33845 - impact: 50 - message: $TotalFailedAuths$ failed authentication events to Splunk from $src$ detected. - mitre_attack_id: - - T1078 - observable: - - name: user - type: User - role: - - Victim - - name: src - type: IP Address - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - user - - src - - info - - action - risk_score: 40 - security_domain: access -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/splunkd_auth/audittrail.log - source: audittrail - sourcetype: audittrail - custom_index: _audit diff --git a/detections/application/splunk_xss_in_highlighted_json_events.yml b/detections/application/splunk_xss_in_highlighted_json_events.yml deleted file mode 100644 index 2cf20cfb88..0000000000 --- a/detections/application/splunk_xss_in_highlighted_json_events.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Splunk XSS in Highlighted JSON Events -id: 1030bc63-0b37-4ac9-9ae0-9361c955a3cc -version: 3 -date: '2024-07-01' -author: Rod Soto, Splunk -status: production -type: Hunting -data_source: -- Splunk -description: The following analytic identifies potential exploitation of a Cross-Site - Scripting (XSS) vulnerability in Splunk Enterprise 9.1.2. It detects suspicious - requests to the Splunk web GUI that may execute JavaScript within script tags. This - detection leverages logs from the `splunkd_ui` data source, focusing on specific - URI paths and HTTP methods. This activity is significant as it can allow attackers - to execute arbitrary JavaScript, potentially accessing the API with the logged-in - user's permissions. If the user is an admin, the attacker could create an admin - account, leading to full control over the Splunk environment. -search: '`splunkd_ui` "/*/splunkd/__raw/servicesNS/nobody/search/authentication/users" - status=201 | stats count min(_time) as firstTime max(_time) as lastTime by clientip, - uri_path, method | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `splunk_xss_in_highlighted_json_events_filter`' -how_to_implement: This search only applies to web-GUI-enabled Splunk instances and - operator must have access to internal indexes. -known_false_positives: This is a hunting search and will produce false positives as - it is not possible to view contents of a request payload. It shows the artifact - resulting from a potential exploitation payload (the creation of a user with admin - privileges). -references: -- https://advisory.splunk.com/advisories/SVD-2023-1103 -cve: -- CVE-2023-46213 -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Possible XSS exploitation from $clientip$ - mitre_attack_id: - - T1189 - observable: - - name: clientip - type: IP Address - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - required_fields: - - clientip - - uri_path - - method - - status - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_xss_in_highlighted_json_events_splunkd_ui_access.log - source: splunkd_ui_access.log - sourcetype: splunkd_ui_access - custom_index: _internal diff --git a/detections/application/splunk_xss_in_monitoring_console.yml b/detections/application/splunk_xss_in_monitoring_console.yml deleted file mode 100644 index 33c0828bd7..0000000000 --- a/detections/application/splunk_xss_in_monitoring_console.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Splunk XSS in Monitoring Console -id: b11accac-6fa3-4103-8a1a-7210f1a67087 -version: 2 -date: '2024-05-17' -author: Lou Stella, Splunk -status: experimental -type: TTP -description: The following analytic identifies attempts to exploit a reflective Cross-Site - Scripting (XSS) vulnerability in the Splunk Distributed Monitoring Console app. - It detects GET requests with suspicious query parameters by analyzing `splunkd_web` - logs in the _internal index. This activity is significant because it targets a known - vulnerability (CVE-2022-27183) that could allow attackers to execute arbitrary scripts - in the context of the user's browser. If confirmed malicious, this could lead to - unauthorized actions, data theft, or further compromise of the Splunk environment. -data_source: [] -search: ' `splunkd_web` method="GET" uri_query="description=%3C*" | table _time host - status clientip user uri | `splunk_xss_in_monitoring_console_filter`' -how_to_implement: This detection does not require you to ingest any new data. The - detection does require the ability to search the _internal index. This detection - will find attempted exploitation of CVE-2022-27183. -known_false_positives: Use of the monitoring console where the less-than sign (<) - is the first character in the description field. -references: -- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0505.html -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 80 - cve: - - CVE-2022-27183 - impact: 50 - message: A potential XSS attempt has been detected from $user$ - mitre_attack_id: - - T1189 - observable: - - name: host - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - method - - uri_query - - status - - clientip - - user - - uri - risk_score: 40 - security_domain: threat -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/xss/splunk_web_access.log - source: /opt/splunk/var/log/splunk/web_access.log - sourcetype: splunk_web_access diff --git a/detections/application/splunk_xss_in_save_table_dialog_header_in_search_page.yml b/detections/application/splunk_xss_in_save_table_dialog_header_in_search_page.yml deleted file mode 100644 index 6126206617..0000000000 --- a/detections/application/splunk_xss_in_save_table_dialog_header_in_search_page.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Splunk XSS in Save table dialog header in search page -id: a974d1ee-ddca-4837-b6ad-d55a8a239c20 -version: 3 -date: '2024-07-01' -author: Rod Soto -status: production -type: Hunting -description: The following analytic identifies persistent cross-site scripting (XSS) - attempts in the 'Save Table' dialog on the Splunk search page. It detects POST requests - to the endpoint `/en-US/splunkd/__raw/servicesNS/nobody/search/datamodel/model` - containing potential XSS payloads. This activity is significant because it can allow - a remote user with the "power" role to inject malicious scripts, leading to persistent - XSS vulnerabilities. If confirmed malicious, this could enable attackers to execute - arbitrary scripts in the context of the affected user, potentially leading to data - theft, session hijacking, or further exploitation within the Splunk environment. -data_source: -- Splunk -search: '`splunkd_webx` method=POST uri=/*/splunkd/__raw/servicesNS/nobody/search/datamodel/model - | table _time host status clientip user uri | `splunk_xss_in_save_table_dialog_header_in_search_page_filter`' -how_to_implement: Watch for POST requests combined with XSS script strings or obfuscation - against the injection point /en-US/splunkd/__raw/servicesNS/nobody/search/datamodel/model. -known_false_positives: If host is vulnerable and XSS script strings are inputted they - will show up in search. Not all Post requests are malicious as they will show when - users create and save dashboards. This search may produce several results with non - malicious POST requests. Only affects Splunk Web enabled instances. -references: -- https://advisory.splunk.com/advisories/SVD-2022-1101 -- https://portswigger.net/web-security/cross-site-scripting -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 50 - cve: - - CVE-2022-43561 - impact: 50 - message: Possible XSS exploitation attempt from $clientip$ - mitre_attack_id: - - T1189 - observable: - - name: clientip - type: IP Address - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - host - - _time - - status - - clientip - - user - - uri - - method - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_xss_in_save_table_dialog_in_search_page.txt - source: /opt/splunk/var/log/splunk/web_access.log - sourcetype: splunk_web_access - custom_index: _internal - update_timestamp: true diff --git a/detections/application/splunk_xss_privilege_escalation_via_custom_urls_in_dashboard.yml b/detections/application/splunk_xss_privilege_escalation_via_custom_urls_in_dashboard.yml deleted file mode 100644 index 12a410bbfd..0000000000 --- a/detections/application/splunk_xss_privilege_escalation_via_custom_urls_in_dashboard.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Splunk XSS Privilege Escalation via Custom Urls in Dashboard -id: 01e1e386-7656-4f36-a55a-52fe39b04a96 -version: 1 -date: '2024-07-01' -author: Rod Soto, Chase Franklin -status: production -type: Hunting -data_source: -- Splunk -description: This is a composed hunting search that looks for POST requests to splunk_internal_metrics/data/ui/views which can be used to elevate privileges on the Splunk server via custom urls. The way to find privilege escalation is by looking at created users with high privielges after payload has been executed. This search looks at POST request and then looks at created users privileges. -search: '`splunkd_ui` method=POST /*/data/ui/views* - | stats values(method) as method by _time index, sourcetype, host - | eval event="post_request" - | append - [| search `audittrail` action="edit_user" operation="create" - | rex field=_raw "object=\"(?.*)\"" - | stats count values(operation) as operation values(splunk_server) as splunk_server values(user) as user by _time index, sourcetype, host, newUser - | eval event="create_user"] - | sort - _time - | transaction host startswith=event="post_request" endswith=event="create_user" maxspan=10m - | table _time index, sourcetype, host, method, user, splunk_server, operation, event, newUser eventcount - | `splunk_xss_privilege_escalation_via_custom_urls_in_dashboard_filter`' -how_to_implement: Requires access to internal indexes _audit and _internal. -known_false_positives: This is a hunting search and requires operator to search for specific indicators of user creation in proximity to POST requests against vulnerable endpoint. It is not possible to detect payload during runtime. -references: -- https://advisory.splunk.com/ -cve: -- CVE-2024-36992 -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Splunk Server - cis20: - - CIS 3 - - CIS 5 - - CIS 16 - confidence: 50 - impact: 10 - kill_chain_phases: - - Exploitation - message: Possible XSS attack and privilege escalation via custom urls in dashboard against $host$ - mitre_attack_id: - - T1189 - nist: - - DE.CM - observable: - - name: host - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - required_fields: - - method - - host - - action - - operation - - splunk_server - - user - risk_score: 5 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/SVD-2024-0712_splunkd_ui_access_splunk_ui_access.log - source: /opt/splunk/var/log/splunk/splunkd_ui_access.log - sourcetype: splunkd_ui_access - custom_index: _internal - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/SVD-2024-0712_audittrail_audittrail.log - source: /opt/splunk/var/log/splunk/audittrail - sourcetype: audittrail - custom_index: _audit \ No newline at end of file diff --git a/detections/application/splunk_xss_via_external_urls_in_dashboards_ssrf.yml b/detections/application/splunk_xss_via_external_urls_in_dashboards_ssrf.yml deleted file mode 100644 index 748c034810..0000000000 --- a/detections/application/splunk_xss_via_external_urls_in_dashboards_ssrf.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Splunk XSS Via External Urls in Dashboards SSRF -id: b0a67520-ae82-4cf6-b04e-9f6cce56830d -version: 1 -date: '2024-07-01' -author: Rod Soto, Chase Franklin -status: production -type: Hunting -data_source: -- Splunk -description: This is a hunting search that provides elements to find possible dashboards created with external URL references in order to elicit Server Side Request Forgery from /data/ui/views endpoint. -search: '`splunkd_web` user=* uri_path="/*/manager/permissions/launcher/data/ui/views/*" file=* - | stats count min(_time) as firstTime max(_time) as lastTime by clientip user file host method uri_path uri_query - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `splunk_xss_via_external_urls_in_dashboards_ssrf_filter`' -how_to_implement: Requires access to internal indexes. -known_false_positives: This is a hunting search and requires an operator to search for specific indicators of Server Side Request Forgery attack against /data/ui/views. - It is not possible to grab display the payloads of such requests, so this search provides users, ip addresses, requests, files, and queries that may indicate malicious intent. There will be false positives. -references: -- https://advisory.splunk.com/SVD-2024-0714 -cve: -- CVE-2024-36994 -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Splunk Server - cis20: - - CIS 3 - - CIS 5 - - CIS 16 - confidence: 50 - impact: 10 - kill_chain_phases: - - Exploitation - message: Possible SSRF attack from $clientip$ - mitre_attack_id: - - T1189 - nist: - - DE.CM - observable: - - name: clientip - type: IP Address - role: - - Attacker - product: - - Splunk Enterprise - required_fields: - - uri_path - - user - - file - - clientip - risk_score: 5 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/SVD-2024-0714_web_access_splunk_web_access.log - source: /opt/splunk/var/log/splunk/web_access.log - sourcetype: splunk_web_access - custom_index: _internal \ No newline at end of file diff --git a/detections/application/splunk_xss_via_view.yml b/detections/application/splunk_xss_via_view.yml deleted file mode 100644 index c4271c50a6..0000000000 --- a/detections/application/splunk_xss_via_view.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Splunk XSS via View -id: 9ac2bfea-a234-4a18-9d37-6d747e85c2e4 -version: 2 -date: '2024-05-13' -author: Rod Soto, Eric McGinnis, Splunk -status: production -type: Hunting -description: The following analytic identifies potential Cross-Site Scripting (XSS) - attempts via the 'layoutPanel' attribute in the 'module' tag within XML Views in - Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4. It leverages internal - logs from "splunk_web_service" and "splunk_python" sourcetypes, focusing on messages - containing "loadParams." This activity is significant as it can lead to unauthorized - script execution within the Splunk Web interface, potentially compromising the security - of the instance. If confirmed malicious, attackers could execute arbitrary scripts, - leading to data theft, session hijacking, or further exploitation of the Splunk - environment. -data_source: -- Splunk -search: 'index = _internal sourcetype IN ("splunk_web_service", "splunk_python") message="*loadParams*" - | `security_content_ctime(_time)` | table _time message fileName | `splunk_xss_via_view_filter`' -how_to_implement: This data is collected by default in Splunk. Upon first enabling - this rule, a number of errors may be observed. Those that are due to improperly - formatted, but non-nefarious, XML views should be be remedied in the corresponding - view. Please take care investigating potential XSS as accessing an affected page - could retrigger the exploit. -known_false_positives: The error detected above can be generated for a wide variety - of improperly formatted XML views. There will be false positives as the search - cannot extract the malicious payload and the view should be manually investigated. -references: -- https://www.splunk.com/en_us/product-security.html -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Endpoint - confidence: 50 - cve: - - CVE-2023-22933 - impact: 50 - message: Potential stored XSS attempt via $fileName$ - mitre_attack_id: - - T1189 - observable: - - name: fileName - type: URL String - role: - - Target - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - message - - fileName - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_xss_via_view.log - source: /opt/splunk/var/log/splunk/web_service.log - sourcetype: splunk_web_service - custom_index: _internal diff --git a/detections/deprecated/open_redirect_in_splunk_web.yml b/detections/deprecated/open_redirect_in_splunk_web.yml deleted file mode 100644 index 5cb274e560..0000000000 --- a/detections/deprecated/open_redirect_in_splunk_web.yml +++ /dev/null @@ -1,36 +0,0 @@ -name: Open Redirect in Splunk Web -id: d199fb99-2312-451a-9daa-e5efa6ed76a7 -version: 1 -date: '2017-09-19' -author: Bhavin Patel, Splunk -status: deprecated -type: TTP -description: This search allows you to look for evidence of exploitation for CVE-2016-4859, - the Splunk Open Redirect Vulnerability. -data_source: [] -search: index=_internal sourcetype=splunk_web_access return_to="/%09/*" | `open_redirect_in_splunk_web_filter` -how_to_implement: No extra steps needed to implement this search. -known_false_positives: None identified -references: [] -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Splunk Server - confidence: 50 - cve: - - CVE-2016-4859 - impact: 50 - message: tbd - observable: - - name: field - type: Unknown - role: - - Unknown - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - risk_score: 25 - security_domain: network diff --git a/detections/deprecated/splunk_enterprise_information_disclosure.yml b/detections/deprecated/splunk_enterprise_information_disclosure.yml deleted file mode 100644 index 76e0243b11..0000000000 --- a/detections/deprecated/splunk_enterprise_information_disclosure.yml +++ /dev/null @@ -1,43 +0,0 @@ -name: Splunk Enterprise Information Disclosure -id: f6a26b7b-7e80-4963-a9a8-d836e7534ebd -version: 1 -date: '2018-06-14' -author: David Dorsey, Splunk -status: deprecated -type: TTP -description: This search allows you to look for evidence of exploitation for CVE-2018-11409, - a Splunk Enterprise Information Disclosure Bug. -data_source: [] -search: index=_internal sourcetype=splunkd_ui_access server-info | search clientip!=127.0.0.1 - uri_path="*raw/services/server/info/server-info" | rename clientip as src_ip, splunk_server - as dest | stats earliest(_time) as firstTime, latest(_time) as lastTime, values(uri) - as uri, values(useragent) as http_user_agent, values(user) as user by src_ip, dest - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_enterprise_information_disclosure_filter` -how_to_implement: The REST endpoint that exposes system information is also necessary - for the proper operation of Splunk clustering and instrumentation. Whitelisting - your Splunk systems will reduce false positives. -known_false_positives: Retrieving server information may be a legitimate API request. - Verify that the attempt is a valid request for information. -references: [] -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Splunk Server - confidence: 50 - cve: - - CVE-2018-11409 - impact: 50 - message: tbd - observable: - - name: field - type: Unknown - role: - - Unknown - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - risk_score: 25 - security_domain: network diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml index 1fcf37a45d..9d7d8bc7d4 100644 --- a/detections/endpoint/detect_renamed_psexec.yml +++ b/detections/endpoint/detect_renamed_psexec.yml @@ -1,8 +1,8 @@ name: Detect Renamed PSExec id: 683e6196-b8e8-11eb-9a79-acde48001122 -version: 5 -date: '2024-05-11' -author: Michael Haag, Splunk +version: 6 +date: '2024-07-23' +author: Michael Haag, Splunk, Alex Oberkircher, Github Community status: production type: Hunting description: The following analytic identifies instances where `PsExec.exe` has been @@ -18,7 +18,7 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name!=psexec.exe - OR Processes.process_name!=psexec64.exe) AND Processes.original_file_name=psexec.c + AND Processes.process_name!=psexec64.exe) AND Processes.original_file_name=psexec.c by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/disable_logs_using_wevtutil.yml b/detections/endpoint/disable_logs_using_wevtutil.yml index 958bc5882e..775e2ce23f 100644 --- a/detections/endpoint/disable_logs_using_wevtutil.yml +++ b/detections/endpoint/disable_logs_using_wevtutil.yml @@ -1,7 +1,7 @@ name: Disable Logs Using WevtUtil id: 236e7c8e-c9d9-11eb-a824-acde48001122 -version: 2 -date: '2024-05-13' +version: 3 +date: '2024-07-23' author: Teoderick Contreras, Splunk status: production type: TTP @@ -43,7 +43,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 30 - message: WevtUtil.exe used to disable Event Logging on $dest + message: WevtUtil.exe used to disable Event Logging on $dest$ mitre_attack_id: - T1070 - T1070.001 @@ -75,3 +75,4 @@ tests: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog +# version bumped by pre-commit hook diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index ea2cb2162d..6c8d9b60f5 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -1,7 +1,7 @@ name: Disable Windows Behavior Monitoring id: 79439cae-9200-11eb-a4d3-acde48001122 -version: 6 -date: '2024-05-18' +version: 7 +date: '2024-07-23' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -48,7 +48,7 @@ tags: asset_type: Endpoint confidence: 100 impact: 40 - message: Windows Defender real time behavior monitoring disabled on $dest + message: Windows Defender real time behavior monitoring disabled on $dest$ mitre_attack_id: - T1562.001 - T1562 @@ -78,3 +78,4 @@ tests: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog +# version bumped by pre-commit hook diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml index 464c1c598c..f1e940a766 100644 --- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -23,7 +23,7 @@ search: '`wineventlog_security` EventCode=4663 NOT (ProcessName IN ("*\\chrome.e how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." -known_false_positives: other browser not listed related to firefox may catch by this +known_false_positives: other browser not listed related to chrome may catch by this rule. references: [] tags: diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml index 5560884e3c..14db3eb4de 100644 --- a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml +++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml @@ -1,7 +1,7 @@ name: Remote Process Instantiation via DCOM and PowerShell id: d4f42098-4680-11ec-ad07-3e22fbd008af -version: 2 -date: '2024-05-20' +version: 3 +date: '2024-07-23' author: Mauricio Velazco, Splunk status: production type: TTP @@ -44,7 +44,7 @@ tags: asset_type: Endpoint confidence: 70 impact: 90 - message: A process was started on a remote endpoint from $dest by abusing DCOM using + message: A process was started on a remote endpoint from $dest$ by abusing DCOM using PowerShell.exe mitre_attack_id: - T1021 @@ -80,3 +80,4 @@ tests: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog +# version bumped by pre-commit hook diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml index 91075a26ea..ee7a0dbcfc 100644 --- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml @@ -1,7 +1,7 @@ name: Remote Process Instantiation via WinRM and PowerShell id: ba24cda8-4716-11ec-8009-3e22fbd008af -version: 2 -date: '2024-05-14' +version: 3 +date: '2024-07-23' author: Mauricio Velazco, Splunk status: production type: TTP @@ -44,7 +44,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 90 - message: A process was started on a remote endpoint from $dest by abusing WinRM + message: A process was started on a remote endpoint from $dest$ by abusing WinRM using PowerShell.exe mitre_attack_id: - T1021 @@ -80,3 +80,4 @@ tests: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog +# version bumped by pre-commit hook diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml index c554f403aa..28bf4680c7 100644 --- a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml @@ -1,7 +1,7 @@ name: Remote Process Instantiation via WinRM and Winrs id: 0dd296a2-4338-11ec-ba02-3e22fbd008af -version: 2 -date: '2024-05-16' +version: 3 +date: '2024-07-23' author: Mauricio Velazco, Splunk status: production type: TTP @@ -44,7 +44,7 @@ tags: asset_type: Endpoint confidence: 60 impact: 90 - message: A process was started on a remote endpoint from $dest + message: A process was started on a remote endpoint from $dest$ mitre_attack_id: - T1021 - T1021.006 @@ -79,3 +79,4 @@ tests: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog +# version bumped by pre-commit hook diff --git a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml index 1152dc9b1f..37493db23d 100644 --- a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml +++ b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml @@ -1,7 +1,7 @@ name: Scheduled Task Creation on Remote Endpoint using At id: 4be54858-432f-11ec-8209-3e22fbd008af -version: 2 -date: '2024-05-24' +version: 3 +date: '2024-07-23' author: Mauricio Velazco, Splunk status: production type: TTP @@ -45,7 +45,7 @@ tags: asset_type: Endpoint confidence: 60 impact: 90 - message: A Windows Scheduled Task was created on a remote endpoint from $dest + message: A Windows Scheduled Task was created on a remote endpoint from $dest$ mitre_attack_id: - T1053 - T1053.002 @@ -80,3 +80,4 @@ tests: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/lateral_movement/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog +# version bumped by pre-commit hook diff --git a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml index 6d638b5be3..f33cbf68fa 100644 --- a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml +++ b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml @@ -1,8 +1,8 @@ name: Scheduled Task Initiation on Remote Endpoint id: 95cf4608-4302-11ec-8194-3e22fbd008af -version: 2 -date: '2024-05-25' -author: Mauricio Velazco, Splunk +version: 4 +date: '2024-07-23' +author: Mauricio Velazco, Splunk, Badoodish, Github Community status: production type: TTP description: The following analytic detects the use of 'schtasks.exe' to start a Scheduled @@ -18,7 +18,7 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=schtasks.exe - OR Processes.original_file_name=schtasks.exe) (Processes.process=*/s* AND Processes.process=*/run*) + OR Processes.original_file_name=schtasks.exe) (Processes.process= "* /S *" AND Processes.process=*/run*) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `scheduled_task_initiation_on_remote_endpoint_filter`' @@ -44,7 +44,7 @@ tags: asset_type: Endpoint confidence: 60 impact: 90 - message: A Windows Scheduled Task was ran on a remote endpoint from $dest + message: A Windows Scheduled Task was ran on a remote endpoint from $dest$ mitre_attack_id: - T1053 - T1053.005 @@ -79,3 +79,4 @@ tests: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog +# version bumped by pre-commit hook diff --git a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml index 0be1143257..7ffe52a19a 100644 --- a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml +++ b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml @@ -14,11 +14,11 @@ description: The following analytic detects the addition of permissions required attack, which can be used to replicate AD objects and exfiltrate sensitive data. If confirmed malicious, an attacker could gain extensive access to Active Directory, leading to severe data breaches and privilege escalation. -search: '`wineventlog_security` | rex field=AttributeValue max_match=10000 \"OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;(?PS-1-[0-59]-\d{2}-\d{8,10}-\d{8,10}-\d{8,10}-[1-9]\d{3})\)\"| +search: '`wineventlog_security` | rex field=AttributeValue max_match=10000 "OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;(?PS-1-[0-59]-\d{2}-\d{8,10}-\d{8,10}-\d{8,10}-[1-9]\d{3})\)"| table _time dest src_user DSRGetChanges_user_sid DSRGetChangesAll_user_sid DSRGetChangesFiltered_user_sid| - mvexpand DSRGetChanges_user_sid| eval minDCSyncPermissions=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid,\"true\",\"false\"), - fullSet=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid AND DSRGetChanges_user_sid=DSRGetChangesFiltered_user_sid,\"true\",\"false\")| - where minDCSyncPermissions=\"true\" | lookup identity_lookup_expanded objectSid + mvexpand DSRGetChanges_user_sid| eval minDCSyncPermissions=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid,"true","false"), + fullSet=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid AND DSRGetChanges_user_sid=DSRGetChangesFiltered_user_sid,"true","false")| + where minDCSyncPermissions="true" | lookup identity_lookup_expanded objectSid as DSRGetChanges_user_sid OUTPUT sAMAccountName as user | rename DSRGetChanges_user_sid as userSid | stats min(_time) as _time values(user) as user by dest src_user userSid minDCSyncPermissions fullSet| `windows_ad_domain_replication_acl_addition_filter`' diff --git a/detections/endpoint/windows_new_inprocserver32_added.yml b/detections/endpoint/windows_new_inprocserver32_added.yml index 0b9156b74e..9d0e9c77fb 100644 --- a/detections/endpoint/windows_new_inprocserver32_added.yml +++ b/detections/endpoint/windows_new_inprocserver32_added.yml @@ -1,7 +1,7 @@ name: Windows New InProcServer32 Added id: 0fa86e31-0f73-4ec7-9ca3-dc88e117f1db -version: 2 -date: '2024-05-13' +version: 3 +date: '2024-07-23' author: Michael Haag, Splunk data_source: - Sysmon EventID 13 @@ -57,7 +57,7 @@ tags: risk_score: 2 security_domain: endpoint cve: - - cve-2024-21378 + - CVE-2024-21378 tests: - name: True Positive Test attack_data: @@ -65,3 +65,4 @@ tests: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/cve-2024-21378/inprocserver32_windows-sysmon.log sourcetype: xmlwineventlog source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +# version bumped by pre-commit hook diff --git a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml index 93128bfde8..7b95893fb1 100644 --- a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml +++ b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml @@ -1,7 +1,7 @@ name: Windows Service Creation on Remote Endpoint id: e0eea4fa-4274-11ec-882b-3e22fbd008af -version: 2 -date: '2024-05-21' +version: 3 +date: '2024-07-23' author: Mauricio Velazco, Splunk status: production type: TTP @@ -46,7 +46,7 @@ tags: asset_type: Endpoint confidence: 60 impact: 90 - message: A Windows Service was created on a remote endpoint from $dest + message: A Windows Service was created on a remote endpoint from $dest$ mitre_attack_id: - T1543 - T1543.003 @@ -81,3 +81,4 @@ tests: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog +# version bumped by pre-commit hook diff --git a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml index 2a16dd2861..4eb50b66c0 100644 --- a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml +++ b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml @@ -1,7 +1,7 @@ name: Windows Service Initiation on Remote Endpoint id: 3f519894-4276-11ec-ab02-3e22fbd008af -version: 2 -date: '2024-05-10' +version: 3 +date: '2024-07-23' author: Mauricio Velazco, Splunk status: production type: TTP @@ -43,7 +43,7 @@ tags: asset_type: Endpoint confidence: 60 impact: 90 - message: A Windows Service was started on a remote endpoint from $dest + message: A Windows Service was started on a remote endpoint from $dest$ mitre_attack_id: - T1543 - T1543.003 @@ -78,3 +78,4 @@ tests: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog +# version bumped by pre-commit hook diff --git a/detections/network/splunk_identified_ssl_tls_certificates.yml b/detections/network/splunk_identified_ssl_tls_certificates.yml deleted file mode 100644 index ccf832b111..0000000000 --- a/detections/network/splunk_identified_ssl_tls_certificates.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Splunk Identified SSL TLS Certificates -id: 620fbb89-86fd-4e2e-925f-738374277586 -version: 2 -date: '2024-05-23' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following analytic identifies the usage of Splunk default SSL/TLS - certificates within the environment. It leverages tags such as SSL, TLS, and certificate - to detect these default certificates by examining the ssl_issuer_common_name field. - This activity is significant because using default certificates can expose the environment - to potential security risks, as they are not unique and can be easily exploited. - If confirmed malicious, attackers could intercept or manipulate data, leading to - unauthorized access or data breaches. It is recommended to replace default certificates - with valid, unique TLS certificates to enhance security. -data_source: -- Splunk Stream TCP -search: tag IN (ssl, tls, certificate) ssl_issuer_common_name=*splunk* | stats values(src) - AS "Host(s) with Default Cert" count by ssl_issuer ssl_subject_common_name ssl_subject_organization - ssl_subject host sourcetype | `splunk_identified_ssl_tls_certificates_filter` -how_to_implement: Ingestion of SSL/TLS data is needed and to be tagged properly as - ssl, tls or certificate. This data may come from a proxy, zeek, or Splunk Streams. - Splunk SOAR customers can find a SOAR workbook that walks an analyst through the - process of running these hunting searches in the references list of this detection. - In order to use this workbook, a user will need to run a curl command to post the - file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template - -d @splunk_psa_0622.json". A user should then create an empty container or case, - attach the workbook, and begin working through the tasks. -known_false_positives: False positives will not be present as it is meant to assist - with identifying default certificates being utilized. -references: -- https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL -- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Proxy - confidence: 70 - cve: - - CVE-2022-32151 - - CVE-2022-32152 - impact: 60 - message: The following $host$ is using the self signed Splunk certificate. - mitre_attack_id: - - T1040 - observable: - - name: host - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - ssl_issuer - - ssl_subject_common_name - - ssl_subject_organization - - ssl_subject - - host - - sourcetype - risk_score: 42 - security_domain: network -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1040/ssltls/ssl_splunk.log - source: stream:tcp - sourcetype: stream:tcp - update_timestamp: true diff --git a/dev/endpoint/7zip_commandline_to_smb_share_path.yml b/dev/endpoint/7zip_commandline_to_smb_share_path.yml deleted file mode 100644 index 1029be3c83..0000000000 --- a/dev/endpoint/7zip_commandline_to_smb_share_path.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: 7zip CommandLine To SMB Share Path -id: 01d29b48-ff6f-11eb-b81e-acde48001122 -version: 1 -date: '2021-08-17' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: This search is to detect a suspicious 7z process with commandline pointing - to SMB network share. This technique was seen in CONTI LEAK tools where it use 7z - to archive a sensitive files and place it in network share tmp folder. This search - is a good hunting query that may give analyst a hint why specific user try to archive - a file pointing to SMB user which is un usual. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: 7z.exe - selection2: - Image|endswith: - - 7z.exe - - 7za.exe - selection3: - OriginalFileName: 7za.exe - selection4: - CommandLine: - - '*\\C$\\*' - - '*\\Admin$\\*' - - '*\\IPC$\\*' - condition: (selection1 or selection2 or selection3) and selection4 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed 7z.exe may be used. -known_false_positives: unknown -references: -- https://threadreaderapp.com/thread/1423361119926816776.html -tags: - analytic_story: - - Ransomware - asset_type: Endpoint - confidence: 50 - impact: 50 - message: archive process $process_name$ with suspicious cmdline $process$ in host - $dest$ - mitre_attack_id: - - T1560.001 - - T1560 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: SourceImage - type: Process - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-sysmon_7z.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/active_setup_registry_autostart.yml b/dev/endpoint/active_setup_registry_autostart.yml deleted file mode 100644 index c7d6b9943a..0000000000 --- a/dev/endpoint/active_setup_registry_autostart.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Active Setup Registry Autostart -id: f64579c0-203f-11ec-abcc-acde48001122 -version: 2 -date: '2022-01-26' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to detect a suspicious modification of the active setup - registry for persistence and privilege escalation. This technique was seen in several - malware (poisonIvy), adware and APT to gain persistence to the compromised machine - upon boot up. This TTP is a good indicator to further check the process id that - do the modification since modification of this registry is not commonly done. check - the legitimacy of the file and process involve in this rules to check if it is a - valid setup installer that creating or modifying this registry. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: '*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*' - Registry.registry_value_name: StubPath - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: Active setup installer may add or modify this registry. -references: -- https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3AWin32%2FPoisonivy.E -- https://attack.mitre.org/techniques/T1547/014/ -tags: - analytic_story: - - Windows Persistence Techniques - - Windows Privilege Escalation - - Hermetic Wiper - asset_type: Endpoint - confidence: 80 - impact: 80 - message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ - mitre_attack_id: - - T1547.014 - - T1547 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1547.014/active_setup_stubpath/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/add_defaultuser_and_password_in_registry.yml b/dev/endpoint/add_defaultuser_and_password_in_registry.yml deleted file mode 100644 index 11ddff6a47..0000000000 --- a/dev/endpoint/add_defaultuser_and_password_in_registry.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Add DefaultUser And Password In Registry -id: d4a3eb62-0f1e-11ec-a971-acde48001122 -version: 2 -date: '2022-01-26' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: this search is to detect a suspicious registry modification to implement - auto admin logon to a host. This technique was seen in BlackMatter ransomware to - automatically logon to the compromise host after triggering a safemode boot to - continue encrypting the whole network. This behavior is not a common practice and - really a suspicious TTP or alert need to be consider if found within then network - premise. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: - - DefaultPassword - - DefaultUserName - TargetObject: '*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: unknown -references: -- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ -tags: - analytic_story: - - BlackMatter Ransomware - asset_type: Endpoint - confidence: 50 - impact: 50 - message: modified registry key $registry_key_name$ with registry value $registry_value_name$ - to prepare autoadminlogon - mitre_attack_id: - - T1552.002 - - T1552 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/add_or_set_windows_defender_exclusion.yml b/dev/endpoint/add_or_set_windows_defender_exclusion.yml deleted file mode 100644 index 59c0466560..0000000000 --- a/dev/endpoint/add_or_set_windows_defender_exclusion.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Add or Set Windows Defender Exclusion -id: 773b66fe-4dd9-11ec-8289-acde48001122 -version: 1 -date: '2021-11-25' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic will identify a suspicious process command-line related - to Windows Defender exclusion feature. This command is abused by adversaries, malware - authors and red teams to bypass Windows Defender Antivirus products by excluding - folder path, file path, process and extensions. From its real time or schedule scan - to execute their malicious code. This is a good indicator for defense evasion and - to look further for events after this behavior. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*-exclusion*' - selection2: - CommandLine: - - '*Add-MpPreference *' - - '*Set-MpPreference *' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: Admin or user may choose to use this windows features. Filter - as needed. -references: -- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html -- https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/ -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -tags: - analytic_story: - - Remcos - - Windows Defense Evasion Tactics - - WhisperGate - - CISA AA22-320A - - AgentTesla - asset_type: Endpoint - confidence: 80 - impact: 80 - message: exclusion command $process$ executed on $dest$ - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/defender_exclusion_sysmon/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/allow_file_and_printing_sharing_in_firewall.yml b/dev/endpoint/allow_file_and_printing_sharing_in_firewall.yml deleted file mode 100644 index 7ec19ecfed..0000000000 --- a/dev/endpoint/allow_file_and_printing_sharing_in_firewall.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Allow File And Printing Sharing In Firewall -id: ce27646e-d411-11eb-8a00-acde48001122 -version: 2 -date: '2021-06-23' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious modification of firewall to allow - file and printer sharing. This technique was seen in ransomware to be able to discover - more machine connected to the compromised host to encrypt more files -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: netsh.exe - selection2: - Image|endswith: netsh.exe - selection3: - CommandLine: '*firewall*' - selection4: - CommandLine: '*group=' - condition: (selection1 or selection2) and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: network admin may modify this firewall feature that may cause - this rule to be triggered. -references: -- https://community.fortinet.com:443/t5/FortiEDR/How-FortiEDR-detects-and-blocks-Revil-Ransomware-aka-sodinokibi/ta-p/189638?externalID=FD52469 -- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ -tags: - analytic_story: - - Ransomware - asset_type: Endpoint - confidence: 50 - impact: 50 - message: '' - mitre_attack_id: - - T1562.007 - - T1562 - observable: - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25.0 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/dev/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml deleted file mode 100644 index ce9b69f5b1..0000000000 --- a/dev/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Allow Inbound Traffic By Firewall Rule Registry -id: 0a46537c-be02-11eb-92ca-acde48001122 -version: 3 -date: '2022-07-19' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic detects a potential suspicious modification of firewall - rule registry allowing inbound traffic in specific port with public profile. This - technique was identified when an adversary wants to grant remote access to a machine - by allowing the traffic in a firewall rule. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '*|Action=' - TargetObject: '*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*' - selection2: - Details: '*|Dir=' - selection3: - Details: '*|LPort=' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: network admin may add/remove/modify public inbound firewall - rule that may cause this rule to be triggered. -references: -- https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps -tags: - analytic_story: - - Prohibited Traffic Allowed or Protocol Mismatch - - Windows Registry Abuse - - Azorult - asset_type: Endpoint - confidence: 50 - impact: 50 - message: Suspicious firewall allow rule modifications were detected via the registry - on endpoint $dest$ by user $user$. - mitre_attack_id: - - T1021.001 - - T1021 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/allow_network_discovery_in_firewall.yml b/dev/endpoint/allow_network_discovery_in_firewall.yml deleted file mode 100644 index 31f2980d05..0000000000 --- a/dev/endpoint/allow_network_discovery_in_firewall.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Allow Network Discovery In Firewall -id: ccd6a38c-d40b-11eb-85a5-acde48001122 -version: 2 -date: '2021-06-23' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious modification to the firewall to - allow network discovery on a machine. This technique was seen in couple of ransomware - (revil, reddot) to discover other machine connected to the compromised host to encrypt - more files. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: netsh.exe - selection2: - Image|endswith: netsh.exe - selection3: - CommandLine: '*firewall*' - selection4: - CommandLine: '*group=' - condition: (selection1 or selection2) and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: network admin may modify this firewall feature that may cause - this rule to be triggered. -references: -- https://community.fortinet.com:443/t5/FortiEDR/How-FortiEDR-detects-and-blocks-Revil-Ransomware-aka-sodinokibi/ta-p/189638?externalID=FD52469 -- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ -tags: - analytic_story: - - Ransomware - - Revil Ransomware - asset_type: Endpoint - confidence: 50 - impact: 50 - message: '' - mitre_attack_id: - - T1562.007 - - T1562 - observable: - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25.0 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/allow_operation_with_consent_admin.yml b/dev/endpoint/allow_operation_with_consent_admin.yml deleted file mode 100644 index 90ab546a89..0000000000 --- a/dev/endpoint/allow_operation_with_consent_admin.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Allow Operation with Consent Admin -id: 7de17d7a-c9d8-11eb-a812-acde48001122 -version: 2 -date: '2022-01-26' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic identifies a potential privilege escalation attempt to - perform malicious task. This registry modification is designed to allow the `Consent - Admin` to perform an operation that requires elevation without consent or credentials. - We also found this in some attacker to gain privilege escalation to the compromise - machine. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: ConsentPromptBehaviorAdmin - TargetObject: '*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*' - Details: '0x00000000' - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: unknown -references: -- https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/341747f5-6b5d-4d30-85fc-fa1cc04038d4 -- https://www.trendmicro.com/vinfo/no/threat-encyclopedia/malware/Ransom.Win32.MRDEC.MRA/ -tags: - analytic_story: - - Ransomware - - Windows Registry Abuse - - Azorult - asset_type: Endpoint - confidence: 50 - impact: 50 - message: Suspicious registry modification was performed on endpoint $dest$ by user - $user$. This behavior is indicative of privilege escalation. - mitre_attack_id: - - T1548 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/anomalous_usage_of_7zip.yml b/dev/endpoint/anomalous_usage_of_7zip.yml deleted file mode 100644 index a3752c2383..0000000000 --- a/dev/endpoint/anomalous_usage_of_7zip.yml +++ /dev/null @@ -1,74 +0,0 @@ -name: Anomalous usage of 7zip -id: 9364ee8e-a39a-11eb-8f1d-acde48001122 -version: 1 -date: '2021-04-22' -author: Michael Haag, Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following detection identifies a 7z.exe spawned from `Rundll32.exe` - or `Dllhost.exe`. It is assumed that the adversary has brought in `7z.exe` and `7z.dll`. - It has been observed where an adversary will rename `7z.exe`. Additional coverage - may be required to identify the behavior of renamed instances of `7z.exe`. During - triage, identify the source of injection into `Rundll32.exe` or `Dllhost.exe`. Capture - any files written to disk and analyze as needed. Review parallel processes for additional - behaviors. Typically, archiving files will result in exfiltration. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: '7z.exe' - ParentImage: - - rundll32.exe - - dllhost.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: False positives should be limited as this behavior is not normal - for `rundll32.exe` or `dllhost.exe` to spawn and run 7zip. -references: -- https://attack.mitre.org/techniques/T1560/001/ -- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ -- https://thedfirreport.com/2021/01/31/bazar-no-ryuk/ -tags: - analytic_story: - - Cobalt Strike - - NOBELIUM Group - asset_type: Endpoint - confidence: 80 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading - of 7zip. - mitre_attack_id: - - T1560.001 - - T1560 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/any_powershell_downloadfile.yml b/dev/endpoint/any_powershell_downloadfile.yml deleted file mode 100644 index 40d82cb52d..0000000000 --- a/dev/endpoint/any_powershell_downloadfile.yml +++ /dev/null @@ -1,91 +0,0 @@ -name: Any Powershell DownloadFile -id: 1a93b7ea-7af7-11eb-adb5-acde48001122 -version: 3 -date: '2022-04-07' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the use of PowerShell downloading a - file using `DownloadFile` method. This particular method is utilized in many different - PowerShell frameworks to download files and output to disk. Identify the source - (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell - transaction logs are available, review for further details of the implant. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: pwsh.dll - selection2: - Image|endswith: - - pwsh.exe - - sqlps.exe - - sqltoolsps.exe - - powershell.exe - - powershell_ise.exe - selection3: - OriginalFileName: PowerShell.EXE - selection4: - OriginalFileName: powershell_ise.EXE - selection5: - CommandLine: '*DownloadFile*' - condition: (selection1 or selection2 or selection3 or selection4) and selection5 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present and filtering will need to occur - by parent process or command line argument. It may be required to modify this query - to an EDR product for more granular coverage. -references: -- https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0 -- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md -tags: - analytic_story: - - Hermetic Wiper - - Malicious PowerShell - - Ingress Tool Transfer - - Log4Shell CVE-2021-44228 - - DarkCrystal RAT - asset_type: Endpoint - confidence: 70 - cve: - - CVE-2021-44228 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile - within PowerShell. - mitre_attack_id: - - T1059 - - T1059.001 - - T1105 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/any_powershell_downloadstring.yml b/dev/endpoint/any_powershell_downloadstring.yml deleted file mode 100644 index 783192506b..0000000000 --- a/dev/endpoint/any_powershell_downloadstring.yml +++ /dev/null @@ -1,88 +0,0 @@ -name: Any Powershell DownloadString -id: 4d015ef2-7adf-11eb-95da-acde48001122 -version: 3 -date: '2022-04-07' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the use of PowerShell downloading a - file using `DownloadString` method. This particular method is utilized in many different - PowerShell frameworks to download files and output to disk. Identify the source - (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell - transaction logs are available, review for further details of the implant. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: pwsh.dll - selection2: - Image|endswith: - - pwsh.exe - - sqlps.exe - - sqltoolsps.exe - - powershell.exe - - powershell_ise.exe - selection3: - OriginalFileName: PowerShell.EXE - selection4: - OriginalFileName: powershell_ise.EXE - selection5: - CommandLine: '*.DownloadString*' - condition: (selection1 or selection2 or selection3 or selection4) and selection5 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present and filtering will need to occur - by parent process or command line argument. It may be required to modify this query - to an EDR product for more granular coverage. -references: -- https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-5.0 -- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md -tags: - analytic_story: - - Hermetic Wiper - - Malicious PowerShell - - HAFNIUM Group - - Ingress Tool Transfer - asset_type: Endpoint - confidence: 70 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadString - within PowerShell. - mitre_attack_id: - - T1059 - - T1059.001 - - T1105 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/attacker_tools_on_endpoint.yml b/dev/endpoint/attacker_tools_on_endpoint.yml deleted file mode 100644 index 6390a7eac3..0000000000 --- a/dev/endpoint/attacker_tools_on_endpoint.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Attacker Tools On Endpoint -id: a51bfe1a-94f0-48cc-b4e4-16a110145893 -version: 2 -date: '2021-11-04' -author: Bhavin Patel, Splunk -status: production -type: TTP -description: This search looks for execution of commonly used attacker tools on an - endpoint. -data_source: -- Sysmon Event ID 1 -search: - selection1: - User: unknown - Computer: unknown - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records process activity from your hosts to populate the endpoint data model - in the processes node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is usually generated via logs that report process tracking - in your Windows audit settings. -known_false_positives: Some administrator activity can be potentially triggered, please - add those users to the filter macro. -references: [] -tags: - analytic_story: - - Monitor for Unauthorized Software - - XMRig - - SamSam Ransomware - - Unusual Processes - - CISA AA22-264A - asset_type: Endpoint - confidence: 80 - impact: 80 - message: An attacker tool $process_name$,listed in attacker_tools.csv is executed - on host $dest$ by User $user$. This process $process_name$ is known to do- $description$ - mitre_attack_id: - - T1036.005 - - T1036 - - T1003 - - T1595 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1595/attacker_scan_tools/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/attempt_to_add_certificate_to_untrusted_store.yml b/dev/endpoint/attempt_to_add_certificate_to_untrusted_store.yml deleted file mode 100644 index f042cefc78..0000000000 --- a/dev/endpoint/attempt_to_add_certificate_to_untrusted_store.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Attempt To Add Certificate To Untrusted Store -id: 6bc5243e-ef36-45dc-9b12-f4a6be131159 -version: 7 -date: '2021-09-16' -author: Patrick Bareiss, Rico Valdez, Splunk -status: production -type: TTP -description: Attempt To Add Certificate To Untrusted Store -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: CertUtil.exe - selection2: - Image|endswith: certutil.exe - selection3: - CommandLine: '*-addstore*' - condition: (selection1 or selection2) and selection3 -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. -known_false_positives: There may be legitimate reasons for administrators to add a - certificate to the untrusted certificate store. In such cases, this will typically - be done on a large number of systems. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.004/T1553.004.md -tags: - analytic_story: - - Disabling Security Tools - asset_type: Endpoint - confidence: 50 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - attempting to add a certificate to the store on endpoint $dest$ by user $user$. - mitre_attack_id: - - T1553.004 - - T1553 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1553.004/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/dev/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml deleted file mode 100644 index 485f8a8e55..0000000000 --- a/dev/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml +++ /dev/null @@ -1,82 +0,0 @@ -name: Attempted Credential Dump From Registry via Reg exe -id: e9fb4a59-c5fb-440a-9f24-191fbc6b2911 -version: 7 -date: '2022-11-15' -author: Patrick Bareiss, Splunk -status: production -type: TTP -description: Monitor for execution of reg.exe with parameters specifying an export - of keys that contain hashed credentials that attackers may try to crack offline. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine|contains: 'save' - Image|endswith: - - cmd.exe - - reg.exe - selection2: - CommandLine: - - '*HKLM\\SAM*' - - '*HKLM\\System*' - - '*HKLM\\Security*' - - '*HKEY_LOCAL_MACHINE\\System*' - - '*HKEY_LOCAL_MACHINE\\SAM*' - - '*HKEY_LOCAL_MACHINE\\Security*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: None identified. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets -tags: - analytic_story: - - Credential Dumping - - DarkSide Ransomware - - Windows Registry Abuse - - Industroyer2 - asset_type: Endpoint - confidence: 100 - impact: 90 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to export the registry keys. - mitre_attack_id: - - T1003.002 - - T1003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/crowdstrike_falcon.log - source: crowdstrike - sourcetype: crowdstrike:events:sensor diff --git a/dev/endpoint/auto_admin_logon_registry_entry.yml b/dev/endpoint/auto_admin_logon_registry_entry.yml deleted file mode 100644 index 201032e6bf..0000000000 --- a/dev/endpoint/auto_admin_logon_registry_entry.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Auto Admin Logon Registry Entry -id: 1379d2b8-0f18-11ec-8ca3-acde48001122 -version: 2 -date: '2020-01-28' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: this search is to detect a suspicious registry modification to implement - auto admin logon to a host. This technique was seen in BlackMatter ransomware to - automatically logon to the compromise host after triggering a safemode boot to - continue encrypting the whole network. This behavior is not a common practice and - really a suspicious TTP or alert need to be consider if found within then network - premise. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: AutoAdminLogon - TargetObject: '*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*' - Details: '1' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: unknown -references: -- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ -tags: - analytic_story: - - BlackMatter Ransomware - - Windows Registry Abuse - asset_type: Endpoint - confidence: 90 - impact: 70 - message: modified registry key $registry_key_name$ with registry value $registry_value_name$ - to prepare autoadminlogon - mitre_attack_id: - - T1552.002 - - T1552 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/batch_file_write_to_system32.yml b/dev/endpoint/batch_file_write_to_system32.yml deleted file mode 100644 index 9fd1af3233..0000000000 --- a/dev/endpoint/batch_file_write_to_system32.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Batch File Write to System32 -id: 503d17cb-9eab-4cf8-a20e-01d5c6987ae3 -version: 3 -date: '2022-12-21' -author: Steven Dick, Michael Haag, Rico Valdez, Splunk -status: production -type: TTP -description: The search looks for a batch file (.bat) written to the Windows system - directory tree. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: '*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: It is possible for this search to generate a notable event - for a batch file write to a path that includes the string "system32", but is not - the actual Windows system directory. As such, you should confirm the path of the - batch file identified by the search. In addition, a false positive may be generated - by an administrator copying a legitimate batch file in this directory tree. You - should confirm that the activity is legitimate and modify the search to add exclusions, - as necessary. -references: [] -tags: - analytic_story: - - SamSam Ransomware - asset_type: Endpoint - confidence: 90 - impact: 70 - message: A file - $file_name$ was written to system32 has occurred on endpoint $dest$ - by user $user$. - mitre_attack_id: - - T1204 - - T1204.002 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: file_name - type: File Name - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.002/batch_file_in_system32/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/bcdedit_command_back_to_normal_mode_boot.yml b/dev/endpoint/bcdedit_command_back_to_normal_mode_boot.yml deleted file mode 100644 index 8642799fca..0000000000 --- a/dev/endpoint/bcdedit_command_back_to_normal_mode_boot.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Bcdedit Command Back To Normal Mode Boot -id: dc7a8004-0f18-11ec-8c54-acde48001122 -version: 1 -date: '2021-09-06' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious bcdedit commandline to configure - the host from safe mode back to normal boot configuration. This technique was seen - in blackMatter ransomware where it force the compromised host to boot in safe mode - to continue its encryption and bring back to normal boot using bcdedit deletevalue - command. This TTP can be a good alert for host that booted from safe mode forcefully - since it need to modify the boot configuration to bring it back to normal. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*/deletevalue*' - Image|endswith: bcdedit.exe - selection2: - CommandLine: '*{current}*' - selection3: - CommandLine: '*safeboot*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -known_false_positives: unknown -references: -- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ -tags: - analytic_story: - - BlackMatter Ransomware - asset_type: Endpoint - confidence: 70 - impact: 50 - message: bcdedit process with commandline $process$ to bring back to normal boot - configuration the $dest$ - mitre_attack_id: - - T1490 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/bcdedit_failure_recovery_modification.yml b/dev/endpoint/bcdedit_failure_recovery_modification.yml deleted file mode 100644 index d3faaf5ab1..0000000000 --- a/dev/endpoint/bcdedit_failure_recovery_modification.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: BCDEdit Failure Recovery Modification -id: 809b31d2-5462-11eb-ae93-0242ac130002 -version: 1 -date: '2020-12-21' -author: Michael Haag, Splunk -status: production -type: TTP -description: This search looks for flags passed to bcdedit.exe modifications to the - built-in Windows error recovery boot configurations. This is typically used by ransomware - to prevent recovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*recoveryenabled*' - Image|endswith: bcdedit.exe - selection2: - CommandLine: '* no*' - condition: selection1 and selection2 -how_to_implement: You must be ingesting endpoint data that tracks process activity, - including parent-child relationships from your endpoints to populate the Endpoint - data model in the Processes node. Tune based on parent process names. -known_false_positives: Administrators may modify the boot configuration. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair -tags: - analytic_story: - - Ryuk Ransomware - - Ransomware - asset_type: Endpoint - confidence: 80 - impact: 100 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting disable the ability to recover the - endpoint. - mitre_attack_id: - - T1490 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/bits_job_persistence.yml b/dev/endpoint/bits_job_persistence.yml deleted file mode 100644 index 9203b6e706..0000000000 --- a/dev/endpoint/bits_job_persistence.yml +++ /dev/null @@ -1,82 +0,0 @@ -name: BITS Job Persistence -id: e97a5ffe-90bf-11eb-928a-acde48001122 -version: 2 -date: '2021-09-16' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following query identifies Microsoft Background Intelligent Transfer - Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint. - The query identifies the parameters used to create, resume or add a file to a BITS - job. Typically seen combined in a oneliner or ran in sequence. If identified, review - the BITS job created and capture any files written to disk. It is possible for BITS - to be used to upload files and this may require further network data analysis to - identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: bitsadmin.exe - selection2: - Image|endswith: bitsadmin.exe - selection3: - CommandLine: [] - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives will be present. Typically, applications - will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments - (legitimate applications) or parent process. -references: -- https://attack.mitre.org/techniques/T1197/ -- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute -- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ -tags: - analytic_story: - - BITS Jobs - - Living Off The Land - asset_type: Endpoint - confidence: 80 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to persist using BITS. - mitre_attack_id: - - T1197 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log - source: crowdstrike - sourcetype: crowdstrike:events:sensor diff --git a/dev/endpoint/bitsadmin_download_file.yml b/dev/endpoint/bitsadmin_download_file.yml deleted file mode 100644 index b6ad41c1cb..0000000000 --- a/dev/endpoint/bitsadmin_download_file.yml +++ /dev/null @@ -1,91 +0,0 @@ -name: BITSAdmin Download File -id: 80630ff4-8e4c-11eb-aab5-acde48001122 -version: 3 -date: '2022-11-29' -author: Michael Haag, Sittikorn S -status: production -type: TTP -description: The following query identifies Microsoft Background Intelligent Transfer - Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote - object. In addition, look for `download` or `upload` on the command-line, the switches - are not required to perform a transfer. Capture any files downloaded. Review the - reputation of the IP or domain used. Typically once executed, a follow on command - will be used to execute the dropped file. Note that the network connection or file - modification events related will not spawn or create from `bitsadmin.exe`, but the - artifacts will appear in a parallel process of `svchost.exe` with a command-line - similar to `svchost.exe -k netsvcs -s BITS`. It's important to review all parallel - and child processes to capture any behaviors and artifacts. In some suspicious and - malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose` - to list out the jobs during investigation. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: bitsadmin.exe - selection2: - Image|endswith: bitsadmin.exe - selection3: - CommandLine: - - '*transfer*' - - '*addfile*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives, however it may be required to filter - based on parent process name or network connection. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download -- https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md -- https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool -- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ -tags: - analytic_story: - - Ingress Tool Transfer - - BITS Jobs - - DarkSide Ransomware - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to download a file. - mitre_attack_id: - - T1197 - - T1105 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log - source: crowdstrike - sourcetype: crowdstrike:events:sensor diff --git a/dev/endpoint/certutil_download_with_urlcache_and_split_arguments.yml b/dev/endpoint/certutil_download_with_urlcache_and_split_arguments.yml deleted file mode 100644 index 080c4d0410..0000000000 --- a/dev/endpoint/certutil_download_with_urlcache_and_split_arguments.yml +++ /dev/null @@ -1,85 +0,0 @@ -name: CertUtil Download With URLCache and Split Arguments -id: 415b4306-8bfb-11eb-85c4-acde48001122 -version: 3 -date: '2022-02-03' -author: Michael Haag, Splunk -status: production -type: TTP -description: Certutil.exe may download a file from a remote destination using `-urlcache`. - This behavior does require a URL to be passed on the command-line. In addition, - `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will - be used. It is not entirely common for `certutil.exe` to contact public IP space. - However, it is uncommon for `certutil.exe` to write files to world writeable paths. - - During triage, capture any files on disk and review. Review the reputation of the - remote IP or domain in question. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: CertUtil.exe - selection2: - Image|endswith: certutil.exe - selection3: - CommandLine: '*split*' - selection4: - CommandLine: '*urlcache*' - selection5: - CommandLine: '*urlcache*' - condition: (selection1 or selection2) and selection3 and selection4 or selection5 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives in most environments, however tune - as needed based on parent-child relationship or network connection. -references: -- https://attack.mitre.org/techniques/T1105/ -- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats -- https://web.archive.org/web/20210921110637/https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html -tags: - analytic_story: - - Ingress Tool Transfer - - DarkSide Ransomware - - Living Off The Land - - ProxyNotShell - - CISA AA22-277A - - Forest Blizzard - - Flax Typhoon - asset_type: Endpoint - confidence: 100 - impact: 90 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to download a file. - mitre_attack_id: - - T1105 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml b/dev/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml deleted file mode 100644 index 7e21422a16..0000000000 --- a/dev/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml +++ /dev/null @@ -1,81 +0,0 @@ -name: CertUtil Download With VerifyCtl and Split Arguments -id: 801ad9e4-8bfb-11eb-8b31-acde48001122 -version: 3 -date: '2022-02-03' -author: Michael Haag, Splunk -status: production -type: TTP -description: 'Certutil.exe may download a file from a remote destination using `-VerifyCtl`. - This behavior does require a URL to be passed on the command-line. In addition, - `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will - be used. It is not entirely common for `certutil.exe` to contact public IP space. - \ During triage, capture any files on disk and review. Review the reputation of - the remote IP or domain in question. Using `-VerifyCtl`, the file will either be - written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\`. ' -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: CertUtil.exe - selection2: - Image|endswith: certutil.exe - selection3: - CommandLine: '*split*' - selection4: - CommandLine: '*verifyctl*' - selection5: - CommandLine: '*verifyctl*' - condition: (selection1 or selection2) and selection3 and selection4 or selection5 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives in most environments, however tune - as needed based on parent-child relationship or network connection. -references: -- https://attack.mitre.org/techniques/T1105/ -- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/ -- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl -- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats -tags: - analytic_story: - - Ingress Tool Transfer - - DarkSide Ransomware - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 90 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to download a file. - mitre_attack_id: - - T1105 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/certutil_exe_certificate_extraction.yml b/dev/endpoint/certutil_exe_certificate_extraction.yml deleted file mode 100644 index 45a748bdc1..0000000000 --- a/dev/endpoint/certutil_exe_certificate_extraction.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Certutil exe certificate extraction -id: 337a46be-600f-11eb-ae93-0242ac130002 -version: 2 -date: '2022-07-15' -author: Rod Soto, Splunk -status: production -type: TTP -description: This search looks for arguments to certutil.exe indicating the manipulation - or extraction of Certificate. This certificate can then be used to sign new authentication - tokens specially inside Federated environments such as Windows ADFS. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*-exportPFX*' - Image|endswith: certutil.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Unless there are specific use cases, manipulating or exporting - certificates using certutil is uncommon. Extraction of certificate has been observed - during attacks such as Golden SAML and other campaigns targeting Federated services. -references: -- https://blog.sygnia.co/detection-and-hunting-of-golden-saml-attack -- https://strontic.github.io/xcyclopedia/library/certutil.exe-09A8A29BAA3A451713FD3D07943B4A43.html -tags: - analytic_story: - - Windows Persistence Techniques - - Cloud Federated Credential Abuse - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 90 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting export a certificate. - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/certutil_exe_certificate_extraction/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/certutil_with_decode_argument.yml b/dev/endpoint/certutil_with_decode_argument.yml deleted file mode 100644 index 20b2c1e0ed..0000000000 --- a/dev/endpoint/certutil_with_decode_argument.yml +++ /dev/null @@ -1,79 +0,0 @@ -name: CertUtil With Decode Argument -id: bfe94226-8c10-11eb-a4b3-acde48001122 -version: 2 -date: '2021-03-23' -author: Michael Haag, Splunk -status: production -type: TTP -description: CertUtil.exe may be used to `encode` and `decode` a file, including PE - and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----` - and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded - file that was downloaded. Once decoded, it will be loaded by a parallel process. - Note that there are two additional command switches that may be used - `encodehex` - and `decodehex`. Similarly, the file will be encoded in HEX and later decoded for - further execution. During triage, identify the source of the file being decoded. - Review its contents or execution behavior for further analysis. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: CertUtil.exe - selection2: - Image|endswith: certutil.exe - selection3: - CommandLine: '*decode*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Typically seen used to `encode` files, but it is possible to - see legitimate use of `decode`. Filter based on parent-child relationship, file - paths, endpoint or user. -references: -- https://attack.mitre.org/techniques/T1140/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1140/T1140.md -- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil -- https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/ -tags: - analytic_story: - - Deobfuscate-Decode Files or Information - - Living Off The Land - - Forest Blizzard - asset_type: Endpoint - confidence: 80 - impact: 50 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to decode a file. - mitre_attack_id: - - T1140 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 40 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/change_default_file_association.yml b/dev/endpoint/change_default_file_association.yml deleted file mode 100644 index a1191c7eed..0000000000 --- a/dev/endpoint/change_default_file_association.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Change Default File Association -id: 462d17d8-1f71-11ec-ad07-acde48001122 -version: 1 -date: '2021-09-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is developed to detect suspicious registry modification - to change the default file association of windows to malicious payload. This technique - was seen in some APT where it modify the default process to run file association, - like .txt to notepad.exe. Instead notepad.exe it will point to a Script or other - payload that will load malicious commands to the compromised host. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: '*HKCR\\*' - selection2: - TargetObject: '*\\shell\\open\\command\\*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: unknown -references: -- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features -tags: - analytic_story: - - Windows Persistence Techniques - - Windows Privilege Escalation - - Windows Registry Abuse - - Hermetic Wiper - - Prestige Ransomware - asset_type: Endpoint - confidence: 100 - impact: 80 - message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ - mitre_attack_id: - - T1546.001 - - T1546 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.001/txtfile_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/change_to_safe_mode_with_network_config.yml b/dev/endpoint/change_to_safe_mode_with_network_config.yml deleted file mode 100644 index 46fa7ce7f0..0000000000 --- a/dev/endpoint/change_to_safe_mode_with_network_config.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Change To Safe Mode With Network Config -id: 81f1dce0-0f18-11ec-a5d7-acde48001122 -version: 1 -date: '2021-09-06' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious bcdedit commandline to configure - the host to boot in safe mode with network config. This technique was seen in blackMatter - ransomware where it force the compromised host to boot in safe mode to continue - its encryption and bring back to normal boot using bcdedit deletevalue command. - This TTP can be a good alert for host that booted from safe mode forcefully since - it need to modify the boot configuration to bring it back to normal. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*/set*' - Image|endswith: bcdedit.exe - selection2: - CommandLine: '*{current}*' - selection3: - CommandLine: '*safeboot*' - selection4: - CommandLine: '*network*' - condition: selection1 and selection2 and selection3 and selection4 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -known_false_positives: unknown -references: -- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ -tags: - analytic_story: - - BlackMatter Ransomware - asset_type: Endpoint - confidence: 50 - impact: 50 - message: bcdedit process with commandline $process$ to force safemode boot the $dest$ - mitre_attack_id: - - T1490 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/chcp_command_execution.yml b/dev/endpoint/chcp_command_execution.yml deleted file mode 100644 index fb9193c680..0000000000 --- a/dev/endpoint/chcp_command_execution.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: CHCP Command Execution -id: 21d236ec-eec1-11eb-b23e-acde48001122 -version: 1 -date: '2021-07-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect execution of chcp.exe application. this utility - is used to change the active code page of the console. This technique was seen in - icedid malware to know the locale region/language/country of the compromise host. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: cmd.exe - Image|endswith: chcp.com - ParentCommandLine: '*/c*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed chcp.com may be used. -known_false_positives: other tools or script may used this to change code page to - UTF-* or others -references: -- https://ss64.com/nt/chcp.html -- https://twitter.com/tccontre18/status/1419941156633329665?s=20 -tags: - analytic_story: - - IcedID - - Azorult - asset_type: Endpoint - confidence: 30 - impact: 30 - message: parent process $parent_process_name$ spawning chcp process $process_name$ - with parent command line $parent_process$ - mitre_attack_id: - - T1059 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/check_elevated_cmd_using_whoami.yml b/dev/endpoint/check_elevated_cmd_using_whoami.yml deleted file mode 100644 index 555c7e77a2..0000000000 --- a/dev/endpoint/check_elevated_cmd_using_whoami.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Check Elevated CMD using whoami -id: a9079b18-1633-11ec-859c-acde48001122 -version: 1 -date: '2021-09-15' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious whoami execution to check if the - cmd or shell instance process is with elevated privileges. This technique was seen - in FIN7 js implant where it execute this as part of its data collection to the infected - machine to check if the running shell cmd process is elevated or not. This TTP is - really a good alert for known attacker that recon on the targetted host. This command - is not so commonly executed by a normal user or even an admin to check if a process - is elevated. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*/group*' - selection2: - CommandLine: '*whoami*' - selection3: - CommandLine: '* find *' - selection4: - CommandLine: '*12288*' - condition: selection1 and selection2 and selection3 and selection4 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -known_false_positives: unknown -references: [] -tags: - analytic_story: - - FIN7 - asset_type: Endpoint - confidence: 80 - impact: 70 - message: Process name $process_name$ with commandline $process$ in $dest$ - mitre_attack_id: - - T1033 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/child_processes_of_spoolsv_exe.yml b/dev/endpoint/child_processes_of_spoolsv_exe.yml deleted file mode 100644 index b475a2feed..0000000000 --- a/dev/endpoint/child_processes_of_spoolsv_exe.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Child Processes of Spoolsv exe -id: aa0c4aeb-5b18-41c4-8c07-f1442d7599df -version: 3 -date: '2020-03-16' -author: Rico Valdez, Splunk -status: experimental -type: TTP -description: This search looks for child processes of spoolsv.exe. This activity is - associated with a POC privilege-escalation exploit associated with CVE-2018-8440. - Spoolsv.exe is the process associated with the Print Spooler service in Windows - and typically runs as SYSTEM. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: regsvr32.exe - ParentImage: spoolsv.exe - condition: selection1 -how_to_implement: You must be ingesting endpoint data that tracks process activity, - including parent-child relationships from your endpoints to populate the Endpoint - data model in the Processes node. The command-line arguments are mapped to the "process" - field in the Endpoint data model. Update the `children_of_spoolsv_filter` macro - to filter out legitimate child processes spawned by spoolsv.exe. -known_false_positives: Some legitimate printer-related processes may show up as children - of spoolsv.exe. You should confirm that any activity as legitimate and may be added - as exclusions in the search. -references: [] -tags: - analytic_story: - - Windows Privilege Escalation - - Hermetic Wiper - asset_type: Endpoint - confidence: 50 - cve: - - CVE-2018-8440 - impact: 50 - message: tbd - mitre_attack_id: - - T1068 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint diff --git a/dev/endpoint/clear_unallocated_sector_using_cipher_app.yml b/dev/endpoint/clear_unallocated_sector_using_cipher_app.yml deleted file mode 100644 index da2642da0d..0000000000 --- a/dev/endpoint/clear_unallocated_sector_using_cipher_app.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Clear Unallocated Sector Using Cipher App -id: cd80a6ac-c9d9-11eb-8839-acde48001122 -version: 1 -date: '2021-06-10' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: this search is to detect execution of `cipher.exe` to clear the unallocated - sectors of a specific disk. This technique was seen in some ransomware to make it - impossible to forensically recover deleted files. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*/w:*' - Image|endswith: cipher.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: administrator may execute this app to manage disk -references: -- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/ -- https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf -tags: - analytic_story: - - Ransomware - asset_type: Endpoint - confidence: 90 - impact: 100 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors - of a specific disk. - mitre_attack_id: - - T1070.004 - - T1070 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/cmd_carry_out_string_command_parameter.yml b/dev/endpoint/cmd_carry_out_string_command_parameter.yml deleted file mode 100644 index 0c9ac0cdfe..0000000000 --- a/dev/endpoint/cmd_carry_out_string_command_parameter.yml +++ /dev/null @@ -1,76 +0,0 @@ -name: CMD Carry Out String Command Parameter -id: 54a6ed00-3256-11ec-b031-acde48001122 -version: 3 -date: '2022-01-18' -author: Teoderick Contreras, Bhavin Patel, Splunk -status: production -type: Hunting -description: The following analytic identifies command-line arguments where `cmd.exe - /c` is used to execute a program. `cmd /c` is used to run commands in MS-DOS and - terminate after command or process completion. This technique is commonly seen in - adversaries and malware to execute batch command using different shell like PowerShell - or different process other than `cmd.exe`. This is a good hunting query for suspicious - command-line made by a script or relative process execute it. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: Cmd.Exe - selection2: - Image|endswith: cmd.exe - selection3: - CommandLine: '* /c *' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be high based on legitimate scripted code - in any environment. Filter as needed. -references: -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -tags: - analytic_story: - - Data Destruction - - IcedID - - Log4Shell CVE-2021-44228 - - WhisperGate - - Hermetic Wiper - - Living Off The Land - - Azorult - - DarkCrystal RAT - - ProxyNotShell - - Qakbot - asset_type: Endpoint - confidence: 50 - cve: - - CVE-2021-44228 - impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting spawn a new process. - mitre_attack_id: - - T1059.003 - - T1059 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/cmd_carry_str_param/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/cmd_echo_pipe___escalation.yml b/dev/endpoint/cmd_echo_pipe___escalation.yml deleted file mode 100644 index 9bea5fb4b6..0000000000 --- a/dev/endpoint/cmd_echo_pipe___escalation.yml +++ /dev/null @@ -1,78 +0,0 @@ -name: CMD Echo Pipe - Escalation -id: eb277ba0-b96b-11eb-b00e-acde48001122 -version: 2 -date: '2021-05-20' -author: Michael Haag, Splunk -status: production -type: TTP -description: This analytic identifies a common behavior by Cobalt Strike and other - frameworks where the adversary will escalate privileges, either via `jump` (Cobalt - Strike PTH) or `getsystem`, using named-pipe impersonation. A suspicious event will - look like `cmd.exe /c echo 4sgryt3436 > \\.\Pipe\5erg53`. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: Cmd.Exe - selection2: - Image|endswith: cmd.exe - selection3: - CommandLine: '*%comspec%*' - selection4: - CommandLine: '*pipe*' - selection5: - CommandLine: '*echo*' - condition: (selection1 or selection2) or selection3 or selection4 or selection5 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Unknown. It is possible filtering may be required to ensure - fidelity. -references: -- https://redcanary.com/threat-detection-report/threats/cobalt-strike/ -- https://github.com/rapid7/meterpreter/blob/master/source/extensions/priv/server/elevate/namedpipe.c -tags: - analytic_story: - - Cobalt Strike - asset_type: Endpoint - confidence: 80 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ potentially performing privilege escalation - using named pipes related to Cobalt Strike and other frameworks. - mitre_attack_id: - - T1059 - - T1059.003 - - T1543.003 - - T1543 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml b/dev/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml deleted file mode 100644 index 035520c1c2..0000000000 --- a/dev/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml +++ /dev/null @@ -1,84 +0,0 @@ -name: Cmdline Tool Not Executed In CMD Shell -id: 6c3f7dd8-153c-11ec-ac2d-acde48001122 -version: 2 -date: '2022-10-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies a non-standard parent process (not - matching CMD, PowerShell, or Explorer) spawning `ipconfig.exe` or `systeminfo.exe`. - This particular behavior was seen in FIN7's JSSLoader .NET payload. This is also - typically seen when an adversary is injected into another process performing different - discovery techniques. This event stands out as a TTP since these tools are commonly - executed with a shell application or Explorer parent, and not by another application. - This TTP is a good indicator for an adversary gathering host information, but one - possible false positive might be an automated tool used by a system administator. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - ipconfig.exe - - systeminfo.exe - - net.exe - - net1.exe - - arp.exe - - nslookup.exe - - route.exe - - netstat.exe - - whoami.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: A network operator or systems administrator may utilize an - automated host discovery application that may generate false positives. Filter as - needed. -references: -- https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation -- https://attack.mitre.org/groups/G0046/ -tags: - analytic_story: - - FIN7 - - Qakbot - - CISA AA22-277A - - Qakbot - asset_type: Endpoint - confidence: 80 - impact: 70 - message: A non-standard parent process $parent_process_name$ spawned child process - $process_name$ to execute command-line tool on $dest$. - mitre_attack_id: - - T1059 - - T1059.007 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/jssloader/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/conti_common_exec_parameter.yml b/dev/endpoint/conti_common_exec_parameter.yml deleted file mode 100644 index 6330662933..0000000000 --- a/dev/endpoint/conti_common_exec_parameter.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Conti Common Exec parameter -id: 624919bc-c382-11eb-adcc-acde48001122 -version: 1 -date: '2021-06-02' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search detects the suspicious commandline argument of revil ransomware - to encrypt specific or all local drive and network shares of the compromised machine - or host. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*-m local*' - - '*-m net*' - - '*-m all*' - - '*-nomutex*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: 3rd party tool may have commandline parameter that can trigger - this detection. -references: -- https://malpedia.caad.fkie.fraunhofer.de/details/win.conti -tags: - analytic_story: - - Ransomware - asset_type: Endpoint - confidence: 80 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ executing specific Conti Ransomware related - parameters. - mitre_attack_id: - - T1204 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/inf1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/control_loading_from_world_writable_directory.yml b/dev/endpoint/control_loading_from_world_writable_directory.yml deleted file mode 100644 index 4f83c5d740..0000000000 --- a/dev/endpoint/control_loading_from_world_writable_directory.yml +++ /dev/null @@ -1,81 +0,0 @@ -name: Control Loading from World Writable Directory -id: 10423ac4-10c9-11ec-8dc4-acde48001122 -version: 1 -date: '2021-09-08' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following detection identifies control.exe loading either a .cpl - or .inf from a writable directory. This is related to CVE-2021-40444. During triage, - review parallel processes, parent and child, for further suspicious behaviors. In - addition, capture file modifications and analyze. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: CONTROL.EXE - selection2: - Image|endswith: control.exe - selection3: - CommandLine: - - '*\\appdata\\*' - - '*\\windows\\temp\\*' - - '*\\programdata\\*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives will be present as control.exe does - not natively load from writable paths as defined. One may add .cpl or .inf to the - command-line if there is any false positives. Tune as needed. -references: -- https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html -- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ -- https://attack.mitre.org/techniques/T1218/011/ -- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml -tags: - analytic_story: - - Microsoft MSHTML Remote Code Execution CVE-2021-40444 - - Living Off The Land - asset_type: Endpoint - confidence: 100 - cve: - - CVE-2021-40444 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk. - mitre_attack_id: - - T1218 - - T1218.002 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/create_local_admin_accounts_using_net_exe.yml b/dev/endpoint/create_local_admin_accounts_using_net_exe.yml deleted file mode 100644 index e6248c60f3..0000000000 --- a/dev/endpoint/create_local_admin_accounts_using_net_exe.yml +++ /dev/null @@ -1,84 +0,0 @@ -name: Create local admin accounts using net exe -id: b89919ed-fe5f-492c-b139-151bb162040e -version: 6 -date: '2021-09-08' -author: Bhavin Patel, Splunk -status: production -type: TTP -description: This search looks for the creation of local administrator accounts using - net.exe . -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*/add*' - Image|endswith: - - net1.exe - - net.exe - selection2: - CommandLine: - - '*administratorer*' - - '*amministratori*' - - '*administrador*' - - '*administrateurs*' - - '*administratoren*' - - '*administrators*' - condition: selection1 and selection2 -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. -known_false_positives: Administrators often leverage net.exe to create admin accounts. -references: [] -tags: - analytic_story: - - DHS Report TA18-074A - - Azorult - - CISA AA22-257A - asset_type: Endpoint - confidence: 60 - impact: 50 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators - group. - mitre_attack_id: - - T1136.001 - - T1136 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-system.log - source: WinEventLog:System - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/dev/endpoint/create_or_delete_windows_shares_using_net_exe.yml deleted file mode 100644 index eb61bf41e1..0000000000 --- a/dev/endpoint/create_or_delete_windows_shares_using_net_exe.yml +++ /dev/null @@ -1,73 +0,0 @@ -name: Create or delete windows shares using net exe -id: 743a322c-9a68-4a0f-9c17-85d9cce2a27c -version: 6 -date: '2020-09-16' -author: Bhavin Patel, Splunk -status: production -type: TTP -description: This search looks for the creation or deletion of hidden shares using - net.exe. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: net.exe - selection2: - Image|endswith: net.exe - selection3: - Image|endswith: net1.exe - selection4: - OriginalFileName: net1.exe - condition: (selection1 or selection2 or selection3 or selection4) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Administrators often leverage net.exe to create or delete network - shares. You should verify that the activity was intentional and is legitimate. -references: -- https://attack.mitre.org/techniques/T1070/005/ -tags: - analytic_story: - - Hidden Cobra Malware - - CISA AA22-277A - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 50 - impact: 50 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ enumerating Windows file shares. - mitre_attack_id: - - T1070 - - T1070.005 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.005/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/creation_of_shadow_copy.yml b/dev/endpoint/creation_of_shadow_copy.yml deleted file mode 100644 index 5ee4f553c2..0000000000 --- a/dev/endpoint/creation_of_shadow_copy.yml +++ /dev/null @@ -1,77 +0,0 @@ -name: Creation of Shadow Copy -id: eb120f5f-b879-4a63-97c1-93352b5df844 -version: 1 -date: '2019-12-10' -author: Patrick Bareiss, Splunk -status: production -type: TTP -description: Monitor for signs that Vssadmin or Wmic has been used to create a shadow - copy. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*create*' - Image|endswith: vssadmin.exe - selection2: - CommandLine: '*shadow*' - selection3: - CommandLine: '*shadowcopy*' - Image|endswith: wmic.exe - selection4: - CommandLine: '*create*' - condition: (selection1 and selection2) or selection3 or selection4 -how_to_implement: You must be ingesting endpoint data that tracks process activity, - including parent-child relationships from your endpoints, to populate the Endpoint - data model in the Processes node. The command-line arguments are mapped to the "process" - field in the Endpoint data model. -known_false_positives: Legitimate administrator usage of Vssadmin or Wmic will create - false positives. -references: -- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf -tags: - analytic_story: - - Credential Dumping - asset_type: Endpoint - confidence: 90 - impact: 90 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform - offline password cracking. - mitre_attack_id: - - T1003.003 - - T1003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 81 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/crowdstrike_falcon.log - source: crowdstrike - sourcetype: crowdstrike:events:sensor diff --git a/dev/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml b/dev/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml deleted file mode 100644 index 7da206ee40..0000000000 --- a/dev/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml +++ /dev/null @@ -1,78 +0,0 @@ -name: Creation of Shadow Copy with wmic and powershell -id: 2ed8b538-d284-449a-be1d-82ad1dbd186b -version: 3 -date: '2021-09-16' -author: Patrick Bareiss, Splunk -status: production -type: TTP -description: This search detects the use of wmic and Powershell to create a shadow - copy. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: wmic.exe - selection2: - Image|endswith: wmic.exe - selection3: - OriginalFileName: wmic.exe - selection4: - Image|endswith: wmic.exe - selection5: - CommandLine: '*shadowcopy*' - selection6: - CommandLine: '*create*' - condition: (selection1 or selection2) or selection3 or selection4 or selection5 - or selection6 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Legtimate administrator usage of wmic to create a shadow copy. -references: -- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf -- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF -tags: - analytic_story: - - Credential Dumping - - Living Off The Land - - Volt Typhoon - asset_type: Endpoint - confidence: 90 - impact: 90 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform - offline password cracking. - mitre_attack_id: - - T1003.003 - - T1003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 81 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml b/dev/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml deleted file mode 100644 index 41d9b85fc0..0000000000 --- a/dev/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Credential Dumping via Copy Command from Shadow Copy -id: d8c406fe-23d2-45f3-a983-1abe7b83ff3b -version: 2 -date: '2021-09-16' -author: Patrick Bareiss, Splunk -status: production -type: TTP -description: This search detects credential dumping using copy command from a shadow - copy. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: Cmd.Exe - selection2: - Image|endswith: cmd.exe - selection3: - CommandLine: - - '*\\system32\\config\\sam*' - - '*\\system32\\config\\security*' - - '*\\system32\\config\\system*' - - '*\\windows\\ntds\\ntds.dit*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: unknown -references: -- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf -tags: - analytic_story: - - Credential Dumping - asset_type: Endpoint - confidence: 90 - impact: 90 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to copy SAM and NTDS.dit for offline - password cracking. - mitre_attack_id: - - T1003.003 - - T1003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 81 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml b/dev/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml deleted file mode 100644 index 536ef93905..0000000000 --- a/dev/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Credential Dumping via Symlink to Shadow Copy -id: c5eac648-fae0-4263-91a6-773df1f4c903 -version: 2 -date: '2021-09-16' -author: Patrick Bareiss, Splunk -status: production -type: TTP -description: This search detects the creation of a symlink to a shadow copy. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: Cmd.Exe - selection2: - Image|endswith: cmd.exe - selection3: - CommandLine: '*mklink*' - selection4: - CommandLine: '*HarddiskVolumeShadowCopy*' - condition: (selection1 or selection2) and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: unknown -references: -- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf -tags: - analytic_story: - - Credential Dumping - asset_type: Endpoint - confidence: 90 - impact: 90 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to create symlink to a shadow copy - to grab credentials. - mitre_attack_id: - - T1003.003 - - T1003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 81 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/csc_net_on_the_fly_compilation.yml b/dev/endpoint/csc_net_on_the_fly_compilation.yml deleted file mode 100644 index 5400bbd19d..0000000000 --- a/dev/endpoint/csc_net_on_the_fly_compilation.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: CSC Net On The Fly Compilation -id: ea73128a-43ab-11ec-9753-acde48001122 -version: 1 -date: '2021-11-12' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: this analytic is to detect a suspicious compile before delivery approach - of .net compiler csc.exe. This technique was seen in several adversaries, malware - and even in red teams to take advantage the csc.exe .net compiler tool to compile - on the fly a malicious .net code to evade detection from security product. This - is a good hunting query to check further the file or process created after this - event and check the file path that passed to csc.exe which is the .net code. Aside - from that, powershell is capable of using this compiler in executing .net code in - a powershell script so filter on that case is needed. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: csc.exe - selection2: - Image|endswith: csc.exe - selection3: - CommandLine: '*/noconfig*' - selection4: - CommandLine: '*/fullpaths*' - selection5: - CommandLine: '*@*' - condition: (selection1 or selection2) and selection3 and selection4 and selection5 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: A network operator or systems administrator may utilize an - automated powershell script taht execute .net code that may generate false positive. - filter is needed. -references: -- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/ -- https://tccontre.blogspot.com/2019/06/maicious-macro-that-compile-c-code-as.html -tags: - analytic_story: - - Windows Defense Evasion Tactics - asset_type: Endpoint - confidence: 50 - impact: 50 - message: csc.exe with commandline $process$ to compile .net code on $dest$ by $user$ - mitre_attack_id: - - T1027.004 - - T1027 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/curl_download_and_bash_execution.yml b/dev/endpoint/curl_download_and_bash_execution.yml deleted file mode 100644 index ca56a403dc..0000000000 --- a/dev/endpoint/curl_download_and_bash_execution.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Curl Download and Bash Execution -id: 900bc324-59f3-11ec-9fb4-acde48001122 -version: 1 -date: '2021-12-10' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the use of curl on Linux or MacOS attempting - to download a file from a remote source and pipe it to bash. This is typically found - with coinminers and most recently with CVE-2021-44228, a vulnerability in Log4j. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*-s *' - Image|endswith: curl - selection2: - CommandLine: '*bash*' - selection3: - CommandLine: '*|*' - condition: (selection1) or selection2 or selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon for Linux, you will need to ensure mapping is - occurring correctly. If the EDR is not parsing the pipe bash in the command-line, - modifying the analytic will be required. Add parent process name (Processes.parent_process_name) - as needed to filter. -known_false_positives: False positives should be limited, however filtering may be - required. -references: -- https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java -- https://www.lunasec.io/docs/blog/log4j-zero-day/ -- https://gist.github.com/nathanqthai/01808c569903f41a52e7e7b575caa890 -tags: - analytic_story: - - Ingress Tool Transfer - - Log4Shell CVE-2021-44228 - - Linux Living Off The Land - asset_type: Endpoint - confidence: 100 - cve: - - CVE-2021-44228 - impact: 80 - message: An instance of $process_name$ was identified on endpoint $dest$ attempting - to download a remote file and run it with bash. - mitre_attack_id: - - T1105 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/linux-sysmon_curlwget.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/deleting_shadow_copies.yml b/dev/endpoint/deleting_shadow_copies.yml deleted file mode 100644 index e1e7be3c21..0000000000 --- a/dev/endpoint/deleting_shadow_copies.yml +++ /dev/null @@ -1,73 +0,0 @@ -name: Deleting Shadow Copies -id: b89919ed-ee5f-492c-b139-95dbb162039e -version: 4 -date: '2020-11-09' -author: David Dorsey, Splunk -status: production -type: TTP -description: The vssadmin.exe utility is used to interact with the Volume Shadow Copy - Service. Wmic is an interface to the Windows Management Instrumentation. This - search looks for either of these tools being used to delete shadow copies. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*delete*' - Image|endswith: - - wmic.exe - - vssadmin.exe - selection2: - CommandLine: '*shadow*' - condition: selection1 and selection2 -how_to_implement: You must be ingesting endpoint data that tracks process activity, - including parent-child relationships from your endpoints to populate the Endpoint - data model in the Processes node. The command-line arguments are mapped to the "process" - field in the Endpoint data model. -known_false_positives: vssadmin.exe and wmic.exe are standard applications shipped - with modern versions of windows. They may be used by administrators to legitimately - delete old backup copies, although this is typically rare. -references: [] -tags: - analytic_story: - - Windows Log Manipulation - - SamSam Ransomware - - Ransomware - - Clop Ransomware - - CISA AA22-264A - - Prestige Ransomware - asset_type: Endpoint - confidence: 90 - impact: 90 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to delete shadow copies. - mitre_attack_id: - - T1490 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 81 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_azurehound_command_line_arguments.yml b/dev/endpoint/detect_azurehound_command_line_arguments.yml deleted file mode 100644 index 0880949b56..0000000000 --- a/dev/endpoint/detect_azurehound_command_line_arguments.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Detect AzureHound Command-Line Arguments -id: 26f02e96-c300-11eb-b611-acde48001122 -version: 1 -date: '2021-06-01' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the common command-line argument used - by AzureHound `Invoke-AzureHound`. Being the script is FOSS, function names may - be modified, but these changes are dependent upon the operator. In most instances - the defaults are used. This analytic works to identify the common command-line attributes - used. It does not cover the entirety of every argument in order to avoid false positives. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*invoke-azurehound*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Unknown. -references: -- https://attack.mitre.org/software/S0521/ -- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors -- https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350 -- https://github.com/BloodHoundAD/Legacy-AzureHound.ps1/blob/master/AzureHound.ps1 -tags: - analytic_story: - - Discovery Techniques - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ using AzureHound to enumerate AzureAD. - mitre_attack_id: - - T1087.002 - - T1069.001 - - T1482 - - T1087.001 - - T1087 - - T1069.002 - - T1069 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_azurehound_file_modifications.yml b/dev/endpoint/detect_azurehound_file_modifications.yml deleted file mode 100644 index 8ad871806e..0000000000 --- a/dev/endpoint/detect_azurehound_file_modifications.yml +++ /dev/null @@ -1,75 +0,0 @@ -name: Detect AzureHound File Modifications -id: 1c34549e-c31b-11eb-996b-acde48001122 -version: 1 -date: '2021-06-01' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic is similar to SharpHound file modifications, but - this instance covers the use of Invoke-AzureHound. AzureHound is the SharpHound - equivilent but for Azure. It's possible this may never be seen in an environment - as most attackers may execute this tool remotely. Once execution is complete, a - zip file with a similar name will drop `20210601090751-azurecollection.zip`. In - addition to the zip, multiple .json files will be written to disk, which are in - the zip. -data_source: -- Sysmon Event ID 11 -search: - selection1: - Filesystem.file_name: - - '*-azurecollection.zip' - - '*-azprivroleadminrights.json' - - '*-azglobaladminrights.json' - - '*-azcloudappadmins.json' - - '*-azapplicationadmins.json' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on file modifications that include the name of the process, and file, responsible - for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` - node. -known_false_positives: False positives should be limited as the analytic is specific - to a filename with extension .zip. Filter as needed. -references: -- https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350 -- https://github.com/BloodHoundAD/Legacy-AzureHound.ps1/blob/master/AzureHound.ps1 -tags: - analytic_story: - - Discovery Techniques - asset_type: Endpoint - confidence: 90 - impact: 70 - message: A file - $file_name$ was written to disk that is related to AzureHound, - a AzureAD enumeration utility, has occurred on endpoint $dest$ by user $user$. - mitre_attack_id: - - T1087.002 - - T1069.001 - - T1482 - - T1087.001 - - T1087 - - T1069.002 - - T1069 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: file_name - type: File Name - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_exchange_web_shell.yml b/dev/endpoint/detect_exchange_web_shell.yml deleted file mode 100644 index 2bb368883b..0000000000 --- a/dev/endpoint/detect_exchange_web_shell.yml +++ /dev/null @@ -1,86 +0,0 @@ -name: Detect Exchange Web Shell -id: 8c14eeee-2af1-4a4b-bda8-228da0f4862a -version: 4 -date: '2022-09-30' -author: Michael Haag, Shannon Davis, David Dorsey, Splunk -status: production -type: TTP -description: 'The following query identifies suspicious .aspx created in 3 paths identified - by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM - group and recently disclosed vulnerablity named ProxyShell and ProxyNotShell. Paths - include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. - Upon triage, the suspicious .aspx file will likely look obvious on the surface. - inspect the contents for script code inside. Identify additional log sources, IIS - included, to review source and other potential exploitation. It is often the case - that a particular threat is only applicable to a specific subset of systems in your - environment. Typically analytics to detect those threats are written without the - benefit of being able to only target those systems as well. Writing analytics against - all systems when those behaviors are limited to identifiable subsets of those systems - is suboptimal. Consider the case ProxyShell vulnerability on Microsoft Exchange - Servers. With asset information, a hunter can limit their analytics to systems that - have been identified as Exchange servers. A hunter may start with the theory that - the exchange server is communicating with new systems that it has not previously. - If this theory is run against all publicly facing systems, the amount of noise it - will generate will likely render this theory untenable. However, using the asset - information to limit this analytic to just the Exchange servers will reduce the - noise allowing the hunter to focus only on the systems where this behavioral change - is relevant.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: System - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` - node. -known_false_positives: The query is structured in a way that `action` (read, create) - is not defined. Review the results of this query, filter, and tune as necessary. - It may be necessary to generate this query specific to your endpoint product. -references: -- https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv -- https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell -- https://www.youtube.com/watch?v=FC6iHw258RI -- https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do -tags: - analytic_story: - - HAFNIUM Group - - ProxyShell - - CISA AA22-257A - - ProxyNotShell - asset_type: Endpoint - confidence: 90 - impact: 90 - message: A file - $file_name$ was written to disk that is related to IIS exploitation - previously performed by HAFNIUM. Review further file modifications on endpoint - $dest$ by user $user$. - mitre_attack_id: - - T1505 - - T1505.003 - - T1190 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: file_name - type: File Name - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 81 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon_proxylogon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_html_help_renamed.yml b/dev/endpoint/detect_html_help_renamed.yml deleted file mode 100644 index 6d6b43960e..0000000000 --- a/dev/endpoint/detect_html_help_renamed.yml +++ /dev/null @@ -1,77 +0,0 @@ -name: Detect HTML Help Renamed -id: 62fed254-513b-460e-953d-79771493a9f3 -version: 4 -date: '2022-04-07' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following analytic identifies a renamed instance of hh.exe (HTML - Help) executing a Compiled HTML Help (CHM). This particular technique will load - Windows script code from a compiled help file. CHM files may contain nearly any - file type embedded, but only execute html/htm. Upon a successful execution, the - following script engines may be used for execution - JScript, VBScript, VBScript.Encode, - JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll - loading into hh.exe upon execution. The "htm" and "html" file extensions were the - only extensions observed to be supported for the execution of Shortcut commands - or WSH script code. During investigation, identify script content origination. Validate - it is the legitimate version of hh.exe by reviewing the PE metadata. hh.exe is natively - found in C:\Windows\system32 and C:\Windows\syswow64. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: HH.EXE - Image|endswith: hh.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Although unlikely a renamed instance of hh.exe will be used - legitimately, filter as needed. -references: -- https://attack.mitre.org/techniques/T1218/001/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md -- https://lolbas-project.github.io/lolbas/Binaries/Hh/ -tags: - analytic_story: - - Suspicious Compiled HTML Activity - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 80 - message: The following $process_name$ has been identified as renamed, spawning from - $parent_process_name$. - mitre_attack_id: - - T1218 - - T1218.001 - observable: - - name: user - type: User - role: - - Victim - - name: Computer - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_html_help_spawn_child_process.yml b/dev/endpoint/detect_html_help_spawn_child_process.yml deleted file mode 100644 index d03e875e79..0000000000 --- a/dev/endpoint/detect_html_help_spawn_child_process.yml +++ /dev/null @@ -1,78 +0,0 @@ -name: Detect HTML Help Spawn Child Process -id: 723716de-ee55-4cd4-9759-c44e7e55ba4b -version: 1 -date: '2021-02-11' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled - HTML Help (CHM) that spawns a child process. This particular technique will load - Windows script code from a compiled help file. CHM files may contain nearly any - file type embedded, but only execute html/htm. Upon a successful execution, the - following script engines may be used for execution - JScript, VBScript, VBScript.Encode, - JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll - loading into hh.exe upon execution. The "htm" and "html" file extensions were the - only extensions observed to be supported for the execution of Shortcut commands - or WSH script code. During investigation, identify script content origination. Review - child process events and investigate further. hh.exe is natively found in C:\Windows\system32 - and C:\Windows\syswow64. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: hh.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Although unlikely, some legitimate applications (ex. web browsers) - may spawn a child process. Filter as needed. -references: -- https://attack.mitre.org/techniques/T1218/001/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md -- https://lolbas-project.github.io/lolbas/Binaries/Hh/ -- https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7 -- https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ -tags: - analytic_story: - - Suspicious Compiled HTML Activity - - Living Off The Land - - AgentTesla - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ spawning a child process, typically not normal - behavior. - mitre_attack_id: - - T1218 - - T1218.001 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_html_help_url_in_command_line.yml b/dev/endpoint/detect_html_help_url_in_command_line.yml deleted file mode 100644 index be013293f6..0000000000 --- a/dev/endpoint/detect_html_help_url_in_command_line.yml +++ /dev/null @@ -1,84 +0,0 @@ -name: Detect HTML Help URL in Command Line -id: 8c5835b9-39d9-438b-817c-95f14c69a31e -version: 2 -date: '2021-09-16' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled - HTML Help (CHM) file from a remote url. This particular technique will load Windows - script code from a compiled help file. CHM files may contain nearly any file type - embedded, but only execute html/htm. Upon a successful execution, the following - script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, - JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe - upon execution. The "htm" and "html" file extensions were the only extensions observed - to be supported for the execution of Shortcut commands or WSH script code. During - investigation, identify script content origination. Review reputation of remote - IP and domain. Some instances, it is worth decompiling the .chm file to review its - original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: HH.EXE - selection2: - Image|endswith: hh.exe - selection3: - CommandLine: '*http*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Although unlikely, some legitimate applications may retrieve - a CHM remotely, filter as needed. -references: -- https://attack.mitre.org/techniques/T1218/001/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md -- https://lolbas-project.github.io/lolbas/Binaries/Hh/ -- https://blog.sevagas.com/?Hacking-around-HTA-files -- https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7 -- https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ -tags: - analytic_story: - - Suspicious Compiled HTML Activity - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 90 - message: An instance of $parent_proces_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ contacting a remote destination to potentally - download a malicious payload. - mitre_attack_id: - - T1218 - - T1218.001 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_html_help_using_infotech_storage_handlers.yml b/dev/endpoint/detect_html_help_using_infotech_storage_handlers.yml deleted file mode 100644 index 1232a942dc..0000000000 --- a/dev/endpoint/detect_html_help_using_infotech_storage_handlers.yml +++ /dev/null @@ -1,83 +0,0 @@ -name: Detect HTML Help Using InfoTech Storage Handlers -id: 0b2eefa5-5508-450d-b970-3dd2fb761aec -version: 2 -date: '2021-09-16' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled - HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique - will load Windows script code from a compiled help file, using InfoTech Storage - Handlers. itss.dll will load upon execution. Three InfoTech Storage handlers are - supported - ms-its, its, mk:@MSITStore. ITSS may be used to launch a specific html/htm - file from within a CHM file. CHM files may contain nearly any file type embedded. - Upon a successful execution, the following script engines may be used for execution - - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may - identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" - and "html" file extensions were the only extensions observed to be supported for - the execution of Shortcut commands or WSH script code. During investigation, identify - script content origination. hh.exe is natively found in C:\Windows\system32 and - C:\Windows\syswow64. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: HH.EXE - selection2: - Image|endswith: hh.exe - selection3: - CommandLine: - - '*its:*' - - '*mk:@MSITStore:*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: It is rare to see instances of InfoTech Storage Handlers being - used, but it does happen in some legitimate instances. Filter as needed. -references: -- https://attack.mitre.org/techniques/T1218/001/ -- https://www.kb.cert.org/vuls/id/851869 -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md -- https://lolbas-project.github.io/lolbas/Binaries/Hh/ -- https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7 -- https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ -tags: - analytic_story: - - Suspicious Compiled HTML Activity - - Living Off The Land - asset_type: Endpoint - confidence: 90 - impact: 80 - message: $process_name$ has been identified using Infotech Storage Handlers to load - a specific file within a CHM on $dest$ under user $user$. - mitre_attack_id: - - T1218 - - T1218.001 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 72 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_mshta_inline_hta_execution.yml b/dev/endpoint/detect_mshta_inline_hta_execution.yml deleted file mode 100644 index acda7a6efa..0000000000 --- a/dev/endpoint/detect_mshta_inline_hta_execution.yml +++ /dev/null @@ -1,78 +0,0 @@ -name: Detect mshta inline hta execution -id: a0873b32-5b68-11eb-ae93-0242ac130002 -version: 6 -date: '2021-09-16' -author: Bhavin Patel, Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies "mshta.exe" execution with inline protocol - handlers. "JavaScript", "VBScript", and "About" are the only supported options when - invoking HTA content directly on the command-line. The search will return the first - time and last time these command-line arguments were used for these executions, - as well as the target system, the user, process "mshta.exe" and its parent process. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: MSHTA.EXE - selection2: - Image|endswith: mshta.exe - selection3: - CommandLine: - - '*vbscript*' - - '*javascript*' - - '*about*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Although unlikely, some legitimate applications may exhibit - this behavior, triggering a false positive. -references: -- https://github.com/redcanaryco/AtomicTestHarnesses -- https://redcanary.com/blog/introducing-atomictestharnesses/ -- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing -tags: - analytic_story: - - Suspicious MSHTA Activity - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 90 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ executing with inline HTA, indicative of defense - evasion. - mitre_attack_id: - - T1218 - - T1218.005 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_mshta_renamed.yml b/dev/endpoint/detect_mshta_renamed.yml deleted file mode 100644 index 99c5eb03d7..0000000000 --- a/dev/endpoint/detect_mshta_renamed.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Detect mshta renamed -id: 8f45fcf0-5b68-11eb-ae93-0242ac130002 -version: 3 -date: '2022-04-07' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following analytic identifies renamed instances of mshta.exe executing. - Mshta.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. This - analytic utilizes the internal name of the PE to identify if is the legitimate mshta - binary. Further analysis should be performed to review the executed content and - validation it is the real mshta. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: MSHTA.EXE - Image|endswith: mshta.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Although unlikely, some legitimate applications may use a moved - copy of mshta.exe, but never renamed, triggering a false positive. -references: -- https://github.com/redcanaryco/AtomicTestHarnesses -- https://redcanary.com/blog/introducing-atomictestharnesses/ -tags: - analytic_story: - - Suspicious MSHTA Activity - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 80 - message: The following $process_name$ has been identified as renamed, spawning from - $parent_process_name$. - mitre_attack_id: - - T1218 - - T1218.005 - observable: - - name: user - type: User - role: - - Victim - - name: Computer - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_mshta_url_in_command_line.yml b/dev/endpoint/detect_mshta_url_in_command_line.yml deleted file mode 100644 index 4e5fb6b784..0000000000 --- a/dev/endpoint/detect_mshta_url_in_command_line.yml +++ /dev/null @@ -1,79 +0,0 @@ -name: Detect MSHTA Url in Command Line -id: 9b3af1e6-5b68-11eb-ae93-0242ac130002 -version: 2 -date: '2021-09-16' -author: Michael Haag, Splunk -status: production -type: TTP -description: This analytic identifies when Microsoft HTML Application Host (mshta.exe) - utility is used to make remote http connections. Adversaries may use mshta.exe to - proxy the download and execution of remote .hta files. The analytic identifies command - line arguments of http and https being used. This technique is commonly used by - malicious software to bypass preventative controls. The search will return the first - time and last time these command-line arguments were used for these executions, - as well as the target system, the user, process "rundll32.exe" and its parent process. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: MSHTA.EXE - selection2: - Image|endswith: mshta.exe - selection3: - CommandLine: - - '*http://*' - - '*https://*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: It is possible legitimate applications may perform this behavior - and will need to be filtered. -references: -- https://github.com/redcanaryco/AtomicTestHarnesses -- https://redcanary.com/blog/introducing-atomictestharnesses/ -- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing -tags: - analytic_story: - - Suspicious MSHTA Activity - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $est$ by user $user$ attempting to access a remote destination to - download an additional payload. - mitre_attack_id: - - T1218 - - T1218.005 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_outlook_exe_writing_a_zip_file.yml b/dev/endpoint/detect_outlook_exe_writing_a_zip_file.yml deleted file mode 100644 index d349ea95d9..0000000000 --- a/dev/endpoint/detect_outlook_exe_writing_a_zip_file.yml +++ /dev/null @@ -1,49 +0,0 @@ -name: Detect Outlook exe writing a zip file -id: a51bfe1a-94f0-4822-b1e4-16ae10145893 -version: 3 -date: '2020-07-21' -author: Bhavin Patel, Splunk -status: experimental -type: TTP -description: This search looks for execution of process `outlook.exe` where the process - is writing a `.zip` file to the disk. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - outlook.exe - - explorer.exe - condition: selection1 -how_to_implement: You must be ingesting data that records filesystem and process activity - from your hosts to populate the Endpoint data model. This is typically populated - via endpoint detection-and-response product, such as Carbon Black, or endpoint data - sources, such as Sysmon. -known_false_positives: It is not uncommon for outlook to write legitimate zip files - to the disk. -references: [] -tags: - analytic_story: - - Spearphishing Attachments - asset_type: Endpoint - confidence: 50 - impact: 50 - message: tbd - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: network diff --git a/dev/endpoint/detect_path_interception_by_creation_of_program_exe.yml b/dev/endpoint/detect_path_interception_by_creation_of_program_exe.yml deleted file mode 100644 index e01cc6c7e5..0000000000 --- a/dev/endpoint/detect_path_interception_by_creation_of_program_exe.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Detect Path Interception By Creation Of program exe -id: cbef820c-e1ff-407f-887f-0a9240a2d477 -version: 3 -date: '2020-07-03' -author: Patrick Bareiss, Splunk -status: production -type: TTP -description: 'The detection Detect Path Interception By Creation Of program exe is - detecting the abuse of unquoted service paths, which is a popular technique for - privilege escalation. ' -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: services.exe - condition: selection1 -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. -known_false_positives: unknown -references: -- https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae -tags: - analytic_story: - - Windows Persistence Techniques - asset_type: Endpoint - confidence: 70 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to perform privilege escalation by - using unquoted service paths. - mitre_attack_id: - - T1574.009 - - T1574 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.009/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml b/dev/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml deleted file mode 100644 index c621437ac1..0000000000 --- a/dev/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml +++ /dev/null @@ -1,73 +0,0 @@ -name: Detect Prohibited Applications Spawning cmd exe -id: dcfd6b40-42f9-469d-a433-2e53f7486664 -version: 6 -date: '2020-11-10' -author: Bhavin Patel, Splunk -status: production -type: Hunting -description: This search looks for executions of cmd.exe spawned by a process that - is often abused by attackers and that does not typically launch cmd.exe. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: Cmd.Exe - selection2: - Image|endswith: cmd.exe - condition: (selection1 or selection2) -how_to_implement: You must be ingesting data that records process activity from your - hosts and populates the Endpoint data model with the resultant dataset. This search - includes a lookup file, `prohibited_apps_launching_cmd.csv`, that contains a list - of processes that should not be spawning cmd.exe. You can modify this lookup to - better suit your environment. To successfully implement this search you need to - be ingesting information on process that include the name of the process responsible - for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` - node. In addition, confirm the latest CIM App 4.20 or higher is installed and the - latest TA for the endpoint product. -known_false_positives: There are circumstances where an application may legitimately - execute and interact with the Windows command-line interface. Investigate and modify - the lookup file, as appropriate. -references: [] -tags: - analytic_story: - - Suspicious Command-Line Executions - - Suspicious MSHTA Activity - - Suspicious Zoom Child Processes - - NOBELIUM Group - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ running prohibited applications. - mitre_attack_id: - - T1059 - - T1059.003 - observable: - - name: user - type: User - role: - - Victim - - name: Computer - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_rclone_command_line_usage.yml b/dev/endpoint/detect_rclone_command_line_usage.yml deleted file mode 100644 index b69ec28be1..0000000000 --- a/dev/endpoint/detect_rclone_command_line_usage.yml +++ /dev/null @@ -1,88 +0,0 @@ -name: Detect RClone Command-Line Usage -id: 32e0baea-b3f1-11eb-a2ce-acde48001122 -version: 2 -date: '2021-11-29' -author: Michael Haag, Splunk -status: production -type: TTP -description: This analytic identifies commonly used command-line arguments used by - `rclone.exe` to initiate a file transfer. Some arguments were negated as they are - specific to the configuration used by adversaries. In particular, an adversary may - list the files or directories of the remote file share using `ls` or `lsd`, which - is not indicative of malicious behavior. During triage, at this stage of a ransomware - event, exfiltration is about to occur or has already. Isolate the endpoint and continue - investigating by review file modifications and parallel processes. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: rclone.exe - selection2: - OriginalFileName: rclone.exe - selection3: - CommandLine: - - '*copy*' - - '*mega*' - - '*pcloud*' - - '*ftp*' - - '*--config*' - - '*--progress*' - - '*--no-check-certificate*' - - '*--ignore-existing*' - - '*--auto-confirm*' - - '*--transfers*' - - '*--multi-thread-streams*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited as this is restricted to - the Rclone process name. Filter or tune the analytic as needed. -references: -- https://redcanary.com/blog/rclone-mega-extortion/ -- https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations -- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ -- https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/ -tags: - analytic_story: - - DarkSide Ransomware - - Ransomware - asset_type: Endpoint - confidence: 70 - impact: 50 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to connect to a remote cloud service - to move files or folders. - mitre_attack_id: - - T1020 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_regasm_spawning_a_process.yml b/dev/endpoint/detect_regasm_spawning_a_process.yml deleted file mode 100644 index 8f50892de3..0000000000 --- a/dev/endpoint/detect_regasm_spawning_a_process.yml +++ /dev/null @@ -1,74 +0,0 @@ -name: Detect Regasm Spawning a Process -id: 72170ec5-f7d2-42f5-aefb-2b8be6aad15f -version: 1 -date: '2021-02-12' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies regasm.exe spawning a process. This - particular technique has been used in the wild to bypass application control products. - Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process - is rare from either process and should be investigated further. During investigation, - identify and retrieve the content being loaded. Review parallel processes for additional - suspicious behavior. Gather any other file modifications and review accordingly. - regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe - and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: regasm.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Although unlikely, limited instances of regasm.exe or regsvcs.exe - may cause a false positive. Filter based endpoint usage, command line arguments, - or process lineage. -references: -- https://attack.mitre.org/techniques/T1218/009/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md -- https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/ -- https://lolbas-project.github.io/lolbas/Binaries/Regasm/ -tags: - analytic_story: - - Suspicious Regsvcs Regasm Activity - - Living Off The Land - asset_type: Endpoint - confidence: 80 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ spawning a child process, typically not normal - behavior for $parent_process_name$. - mitre_attack_id: - - T1218 - - T1218.009 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_regasm_with_no_command_line_arguments.yml b/dev/endpoint/detect_regasm_with_no_command_line_arguments.yml deleted file mode 100644 index 80ab542f8f..0000000000 --- a/dev/endpoint/detect_regasm_with_no_command_line_arguments.yml +++ /dev/null @@ -1,74 +0,0 @@ -name: Detect Regasm with no Command Line Arguments -id: c3bc1430-04e7-4178-835f-047d8e6e97df -version: 3 -date: '2022-03-15' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies regasm.exe with no command line arguments. - This particular behavior occurs when another process injects into regasm.exe, no - command line arguments will be present. During investigation, identify any network - connections and parallel processes. Identify any suspicious module loads related - to credential dumping or file writes. Regasm.exe are natively found in `C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe` - and `C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe`. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: RegAsm.exe - selection2: - Image|endswith: regasm.exe - condition: (selection1 or selection2) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Although unlikely, limited instances of regasm.exe or may cause - a false positive. Filter based endpoint usage, command line arguments, or process - lineage. -references: -- https://attack.mitre.org/techniques/T1218/009/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md -- https://lolbas-project.github.io/lolbas/Binaries/Regasm/ -tags: - analytic_story: - - Suspicious Regsvcs Regasm Activity - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 70 - message: The process $process_name$ was spawned by $parent_process_name$ without - any command-line arguments on $dest$ by $user$. - mitre_attack_id: - - T1218 - - T1218.009 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_regsvcs_spawning_a_process.yml b/dev/endpoint/detect_regsvcs_spawning_a_process.yml deleted file mode 100644 index 0611d734fe..0000000000 --- a/dev/endpoint/detect_regsvcs_spawning_a_process.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Detect Regsvcs Spawning a Process -id: bc477b57-5c21-4ab6-9c33-668772e7f114 -version: 1 -date: '2021-02-12' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies regsvcs.exe spawning a process. This - particular technique has been used in the wild to bypass application control products. - Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process - is rare from either process and should be investigated further. During investigation, - identify and retrieve the content being loaded. Review parallel processes for additional - suspicious behavior. Gather any other file modifications and review accordingly. - regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe - and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: regsvcs.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Although unlikely, limited instances of regasm.exe or regsvcs.exe - may cause a false positive. Filter based endpoint usage, command line arguments, - or process lineage. -references: -- https://attack.mitre.org/techniques/T1218/009/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md -- https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/ -tags: - analytic_story: - - Suspicious Regsvcs Regasm Activity - - Living Off The Land - asset_type: Endpoint - confidence: 80 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ typically not normal for this process. - mitre_attack_id: - - T1218 - - T1218.009 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_regsvcs_with_no_command_line_arguments.yml b/dev/endpoint/detect_regsvcs_with_no_command_line_arguments.yml deleted file mode 100644 index 7b95ed41d5..0000000000 --- a/dev/endpoint/detect_regsvcs_with_no_command_line_arguments.yml +++ /dev/null @@ -1,74 +0,0 @@ -name: Detect Regsvcs with No Command Line Arguments -id: 6b74d578-a02e-4e94-a0d1-39440d0bf254 -version: 3 -date: '2022-03-15' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies regsvcs.exe with no command line arguments. - This particular behavior occurs when another process injects into regsvcs.exe, no - command line arguments will be present. During investigation, identify any network - connections and parallel processes. Identify any suspicious module loads related - to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe - and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: RegSvcs.exe - selection2: - Image|endswith: regsvcs.exe - condition: (selection1 or selection2) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Although unlikely, limited instances of regsvcs.exe may cause - a false positive. Filter based endpoint usage, command line arguments, or process - lineage. -references: -- https://attack.mitre.org/techniques/T1218/009/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md -- https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/ -tags: - analytic_story: - - Suspicious Regsvcs Regasm Activity - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 70 - message: The process $process_name$ was spawned by $parent_process_name$ without - any command-line arguments on $dest$ by $user$. - mitre_attack_id: - - T1218 - - T1218.009 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_renamed_7_zip.yml b/dev/endpoint/detect_renamed_7_zip.yml deleted file mode 100644 index 0ac2487150..0000000000 --- a/dev/endpoint/detect_renamed_7_zip.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Detect Renamed 7-Zip -id: 4057291a-b8cf-11eb-95fe-acde48001122 -version: 2 -date: '2021-09-16' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following analytic identifies renamed 7-Zip usage using Sysmon. At - this stage of an attack, review parallel processes and file modifications for data - that is staged or potentially have been exfiltrated. This analytic utilizes the - OriginalFileName to capture the renamed process. During triage, validate this is - the legitimate version of `7zip` by reviewing the PE metadata. In addition, review - parallel processes for further suspicious behavior. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: 7z*.exe - OriginalFileName: 7z*.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Limited false positives, however this analytic will need to - be modified for each environment if Sysmon is not used. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md -tags: - analytic_story: - - Collection and Staging - asset_type: Endpoint - confidence: 90 - impact: 30 - message: The following $process_name$ has been identified as renamed, spawning from - $parent_process_name$ on $dest$ by $user$. - mitre_attack_id: - - T1560.001 - - T1560 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 27 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_renamed_psexec.yml b/dev/endpoint/detect_renamed_psexec.yml deleted file mode 100644 index 1d2bd0b47f..0000000000 --- a/dev/endpoint/detect_renamed_psexec.yml +++ /dev/null @@ -1,76 +0,0 @@ -name: Detect Renamed PSExec -id: 683e6196-b8e8-11eb-9a79-acde48001122 -version: 4 -date: '2022-04-07' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following analytic identifies renamed instances of `PsExec.exe` being - utilized on an endpoint. Most instances, it is highly probable to capture `Psexec.exe` - or other SysInternal utility usage with the command-line argument of `-accepteula`. - During triage, validate this is the legitimate version of `PsExec` by reviewing - the PE metadata. In addition, review parallel processes for further suspicious behavior. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: psexec.c - Image|endswith: - - psexec64.exe - - psexec.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives should be present. It is possible some - third party applications may use older versions of PsExec, filter as needed. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1569.002/T1569.002.yaml -- https://redcanary.com/blog/threat-hunting-psexec-lateral-movement/ -tags: - analytic_story: - - SamSam Ransomware - - DHS Report TA18-074A - - HAFNIUM Group - - DarkSide Ransomware - - Active Directory Lateral Movement - - CISA AA22-320A - asset_type: Endpoint - confidence: 90 - impact: 30 - message: The following $process_name$ has been identified as renamed, spawning from - $parent_process_name$ on $dest$ by $user$. - mitre_attack_id: - - T1569 - - T1569.002 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 27 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_renamed_rclone.yml b/dev/endpoint/detect_renamed_rclone.yml deleted file mode 100644 index 7bcada4dcd..0000000000 --- a/dev/endpoint/detect_renamed_rclone.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Detect Renamed RClone -id: 6dca1124-b3ec-11eb-9328-acde48001122 -version: 2 -date: '2021-09-16' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following analytic identifies the usage of `rclone.exe`, renamed, - being used to exfiltrate data to a remote destination. RClone has been used by multiple - ransomware groups to exfiltrate data. In many instances, it will be downloaded from - the legitimate site and executed accordingly. During triage, isolate the endpoint - and begin to review parallel processes for additional behavior. At this stage, the - adversary may have staged data to be exfiltrated. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: rclone.exe - OriginalFileName: rclone.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited as this analytic identifies - renamed instances of `rclone.exe`. Filter as needed if there is a legitimate business - use case. -references: -- https://redcanary.com/blog/rclone-mega-extortion/ -- https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations -- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ -tags: - analytic_story: - - DarkSide Ransomware - - Ransomware - asset_type: Endpoint - confidence: 90 - impact: 30 - message: The following $process_name$ has been identified as renamed, spawning from - $parent_process_name$ on $dest$ by $user$. - mitre_attack_id: - - T1020 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 27 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_renamed_winrar.yml b/dev/endpoint/detect_renamed_winrar.yml deleted file mode 100644 index 5b07e8c18b..0000000000 --- a/dev/endpoint/detect_renamed_winrar.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Detect Renamed WinRAR -id: 1b7bfb2c-b8e6-11eb-99ac-acde48001122 -version: 3 -date: '2021-09-16' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following analtyic identifies renamed instances of `WinRAR.exe`. - In most cases, it is not common for WinRAR to be used renamed, however it is common - to be installed by a third party application and executed from a non-standard path. - During triage, validate additional metadata from the binary that this is `WinRAR`. - Review parallel processes and file modifications. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - winrar.exe - - rar.exe - OriginalFileName: WinRAR.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Unknown. It is possible third party applications use renamed - instances of WinRAR. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md -tags: - analytic_story: - - Collection and Staging - - CISA AA22-277A - asset_type: Endpoint - confidence: 90 - impact: 30 - message: The following $process_name$ has been identified as renamed, spawning from - $parent_process_name$ on $dest$ by $user$. - mitre_attack_id: - - T1560.001 - - T1560 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 27 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_sharphound_command_line_arguments.yml b/dev/endpoint/detect_sharphound_command_line_arguments.yml deleted file mode 100644 index c7a5be1d5a..0000000000 --- a/dev/endpoint/detect_sharphound_command_line_arguments.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Detect SharpHound Command-Line Arguments -id: a0bdd2f6-c2ff-11eb-b918-acde48001122 -version: 1 -date: '2021-06-01' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies common command-line arguments used - by SharpHound `-collectionMethod` and `invoke-bloodhound`. Being the script is FOSS, - function names may be modified, but these changes are dependent upon the operator. - In most instances the defaults are used. This analytic works to identify the common - command-line attributes used. It does not cover the entirety of every argument in - order to avoid false positives. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*-collectionMethod*' - - '*invoke-bloodhound*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: False positives should be limited as the arguments used are - specific to SharpHound. Filter as needed or add more command-line arguments as needed. -references: -- https://attack.mitre.org/software/S0521/ -- https://thedfirreport.com/?s=bloodhound -- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors -- https://github.com/BloodHoundAD/SharpHound3 -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk -tags: - analytic_story: - - Discovery Techniques - - Ransomware - asset_type: Endpoint - confidence: 80 - impact: 30 - message: Possible SharpHound command-Line arguments identified on $dest$ - mitre_attack_id: - - T1087.002 - - T1069.001 - - T1482 - - T1087.001 - - T1087 - - T1069.002 - - T1069 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 24 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_sharphound_file_modifications.yml b/dev/endpoint/detect_sharphound_file_modifications.yml deleted file mode 100644 index 7e61958485..0000000000 --- a/dev/endpoint/detect_sharphound_file_modifications.yml +++ /dev/null @@ -1,84 +0,0 @@ -name: Detect SharpHound File Modifications -id: 42b4b438-beed-11eb-ba1d-acde48001122 -version: 2 -date: '2022-10-09' -author: Michael Haag, Splunk -status: production -type: TTP -description: SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. - SharpHound will query the domain controller and begin gathering all the data related - to the domain and trusts. For output, it will drop a .zip file upon completion following - a typical pattern that is often not changed. This analytic focuses on the default - file name scheme. Note that this may be evaded with different parameters within - SharpHound, but that depends on the operator. `-randomizefilenames` and `-encryptzip` - are two examples. In addition, executing SharpHound via .exe or .ps1 without any - command-line arguments will still perform activity and dump output to the default - filename. Example default filename `20210601181553_BloodHound.zip`. SharpHound creates - multiple temp files following the same pattern `20210601182121_computers.json`, - `domains.json`, `gpos.json`, `ous.json` and `users.json`. Tuning may be required, - or remove these json's entirely if it is too noisy. During traige, review parallel - processes for further suspicious behavior. Typically, the process executing the - `.ps1` ingestor will be PowerShell. -data_source: -- Sysmon Event ID 11 -search: - selection1: - Filesystem.file_name: - - '*bloodhound.zip' - - '*_computers.json' - - '*_gpos.json' - - '*_domains.json' - - '*_users.json' - - '*_groups.json' - - '*_ous.json' - - '*_containers.json' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on file modifications that include the name of the process, and file, responsible - for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` - node. -known_false_positives: False positives should be limited as the analytic is specific - to a filename with extension .zip. Filter as needed. -references: -- https://attack.mitre.org/software/S0521/ -- https://thedfirreport.com/?s=bloodhound -- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors -- https://github.com/BloodHoundAD/SharpHound3 -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk -tags: - analytic_story: - - Discovery Techniques - - Ransomware - asset_type: Endpoint - confidence: 80 - impact: 30 - message: Potential SharpHound file modifications identified on $dest$ - mitre_attack_id: - - T1087.002 - - T1069.001 - - T1482 - - T1087.001 - - T1087 - - T1069.002 - - T1069 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 24 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_sharphound_usage.yml b/dev/endpoint/detect_sharphound_usage.yml deleted file mode 100644 index 6ca204779a..0000000000 --- a/dev/endpoint/detect_sharphound_usage.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Detect SharpHound Usage -id: dd04b29a-beed-11eb-87bc-acde48001122 -version: 2 -date: '2021-05-27' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies SharpHound binary usage by using the - original filena,e. In addition to renaming the PE, other coverage is available to - detect command-line arguments. This particular analytic looks for the original_file_name - of `SharpHound.exe` and the process name. It is possible older instances of SharpHound.exe - have different original filenames. Dependent upon the operator, the code may be - re-compiled and the attributes removed or changed to anything else. During triage, - review the metadata of the binary in question. Review parallel processes for suspicious - behavior. Identify the source of this binary. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: SharpHound.exe - selection2: - Image|endswith: sharphound.exe - condition: (selection1 or selection2) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited as this is specific to a - file attribute not used by anything else. Filter as needed. -references: -- https://attack.mitre.org/software/S0521/ -- https://thedfirreport.com/?s=bloodhound -- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors -- https://github.com/BloodHoundAD/SharpHound3 -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk -tags: - analytic_story: - - Discovery Techniques - - Ransomware - asset_type: Endpoint - confidence: 80 - impact: 30 - message: Potential SharpHound binary identified on $dest$ - mitre_attack_id: - - T1087.002 - - T1069.001 - - T1482 - - T1087.001 - - T1087 - - T1069.002 - - T1069 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 24 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml b/dev/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml deleted file mode 100644 index e642fe8a28..0000000000 --- a/dev/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml +++ /dev/null @@ -1,55 +0,0 @@ -name: Detect Use of cmd exe to Launch Script Interpreters -id: b89919ed-fe5f-492c-b139-95dbb162039e -version: 4 -date: '2020-07-21' -author: Bhavin Patel, Mauricio Velazco, Splunk -status: production -type: TTP -description: This search looks for the execution of the cscript.exe or wscript.exe - processes, with a parent of cmd.exe. The search will return the count, the first - and last time this execution was seen on a machine, the user, and the destination - of the machine -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - wscript.exe - - cscript.exe - ParentImage: cmd.exe - condition: (selection1) -how_to_implement: To successfully implement this search, you must be ingesting data - that records process activity from your hosts to populate the endpoint data model - in the processes node. If you are using Sysmon, you must have at least version 6.0.4 - of the Sysmon TA. -known_false_positives: Some legitimate applications may exhibit this behavior. -references: [] -tags: - analytic_story: - - 'Emotet Malware DHS Report TA18-201A ' - - Suspicious Command-Line Executions - - Azorult - asset_type: Endpoint - confidence: 50 - impact: 70 - message: cmd.exe launching script interpreters on $dest$ - mitre_attack_id: - - T1059 - - T1059.003 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/cmd_spawns_cscript/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detection_of_tools_built_by_nirsoft.yml b/dev/endpoint/detection_of_tools_built_by_nirsoft.yml deleted file mode 100644 index 5b8bef6042..0000000000 --- a/dev/endpoint/detection_of_tools_built_by_nirsoft.yml +++ /dev/null @@ -1,45 +0,0 @@ -name: Detection of tools built by NirSoft -id: 3d8d201c-aa03-422d-b0ee-2e5ecf9718c0 -version: 3 -date: '2020-07-21' -author: Bhavin Patel, Splunk -status: experimental -type: TTP -description: This search looks for specific command-line arguments that may indicate - the execution of tools made by Nirsoft, which are legitimate, but may be abused - by attackers. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '* /stext *' - - '* /scomma *' - condition: (selection1) -how_to_implement: You must be ingesting endpoint data that tracks process activity, - including parent-child relationships from your endpoints to populate the Endpoint - data model in the Processes node. The command-line arguments are mapped to the "process" - field in the Endpoint data model. -known_false_positives: While legitimate, these NirSoft tools are prone to abuse. You - should verfiy that the tool was used for a legitimate purpose. -references: [] -tags: - analytic_story: - - 'Emotet Malware DHS Report TA18-201A ' - asset_type: Endpoint - confidence: 50 - impact: 50 - message: tbd - mitre_attack_id: - - T1072 - observable: - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint diff --git a/dev/endpoint/disable_amsi_through_registry.yml b/dev/endpoint/disable_amsi_through_registry.yml deleted file mode 100644 index bd320621f0..0000000000 --- a/dev/endpoint/disable_amsi_through_registry.yml +++ /dev/null @@ -1,55 +0,0 @@ -name: Disable AMSI Through Registry -id: 9c27ec42-d338-11eb-9044-acde48001122 -version: 2 -date: '2022-01-26' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: this search is to identify modification in registry to disable AMSI windows - feature to evade detections. This technique was seen in several ransomware, RAT - and even APT to impaire defenses of the compromise machine and to be able to execute - payload with minimal alert as much as possible. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000000' - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\AmsiEnable' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: network operator may disable this feature of windows but not - so common. -references: -- https://blog.f-secure.com/hunting-for-amsi-bypasses/ -- https://gist.github.com/rxwx/8955e5abf18dc258fd6b43a3a7f4dbf9 -tags: - analytic_story: - - Ransomware - - Windows Registry Abuse - asset_type: Endpoint - confidence: 50 - impact: 50 - message: Disable AMSI Through Registry - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25.0 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disable_defender_blockatfirstseen_feature.yml b/dev/endpoint/disable_defender_blockatfirstseen_feature.yml deleted file mode 100644 index 9820309477..0000000000 --- a/dev/endpoint/disable_defender_blockatfirstseen_feature.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Disable Defender BlockAtFirstSeen Feature -id: 2dd719ac-3021-11ec-97b4-acde48001122 -version: 2 -date: '2022-01-26' -author: Teoderick Contreras -status: production -type: TTP -description: This analytic is intended to detect a suspicious modification of the - Windows registry to disable a Windows Defender feature. This technique is intended - to bypass or evade detection from Windows Defender AV, specifically the BlockAtFirstSeen - feature where it blocks suspicious files the first time seen on the host. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: DisableBlockAtFirstSeen - TargetObject: '*\\Microsoft\\Windows Defender\\SpyNet*' - Details: '0x00000001' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the registry value name, registry path, and registry value data from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: admin or user may choose to disable windows defender product -references: -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ -tags: - analytic_story: - - IcedID - - Windows Registry Abuse - - Azorult - asset_type: Endpoint - confidence: 70 - impact: 70 - message: modified/added/deleted registry entry $registry_path$ in $dest$ - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disable_defender_enhanced_notification.yml b/dev/endpoint/disable_defender_enhanced_notification.yml deleted file mode 100644 index 1227045c83..0000000000 --- a/dev/endpoint/disable_defender_enhanced_notification.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Disable Defender Enhanced Notification -id: dc65678c-301f-11ec-8e30-acde48001122 -version: 2 -date: '2022-01-26' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is intended to detect a suspicious modification of registry - to disable windows defender features. This technique attempts to bypass or evade - detection from Windows Defender AV, specifically the Enhanced Notification feature - where a user or admin would receive alerts. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: DisableEnhancedNotifications - TargetObject: '*Microsoft\\Windows Defender\\Reporting*' - Details: '0x00000001' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the registry value name, registry path, and registry value data executions - from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 - of the Sysmon TA. -known_false_positives: user may choose to disable windows defender AV -references: -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ -tags: - analytic_story: - - IcedID - - Windows Registry Abuse - - Azorult - asset_type: Endpoint - confidence: 70 - impact: 70 - message: modified/added/deleted registry entry $registry_path$ in $dest$ - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disable_defender_mpengine_registry.yml b/dev/endpoint/disable_defender_mpengine_registry.yml deleted file mode 100644 index e11baba919..0000000000 --- a/dev/endpoint/disable_defender_mpengine_registry.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Disable Defender MpEngine Registry -id: cc391750-3024-11ec-955a-acde48001122 -version: 2 -date: '2022-01-26' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This particular behavior is typically executed when an adversary or malware - gains access to an endpoint and begins to perform execution and to evade detections. - Usually, a batch (.bat) file will be executed and multiple registry and scheduled - task modifications will occur. During triage, review parallel processes and identify - any further file modifications. Endpoint should be isolated. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: MpEnablePus - TargetObject: '*\\Policies\\Microsoft\\Windows Defender\\MpEngine*' - Details: '0x00000000' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the registry value name, registry path, and registry value data from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: admin or user may choose to disable windows defender product -references: -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ -tags: - analytic_story: - - IcedID - - Windows Registry Abuse - asset_type: Endpoint - confidence: 70 - impact: 70 - message: modified/added/deleted registry entry $registry_path$ in $dest$ - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disable_defender_spynet_reporting.yml b/dev/endpoint/disable_defender_spynet_reporting.yml deleted file mode 100644 index 95f067dec7..0000000000 --- a/dev/endpoint/disable_defender_spynet_reporting.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Disable Defender Spynet Reporting -id: 898debf4-3021-11ec-ba7c-acde48001122 -version: 2 -date: '2022-01-26' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is intended to detect a suspicious modification of registry - to disable Windows Defender feature. This technique is intended to bypass or evade - detection from Windows Defender AV product, specifically the spynet reporting for - Defender telemetry. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: SpynetReporting - TargetObject: '*\\Microsoft\\Windows Defender\\SpyNet*' - Details: '0x00000000' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the registry value name, registry path, and registry value data from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: admin or user may choose to disable windows defender product -references: -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ -tags: - analytic_story: - - IcedID - - Windows Registry Abuse - - Azorult - - Qakbot - asset_type: Endpoint - confidence: 70 - impact: 70 - message: modified/added/deleted registry entry $registry_path$ in $dest$ - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disable_defender_submit_samples_consent_feature.yml b/dev/endpoint/disable_defender_submit_samples_consent_feature.yml deleted file mode 100644 index d97e6d790e..0000000000 --- a/dev/endpoint/disable_defender_submit_samples_consent_feature.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Disable Defender Submit Samples Consent Feature -id: 73922ff8-3022-11ec-bf5e-acde48001122 -version: 2 -date: '2022-01-26' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is intended to detect a suspicious modification of the - Windows registry to disable a Windows Defender feature. This technique is intended - to bypass or evade detection from Windows Defender AV, specifically the feature - that submits samples for further analysis. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: SubmitSamplesConsent - TargetObject: '*\\Microsoft\\Windows Defender\\SpyNet*' - Details: '0x00000000' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the registry value name, registry path, and registry value data from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: admin or user may choose to disable windows defender product -references: -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ -tags: - analytic_story: - - IcedID - - Windows Registry Abuse - - Azorult - asset_type: Endpoint - confidence: 70 - impact: 70 - message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disable_etw_through_registry.yml b/dev/endpoint/disable_etw_through_registry.yml deleted file mode 100644 index bc8d097596..0000000000 --- a/dev/endpoint/disable_etw_through_registry.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Disable ETW Through Registry -id: f0eacfa4-d33f-11eb-8f9d-acde48001122 -version: 2 -date: '2022-01-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: this search is to identify modification in registry to disable ETW windows - feature to evade detections. This technique was seen in several ransomware, RAT - and even APT to impaire defenses of the compromise machine and to be able to execute - payload with minimal alert as much as possible. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000000' - TargetObject: '*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: network operator may disable this feature of windows but not - so common. -references: -- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ -tags: - analytic_story: - - Ransomware - - Windows Registry Abuse - asset_type: Endpoint - confidence: 50 - impact: 50 - message: Disable ETW Through Registry - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25.0 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disable_logs_using_wevtutil.yml b/dev/endpoint/disable_logs_using_wevtutil.yml deleted file mode 100644 index 73234ddbff..0000000000 --- a/dev/endpoint/disable_logs_using_wevtutil.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Disable Logs Using WevtUtil -id: 236e7c8e-c9d9-11eb-a824-acde48001122 -version: 1 -date: '2021-06-10' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect execution of wevtutil.exe to disable logs. This - technique was seen in several ransomware to disable the event logs to evade alerts - and detections. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*sl*' - Image|endswith: wevtutil.exe - selection2: - CommandLine: '*/e:false*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: network operator may disable audit event logs for debugging - purposes. -references: -- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/ -tags: - analytic_story: - - Ransomware - asset_type: Endpoint - confidence: 80 - impact: 30 - message: WevtUtil.exe used to disable Event Logging on $dest - mitre_attack_id: - - T1070 - - T1070.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 24 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disable_registry_tool.yml b/dev/endpoint/disable_registry_tool.yml deleted file mode 100644 index 4382f1c345..0000000000 --- a/dev/endpoint/disable_registry_tool.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Disable Registry Tool -id: cd2cf33c-9201-11eb-a10a-acde48001122 -version: 2 -date: '2022-01-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search identifies modification of registry to disable the regedit - or registry tools of the windows operating system. Since registry tool is a swiss - knife in analyzing registry, malware such as RAT or trojan Spy disable this application - to prevent the removal of their registry entry such as persistence, file less components - and defense evasion. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: admin may disable this application for non technical user. -references: -- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 100 - impact: 40 - message: Disabled Registry Tools on $dest$ - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 40 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - source: WinEventLog:System - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disable_schedule_task.yml b/dev/endpoint/disable_schedule_task.yml deleted file mode 100644 index 4c1d6ead21..0000000000 --- a/dev/endpoint/disable_schedule_task.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Disable Schedule Task -id: db596056-3019-11ec-a9ff-acde48001122 -version: 1 -date: '2021-10-18' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to detect a suspicious commandline to disable existing - schedule task. This technique is used by adversaries or commodity malware like IcedID - to disable security application (AV products) in the targetted host to evade detections. - This TTP is a good pivot to check further why and what other process run before - and after this detection. check which process execute the commandline and what task - is disabled. parent child process is quite valuable in this scenario too. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*/change*' - Image|endswith: schtasks.exe - selection2: - CommandLine: '*/disable*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: admin may disable problematic schedule task -references: -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ -tags: - analytic_story: - - IcedID - - Living Off The Land - asset_type: Endpoint - confidence: 80 - impact: 70 - message: schtask process with commandline $process$ to disable schedule task in - $dest$ - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_schtask/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disable_security_logs_using_minint_registry.yml b/dev/endpoint/disable_security_logs_using_minint_registry.yml deleted file mode 100644 index 4c2b74b3f7..0000000000 --- a/dev/endpoint/disable_security_logs_using_minint_registry.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Disable Security Logs Using MiniNt Registry -id: 39ebdc68-25b9-11ec-aec7-acde48001122 -version: 2 -date: '2022-01-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to detect a suspicious registry modification to disable - security audit logs. This technique was shared by a researcher to disable Security - logs of windows by adding this registry. The Windows will think it is WinPE and - will not log any event to the Security Log -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: '*\\Control\\MiniNt\\*' - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: Unknown. -references: -- https://twitter.com/0gtweet/status/1182516740955226112 -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 100 - impact: 80 - message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/minint_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disable_show_hidden_files.yml b/dev/endpoint/disable_show_hidden_files.yml deleted file mode 100644 index 1b852a02ef..0000000000 --- a/dev/endpoint/disable_show_hidden_files.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Disable Show Hidden Files -id: 6f3ccfa2-91fe-11eb-8f9b-acde48001122 -version: 2 -date: '2022-01-27' -author: Teoderick Contreras, Mauricio Velazco, Splunk -status: production -type: TTP -description: The following analytic is to identify a modification in the Windows registry - to prevent users from seeing all the files with hidden attributes. This event or - techniques are known on some worm and trojan spy malware that will drop hidden files - on the infected machine. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: - - '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt' - - '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden' - selection2: - Details: '0x00000000' - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden' - condition: selection1 or selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: unknown -references: -- https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - - Azorult - asset_type: Endpoint - confidence: 100 - impact: 40 - message: Disabled 'Show Hidden Files' on $dest$ - mitre_attack_id: - - T1564.001 - - T1562.001 - - T1564 - - T1562 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 40 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - source: WinEventLog:System - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disable_uac_remote_restriction.yml b/dev/endpoint/disable_uac_remote_restriction.yml deleted file mode 100644 index 3300a6b17c..0000000000 --- a/dev/endpoint/disable_uac_remote_restriction.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Disable UAC Remote Restriction -id: 9928b732-210e-11ec-b65e-acde48001122 -version: 2 -date: '2022-01-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to detect a suspicious modification of registry to disable - UAC remote restriction. This technique was well documented in Microsoft page where - attacker may modify this registry value to bypassed UAC feature of windows host. - This is a good indicator that some tries to bypassed UAC to suspicious process or - gain privilege escalation. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: LocalAccountTokenFilterPolicy - TargetObject: '*\\CurrentVersion\\Policies\\System*' - Details: '0x00000001' - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: admin may set this policy for non-critical machine. -references: -- https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/user-account-control-and-remote-restriction -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Suspicious Windows Registry Activities - - Windows Registry Abuse - asset_type: Endpoint - confidence: 100 - impact: 80 - message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ - mitre_attack_id: - - T1548.002 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/LocalAccountTokenFilterPolicy/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disable_windows_app_hotkeys.yml b/dev/endpoint/disable_windows_app_hotkeys.yml deleted file mode 100644 index 6aa869654d..0000000000 --- a/dev/endpoint/disable_windows_app_hotkeys.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Disable Windows App Hotkeys -id: 1490f224-ad8b-11eb-8c4f-acde48001122 -version: 2 -date: '2022-01-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic detects a suspicious registry modification to disable Windows - hotkey (shortcut keys) for native Windows applications. This technique is commonly - used to disable certain or several Windows applications like `taskmgr.exe` and `cmd.exe`. - This technique is used to impair the analyst in analyzing and removing the attacker - implant in compromised systems. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: HotKey Disabled - TargetObject: '*\\Windows NT\\CurrentVersion\\Image File Execution Options\\*' - Registry.registry_value_name: Debugger - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: unknown -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -tags: - analytic_story: - - XMRig - - Windows Registry Abuse - asset_type: Endpoint - confidence: 100 - impact: 40 - message: Disabled 'Windows App Hotkeys' on $dest$ - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 40 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disable_windows_behavior_monitoring.yml b/dev/endpoint/disable_windows_behavior_monitoring.yml deleted file mode 100644 index 3dffd94849..0000000000 --- a/dev/endpoint/disable_windows_behavior_monitoring.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Disable Windows Behavior Monitoring -id: 79439cae-9200-11eb-a4d3-acde48001122 -version: 2 -date: '2022-01-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to identifies a modification in registry to disable the - windows denfender real time behavior monitoring. This event or technique is commonly - seen in RAT, bot, or Trojan to disable AV to evade detections. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: - - '*\\Real-Time Protection\\DisableScriptScanning' - - '*\\Real-Time Protection\\DisableIOAVProtection' - - '*\\Real-Time Protection\\DisableIntrusionPreventionSystem' - - '*\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring' - - '*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable' - - '*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection' - - '*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: admin or user may choose to disable this windows features. -references: -- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Ransomware - - Revil Ransomware - - Windows Registry Abuse - - Azorult - asset_type: Endpoint - confidence: 100 - impact: 40 - message: Windows Defender real time behavior monitoring disabled on $dest - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 40 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - source: WinEventLog:System - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disable_windows_smartscreen_protection.yml b/dev/endpoint/disable_windows_smartscreen_protection.yml deleted file mode 100644 index 324f4b8316..0000000000 --- a/dev/endpoint/disable_windows_smartscreen_protection.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Disable Windows SmartScreen Protection -id: 664f0fd0-91ff-11eb-a56f-acde48001122 -version: 2 -date: '2022-01-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following search identifies a modification of registry to disable - the smartscreen protection of windows machine. This is windows feature provide an - early warning system against website that might engage in phishing attack or malware - distribution. This modification are seen in RAT malware to cover their tracks upon - downloading other of its component or other payload. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: 'Off' - TargetObject: '*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: admin or user may choose to disable this windows features. -references: -- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 50 - impact: 50 - message: The Windows Smartscreen was disabled on $dest$ by $user$. - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - source: WinEventLog:System - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disabling_cmd_application.yml b/dev/endpoint/disabling_cmd_application.yml deleted file mode 100644 index 617ba77ac0..0000000000 --- a/dev/endpoint/disabling_cmd_application.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Disabling CMD Application -id: ff86077c-9212-11eb-a1e6-acde48001122 -version: 2 -date: '2022-01-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: this search is to identify modification in registry to disable cmd prompt - application. This technique is commonly seen in RAT, Trojan or WORM to prevent triaging - or deleting there samples through cmd application which is one of the tool of analyst - to traverse on directory and files. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: '*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: admin may disable this application for non technical user. -references: -- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 50 - impact: 50 - message: The Windows command prompt was disabled on $dest$ by $user$. - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - source: WinEventLog:System - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disabling_controlpanel.yml b/dev/endpoint/disabling_controlpanel.yml deleted file mode 100644 index a0afa2d1ba..0000000000 --- a/dev/endpoint/disabling_controlpanel.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Disabling ControlPanel -id: 6ae0148e-9215-11eb-a94a-acde48001122 -version: 2 -date: '2022-01-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: this search is to identify registry modification to disable control panel - window. This technique is commonly seen in malware to prevent their artifacts , - persistence removed on the infected machine. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: admin may disable this application for non technical user. -references: -- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 50 - impact: 50 - message: The Windows Control Panel was disabled on $dest$ by $user$. - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - source: WinEventLog:System - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disabling_defender_services.yml b/dev/endpoint/disabling_defender_services.yml deleted file mode 100644 index 693bbabfce..0000000000 --- a/dev/endpoint/disabling_defender_services.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Disabling Defender Services -id: 911eacdc-317f-11ec-ad30-acde48001122 -version: 2 -date: '2022-01-28' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This particular behavior is typically executed when an adversaries or - malware gains access to an endpoint and beings to perform execution and to evade - detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled - task modifications will occur. During triage, review parallel processes and identify - any further file modifications. Endpoint should be isolated. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: - - '*WdBoot*' - - '*WdFilter*' - - '*WdNisDrv*' - - '*WdNisSvc*' - - '*WinDefend*' - - '*SecurityHealthService*' - selection2: - TargetObject: '*\\System\\CurrentControlSet\\Services\\*' - selection3: - Details: '0x00000004' - Registry.registry_value_name: Start - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: admin or user may choose to disable windows defender product -references: -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ -tags: - analytic_story: - - IcedID - - Windows Registry Abuse - asset_type: Endpoint - confidence: 70 - impact: 70 - message: modified/added/deleted registry entry $registry_path$ in $dest$ - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon2.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disabling_firewall_with_netsh.yml b/dev/endpoint/disabling_firewall_with_netsh.yml deleted file mode 100644 index 08eb5e12cc..0000000000 --- a/dev/endpoint/disabling_firewall_with_netsh.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Disabling Firewall with Netsh -id: 6860a62c-9203-11eb-9e05-acde48001122 -version: 2 -date: '2021-03-31' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This search is to identifies suspicious firewall disabling using netsh - application. this technique is commonly seen in malware that tries to communicate - or download its component or other payload to its C2 server. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: netsh.exe - selection2: - Image|endswith: netsh.exe - selection3: - CommandLine: '*firewall*' - selection4: - CommandLine: - - '*off*' - - '*disable*' - condition: (selection1 or selection2) and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: admin may disable firewall during testing or fixing network - problem. -references: -- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html -tags: - analytic_story: - - Windows Defense Evasion Tactics - asset_type: Endpoint - confidence: 50 - impact: 50 - message: The Windows Firewall was disabled on $dest$ by $user$. - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - source: WinEventLog:System - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disabling_folderoptions_windows_feature.yml b/dev/endpoint/disabling_folderoptions_windows_feature.yml deleted file mode 100644 index a39ee229d8..0000000000 --- a/dev/endpoint/disabling_folderoptions_windows_feature.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Disabling FolderOptions Windows Feature -id: 83776de4-921a-11eb-868a-acde48001122 -version: 2 -date: '2022-01-28' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to identify registry modification to disable folder options - feature of windows to show hidden files, file extension and etc. This technique - used by malware in combination if disabling show hidden files feature to hide their - files and also to hide the file extension to lure the user base on file icons or - fake file extensions. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: admin may disable this application for non technical user. -references: -- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 50 - impact: 50 - message: The Windows Folder Options, to hide files, was disabled on $dest$ by $user$. - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - source: WinEventLog:System - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disabling_norun_windows_app.yml b/dev/endpoint/disabling_norun_windows_app.yml deleted file mode 100644 index 77286fb93b..0000000000 --- a/dev/endpoint/disabling_norun_windows_app.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Disabling NoRun Windows App -id: de81bc46-9213-11eb-adc9-acde48001122 -version: 2 -date: '2022-01-28' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to identify modification of registry to disable run application - in window start menu. this application is known to be a helpful shortcut to windows - OS user to run known application and also to execute some reg or batch script. This - technique is used malware to make cleaning of its infection more harder by preventing - known application run easily through run shortcut. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: admin may disable this application for non technical user. -references: -- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry -- https://blog.malwarebytes.com/detections/pum-optional-norun/ -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 50 - impact: 50 - message: The Windows registry was modified to disable run application in window - start menu on $dest$ by $user$. - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - source: WinEventLog:System - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disabling_remote_user_account_control.yml b/dev/endpoint/disabling_remote_user_account_control.yml deleted file mode 100644 index 5cf644101d..0000000000 --- a/dev/endpoint/disabling_remote_user_account_control.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Disabling Remote User Account Control -id: bbc644bc-37df-4e1a-9c88-ec9a53e2038c -version: 4 -date: '2020-11-18' -author: David Dorsey, Patrick Bareiss, Splunk -status: production -type: TTP -description: The search looks for modifications to registry keys that control the - enforcement of Windows User Account Control (UAC). -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000000' - TargetObject: '*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA*' - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. - The data used for this search is typically generated via logs that report registry - modifications. -known_false_positives: This registry key may be modified via administrators to implement - a change in system policy. This type of change should be a very rare occurrence. -references: [] -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Suspicious Windows Registry Activities - - Remcos - - Windows Registry Abuse - - Azorult - - AgentTesla - asset_type: Endpoint - confidence: 60 - impact: 70 - message: The Windows registry keys that control the enforcement of Windows User - Account Control (UAC) were modified on $dest$ by $user$. - mitre_attack_id: - - T1548.002 - - T1548 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 42 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disabling_systemrestore_in_registry.yml b/dev/endpoint/disabling_systemrestore_in_registry.yml deleted file mode 100644 index 7062e948b6..0000000000 --- a/dev/endpoint/disabling_systemrestore_in_registry.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Disabling SystemRestore In Registry -id: f4f837e2-91fb-11eb-8bf6-acde48001122 -version: 2 -date: '2022-01-28' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following search identifies the modification of registry related - in disabling the system restore of a machine. This event or behavior are seen in - some RAT malware to make the restore of the infected machine difficult and keep - their infection on the box. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: - - '*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableConfig' - - '*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableSR' - - '*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig' - - '*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: in some cases admin can disable systemrestore on a machine. -references: -- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 70 - impact: 70 - message: The Windows registry was modified to disable system restore on $dest$ by - $user$. - mitre_attack_id: - - T1490 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - source: WinEventLog:System - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disabling_task_manager.yml b/dev/endpoint/disabling_task_manager.yml deleted file mode 100644 index b50db388bf..0000000000 --- a/dev/endpoint/disabling_task_manager.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Disabling Task Manager -id: dac279bc-9202-11eb-b7fb-acde48001122 -version: 2 -date: '2022-01-28' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to identifies modification of registry to disable the - task manager of windows operating system. this event or technique are commonly seen - in malware such as RAT, Trojan, TrojanSpy or worm to prevent the user to terminate - their process. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: admin may disable this application for non technical user. -references: -- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry -- https://blog.talosintelligence.com/2020/05/threat-roundup-0424-0501.html -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 60 - impact: 70 - message: The Windows Task Manager was disabled on $dest$ by $user$. - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 42 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - source: WinEventLog:System - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/dev/endpoint/dllhost_with_no_command_line_arguments_with_network.yml deleted file mode 100644 index 007d5d6d1a..0000000000 --- a/dev/endpoint/dllhost_with_no_command_line_arguments_with_network.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: DLLHost with no Command Line Arguments with Network -id: f1c07594-a141-11eb-8407-acde48001122 -version: 3 -date: '2022-03-15' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies DLLHost.exe with no command line arguments - with a network connection. It is unusual for DLLHost.exe to execute with no command - line arguments present. This particular behavior is common with malicious software, - including Cobalt Strike. During investigation, triage any network connections and - parallel processes. Identify any suspicious module loads related to credential dumping - or file writes. DLLHost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: dllhost.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. -known_false_positives: Although unlikely, some legitimate third party applications - may use a moved copy of dllhost, triggering a false positive. -references: -- https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile -- https://www.cobaltstrike.com/blog/learn-pipe-fitting-for-all-of-your-offense-projects/ -tags: - analytic_story: - - Cobalt Strike - asset_type: Endpoint - confidence: 70 - impact: 70 - message: The process $process_name$ was spawned by $parent_image$ without any command-line - arguments on $dest$ by $user$. - mitre_attack_id: - - T1055 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_image - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_dllhost.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/domain_account_discovery_with_dsquery.yml b/dev/endpoint/domain_account_discovery_with_dsquery.yml deleted file mode 100644 index 99901e72aa..0000000000 --- a/dev/endpoint/domain_account_discovery_with_dsquery.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Domain Account Discovery with Dsquery -id: b1a8ce04-04c2-11ec-bea7-acde48001122 -version: 1 -date: '2021-08-24' -author: Teoderick Contreras, Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `dsquery.exe` with command-line - arguments utilized to discover domain users. The `user` argument returns a list - of all users registered in the domain. Red Teams and adversaries alike engage in - remote system discovery for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*user*' - Image|endswith: dsquery.exe - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm -- https://attack.mitre.org/techniques/T1087/002/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 50 - message: an instance of process $process_name$ with commandline $process$ in $dest$ - mitre_attack_id: - - T1087.002 - - T1087 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/domain_account_discovery_with_net_app.yml b/dev/endpoint/domain_account_discovery_with_net_app.yml deleted file mode 100644 index 1ef527e8a7..0000000000 --- a/dev/endpoint/domain_account_discovery_with_net_app.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Domain Account Discovery With Net App -id: 98f6a534-04c2-11ec-96b2-acde48001122 -version: 1 -date: '2021-08-24' -author: Teoderick Contreras, Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `net.exe` or `net1.exe` with - command-line arguments utilized to query for domain users. Red Teams and adversaries - alike may use net.exe to enumerate domain users for situational awareness and Active - Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: net.exe - selection2: - Image|endswith: net.exe - selection3: - Image|endswith: net1.exe - selection4: - OriginalFileName: net1.exe - selection5: - CommandLine: '* user*' - selection6: - CommandLine: '*/do*' - condition: (selection1 or selection2 or selection3 or selection4) and selection5 - and selection6 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://docs.microsoft.com/en-us/defender-for-identity/playbook-domain-dominance -- https://attack.mitre.org/techniques/T1087/002/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 50 - message: an instance of process $process_name$ with commandline $process$ in $dest$ - mitre_attack_id: - - T1087.002 - - T1087 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/domain_account_discovery_with_wmic.yml b/dev/endpoint/domain_account_discovery_with_wmic.yml deleted file mode 100644 index c50d678f94..0000000000 --- a/dev/endpoint/domain_account_discovery_with_wmic.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Domain Account Discovery with Wmic -id: 383572e0-04c5-11ec-bdcc-acde48001122 -version: 1 -date: '2021-08-24' -author: Teoderick Contreras, Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `wmic.exe` with command-line - arguments utilized to query for domain users. Red Teams and adversaries alike use - wmic.exe to enumerate domain users for situational awareness and Active Directory - Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*/NAMESPACE:\\\\root\\directory\\ldap*' - Image|endswith: wmic.exe - selection2: - CommandLine: '*ds_user*' - selection3: - CommandLine: '*GET*' - selection4: - CommandLine: '*ds_samaccountname*' - condition: selection1 and selection2 and selection3 and selection4 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1087/002/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 50 - message: an instance of process $process_name$ with commandline $process$ in $dest$ - mitre_attack_id: - - T1087.002 - - T1087 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/domain_controller_discovery_with_nltest.yml b/dev/endpoint/domain_controller_discovery_with_nltest.yml deleted file mode 100644 index f70577d982..0000000000 --- a/dev/endpoint/domain_controller_discovery_with_nltest.yml +++ /dev/null @@ -1,53 +0,0 @@ -name: Domain Controller Discovery with Nltest -id: 41243735-89a7-4c83-bcdd-570aa78f00a1 -version: 1 -date: '2021-08-30' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `nltest.exe` with command-line - arguments utilized to discover remote systems. The arguments `/dclist:` and '/dsgetdc:', - can be used to return a list of all domain controllers. Red Teams and adversaries - alike may use nltest.exe to identify domain controllers in a Windows Domain for - situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*/dsgetdc:*' - - '*/dclist:*' - Image|endswith: nltest.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1018/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 70 - impact: 30 - message: Domain controller discovery on $dest$ by $user$ - mitre_attack_id: - - T1018 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 21 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/domain_controller_discovery_with_wmic.yml b/dev/endpoint/domain_controller_discovery_with_wmic.yml deleted file mode 100644 index b6c5872965..0000000000 --- a/dev/endpoint/domain_controller_discovery_with_wmic.yml +++ /dev/null @@ -1,53 +0,0 @@ -name: Domain Controller Discovery with Wmic -id: 64c7adaa-48ee-483c-b0d6-7175bc65e6cc -version: 1 -date: '2021-09-01' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `wmic.exe` with command-line - arguments utilized to discover remote systems. The arguments utilized in this command - line return a list of all domain controllers in a Windows domain. Red Teams and - adversaries alike use *.exe to identify remote systems for situational awareness - and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*DomainControllerAddress*' - - '' - Image|endswith: wmic.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1018/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 70 - impact: 30 - message: Domain controller discovery on $dest$ by $user$ - mitre_attack_id: - - T1018 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 21 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/domain_group_discovery_with_dsquery.yml b/dev/endpoint/domain_group_discovery_with_dsquery.yml deleted file mode 100644 index bb01483967..0000000000 --- a/dev/endpoint/domain_group_discovery_with_dsquery.yml +++ /dev/null @@ -1,51 +0,0 @@ -name: Domain Group Discovery With Dsquery -id: f0c9d62f-a232-4edd-b17e-bc409fb133d4 -version: 1 -date: '2021-09-01' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `dsquery.exe` with command-line - arguments utilized to query for domain groups. The argument `group`, returns a list - of all domain groups. Red Teams and adversaries alike use may leverage dsquery.exe - to enumerate domain groups for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*group*' - Image|endswith: dsquery.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1069/002/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Domain group discovery enumeration on $dest$ by $user$ - mitre_attack_id: - - T1069 - - T1069.002 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/domain_group_discovery_with_net.yml b/dev/endpoint/domain_group_discovery_with_net.yml deleted file mode 100644 index 6c7d0322e0..0000000000 --- a/dev/endpoint/domain_group_discovery_with_net.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Domain Group Discovery With Net -id: f2f14ac7-fa81-471a-80d5-7eb65c3c7349 -version: 1 -date: '2021-08-25' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `net.exe` with command-line - arguments utilized to query for domain groups. The argument `group /domain`, returns - a list of all domain groups. Red Teams and adversaries alike use net.exe to enumerate - domain groups for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - net.exe - - net1.exe - selection2: - CommandLine: '*/do*' - selection3: - CommandLine: '*group*' - condition: (selection1) and selection2 and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1069/002/ -tags: - analytic_story: - - Active Directory Discovery - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Domain group discovery enumeration on $dest$ by $user$ - mitre_attack_id: - - T1069 - - T1069.002 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/domain_group_discovery_with_wmic.yml b/dev/endpoint/domain_group_discovery_with_wmic.yml deleted file mode 100644 index fe01b35f47..0000000000 --- a/dev/endpoint/domain_group_discovery_with_wmic.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Domain Group Discovery With Wmic -id: a87736a6-95cd-4728-8689-3c64d5026b3e -version: 1 -date: '2021-08-25' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `wmic.exe` with command-line - arguments utilized to query for domain groups. The arguments utilized in this command - return a list of all domain groups. Red Teams and adversaries alike use wmic.exe - to enumerate domain groups for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: wmic.exe - selection2: - CommandLine: '*ds_group*' - selection3: - CommandLine: '*/NAMESPACE:\\\\root\\directory\\ldap*' - selection4: - CommandLine: '*GET ds_samaccountname*' - condition: (selection1) and selection2 and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1069/002/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Domain group discovery enumeration on $dest$ by $user$ - mitre_attack_id: - - T1069 - - T1069.002 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/dsquery_domain_discovery.yml b/dev/endpoint/dsquery_domain_discovery.yml deleted file mode 100644 index da70e42e4d..0000000000 --- a/dev/endpoint/dsquery_domain_discovery.yml +++ /dev/null @@ -1,85 +0,0 @@ -name: DSQuery Domain Discovery -id: cc316032-924a-11eb-91a2-acde48001122 -version: 1 -date: '2021-03-31' -author: Michael Haag, Splunk -status: production -type: TTP -description: 'The following analytic identifies "dsquery.exe" execution with arguments - looking for `TrustedDomain` query directly on the command-line. This is typically - indicative of an Administrator or adversary perform domain trust discovery. Note - that this query does not identify any other variations of "Dsquery.exe" usage. - - Within this detection, it is assumed `dsquery.exe` is not moved or renamed. - - The search will return the first time and last time these command-line arguments - were used for these executions, as well as the target system, the user, process - "dsquery.exe" and its parent process. - - DSQuery.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64` - and only on Server operating system. - - The following DLL(s) are loaded when DSQuery.exe is launched `dsquery.dll`. If found - loaded by another process, it is possible dsquery is running within that process - context in memory. - - In addition to trust discovery, review parallel processes for additional behaviors - performed. Identify the parent process and capture any files (batch files, for example) - being used.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*trustedDomain*' - Image|endswith: dsquery.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Limited false positives. If there is a true false positive, - filter based on command-line or parent process. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md -- https://blog.harmj0y.net/redteaming/a-guide-to-attacking-domain-trusts/ -- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732952(v=ws.11) -- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc754232(v=ws.11) -tags: - analytic_story: - - Domain Trust Discovery - - Active Directory Discovery - asset_type: Endpoint - confidence: 90 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - performing domain discovery on endpoint $dest$ by user $user$. - mitre_attack_id: - - T1482 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 72 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/dump_lsass_via_procdump.yml b/dev/endpoint/dump_lsass_via_procdump.yml deleted file mode 100644 index 8a8ea725a9..0000000000 --- a/dev/endpoint/dump_lsass_via_procdump.yml +++ /dev/null @@ -1,91 +0,0 @@ -name: Dump LSASS via procdump -id: 3742ebfe-64c2-11eb-ae93-0242ac130002 -version: 3 -date: '2022-08-31' -author: Michael Haag, Splunk -status: production -type: TTP -description: 'Detect procdump.exe dumping the lsass process. This query looks for - both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump - file with all process memory. Both are highly suspect and should be reviewed. This - query does not monitor for the internal name (original_file_name=procdump) of the - PE or look for procdump64.exe. Modify the query as needed. - - During triage, confirm this is procdump.exe executing. If it is the first time a - Sysinternals utility has been ran, it is possible there will be a -accepteula on - the command line. Review other endpoint data sources for cross process (injection) - into lsass.exe.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: procdump - selection2: - Image|endswith: - - procdump.exe - - procdump64.exe - selection3: - CommandLine: - - '*-ma*' - - '*-mm*' - selection4: - CommandLine: '*lsass*' - condition: (selection1 or selection2) and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: None identified. -references: -- https://attack.mitre.org/techniques/T1003/001/ -- https://docs.microsoft.com/en-us/sysinternals/downloads/procdump -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump -- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ -tags: - analytic_story: - - Credential Dumping - - HAFNIUM Group - - CISA AA22-257A - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - attempting to dump lsass.exe on endpoint $dest$ by user $user$. - mitre_attack_id: - - T1003.001 - - T1003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/crowdstrike_falcon.log - source: crowdstrike - sourcetype: crowdstrike:events:sensor diff --git a/dev/endpoint/elevated_group_discovery_with_net.yml b/dev/endpoint/elevated_group_discovery_with_net.yml deleted file mode 100644 index ea78b2ed44..0000000000 --- a/dev/endpoint/elevated_group_discovery_with_net.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Elevated Group Discovery With Net -id: a23a0e20-0b1b-4a07-82e5-ec5f70811e7a -version: 1 -date: '2021-08-25' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `net.exe` or `net1.exe` with - command-line arguments utilized to query for specific elevated domain groups. Red - Teams and adversaries alike use net.exe to enumerate elevated domain groups for - situational awareness and Active Directory Discovery to identify high privileged - users. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - net.exe - - net1.exe - selection2: - CommandLine: '*/do*' - selection3: - CommandLine: '*group*' - selection4: - CommandLine: - - '*Domain Admins*' - - '*Enterprise Admins*' - - '*Schema Admins*' - - '*Account Operators*' - - '*Server Operators*' - - '*Protected Users*' - - '*Dns Admins*' - condition: (selection1) and selection2 and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1069/002/ -- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory -- https://adsecurity.org/?p=3658 -- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF -tags: - analytic_story: - - Active Directory Discovery - - Volt Typhoon - asset_type: Endpoint - confidence: 70 - impact: 30 - message: Elevated domain group discovery enumeration on $dest$ by $user$ - mitre_attack_id: - - T1069 - - T1069.002 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 21 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/elevated_group_discovery_with_wmic.yml b/dev/endpoint/elevated_group_discovery_with_wmic.yml deleted file mode 100644 index ede53fd985..0000000000 --- a/dev/endpoint/elevated_group_discovery_with_wmic.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Elevated Group Discovery With Wmic -id: 3f6bbf22-093e-4cb4-9641-83f47b8444b6 -version: 1 -date: '2021-08-25' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `wmic.exe` with command-line - arguments utilized to query for specific domain groups. Red Teams and adversaries - alike use net.exe to enumerate elevated domain groups for situational awareness - and Active Directory Discovery to identify high privileged users. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*/NAMESPACE:\\\\root\\directory\\ldap*' - Image|endswith: wmic.exe - selection2: - CommandLine: - - '*Dns Admins*' - - '*Protected Users*' - - '*Server Operators*' - - '*Account Operators*' - - '*Schema Admins*' - - '*Enterprise Admins*' - - '*Domain Admins*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1069/002/ -- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory -- https://adsecurity.org/?p=3658 -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 70 - impact: 30 - message: Elevated domain group discovery enumeration on $dest$ by $user$ - mitre_attack_id: - - T1069 - - T1069.002 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 21 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/enable_rdp_in_other_port_number.yml b/dev/endpoint/enable_rdp_in_other_port_number.yml deleted file mode 100644 index b5560c4403..0000000000 --- a/dev/endpoint/enable_rdp_in_other_port_number.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Enable RDP In Other Port Number -id: 99495452-b899-11eb-96dc-acde48001122 -version: 2 -date: '2022-01-28' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a modification to registry to enable rdp to - a machine with different port number. This technique was seen in some atttacker - tries to do lateral movement and remote access to a compromised machine to gain - control of it. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: PortNumber - TargetObject: '*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: unknown -references: -- https://www.mvps.net/docs/how-to-secure-remote-desktop-rdp/ -tags: - analytic_story: - - Prohibited Traffic Allowed or Protocol Mismatch - - Windows Registry Abuse - asset_type: Endpoint - confidence: 100 - impact: 80 - message: RDP was moved to a non-standard port on $dest$ by $user$. - mitre_attack_id: - - T1021 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/enable_wdigest_uselogoncredential_registry.yml b/dev/endpoint/enable_wdigest_uselogoncredential_registry.yml deleted file mode 100644 index 92bae0fab5..0000000000 --- a/dev/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Enable WDigest UseLogonCredential Registry -id: 0c7d8ffe-25b1-11ec-9f39-acde48001122 -version: 2 -date: '2022-01-28' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to detect a suspicious registry modification to enable - plain text credential feature of windows. This technique was used by several malware - and also by mimikatz to be able to dumpe the a plain text credential to the compromised - or target host. This TTP is really a good indicator that someone wants to dump the - crendential of the host so it must be a good pivot for credential dumping techniques. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: UseLogonCredential - TargetObject: '*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*' - Details: '0x00000001' - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: unknown -references: -- https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html -tags: - analytic_story: - - Credential Dumping - - Windows Registry Abuse - - CISA AA22-320A - asset_type: Endpoint - confidence: 100 - impact: 80 - message: wdigest registry $registry_path$ was modified in $dest$ - mitre_attack_id: - - T1112 - - T1003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/wdigest_enable/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/esentutl_sam_copy.yml b/dev/endpoint/esentutl_sam_copy.yml deleted file mode 100644 index 48806a2bdd..0000000000 --- a/dev/endpoint/esentutl_sam_copy.yml +++ /dev/null @@ -1,74 +0,0 @@ -name: Esentutl SAM Copy -id: d372f928-ce4f-11eb-a762-acde48001122 -version: 1 -date: '2021-08-18' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following analytic identifies the process - `esentutl.exe` - being - used to capture credentials stored in ntds.dit or the SAM file on disk. During triage, - review parallel processes and determine if legitimate activity. Upon determination - of illegitimate activity, take further action to isolate and contain the threat. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: esentutl.exe - selection2: - Image|endswith: esentutl.exe - selection3: - CommandLine: - - '*ntds*' - - '*SAM*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited. Filter as needed. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/6a570c2a4630cf0c2bd41a2e8375b5d5ab92f700/atomics/T1003.002/T1003.002.md -- https://attack.mitre.org/software/S0404/ -tags: - analytic_story: - - Credential Dumping - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user user$ attempting to capture credentials for offline - cracking or observability. - mitre_attack_id: - - T1003.002 - - T1003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/etw_registry_disabled.yml b/dev/endpoint/etw_registry_disabled.yml deleted file mode 100644 index b774afe62c..0000000000 --- a/dev/endpoint/etw_registry_disabled.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: ETW Registry Disabled -id: 8ed523ac-276b-11ec-ac39-acde48001122 -version: 2 -date: '2022-01-28' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to detect a registry modification to disable ETW feature - of windows. This technique is to evade EDR appliance to evade detections and hide - its execution from audit logs. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: ETWEnabled - TargetObject: '*\\SOFTWARE\\Microsoft\\.NETFramework*' - Details: '0x00000000' - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: unknown -references: -- https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3 -tags: - analytic_story: - - Windows Persistence Techniques - - Windows Privilege Escalation - - Windows Registry Abuse - - Hermetic Wiper - asset_type: Endpoint - confidence: 100 - impact: 90 - message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ - mitre_attack_id: - - T1562.006 - - T1127 - - T1562 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/etw_disable/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/eventvwr_uac_bypass.yml b/dev/endpoint/eventvwr_uac_bypass.yml deleted file mode 100644 index 0742bcc6c6..0000000000 --- a/dev/endpoint/eventvwr_uac_bypass.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Eventvwr UAC Bypass -id: 9cf8fe08-7ad8-11eb-9819-acde48001122 -version: 2 -date: '2022-01-28' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following search identifies Eventvwr bypass by identifying the registry - modification into a specific path that eventvwr.msc looks to (but is not valid) - upon execution. A successful attack will include a suspicious command to be executed - upon eventvwr.msc loading. Upon triage, review the parallel processes that have - executed. Identify any additional registry modifications on the endpoint that may - look suspicious. Remediate as necessary. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: '*mscfile\\shell\\open\\command\\*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. -known_false_positives: Some false positives may be present and will need to be filtered. -references: -- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md -- https://attack.mitre.org/techniques/T1548/002/ -- https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/ -tags: - analytic_story: - - Windows Defense Evasion Tactics - - IcedID - - Living Off The Land - - Windows Registry Abuse - asset_type: Endpoint - confidence: 100 - impact: 80 - message: Registry values were modified to bypass UAC using Event Viewer on $dest$ - by $user$. - mitre_attack_id: - - T1548.002 - - T1548 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/excel_spawning_powershell.yml b/dev/endpoint/excel_spawning_powershell.yml deleted file mode 100644 index c249bc98ac..0000000000 --- a/dev/endpoint/excel_spawning_powershell.yml +++ /dev/null @@ -1,83 +0,0 @@ -name: Excel Spawning PowerShell -id: 42d40a22-9be3-11eb-8f08-acde48001122 -version: 1 -date: '2021-04-12' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following detection identifies Microsoft Excel spawning PowerShell. - Typically, this is not common behavior and not default with Excel.exe. Excel.exe - will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` - (version will vary). PowerShell spawning from Excel.exe is common for a spearphishing - attachment and is actively used. Albeit, the command executed will most likely be - encoded and captured via another detection. During triage, review parallel processes - and identify any files that may have been written. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: excel.exe - selection2: - OriginalFileName: pwsh.dll - selection3: - Image|endswith: - - pwsh.exe - - sqlps.exe - - sqltoolsps.exe - - powershell.exe - - powershell_ise.exe - selection4: - OriginalFileName: PowerShell.EXE - selection5: - OriginalFileName: powershell_ise.EXE - condition: selection1 and selection2 and selection3 and selection4 and selection5 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited, but if any are present, - filter as needed. -references: -- https://redcanary.com/threat-detection-report/techniques/powershell/ -- https://attack.mitre.org/techniques/T1566/001/ -tags: - analytic_story: - - Spearphishing Attachments - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. - mitre_attack_id: - - T1003.002 - - T1003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/excel_spawning_windows_script_host.yml b/dev/endpoint/excel_spawning_windows_script_host.yml deleted file mode 100644 index eaf5885306..0000000000 --- a/dev/endpoint/excel_spawning_windows_script_host.yml +++ /dev/null @@ -1,75 +0,0 @@ -name: Excel Spawning Windows Script Host -id: 57fe880a-9be3-11eb-9bf3-acde48001122 -version: 1 -date: '2021-04-12' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following detection identifies Microsoft Excel spawning Windows Script - Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior and - not default with Excel.exe. Excel.exe will generally be found in the following path - `C:\Program Files\Microsoft Office\root\Office16` (version will vary). `cscript.exe` - or `wscript.exe` default location is `c:\windows\system32\` or c:windows\syswow64`. - `cscript.exe` or `wscript.exe` spawning from Excel.exe is common for a spearphishing - attachment and is actively used. Albeit, the command-line executed will most likely - be obfuscated and captured via another detection. During triage, review parallel - processes and identify any files that may have been written. Review the reputation - of the remote destination and block accordingly. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - cscript.exe - - wscript.exe - ParentImage: excel.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: False positives should be limited, but if any are present, - filter as needed. In some instances, `cscript.exe` is used for legitimate business - practices. -references: -- https://app.any.run/tasks/8ecfbc29-03d0-421c-a5bf-3905d29192a2/ -- https://attack.mitre.org/techniques/T1566/001/ -tags: - analytic_story: - - Spearphishing Attachments - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. - mitre_attack_id: - - T1003.002 - - T1003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/execute_javascript_with_jscript_com_clsid.yml b/dev/endpoint/execute_javascript_with_jscript_com_clsid.yml deleted file mode 100644 index c20e6575fc..0000000000 --- a/dev/endpoint/execute_javascript_with_jscript_com_clsid.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Execute Javascript With Jscript COM CLSID -id: dc64d064-d346-11eb-8588-acde48001122 -version: 1 -date: '2021-06-22' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic will identify suspicious process of cscript.exe where it - tries to execute javascript using jscript.encode CLSID (COM OBJ). This technique - was seen in ransomware (reddot ransomware) where it execute javascript with this - com object with combination of amsi disabling technique. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*-e:{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}*' - Image|endswith: cscript.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Filesystem` node. -known_false_positives: unknown -references: -- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ -tags: - analytic_story: - - Ransomware - asset_type: Endpoint - confidence: 70 - impact: 80 - message: Suspicious process of cscript.exe with a parent process $parent_process_name$ - where it tries to execute javascript using jscript.encode CLSID (COM OBJ), detected - on $dest$ by $user$ - mitre_attack_id: - - T1059 - - T1059.005 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Endpoint - role: - - Victim - - name: process_id - type: Process - role: - - Attacker - - name: parent_process_name - type: Process Name - role: - - Parent Process - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/execution_of_file_with_multiple_extensions.yml b/dev/endpoint/execution_of_file_with_multiple_extensions.yml deleted file mode 100644 index 26bafeb99a..0000000000 --- a/dev/endpoint/execution_of_file_with_multiple_extensions.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Execution of File with Multiple Extensions -id: b06a555e-dce0-417d-a2eb-28a5d8d66ef7 -version: 3 -date: '2020-11-18' -author: Rico Valdez, Splunk -status: production -type: TTP -description: This search looks for processes launched from files that have double - extensions in the file name. This is typically done to obscure the "real" file extension - and make it appear as though the file being accessed is a data file, as opposed - to executable content. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*.doc.exe' - - '*.htm.exe' - - '*.html.exe' - - '*.txt.exe' - - '*.pdf.exe' - - '*.doc.exe' - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records process activity from your hosts to populate the endpoint data model - in the processes node. -known_false_positives: None identified. -references: [] -tags: - analytic_story: - - Windows File Extension and Association Abuse - - Masquerading - Rename System Utilities - asset_type: Endpoint - confidence: 70 - impact: 80 - message: process $process$ have double extensions in the file name is executed on - $dest$ by $user$ - mitre_attack_id: - - T1036 - - T1036.003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Endpoint - role: - - Victim - - name: process - type: Process - role: - - Parent Process - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/extraction_of_registry_hives.yml b/dev/endpoint/extraction_of_registry_hives.yml deleted file mode 100644 index 3fe99bcfef..0000000000 --- a/dev/endpoint/extraction_of_registry_hives.yml +++ /dev/null @@ -1,77 +0,0 @@ -name: Extraction of Registry Hives -id: 8bbb7d58-b360-11eb-ba21-acde48001122 -version: 2 -date: '2021-09-09' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the use of `reg.exe` exporting Windows - Registry hives containing credentials. Adversaries may use this technique to export - registry hives for offline credential access attacks. Typically found executed from - a untrusted process or script. Upon execution, a file will be written to disk. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: reg.exe - selection2: - Image|endswith: reg.exe - selection3: - CommandLine: - - '*save*' - - '*export*' - selection4: - CommandLine: - - '*\sam *' - - '*\system *' - - '*\security *' - condition: (selection1 or selection2) and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: It is possible some agent based products will generate false - positives. Filter as needed. -references: -- https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md -- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF -tags: - analytic_story: - - DarkSide Ransomware - - Credential Dumping - - CISA AA22-257A - - Volt Typhoon - asset_type: Endpoint - confidence: 70 - impact: 80 - message: Suspicious use of `reg.exe` exporting Windows Registry hives containing - credentials executed on $dest$ by user $user$, with a parent process of $parent_process_id$ - mitre_attack_id: - - T1003.002 - - T1003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Endpoint - role: - - Victim - - name: parent_process_id - type: Process - role: - - Parent Process - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/firewall_allowed_program_enable.yml b/dev/endpoint/firewall_allowed_program_enable.yml deleted file mode 100644 index a1577a3b44..0000000000 --- a/dev/endpoint/firewall_allowed_program_enable.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Firewall Allowed Program Enable -id: 9a8f63a8-43ac-11ec-904c-acde48001122 -version: 1 -date: '2021-11-12' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic detects a potential suspicious modification of firewall - rule allowing to execute specific application. This technique was identified when - an adversary and red teams to bypassed firewall file execution restriction in a - targetted host. Take note that this event or command can run by administrator during - testing or allowing legitimate tool or application. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*allow*' - selection2: - CommandLine: '*firewall*' - selection3: - CommandLine: '*add*' - selection4: - CommandLine: '*ENABLE*' - condition: selection1 and selection2 and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: A network operator or systems administrator may utilize an - automated or manual execution of this firewall rule that may generate false positives. - Filter as needed. -references: -- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/ -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Azorult - asset_type: Endpoint - confidence: 50 - impact: 50 - message: firewall allowed program commandline $process$ of $process_name$ on $dest$ - by $user$ - mitre_attack_id: - - T1562.004 - - T1562 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/first_time_seen_child_process_of_zoom.yml b/dev/endpoint/first_time_seen_child_process_of_zoom.yml deleted file mode 100644 index 68a36ba279..0000000000 --- a/dev/endpoint/first_time_seen_child_process_of_zoom.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: First Time Seen Child Process of Zoom -id: e91bd102-d630-4e76-ab73-7e3ba22c5961 -version: 1 -date: '2020-05-20' -author: David Dorsey, Splunk -status: experimental -type: Anomaly -description: This search looks for child processes spawned by zoom.exe or zoom.us - that has not previously been seen. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - zoom.exe - - zoom.us - condition: (selection1) -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You should run - the baseline search `Previously Seen Zoom Child Processes - Initial` to build the - initial table of child processes and hostnames for this search to work. You should - also schedule at the same interval as this search the second baseline search `Previously - Seen Zoom Child Processes - Update` to keep this table up to date and to age out - old child processes. Please update the `previously_seen_zoom_child_processes_window` - macro to adjust the time window. -known_false_positives: A new child process of zoom isn't malicious by that fact alone. - Further investigation of the actions of the child process is needed to verify any - malicious behavior is taken. -references: [] -tags: - analytic_story: - - Suspicious Zoom Child Processes - asset_type: Endpoint - confidence: 80 - impact: 80 - message: Child process $process_name$ with $process_id$ spawned by zoom.exe or zoom.us - which has not been previously on host $dest$ - mitre_attack_id: - - T1068 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Endpoint - role: - - Victim - - name: process_name - type: Process Name - role: - - Attacker - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint diff --git a/dev/endpoint/fodhelper_uac_bypass.yml b/dev/endpoint/fodhelper_uac_bypass.yml deleted file mode 100644 index 9edcd4497a..0000000000 --- a/dev/endpoint/fodhelper_uac_bypass.yml +++ /dev/null @@ -1,76 +0,0 @@ -name: FodHelper UAC Bypass -id: 909f8fd8-7ac8-11eb-a1f3-acde48001122 -version: 1 -date: '2021-03-01' -author: Michael Haag, Splunk -status: production -type: TTP -description: 'Fodhelper.exe has a known UAC bypass as it attempts to look for specific - registry keys upon execution, that do not exist. Therefore, an attacker can write - its malicious commands in these registry keys to be executed by fodhelper.exe with - the highest privilege. - - * `HKCU:\Software\Classes\ms-settings\shell\open\command` - - * `HKCU:\Software\Classes\ms-settings\shell\open\command\DelegateExecute` - - * `HKCU:\Software\Classes\ms-settings\shell\open\command\(default)` - - Upon triage, fodhelper.exe will have a child process and read access will occur - on the registry keys. Isolate the endpoint and review parallel processes for additional - behavior.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: fodhelper.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Limited to no false positives are expected. -references: -- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md -- https://github.com/gushmazuko/WinBypass/blob/master/FodhelperBypass.ps1 -- https://attack.mitre.org/techniques/T1548/002/ -tags: - analytic_story: - - Windows Defense Evasion Tactics - - IcedID - asset_type: Endpoint - confidence: 90 - impact: 90 - message: Suspcious registy keys added by process fodhelper.exe (process_id- $process_id), - with a parent_process of $parent_process_name$ that has been executed on $dest$ - by $user$. - mitre_attack_id: - - T1112 - - T1548.002 - - T1548 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Endpoint - role: - - Victim - - name: parent_process_name - type: Process Name - role: - - Parent Process - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 81 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/fsutil_zeroing_file.yml b/dev/endpoint/fsutil_zeroing_file.yml deleted file mode 100644 index c992871134..0000000000 --- a/dev/endpoint/fsutil_zeroing_file.yml +++ /dev/null @@ -1,50 +0,0 @@ -name: Fsutil Zeroing File -id: 4e5e024e-fabb-11eb-8b8f-acde48001122 -version: 1 -date: '2021-08-11' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious fsutil process to zeroing a target - file. This technique was seen in lockbit ransomware where it tries to zero out its - malware path as part of its defense evasion after encrypting the compromised host. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*setzerodata*' - Image|endswith: fsutil.exe - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: unknown -references: -- https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/ -tags: - analytic_story: - - Ransomware - asset_type: Endpoint - confidence: 90 - impact: 60 - message: Possible file data deletion on $dest$ using $process$ - mitre_attack_id: - - T1070 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 54 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml b/dev/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml deleted file mode 100644 index eae347af84..0000000000 --- a/dev/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Get ADDefaultDomainPasswordPolicy with Powershell -id: 36e46ebe-065a-11ec-b4c7-acde48001122 -version: 1 -date: '2021-08-26' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `powershell.exe` executing the - Get-ADDefaultDomainPasswordPolicy commandlet used to obtain the password policy - in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate - domain policies for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*Get-ADDefaultDomainPasswordPolicy*' - Image|endswith: - - powershell* - - cmd.exe - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet -- https://attack.mitre.org/techniques/T1201/ -- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2019-ps -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 30 - impact: 30 - message: an instance of process $process_name$ with commandline $process$ in $dest$ - mitre_attack_id: - - T1201 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/get_aduser_with_powershell.yml b/dev/endpoint/get_aduser_with_powershell.yml deleted file mode 100644 index 083f600d33..0000000000 --- a/dev/endpoint/get_aduser_with_powershell.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Get ADUser with PowerShell -id: 0b6ee3f4-04e3-11ec-a87d-acde48001122 -version: 1 -date: '2021-08-24' -author: Teoderick Contreras, Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `powershell.exe` with command-line - arguments utilized to enumerate domain users. The `Get-AdUser' commandlet returns - a list of all domain users. Red Teams and adversaries alike may use this commandlet - to identify remote systems for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*Get-ADUser*' - Image|endswith: - - powershell* - - cmd.exe - selection2: - CommandLine: '*-filter*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://www.blackhillsinfosec.com/red-blue-purple/ -- https://attack.mitre.org/techniques/T1087/002/ -- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2019-ps -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 50 - message: an instance of process $process_name$ with commandline $process$ in $dest$ - mitre_attack_id: - - T1087.002 - - T1087 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml b/dev/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml deleted file mode 100644 index 7895f50102..0000000000 --- a/dev/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Get ADUserResultantPasswordPolicy with Powershell -id: 8b5ef342-065a-11ec-b0fc-acde48001122 -version: 1 -date: '2021-08-26' -author: Teoderick Contreras, Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `powershell.exe` executing the - Get ADUserResultantPasswordPolicy commandlet used to obtain the password policy - in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate - domain policies for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*Get-ADUserResultantPasswordPolicy*' - Image|endswith: - - powershell* - - cmd.exe - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet -- https://attack.mitre.org/techniques/T1201/ -- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduserresultantpasswordpolicy?view=windowsserver2019-ps -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 50 - message: an instance of process $process_name$ with commandline $process$ in $dest$ - mitre_attack_id: - - T1201 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/get_domainpolicy_with_powershell.yml b/dev/endpoint/get_domainpolicy_with_powershell.yml deleted file mode 100644 index 795ecb2b54..0000000000 --- a/dev/endpoint/get_domainpolicy_with_powershell.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Get DomainPolicy with Powershell -id: b8f9947e-065a-11ec-aafb-acde48001122 -version: 1 -date: '2021-08-26' -author: Teoderick Contreras, Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `powershell.exe` executing the - `Get-DomainPolicy` commandlet used to obtain the password policy in a Windows domain. - Red Teams and adversaries alike may use PowerShell to enumerate domain policies - for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*Get-DomainPolicy*' - Image|endswith: - - powershell* - - cmd.exe - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet -- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainPolicy/ -- https://attack.mitre.org/techniques/T1201/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 60 - impact: 50 - message: an instance of process $process_name$ with commandline $process$ in $dest$ - mitre_attack_id: - - T1201 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/get_domaintrust_with_powershell.yml b/dev/endpoint/get_domaintrust_with_powershell.yml deleted file mode 100644 index 8bd69528ea..0000000000 --- a/dev/endpoint/get_domaintrust_with_powershell.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Get-DomainTrust with PowerShell -id: 4fa7f846-054a-11ec-a836-acde48001122 -version: 1 -date: '2021-08-24' -author: Michael Haag, Splunk -status: production -type: TTP -description: This analytic identifies Get-DomainTrust from PowerView in order to gather - domain trust information. Typically, this is utilized within a script being executed - and used to enumerate the domain trust information. This grants the adversary an - understanding of how large or small the domain is. During triage, review parallel - processes using an EDR product or 4688 events. It will be important to understand - the timeline of events around this activity. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*get-domaintrust*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives as this requires an active Administrator - or adversary to bring in, import, and execute. -references: -- https://blog.harmj0y.net/redteaming/a-guide-to-attacking-domain-trusts/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 40 - impact: 30 - message: Suspicious PowerShell Get-DomainTrust was identified on endpoint $dest$ - by user $user$. - mitre_attack_id: - - T1482 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 12 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/get_domainuser_with_powershell.yml b/dev/endpoint/get_domainuser_with_powershell.yml deleted file mode 100644 index f7d4411e14..0000000000 --- a/dev/endpoint/get_domainuser_with_powershell.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Get DomainUser with PowerShell -id: 9a5a41d6-04e7-11ec-923c-acde48001122 -version: 1 -date: '2021-08-24' -author: Teoderick Contreras, Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `powershell.exe` with command-line - arguments utilized to enumerate domain users. `Get-DomainUser` is part of PowerView, - a PowerShell tool used to perform enumeration on Windows domains. Red Teams and - adversaries alike may leverage PowerView to enumerate domain users for situational - awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*Get-DomainUser*' - Image|endswith: - - powershell* - - cmd.exe - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 50 - message: an instance of process $process_name$ with commandline $process$ in $dest$ - mitre_attack_id: - - T1087.002 - - T1087 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/get_foresttrust_with_powershell.yml b/dev/endpoint/get_foresttrust_with_powershell.yml deleted file mode 100644 index 223a9c13fa..0000000000 --- a/dev/endpoint/get_foresttrust_with_powershell.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Get-ForestTrust with PowerShell -id: 584f4884-0bf1-11ec-a5ec-acde48001122 -version: 1 -date: '2021-09-02' -author: Michael Haag, Splunk -status: production -type: TTP -description: This analytic identifies Get-ForestTrust from PowerSploit in order to - gather domain trust information. Typically, this is utilized within a script being - executed and used to enumerate the domain trust information. This grants the adversary - an understanding of how large or small the domain is. During triage, review parallel - processes using an EDR product or 4688 events. It will be important to understand - the timeline of events around this activity. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*get-foresttrust*' - Image|endswith: - - cmd.exe - - powershell.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives as this requires an active Administrator - or adversary to bring in, import, and execute. -references: -- https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 40 - impact: 30 - message: Suspicious PowerShell Get-ForestTrust was identified on endpoint $dest$ - by user $user$. - mitre_attack_id: - - T1482 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 12 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/get_wmiobject_group_discovery.yml b/dev/endpoint/get_wmiobject_group_discovery.yml deleted file mode 100644 index 2c2d087c76..0000000000 --- a/dev/endpoint/get_wmiobject_group_discovery.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Get WMIObject Group Discovery -id: 5434f670-155d-11ec-8cca-acde48001122 -version: 1 -date: '2021-09-14' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following hunting analytic identifies the use of `Get-WMIObject Win32_Group` - being used with PowerShell to identify local groups on the endpoint. \ Typically, - by itself, is not malicious but may raise suspicion based on time of day, endpoint - and username. \ During triage, review parallel processes and identify any further - suspicious behavior. -data_source: -- Sysmon Event ID 1 -search: - selection1: - processes.process_name: cmd.exe - selection2: - Image|endswith: powershell.exe - selection3: - CommandLine: '*Win32_Group*' - selection4: - CommandLine: '*Get-WMIObject*' - condition: (selection1 or selection2) and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present. Tune as needed. -references: -- https://attack.mitre.org/techniques/T1069/001/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: System group discovery on $dest$ by $user$. - mitre_attack_id: - - T1069 - - T1069.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/getadcomputer_with_powershell.yml b/dev/endpoint/getadcomputer_with_powershell.yml deleted file mode 100644 index 2d6850b6e2..0000000000 --- a/dev/endpoint/getadcomputer_with_powershell.yml +++ /dev/null @@ -1,50 +0,0 @@ -name: GetAdComputer with PowerShell -id: c5a31f80-5888-4d81-9f78-1cc65026316e -version: 1 -date: '2021-09-07' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `powershell.exe` with command-line - arguments utilized to discover remote systems. The `Get-AdComputer' commandlet returns - a list of all domain computers. Red Teams and adversaries alike may use this commandlet - to identify remote systems for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*Get-AdComputer*' - Image|endswith: powershell.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1018/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Remote system discovery enumeration on $dest$ by $user$ - mitre_attack_id: - - T1018 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/getadgroup_with_powershell.yml b/dev/endpoint/getadgroup_with_powershell.yml deleted file mode 100644 index b260f47936..0000000000 --- a/dev/endpoint/getadgroup_with_powershell.yml +++ /dev/null @@ -1,53 +0,0 @@ -name: GetAdGroup with PowerShell -id: 872e3063-0fc4-4e68-b2f3-f2b99184a708 -version: 1 -date: '2021-08-25' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `powershell.exe` with command-line - arguments utilized to query for domain groups. The `Get-AdGroup` commandlnet is - used to return a list of all groups available in a Windows Domain. Red Teams and - adversaries alike may leverage this commandlet to enumerate domain groups for situational - awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*Get-AdGroup*' - Image|endswith: powershell.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1069/002/ -- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Domain group discovery enumeration on $dest$ by $user$ - mitre_attack_id: - - T1069 - - T1069.002 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/getcurrent_user_with_powershell.yml b/dev/endpoint/getcurrent_user_with_powershell.yml deleted file mode 100644 index c5ea79eb86..0000000000 --- a/dev/endpoint/getcurrent_user_with_powershell.yml +++ /dev/null @@ -1,53 +0,0 @@ -name: GetCurrent User with PowerShell -id: 7eb9c3d5-c98c-4088-acc5-8240bad15379 -version: 1 -date: '2021-09-13' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `powerhsell.exe` with command-line - arguments that execute the `GetCurrent` method of the WindowsIdentity .NET class. - This method returns an object that represents the current Windows user. Red Teams - and adversaries may leverage this method to identify the logged user on a compromised - endpoint for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*GetCurrent(' - - '*System.Security.Principal.WindowsIdentity*' - Image|endswith: powershell.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1033/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: System user discovery on $dest$ - mitre_attack_id: - - T1033 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/getdomaincomputer_with_powershell.yml b/dev/endpoint/getdomaincomputer_with_powershell.yml deleted file mode 100644 index f0beb1e53d..0000000000 --- a/dev/endpoint/getdomaincomputer_with_powershell.yml +++ /dev/null @@ -1,51 +0,0 @@ -name: GetDomainComputer with PowerShell -id: ed550c19-712e-43f6-bd19-6f58f61b3a5e -version: 1 -date: '2021-09-07' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `powershell.exe` with command-line - arguments utilized to discover remote systems. `Get-DomainComputer` is part of PowerView, - a PowerShell tool used to perform enumeration on Windows domains. Red Teams and - adversaries alike may leverage PowerView to enumerate domain groups for situational - awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*Get-DomainComputer*' - Image|endswith: powershell.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use PowerView for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1018/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 80 - impact: 30 - message: Remote system discovery enumeration on $dest$ by $user$ - mitre_attack_id: - - T1018 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 24 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/getdomaincontroller_with_powershell.yml b/dev/endpoint/getdomaincontroller_with_powershell.yml deleted file mode 100644 index a74c085d4e..0000000000 --- a/dev/endpoint/getdomaincontroller_with_powershell.yml +++ /dev/null @@ -1,52 +0,0 @@ -name: GetDomainController with PowerShell -id: 868ee0e4-52ab-484a-833a-6d85b7c028d0 -version: 1 -date: '2021-09-07' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `powershell.exe` with command-line - arguments utilized to discover remote systems. `Get-DomainController` is part of - PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red - Teams and adversaries alike may leverage PowerView to enumerate domain groups for - situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*Get-DomainController*' - Image|endswith: powershell.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use PowerView for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1018/ -- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainController/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 80 - impact: 30 - message: Remote system discovery using PowerView on $dest$ by $user$ - mitre_attack_id: - - T1018 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 24 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/getdomaingroup_with_powershell.yml b/dev/endpoint/getdomaingroup_with_powershell.yml deleted file mode 100644 index 28e4e70c84..0000000000 --- a/dev/endpoint/getdomaingroup_with_powershell.yml +++ /dev/null @@ -1,53 +0,0 @@ -name: GetDomainGroup with PowerShell -id: 93c94be3-bead-4a60-860f-77ca3fe59903 -version: 1 -date: '2021-08-25' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `powershell.exe` with command-line - arguments utilized to query for domain groups. `Get-DomainGroup` is part of PowerView, - a PowerShell tool used to perform enumeration on Windows domains. Red Teams and - adversaries alike may leverage PowerView to enumerate domain groups for situational - awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*Get-DomainGroup*' - Image|endswith: powershell.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1069/002/ -- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroup/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Domain group discovery with PowerView on $dest$ by $user$ - mitre_attack_id: - - T1069 - - T1069.002 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/getlocaluser_with_powershell.yml b/dev/endpoint/getlocaluser_with_powershell.yml deleted file mode 100644 index e1957412f4..0000000000 --- a/dev/endpoint/getlocaluser_with_powershell.yml +++ /dev/null @@ -1,52 +0,0 @@ -name: GetLocalUser with PowerShell -id: 85fae8fa-0427-11ec-8b78-acde48001122 -version: 1 -date: '2021-08-23' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `powershell.exe` with command-line - arguments utilized to query for local users. The `Get-LocalUser` commandlet is used - to return a list of all local users. Red Teams and adversaries may leverage this - commandlet to enumerate users for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*Get-LocalUser*' - Image|endswith: powershell.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this PowerShell commandlet - for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1087/001/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Local user discovery enumeration using PowerShell on $dest$ by $user$ - mitre_attack_id: - - T1087 - - T1087.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/getnettcpconnection_with_powershell.yml b/dev/endpoint/getnettcpconnection_with_powershell.yml deleted file mode 100644 index bdce44a61a..0000000000 --- a/dev/endpoint/getnettcpconnection_with_powershell.yml +++ /dev/null @@ -1,51 +0,0 @@ -name: GetNetTcpconnection with PowerShell -id: e02af35c-1de5-4afe-b4be-f45aba57272b -version: 1 -date: '2021-08-25' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `powershell.exe` with command-line - utilized to get a listing of network connections on a compromised system. The `Get-NetTcpConnection` - commandlet lists the current TCP connections. Red Teams and adversaries alike may - use this commandlet for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*Get-NetTcpConnection*' - Image|endswith: powershell.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1049/ -- https://docs.microsoft.com/en-us/powershell/module/nettcpip/get-nettcpconnection?view=windowsserver2019-ps -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Network Connection discovery on $dest$ by $user$ - mitre_attack_id: - - T1049 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1049/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/getwmiobject_ds_computer_with_powershell.yml b/dev/endpoint/getwmiobject_ds_computer_with_powershell.yml deleted file mode 100644 index 955396dc81..0000000000 --- a/dev/endpoint/getwmiobject_ds_computer_with_powershell.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: GetWmiObject Ds Computer with PowerShell -id: 7141122c-3bc2-4aaa-ab3b-7a85a0bbefc3 -version: 1 -date: '2021-09-07' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `powershell.exe` with command-line - arguments utilized to discover remote systems. The `Get-WmiObject` commandlet combined - with the `DS_Computer` parameter can be used to return a list of all domain computers. - Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, - to enumerate domain groups for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: powershell.exe - selection2: - CommandLine: '*namespace root\\directory\\ldap*' - selection3: - CommandLine: '*Get-WmiObject*' - selection4: - CommandLine: '*class ds_computer*' - condition: (selection1) and selection2 and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1018/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 70 - impact: 30 - message: Remote system discovery enumeration using WMI on $dest$ by $user$ - mitre_attack_id: - - T1018 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 21 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/getwmiobject_ds_group_with_powershell.yml b/dev/endpoint/getwmiobject_ds_group_with_powershell.yml deleted file mode 100644 index c9faad9079..0000000000 --- a/dev/endpoint/getwmiobject_ds_group_with_powershell.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: GetWmiObject Ds Group with PowerShell -id: df275a44-4527-443b-b884-7600e066e3eb -version: 1 -date: '2021-08-25' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `powershell.exe` with command-line - arguments utilized to query for domain groups. The `Get-WmiObject` commandlet combined - with the `-class ds_group` parameter can be used to return the full list of groups - in a Windows domain. Red Teams and adversaries alike may leverage WMI in this case, - using PowerShell, to enumerate domain groups for situational awareness and Active - Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: powershell.exe - selection2: - CommandLine: '*namespace root\\directory\\ldap*' - selection3: - CommandLine: '*Get-WmiObject*' - selection4: - CommandLine: '*class ds_group*' - condition: (selection1) and selection2 and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1069/002/ -- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1 -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Domain group discovery enumeration on $dest$ by $user$ - mitre_attack_id: - - T1069 - - T1069.002 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/getwmiobject_ds_user_with_powershell.yml b/dev/endpoint/getwmiobject_ds_user_with_powershell.yml deleted file mode 100644 index 8b524a3171..0000000000 --- a/dev/endpoint/getwmiobject_ds_user_with_powershell.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: GetWmiObject DS User with PowerShell -id: 22d3b118-04df-11ec-8fa3-acde48001122 -version: 1 -date: '2021-08-24' -author: Teoderick Contreras, Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `powershell.exe` with command-line - arguments utilized to query for domain users. The `Get-WmiObject` commandlet combined - with the `-class ds_user` parameter can be used to return the full list of users - in a Windows domain. Red Teams and adversaries alike may leverage WMI in this case, - using PowerShell, to enumerate domain users for situational awareness and Active - Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*get-wmiobject*' - Image|endswith: - - powershell* - - cmd.exe - selection2: - CommandLine: '*ds_user*' - selection3: - CommandLine: '*root\\directory\\ldap*' - selection4: - CommandLine: '*-namespace*' - condition: selection1 and selection2 and selection3 and selection4 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 50 - message: an instance of process $process_name$ with commandline $process$ in $dest$ - mitre_attack_id: - - T1087.002 - - T1087 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/getwmiobject_user_account_with_powershell.yml b/dev/endpoint/getwmiobject_user_account_with_powershell.yml deleted file mode 100644 index 69fdeaed6a..0000000000 --- a/dev/endpoint/getwmiobject_user_account_with_powershell.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: GetWmiObject User Account with PowerShell -id: b44f6ac6-0429-11ec-87e9-acde48001122 -version: 1 -date: '2021-08-23' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `powershell.exe` with command-line - arguments utilized to query local users. The `Get-WmiObject` commandlet combined - with the `Win32_UserAccount` parameter is used to return a list of all local users. - Red Teams and adversaries may leverage this commandlet to enumerate users for situational - awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: powershell.exe - selection2: - CommandLine: '*Win32_UserAccount*' - selection3: - CommandLine: '*Get-WmiObject*' - condition: (selection1) and selection2 and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this PowerShell commandlet - for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1087/001/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Local user discovery enumeration using PowerShell on $dest$ by $user$ - mitre_attack_id: - - T1087 - - T1087.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml b/dev/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml deleted file mode 100644 index 13739b4d12..0000000000 --- a/dev/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: GPUpdate with no Command Line Arguments with Network -id: 2c853856-a140-11eb-a5b5-acde48001122 -version: 2 -date: '2022-03-15' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies gpupdate.exe with no command line arguments - and with a network connection. It is unusual for gpupdate.exe to execute with no - command line arguments present. This particular behavior is common with malicious - software, including Cobalt Strike. During investigation, triage any network connections - and parallel processes. Identify any suspicious module loads related to credential - dumping or file writes. gpupdate.exe is natively found in C:\Windows\system32 and - C:\Windows\syswow64. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: gpupdate.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Limited false positives may be present in small environments. - Tuning may be required based on parent process. -references: -- https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile -- https://www.cobaltstrike.com/blog/learn-pipe-fitting-for-all-of-your-offense-projects/ -tags: - analytic_story: - - Cobalt Strike - asset_type: Endpoint - confidence: 90 - impact: 90 - message: Process gpupdate.exe with parent_process $parent_process_name$ is executed - on $dest$ by user $user$, followed by an outbound network connection to $connection_to_CNC$ - on port $dest_port$. This behaviour is seen with cobaltstrike. - mitre_attack_id: - - T1055 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Endpoint - role: - - Victim - - name: parent_process_name - type: Process Name - role: - - Parent Process - - Attacker - - name: connection_to_CNC - type: IP Address - role: - - Other - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 81 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/hide_user_account_from_sign_in_screen.yml b/dev/endpoint/hide_user_account_from_sign_in_screen.yml deleted file mode 100644 index 999c5482e9..0000000000 --- a/dev/endpoint/hide_user_account_from_sign_in_screen.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Hide User Account From Sign-In Screen -id: 834ba832-ad89-11eb-937d-acde48001122 -version: 2 -date: '2022-01-28' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic identifies a suspicious registry modification to hide a - user account on the Windows Login screen. This technique was seen in some tradecraft - where the adversary will create a hidden user account with Admin privileges in login - screen to avoid noticing by the user that they already compromise and to persist - on that said machine. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000000' - TargetObject: '*\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist*' - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: Unknown. Filter as needed. -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -tags: - analytic_story: - - XMRig - - Windows Registry Abuse - - Azorult - asset_type: Endpoint - confidence: 80 - impact: 90 - message: Suspicious registry modification ($registry_value_name$) which is used - go hide a user account on the Windows Login screen detected on $dest$ executed - by $user$ - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Endpoint - role: - - Victim - - name: registry_value_name - type: Other - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 72 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/hiding_files_and_directories_with_attrib_exe.yml b/dev/endpoint/hiding_files_and_directories_with_attrib_exe.yml deleted file mode 100644 index e699c61749..0000000000 --- a/dev/endpoint/hiding_files_and_directories_with_attrib_exe.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Hiding Files And Directories With Attrib exe -id: 6e5a3ae4-90a3-462d-9aa6-0119f638c0f1 -version: 4 -date: '2020-07-21' -author: Bhavin Patel, Splunk -status: production -type: TTP -description: Attackers leverage an existing Windows binary, attrib.exe, to mark specific - as hidden by using specific flags so that the victim does not see the file. The - search looks for specific command-line arguments to detect the use of attrib.exe - to hide files. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*+h*' - Image|endswith: attrib.exe - condition: (selection1) -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. -known_false_positives: 'Some applications and users may legitimately use attrib.exe - to interact with the files. ' -references: [] -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Persistence Techniques - - Azorult - asset_type: '' - confidence: 80 - impact: 90 - message: Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is detected. - mitre_attack_id: - - T1222 - - T1222.001 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Endpoint - role: - - Victim - - name: parent_process - type: Other - role: - - Attacker - - Parent Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 72 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/impacket_lateral_movement_commandline_parameters.yml b/dev/endpoint/impacket_lateral_movement_commandline_parameters.yml deleted file mode 100644 index 2f95e9e9e1..0000000000 --- a/dev/endpoint/impacket_lateral_movement_commandline_parameters.yml +++ /dev/null @@ -1,75 +0,0 @@ -name: Impacket Lateral Movement Commandline Parameters -id: 8ce07472-496f-11ec-ab3b-3e22fbd008af -version: 2 -date: '2022-01-18' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the presence of suspicious commandline parameters - typically present when using Impacket tools. Impacket is a collection of python - classes meant to be used with Microsoft network protocols. There are multiple scripts - that leverage impacket libraries like `wmiexec.py`, `smbexec.py`, `dcomexec.py` - and `atexec.py` used to execute commands on remote endpoints. By default, these - scripts leverage administrative shares and hardcoded parameters that can be used - as a signature to detect its use. Red Teams and adversaries alike may leverage Impackets - tools for lateral movement and remote code execution. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*/c* \\\\127.0.0.1\\*' - - '*/c* 2>&1' - condition: (selection1) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -known_false_positives: Although uncommon, Administrators may leverage Impackets tools - to start a process on remote systems for system administration or automation use - cases. -references: -- https://attack.mitre.org/techniques/T1021/002/ -- https://attack.mitre.org/techniques/T1021/003/ -- https://attack.mitre.org/techniques/T1047/ -- https://attack.mitre.org/techniques/T1053/ -- https://attack.mitre.org/techniques/T1053/005/ -- https://github.com/SecureAuthCorp/impacket -- https://vk9-sec.com/impacket-remote-code-execution-rce-on-windows-from-linux/ -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ -tags: - analytic_story: - - Active Directory Lateral Movement - - WhisperGate - - Industroyer2 - - CISA AA22-277A - - Prestige Ransomware - - Volt Typhoon - asset_type: Endpoint - confidence: 70 - impact: 90 - message: Suspicious command line parameters on $dest may represent a lateral movement - attack with Impackets tools - mitre_attack_id: - - T1021 - - T1021.002 - - T1021.003 - - T1047 - - T1543.003 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/impacket/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/java_writing_jsp_file.yml b/dev/endpoint/java_writing_jsp_file.yml deleted file mode 100644 index 31e442bd94..0000000000 --- a/dev/endpoint/java_writing_jsp_file.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Java Writing JSP File -id: eb65619c-4f8d-4383-a975-d352765d344b -version: 2 -date: '2022-06-03' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the process java writing a .jsp to - disk. This is potentially indicative of a web shell being written to disk. Modify - and tune the analytic based on data ingested. For instance, it may be worth running - a broad query for jsp file writes first before performing a join. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - java - - java.exe - - javaw.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` - node. In addition, confirm the latest CIM App 4.20 or higher is installed and the - latest TA for the endpoint product. -known_false_positives: False positives are possible and filtering may be required. - Restrict by assets or filter known jsp files that are common for the environment. -references: -- https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/ -- https://github.com/TheGejr/SpringShell -- https://www.tenable.com/blog/spring4shell-faq-spring-framework-remote-code-execution-vulnerability -tags: - analytic_story: - - Spring4Shell CVE-2022-22965 - - Atlassian Confluence Server and Data Center CVE-2022-26134 - - SysAid On-Prem Software CVE-2023-47246 Vulnerability - asset_type: Endpoint - confidence: 70 - cve: - - CVE-2022-22965 - impact: 60 - message: An instance of $process_name$ was identified on endpoint $dest$ writing - a jsp file to disk, potentially indicative of exploitation. - mitre_attack_id: - - T1190 - - T1133 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 42 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/java_write_jsp-linux-sysmon.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/jscript_execution_using_cscript_app.yml b/dev/endpoint/jscript_execution_using_cscript_app.yml deleted file mode 100644 index 52286f433d..0000000000 --- a/dev/endpoint/jscript_execution_using_cscript_app.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Jscript Execution Using Cscript App -id: 002f1e24-146e-11ec-a470-acde48001122 -version: 1 -date: '2021-09-13' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a execution of jscript using cscript process. - Commonly when a user run jscript file it was executed by wscript.exe application. - This technique was seen in FIN7 js implant to execute its malicious script using - cscript process. This behavior is uncommon and a good artifacts to check further - anomalies within the network -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentCommandLine: '*//e:jscript*' - ParentImage: cscript.exe - selection2: - CommandLine: '*//e:jscript*' - Image|endswith: cscript.exe - condition: selection1 or selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: unknown -references: -- https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation -- https://attack.mitre.org/groups/G0046/ -tags: - analytic_story: - - FIN7 - - Remcos - asset_type: Endpoint - confidence: 70 - impact: 70 - message: Process name $process_name$ with commandline $process$ to execute jscript - in $dest$ - mitre_attack_id: - - T1059 - - T1059.007 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml b/dev/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml deleted file mode 100644 index ef53991417..0000000000 --- a/dev/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Linux Account Manipulation Of SSH Config and Keys -id: 73a56508-1cf5-4df7-b8d9-5737fbdc27d2 -version: 1 -date: '2022-04-12' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to detect a deletion of ssh key in a linux machine. - attacker may delete or modify ssh key to impair some security features or act as - defense evasion in compromised linux machine. This Anomaly can be also a good indicator - of a malware trying to wipe or delete several files in a compromised host as part - of its destructive payload like what acidrain malware does in linux or router machines. - This detection can be a good pivot to check what process and user tries to delete - this type of files which is not so common and need further investigation. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: - - /etc/ssh/* - - ~/.ssh/* - Filesystem.action: deleted - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ -tags: - analytic_story: - - Acidrain - asset_type: endpoint - confidence: 70 - impact: 70 - message: a $process_name$ deleting a SSH key in $dest$ - mitre_attack_id: - - T1485 - - T1070.004 - - T1070 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_add_files_in_known_crontab_directories.yml b/dev/endpoint/linux_add_files_in_known_crontab_directories.yml deleted file mode 100644 index 173a50356b..0000000000 --- a/dev/endpoint/linux_add_files_in_known_crontab_directories.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Linux Add Files In Known Crontab Directories -id: 023f3452-5f27-11ec-bf00-acde48001122 -version: 1 -date: '2021-12-17' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic identifies a suspicious file creation in known - cron table directories. This event is commonly abuse by malware, adversaries and - red teamers to persist on the target or compromised host. crontab or cronjob is - like a schedule task in windows environment where you can create an executable or - script on the known crontab directories to run it base on its schedule. This Anomaly - query is a good indicator to look further what file is added and who added the file - if to consider it legitimate file. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: - - '*/etc/cron*' - - '*/var/spool/cron/*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the file name, file path, and process_guid executions from your endpoints. - If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. -known_false_positives: Administrator or network operator can create file in crontab - folders for automation purposes. Please update the filter macros to remove false - positives. -references: -- https://www.sandflysecurity.com/blog/detecting-cronrat-malware-on-linux-instantly/ -- https://www.cyberciti.biz/faq/how-do-i-add-jobs-to-cron-under-linux-or-unix-oses/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 50 - message: a file $file_name$ is created in $file_path$ on $dest$ - mitre_attack_id: - - T1053.003 - - T1053 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/cronjobs_entry/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_add_user_account.yml b/dev/endpoint/linux_add_user_account.yml deleted file mode 100644 index 3a981ab90e..0000000000 --- a/dev/endpoint/linux_add_user_account.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Linux Add User Account -id: 51fbcaf2-6259-11ec-b0f3-acde48001122 -version: 1 -date: '2021-12-21' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: This analytic looks for commands to create user accounts on the linux - platform. This technique is commonly abuse by adversaries, malware author and red - teamers to persist on the targeted or compromised host by creating new user with - an elevated privilege. This Hunting query may catch normal creation of user by administrator - so filter is needed. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*useradd *' - - '*adduser *' - selection2: - Image|endswith: - - useradd - - adduser - condition: selection1 or selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://linuxize.com/post/how-to-create-users-in-linux-using-the-useradd-command/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 50 - impact: 50 - message: A commandline $process$ that may create user account on $dest$ - mitre_attack_id: - - T1136.001 - - T1136 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_adduser/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_adding_crontab_using_list_parameter.yml b/dev/endpoint/linux_adding_crontab_using_list_parameter.yml deleted file mode 100644 index edf667f465..0000000000 --- a/dev/endpoint/linux_adding_crontab_using_list_parameter.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Linux Adding Crontab Using List Parameter -id: 52f6d751-1fd4-4c74-a4c9-777ecfeb5c58 -version: 1 -date: '2022-04-22' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: The following analytic identifies a suspicious cron jobs modification - using crontab list parameters. This command line parameter can be abused by malware - like industroyer2, adversaries, and red teamers to add a crontab entry to their - malicious code to execute to the schedule they want. This event can also be executed - by administrator or normal user for automation purposes so filter is needed. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '* -l*' - Image|endswith: crontab - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. -references: -- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ -- https://cert.gov.ua/article/39518 -tags: - analytic_story: - - Industroyer2 - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 50 - message: A possible crontab list command $process$ executed on $dest$ - mitre_attack_id: - - T1053.003 - - T1053 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/crontab_list_parameter/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_apt_get_privilege_escalation.yml b/dev/endpoint/linux_apt_get_privilege_escalation.yml deleted file mode 100644 index 366445fc2a..0000000000 --- a/dev/endpoint/linux_apt_get_privilege_escalation.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Linux apt-get Privilege Escalation -id: d870ce3b-e796-402f-b2af-cab4da1223f2 -version: 1 -date: '2022-08-11' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: The apt-get is a command line tool for interacting with the Advanced - Package Tool (APT) library (a package management system for Linux distributions). - It allows you to search for, install, manage, update, and remove software. The tool - does not build software from the source code. If sudo right is given to the tool - for user, then the user can run system commands as root and possibly get a root - shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*APT::Update::Pre-Invoke::*' - selection2: - CommandLine: '*apt-get*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/apt-get/ -- https://phoenixnap.com/kb/how-to-use-apt-get-commands -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 20 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 10 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/apt_get/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_apt_privilege_escalation.yml b/dev/endpoint/linux_apt_privilege_escalation.yml deleted file mode 100644 index e874966639..0000000000 --- a/dev/endpoint/linux_apt_privilege_escalation.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Linux APT Privilege Escalation -id: 4d5a05fa-77d9-4fd0-af9c-05704f9f9a88 -version: 1 -date: '2022-08-11' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: Advanced Package Tool, more commonly known as APT, is a collection of - tools used to install, update, remove, and otherwise manage software packages on - Debian and its derivative operating systems, including Ubuntu and Linux Mint. If - sudo right is given to the tool for user, then the user can run system commands - as root and possibly get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*APT::Update::Pre-Invoke::*' - selection2: - CommandLine: '*apt*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/apt/ -- https://www.digitalocean.com/community/tutorials/what-is-apt -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 20 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 10 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/apt/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_at_allow_config_file_creation.yml b/dev/endpoint/linux_at_allow_config_file_creation.yml deleted file mode 100644 index 5c33a14901..0000000000 --- a/dev/endpoint/linux_at_allow_config_file_creation.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Linux At Allow Config File Creation -id: 977b3082-5f3d-11ec-b954-acde48001122 -version: 1 -date: '2021-12-17' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic identifies a suspicious file creation of /etc/at.allow - or /etc/at.deny. These 2 files are commonly abused by malware, adversaries or red - teamers to persist on the targeted or compromised host. These config files can restrict - or allow user to execute "at" application (another schedule task application in - linux). attacker can create a user or add the compromised username to that config - file to execute "at" to schedule it malicious code. This anomaly detection can be - a good indicator to investigate further the entry in created config file and who - created it to verify if it is a false positive. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: - - '*/etc/at.allow' - - '*/etc/at.deny' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the file name, file path, and process_guid executions from your endpoints - into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for - Linux Sysmon from Splunkbase. -known_false_positives: Administrator or network operator can create this file for - automation purposes. Please update the filter macros to remove false positives. -references: -- https://linuxize.com/post/at-command-in-linux/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 50 - message: A file $file_name$ is created in $file_path$ on $dest$ - mitre_attack_id: - - T1053.003 - - T1053 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/at_execution/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_at_application_execution.yml b/dev/endpoint/linux_at_application_execution.yml deleted file mode 100644 index 1e9c02f275..0000000000 --- a/dev/endpoint/linux_at_application_execution.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Linux At Application Execution -id: bf0a378e-5f3c-11ec-a6de-acde48001122 -version: 2 -date: '2022-05-26' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic identifies a suspicious process creation of At - application. This process can be used by malware, adversaries and red teamers to - create persistence entry to the targeted or compromised host with their malicious - code. This anomaly detection can be a good indicator to investigate the event before - and after this process execution, when it was executed and what schedule task it - will execute. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - at - - atd - selection2: - Image|endswith: - - at - - atd - condition: selection1 or selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. -references: -- https://attack.mitre.org/techniques/T1053/001/ -- https://www.linkedin.com/pulse/getting-attacker-ip-address-from-malicious-linux-job-craig-rowland/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Living Off The Land - asset_type: Endpoint - confidence: 30 - impact: 30 - message: At application was executed in $dest$ - mitre_attack_id: - - T1053.002 - - T1053 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/at_execution/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_awk_privilege_escalation.yml b/dev/endpoint/linux_awk_privilege_escalation.yml deleted file mode 100644 index bd9aaf4539..0000000000 --- a/dev/endpoint/linux_awk_privilege_escalation.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Linux AWK Privilege Escalation -id: 4510cae0-96a2-4840-9919-91d262db210a -version: 1 -date: '2022-07-31' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: Awk is mostly used for processing and scanning patterns. It checks one - or more files to determine whether any lines fit the specified patterns, and if - so, it does the appropriate action. If sudo right is given to AWK binary for the - user, then the user can run system commands as root and possibly get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*awk*' - selection2: - CommandLine: '*sudo*' - selection3: - CommandLine: '*BEGIN*system*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives are present based on automated tooling or system - administrative usage. Filter as needed. -references: -- https://www.hacknos.com/awk-privilege-escalation/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/awk/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_busybox_privilege_escalation.yml b/dev/endpoint/linux_busybox_privilege_escalation.yml deleted file mode 100644 index b4dc8979ce..0000000000 --- a/dev/endpoint/linux_busybox_privilege_escalation.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Linux Busybox Privilege Escalation -id: 387c4e78-f4a4-413d-ad44-e9f7bc4642c9 -version: 1 -date: '2022-08-11' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: BusyBox combines tiny versions of many common UNIX utilities into a single - small executable. It provides minimalist replacements for most of the utilities - you usually find in GNU coreutils, util-linux, etc. If sudo right is given to BusyBox - application for the user, then the user can run system commands as root and possibly - get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*sh*' - selection2: - CommandLine: '*busybox*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/busybox/ -- https://man.archlinux.org/man/busybox.1.en -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 20 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 10 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/busybox/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_c89_privilege_escalation.yml b/dev/endpoint/linux_c89_privilege_escalation.yml deleted file mode 100644 index 50312ea89e..0000000000 --- a/dev/endpoint/linux_c89_privilege_escalation.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Linux c89 Privilege Escalation -id: 54c95f4d-3e5d-44be-9521-ea19ba62f7a8 -version: 1 -date: '2022-08-11' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: The c89 and cc commands compile, assemble, and link-edit C programs; - the cxx or c++ command does the same for C++ programs. The c89 command should be - used when compiling C programs that are written according to Standard C. If sudo - right is given to c89 application for the user, then the user can run system commands - as root and possibly get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*-wrapper*' - selection2: - CommandLine: '*c89*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/c89/ -- https://www.ibm.com/docs/en/zos/2.1.0?topic=guide-c89-compiler-invocation-using-host-environment-variables -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/c89/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_c99_privilege_escalation.yml b/dev/endpoint/linux_c99_privilege_escalation.yml deleted file mode 100644 index 8e4b8ff9ee..0000000000 --- a/dev/endpoint/linux_c99_privilege_escalation.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Linux c99 Privilege Escalation -id: e1c6dec5-2249-442d-a1f9-99a4bd228183 -version: 1 -date: '2022-08-11' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: The c99 utility is an interface to the standard C compilation system; - it shall accept source code conforming to the ISO C standard. The system conceptually - consists of a compiler and link editor. If sudo right is given to ruby application - for the user, then the user can run system commands as root and possibly get a root - shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*-wrapper*' - selection2: - CommandLine: '*c99*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/c99/ -- https://pubs.opengroup.org/onlinepubs/009604499/utilities/c99.html -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/c99/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_change_file_owner_to_root.yml b/dev/endpoint/linux_change_file_owner_to_root.yml deleted file mode 100644 index 94f70fb652..0000000000 --- a/dev/endpoint/linux_change_file_owner_to_root.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Linux Change File Owner To Root -id: c1400ea2-6257-11ec-ad49-acde48001122 -version: 1 -date: '2021-12-21' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic looks for a commandline that change the file owner to root - using chown utility tool. This technique is commonly abuse by adversaries, malware - author and red teamers to escalate privilege to the targeted or compromised host - by changing the owner of their malicious file to root. This event is not so common - in corporate network except from the administrator doing normal task that needs - high privilege. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*chown *' - selection2: - Image|endswith: chown - selection3: - CommandLine: '* root *' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://unix.stackexchange.com/questions/101073/how-to-change-permissions-from-root-user-to-all-users -- https://askubuntu.com/questions/617850/changing-from-user-to-superuser -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Living Off The Land - asset_type: Endpoint - confidence: 80 - impact: 80 - message: A commandline $process$ that may change ownership to root on $dest$ - mitre_attack_id: - - T1222.002 - - T1222 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_clipboard_data_copy.yml b/dev/endpoint/linux_clipboard_data_copy.yml deleted file mode 100644 index fa24f802be..0000000000 --- a/dev/endpoint/linux_clipboard_data_copy.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Linux Clipboard Data Copy -id: 7173b2ad-6146-418f-85ae-c3479e4515fc -version: 1 -date: '2022-07-28' -author: Michael Haag, Splunk -status: production -type: Anomaly -description: The following analytic identifies the use of Linux Xclip copying data - out of the clipboard. Adversaries have utilized this technique to capture passwords, - IP addresses, or store payloads. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*-o *' - - '*-sel *' - - '*-selection *' - - '*clip *' - - '*clipboard*' - Image|endswith: xclip - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present on Linux desktop as it may commonly - be used by administrators or end users. Filter as needed. -references: -- https://attack.mitre.org/techniques/T1115/ -- https://linux.die.net/man/1/xclip -tags: - analytic_story: - - Linux Living Off The Land - asset_type: Endpoint - confidence: 40 - impact: 40 - message: An instance of $process_name$ was identified on endpoint $dest$ by user - $user$ adding or removing content from the clipboard. - mitre_attack_id: - - T1115 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 16 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1115/atomic_red_team/linux-sysmon.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_common_process_for_elevation_control.yml b/dev/endpoint/linux_common_process_for_elevation_control.yml deleted file mode 100644 index 3fb272275e..0000000000 --- a/dev/endpoint/linux_common_process_for_elevation_control.yml +++ /dev/null @@ -1,96 +0,0 @@ -name: Linux Common Process For Elevation Control -id: 66ab15c0-63d0-11ec-9e70-acde48001122 -version: 1 -date: '2021-12-23' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: This analytic is to look for possible elevation control access using - a common known process in linux platform to change the attribute and file ownership. - This technique is commonly abused by adversaries, malware author and red teamers - to gain persistence or privilege escalation on the target or compromised host. This - common process is used to modify file attribute, file ownership or SUID. This tools - can be used in legitimate purposes so filter is needed. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*chmod *' - - '*chown *' - - '*fchmod *' - - '*fchmodat *' - - '*fchown *' - - '*fchownat *' - - '*fremovexattr *' - - '*fsetxattr *' - - '*lchown *' - - '*lremovexattr *' - - '*lsetxattr *' - - '*removexattr *' - - '*setuid *' - - '*setgid *' - - '*setreuid *' - - '*setregid *' - - '*setcap *' - - '*chattr *' - selection2: - Image|endswith: - - chmod - - chown - - fchmod - - fchmodat - - fchown - - fchownat - - fremovexattr - - fsetxattr - - lchown - - lremovexattr - - lsetxattr - - removexattr - - setuid - - setgid - - setreuid - - setregid - - chattr - condition: selection1 or selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://attack.mitre.org/techniques/T1548/001/ -- https://github.com/Neo23x0/auditd/blob/master/audit.rules#L285-L297 -- https://github.com/bfuzzy1/auditd-attack/blob/master/auditd-attack/auditd-attack.rules#L269-L270 -- https://github.com/microsoft/MSTIC-Sysmon/blob/main/linux/configs/attack-based/privilege_escalation/T1548.001_ElevationControl_CommonProcesses.xml -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Living Off The Land - asset_type: Endpoint - confidence: 30 - impact: 30 - message: A commandline $process$ with process $process_name$ on $dest$ - mitre_attack_id: - - T1548.001 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_composer_privilege_escalation.yml b/dev/endpoint/linux_composer_privilege_escalation.yml deleted file mode 100644 index a1b28e59e8..0000000000 --- a/dev/endpoint/linux_composer_privilege_escalation.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Linux Composer Privilege Escalation -id: a3bddf71-6ba3-42ab-a6b2-396929b16d92 -version: 1 -date: '2022-08-11' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: Composer is a tool for dependency management in PHP. It allows you to - declare the libraries your project depends on and it will manage (install/update) - them for you. If sudo right is given to tool for the user, then the user can run - system commands as root and possibly get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*run-script*' - selection2: - CommandLine: '*composer*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/composer/ -- https://getcomposer.org/doc/00-intro.md -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 20 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 10 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/composer/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_cpulimit_privilege_escalation.yml b/dev/endpoint/linux_cpulimit_privilege_escalation.yml deleted file mode 100644 index 886009ea58..0000000000 --- a/dev/endpoint/linux_cpulimit_privilege_escalation.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Linux Cpulimit Privilege Escalation -id: d4e40b7e-aad3-4a7d-aac8-550ea5222be5 -version: 1 -date: '2022-08-11' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: cpulimit is a simple program which attempts to limit the cpu usage of - a process (expressed in percentage, not in cpu time). This is useful to control - batch jobs, when you don't want them to eat too much cpu. If sudo right is given - to the program for the user, then the user can run system commands as root and possibly - get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*-l*' - selection2: - CommandLine: '*cpulimit*' - selection3: - CommandLine: '*-f*' - selection4: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 and selection4 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/cpulimit/ -- http://cpulimit.sourceforge.net/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 40 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 20 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/cpulimit/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_csvtool_privilege_escalation.yml b/dev/endpoint/linux_csvtool_privilege_escalation.yml deleted file mode 100644 index 5c6d74f3a4..0000000000 --- a/dev/endpoint/linux_csvtool_privilege_escalation.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Linux Csvtool Privilege Escalation -id: f8384f9e-1a5c-4c3a-96d6-8a7e5a38a8b8 -version: 1 -date: '2022-08-11' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: csvtool is an easy to use command-line tool to work with .CSV files. - If sudo right is given to the tool for the user, then the user can run system commands - as root and possibly get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*call*' - selection2: - CommandLine: '*csvtool*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/csvtool/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 20 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 10 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/csvtool/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_curl_upload_file.yml b/dev/endpoint/linux_curl_upload_file.yml deleted file mode 100644 index c810ebb3c3..0000000000 --- a/dev/endpoint/linux_curl_upload_file.yml +++ /dev/null @@ -1,84 +0,0 @@ -name: Linux Curl Upload File -id: c1de2d9a-0c02-4bb4-a49a-510c6e9cf2bf -version: 1 -date: '2022-07-29' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies curl being utilized with the -F or - --form, --upload-file, -T, -d, --data, --data-raw, -I and --head switches to upload - AWS credentials or config to a remote destination. This enables uploading of binary - files and so forth. To force the 'content' part to be a file, prefix the file name - with an @ sign. To just get the content part from a file, prefix the file name with - the symbol <. The difference between @ and < is then that @ makes a file get attached - in the post as a file upload, while the < makes a text field and just get the contents - for that text field from a file. This technique was utlized by the TeamTNT group - to exfiltrate AWS credentials. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*-F *' - - '*--form *' - - '*--upload-file *' - - '*-T *' - - '*-d *' - - '*--data *' - - '*--data-raw *' - - '*-I *' - - '*--head *' - Image|endswith: curl - selection2: - CommandLine: '*.aws/credentials*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Filtering may be required. In addition to AWS credentials, - add other important files and monitor. The inverse would be to look for _all_ -F - behavior and tune from there. -references: -- https://curl.se/docs/manpage.html -- https://www.cadosecurity.com/team-tnt-the-first-crypto-mining-worm-to-steal-aws-credentials/ -- https://gtfobins.github.io/gtfobins/curl/ -tags: - analytic_story: - - Linux Living Off The Land - - Data Exfiltration - - Ingress Tool Transfer - asset_type: Endpoint - confidence: 80 - impact: 80 - message: An instance of $process_name$ was identified on endpoint $dest$ by user - $user$ attempting to upload important files to a remote destination. - mitre_attack_id: - - T1105 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_dd_file_overwrite.yml b/dev/endpoint/linux_dd_file_overwrite.yml deleted file mode 100644 index 134800c879..0000000000 --- a/dev/endpoint/linux_dd_file_overwrite.yml +++ /dev/null @@ -1,55 +0,0 @@ -name: Linux DD File Overwrite -id: 9b6aae5e-8d85-11ec-b2ae-acde48001122 -version: 1 -date: '2022-02-14' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to look for dd command to overwrite file. This technique - was abused by adversaries or threat actor to destroy files or data on specific system - or in a large number of host within network to interrupt host avilability, services - and many more. This is also used to destroy data where it make the file irrecoverable - by forensic techniques through overwriting files, data or local and remote drives. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*of=' - Image|endswith: dd - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://gtfobins.github.io/gtfobins/dd/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md -tags: - analytic_story: - - Data Destruction - - Industroyer2 - asset_type: endpoint - confidence: 80 - impact: 80 - message: A commandline $process$ executed on $dest$ - mitre_attack_id: - - T1485 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/linux_dd_file_overwrite/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_decode_base64_to_shell.yml b/dev/endpoint/linux_decode_base64_to_shell.yml deleted file mode 100644 index 73a38becf9..0000000000 --- a/dev/endpoint/linux_decode_base64_to_shell.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Linux Decode Base64 to Shell -id: 637b603e-1799-40fd-bf87-47ecbd551b66 -version: 1 -date: '2022-07-27' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies base64 being decoded and passed to - a Linux shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*|*' - selection2: - CommandLine: - - '*base64 -d*' - - '*base64 --decode*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present based on legitimate software - being utilized. Filter as needed. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027/T1027.md#atomic-test-1---decode-base64-data-into-script -- https://redcanary.com/blog/lateral-movement-with-secure-shell/ -- https://linux.die.net/man/1/base64 -tags: - analytic_story: - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 50 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ decoding base64 and passing it to a shell. - mitre_attack_id: - - T1027 - - T1059.004 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027/atomic_red_team/linux-sysmon.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_deleting_critical_directory_using_rm_command.yml b/dev/endpoint/linux_deleting_critical_directory_using_rm_command.yml deleted file mode 100644 index 0b573a38e1..0000000000 --- a/dev/endpoint/linux_deleting_critical_directory_using_rm_command.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Linux Deleting Critical Directory Using RM Command -id: 33f89303-cc6f-49ad-921d-2eaea38a6f7a -version: 1 -date: '2022-04-22' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies a suspicious deletion of a critical - folder in Linux machine using rm command. This technique was seen in industroyer2 - campaign to wipe or destroy energy facilities of a targeted sector. Deletion in - these list of folder is not so common since it need some elevated privileges to - access some of it. We recommend to look further events specially in file access - or file deletion, process commandline that may related to this technique. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '* -rf *' - Image|endswith: rm - selection2: - CommandLine: - - '*/boot/*' - - '*/var/log/*' - - '*/etc/*' - - '*/dev/*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. -references: -- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ -- https://cert.gov.ua/article/39518 -tags: - analytic_story: - - Industroyer2 - - Data Destruction - asset_type: Endpoint - confidence: 80 - impact: 80 - message: A deletion in known critical list of folder using rm command $process$ - executed on $dest$ - mitre_attack_id: - - T1485 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/rm_shred_critical_dir/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_deletion_of_cron_jobs.yml b/dev/endpoint/linux_deletion_of_cron_jobs.yml deleted file mode 100644 index e6922761b1..0000000000 --- a/dev/endpoint/linux_deletion_of_cron_jobs.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Linux Deletion Of Cron Jobs -id: 3b132a71-9335-4f33-9932-00bb4f6ac7e8 -version: 1 -date: '2022-04-12' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to detect a deletion of cron job in a linux machine. - This technique can be related to an attacker, threat actor or malware to disable - scheduled cron jobs that might be related to security or to evade some detections. - We also saw that this technique can be a good indicator for malware that is trying - to wipe or delete several files on the compromised host like the acidrain malware. - This anomaly detection can be a good pivot detection to look for process and user - doing it why they doing. Take note that this event can be done by administrator - so filtering on those possible false positive event is needed. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: /etc/cron.* - Filesystem.action: deleted - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ -tags: - analytic_story: - - AcidRain - asset_type: endpoint - confidence: 70 - impact: 70 - message: a $process_name$ deleting cron jobs in $dest$ - mitre_attack_id: - - T1485 - - T1070.004 - - T1070 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_deletion_of_init_daemon_script.yml b/dev/endpoint/linux_deletion_of_init_daemon_script.yml deleted file mode 100644 index c139919851..0000000000 --- a/dev/endpoint/linux_deletion_of_init_daemon_script.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Linux Deletion Of Init Daemon Script -id: 729aab57-d26f-4156-b97f-ab8dda8f44b1 -version: 1 -date: '2022-04-12' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to detect a deletion of init daemon script in a linux - machine. daemon script that place in /etc/init.d/ is a directory that can start - and stop some daemon services in linux machines. attacker may delete or modify daemon - script to impair some security features or act as defense evasion in a compromised - linux machine. This TTP can be also a good indicator of a malware trying to wipe - or delete several files in compromised host as part of its destructive payload like - what acidrain malware does in linux or router machines. This detection can be a - good pivot to check what process and user tries to delete this type of files which - is not so common and need further investigation. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: /etc/init.d/* - Filesystem.action: deleted - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ -tags: - analytic_story: - - AcidRain - asset_type: endpoint - confidence: 70 - impact: 70 - message: a $process_name$ deleting a daemon script in $dest$ - mitre_attack_id: - - T1485 - - T1070.004 - - T1070 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_deletion_of_services.yml b/dev/endpoint/linux_deletion_of_services.yml deleted file mode 100644 index 487761fb6c..0000000000 --- a/dev/endpoint/linux_deletion_of_services.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Linux Deletion Of Services -id: b509bbd3-0331-4aaa-8e4a-d2affe100af6 -version: 1 -date: '2022-04-12' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to detect a deletion of services in a linux machine. - attacker may delete or modify services to impair some security features or act as - defense evasion in a compromised linux machine. This TTP can be also a good indicator - of a malware trying to wipe or delete several files in a compromised host as part - of its destructive payload like what acidrain malware does in linux or router machines. - This detection can be a good pivot to check what process and user tries to delete - this type of files which is not so common and need further investigation. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: - - /etc/systemd/* - - /usr/lib/systemd/* - Filesystem.action: deleted - selection2: - TargetFilename: '*.service' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ -tags: - analytic_story: - - AcidRain - asset_type: endpoint - confidence: 80 - impact: 80 - message: a $process_name$ deleting a services in $dest$ - mitre_attack_id: - - T1485 - - T1070.004 - - T1070 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_deletion_of_ssl_certificate.yml b/dev/endpoint/linux_deletion_of_ssl_certificate.yml deleted file mode 100644 index a0ac97d0a9..0000000000 --- a/dev/endpoint/linux_deletion_of_ssl_certificate.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Linux Deletion of SSL Certificate -id: 839ab790-a60a-4f81-bfb3-02567063f615 -version: 1 -date: '2022-04-12' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to detect a deletion of ssl certificate in a linux machine. - attacker may delete or modify ssl certificate to impair some security features or - act as defense evasion in compromised linux machine. This Anomaly can be also a - good indicator of a malware trying to wipe or delete several files in a compromised - host as part of its destructive payload like what acidrain malware does in linux - or router machines. This detection can be a good pivot to check what process and - user tries to delete this type of files which is not so common and need further - investigation. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: /etc/ssl/certs/* - Filesystem.action: deleted - selection2: - TargetFilename: - - '*.pem' - - '*.crt' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ -tags: - analytic_story: - - Acidrain - asset_type: endpoint - confidence: 70 - impact: 70 - message: a $process_name$ deleting a SSL certificate in $dest$ - mitre_attack_id: - - T1485 - - T1070.004 - - T1070 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_disable_services.yml b/dev/endpoint/linux_disable_services.yml deleted file mode 100644 index 12fb5a6386..0000000000 --- a/dev/endpoint/linux_disable_services.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Linux Disable Services -id: f2e08a38-6689-4df4-ad8c-b51c16262316 -version: 1 -date: '2022-04-22' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic is to detect events that attempts to disable a - service. This is typically identified in parallel with other instances of service - enumeration of attempts to stop a service and then delete it. Adversaries utilize - this technique like industroyer2 malware to terminate security services or other - related services to continue there objective as a destructive payload. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '* disable*' - Image|endswith: - - systemctl - - service - - svcadm - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. -references: -- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ -- https://cert.gov.ua/article/39518 -tags: - analytic_story: - - Industroyer2 - asset_type: Endpoint - confidence: 70 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - attempting to disable services on endpoint $dest$ by $user$. - mitre_attack_id: - - T1489 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/linux_service_stop_disable/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_doas_conf_file_creation.yml b/dev/endpoint/linux_doas_conf_file_creation.yml deleted file mode 100644 index 72934a3eb3..0000000000 --- a/dev/endpoint/linux_doas_conf_file_creation.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Linux Doas Conf File Creation -id: f6343e86-6e09-11ec-9376-acde48001122 -version: 1 -date: '2022-01-05' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to detect the creation of doas.conf file in linux host - platform. This configuration file can be use by doas utility tool to allow or permit - standard users to perform tasks as root, the same way sudo does. This tool is developed - as a minimalistic alternative to sudo application. This tool can be abused advesaries, - attacker or malware to gain elevated privileges to the targeted or compromised host. - On the other hand this can also be executed by administrator for a certain task - that needs admin rights. In this case filter is needed. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: '*/etc/doas.conf' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://wiki.gentoo.org/wiki/Doas -- https://www.makeuseof.com/how-to-install-and-use-doas/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 70 - impact: 70 - message: A file $file_name$ is created in $file_path$ on $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/doas/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_doas_tool_execution.yml b/dev/endpoint/linux_doas_tool_execution.yml deleted file mode 100644 index 0f3f1e3f0d..0000000000 --- a/dev/endpoint/linux_doas_tool_execution.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Linux Doas Tool Execution -id: d5a62490-6e09-11ec-884e-acde48001122 -version: 1 -date: '2022-01-05' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to detect the doas tool execution in linux host platform. - This utility tool allow standard users to perform tasks as root, the same way sudo - does. This tool is developed as a minimalistic alternative to sudo application. - This tool can be abused advesaries, attacker or malware to gain elevated privileges - to the targeted or compromised host. On the other hand this can also be executed - by administrator for a certain task that needs admin rights. In this case filter - is needed. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: doas - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://wiki.gentoo.org/wiki/Doas -- https://www.makeuseof.com/how-to-install-and-use-doas/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 70 - impact: 70 - message: A doas $process_name$ with commandline $process$ was executed on $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/doas_exec/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_docker_privilege_escalation.yml b/dev/endpoint/linux_docker_privilege_escalation.yml deleted file mode 100644 index ae128bff7f..0000000000 --- a/dev/endpoint/linux_docker_privilege_escalation.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Linux Docker Privilege Escalation -id: 2e7bfb78-85f6-47b5-bc2f-15813a4ef2b3 -version: 1 -date: '2022-07-31' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: Docker is an open source containerization platform. It helps programmers - to bundle applications into containers, which are standardized executable parts - that include the application source code along with the OS libraries and dependencies - needed to run that code in any setting. The user can add mount the root directory - into a container and edit the /etc/password file to add a super user. This requires - the user to be privileged enough to run docker, i.e. being in the docker group or - being root. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*docker*-v*/*:*' - - '*docker*--volume*/*:*' - - '*docker*exec*sh*' - - '*docker*exec*bash*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives are present based on automated tooling or system - administrative usage. Filter as needed. -references: -- https://gtfobins.github.io/gtfobins/docker/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 10 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 5 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/docker/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_edit_cron_table_parameter.yml b/dev/endpoint/linux_edit_cron_table_parameter.yml deleted file mode 100644 index 3a7b34e1bc..0000000000 --- a/dev/endpoint/linux_edit_cron_table_parameter.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Linux Edit Cron Table Parameter -id: 0d370304-5f26-11ec-a4bb-acde48001122 -version: 1 -date: '2021-12-17' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: The following analytic identifies a suspicious cronjobs modification - using crontab edit parameter. This commandline parameter can be abuse by malware - author, adversaries, and red red teamers to add cronjob entry to their malicious - code to execute to the schedule they want. This event can also be executed by administrator - or normal user for automation purposes so filter is needed. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*crontab *' - Image|endswith: crontab - selection2: - CommandLine: '* -e*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. -references: -- https://attack.mitre.org/techniques/T1053/003/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Living Off The Land - asset_type: Endpoint - confidence: 30 - impact: 30 - message: A possible crontab edit command $process$ executed on $dest$ - mitre_attack_id: - - T1053.003 - - T1053 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/crontab_edit_parameter/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_emacs_privilege_escalation.yml b/dev/endpoint/linux_emacs_privilege_escalation.yml deleted file mode 100644 index 6e10a076b4..0000000000 --- a/dev/endpoint/linux_emacs_privilege_escalation.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Linux Emacs Privilege Escalation -id: 92033cab-1871-483d-a03b-a7ce98665cfc -version: 1 -date: '2022-08-09' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: EMACS is a family of text editors that are characterized by their extensibility. - The manual for the most widely used variant, GNU Emacs, describes it as "the extensible, - customizable, self-documenting, real-time display editor". If sudo right is given - to EMACS tool for the user, then the user can run special commands as root and possibly - get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*--eval*' - selection2: - CommandLine: '*emacs*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/emacs/ -- https://en.wikipedia.org/wiki/Emacs -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 40 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 20 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/emacs/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_file_created_in_kernel_driver_directory.yml b/dev/endpoint/linux_file_created_in_kernel_driver_directory.yml deleted file mode 100644 index 4f15b09552..0000000000 --- a/dev/endpoint/linux_file_created_in_kernel_driver_directory.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Linux File Created In Kernel Driver Directory -id: b85bbeec-6326-11ec-9311-acde48001122 -version: 1 -date: '2021-12-22' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic looks for suspicious file creation in kernel/driver directory - in linux platform. This directory is known folder for all linux kernel module available - within the system. so creation of file in this directory is a good indicator that - there is a possible rootkit installation in the host machine. This technique was - abuse by adversaries, malware author and red teamers to gain high privileges to - their malicious code such us in kernel level. Even this event is not so common administrator - or legitimate 3rd party tool may install driver or linux kernel module as part of - its installation. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: '*/kernel/drivers/*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the file name, file path, and process_guid executions from your endpoints. - If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. -known_false_positives: Administrator or network operator can create file in this folders - for automation purposes. Please update the filter macros to remove false positives. -references: -- https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/ -- https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup -- https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485 -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Rootkit - asset_type: Endpoint - confidence: 90 - impact: 80 - message: A file $file_name$ is created in $file_path$ on $dest$ - mitre_attack_id: - - T1547.006 - - T1547 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 72 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/loading_linux_kernel_module/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_file_creation_in_init_boot_directory.yml b/dev/endpoint/linux_file_creation_in_init_boot_directory.yml deleted file mode 100644 index 17089f7851..0000000000 --- a/dev/endpoint/linux_file_creation_in_init_boot_directory.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Linux File Creation In Init Boot Directory -id: 97d9cfb2-61ad-11ec-bb2d-acde48001122 -version: 1 -date: '2021-12-20' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic looks for suspicious file creation on init system directories - for automatic execution of script or file upon boot up. This technique is commonly - abuse by adversaries, malware author and red teamer to persist on the targeted or - compromised host. This behavior can be executed or use by an administrator or network - operator to add script files or binary files as part of a task or automation. filter - is needed. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: - - '*/etc/init.d/*' - - '*/etc/rc.d/*' - - '*/sbin/init.d/*' - - '*/etc/rc.local*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the file name, file path, and process_guid executions from your endpoints. - If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase -known_false_positives: Administrator or network operator can create file in this folders - for automation purposes. Please update the filter macros to remove false positives. -references: -- https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 70 - impact: 70 - message: A file $file_name$ is created in $file_path$ on $dest$ - mitre_attack_id: - - T1037.004 - - T1037 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_file_creation_in_profile_directory.yml b/dev/endpoint/linux_file_creation_in_profile_directory.yml deleted file mode 100644 index d34b70b535..0000000000 --- a/dev/endpoint/linux_file_creation_in_profile_directory.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Linux File Creation In Profile Directory -id: 46ba0082-61af-11ec-9826-acde48001122 -version: 1 -date: '2021-12-20' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic looks for suspicious file creation in /etc/profile.d directory - to automatically execute scripts by shell upon boot up of a linux machine. This - technique is commonly abused by adversaries, malware and red teamers as a persistence - mechanism to the targeted or compromised host. This Anomaly detection is a good - indicator that someone wants to run a code after boot up which can be done also - by the administrator or network operator for automation purposes. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: '*/etc/profile.d/*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the file name, file path, and process_guid executions from your endpoints. - If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. -known_false_positives: Administrator or network operator can create file in profile.d - folders for automation purposes. Please update the filter macros to remove false - positives. -references: -- https://attack.mitre.org/techniques/T1546/004/ -- https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 80 - impact: 70 - message: A file $file_name$ is created in $file_path$ on $dest$ - mitre_attack_id: - - T1546.004 - - T1546 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_find_privilege_escalation.yml b/dev/endpoint/linux_find_privilege_escalation.yml deleted file mode 100644 index c498d890bb..0000000000 --- a/dev/endpoint/linux_find_privilege_escalation.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Linux Find Privilege Escalation -id: 2ff4e0c2-8256-4143-9c07-1e39c7231111 -version: 1 -date: '2022-08-09' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: Find is a command-line utility that locates files based on some user-specified - criteria and either prints the pathname of each matched object or, if another action - is requested, performs that action on each matched object. If sudo right is given - to find utility for the user, then the user can run system commands as root and - possibly get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*-exec*' - selection2: - CommandLine: '*find*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives are present based on automated tooling or system - administrative usage. Filter as needed. -references: -- https://gtfobins.github.io/gtfobins/find/ -- https://en.wikipedia.org/wiki/Find_(Unix) -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 10 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 5 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/find/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_gdb_privilege_escalation.yml b/dev/endpoint/linux_gdb_privilege_escalation.yml deleted file mode 100644 index bbe155eb3f..0000000000 --- a/dev/endpoint/linux_gdb_privilege_escalation.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Linux GDB Privilege Escalation -id: 310b7da2-ab52-437f-b1bf-0bd458674308 -version: 1 -date: '2022-08-09' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: GDB is the acronym for GNU Debugger. This tool helps to debug the programs - written in C, C++, Ada, Fortran, etc. The console can be opened using the gdb command - on terminal. If sudo right is given to GDB tool for the user, then the user can - run system commands as root and possibly get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*-nx*' - selection2: - CommandLine: '*gdb*' - selection3: - CommandLine: '*-ex*!*' - selection4: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 and selection4 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/gdb/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 20 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 10 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gdb/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_gem_privilege_escalation.yml b/dev/endpoint/linux_gem_privilege_escalation.yml deleted file mode 100644 index 9d2f025e69..0000000000 --- a/dev/endpoint/linux_gem_privilege_escalation.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Linux Gem Privilege Escalation -id: 0115482a-5dcb-4bb0-bcca-5d095d224236 -version: 1 -date: '2022-08-09' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: RubyGems is a package manager for the Ruby programming language that - provides a standard format for distributing Ruby programs and libraries (in a self-contained - format called a "gem"), a tool designed to easily manage the installation of gems, - and a server for distributing them. If sudo right is given to GEM utility for the - user, then the user can run system commands as root and possibly get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*-c*' - selection2: - CommandLine: '*gem*open*-e*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/gem/ -- https://en.wikipedia.org/wiki/RubyGems -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 20 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 10 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gem/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_gnu_awk_privilege_escalation.yml b/dev/endpoint/linux_gnu_awk_privilege_escalation.yml deleted file mode 100644 index f7e6293bc9..0000000000 --- a/dev/endpoint/linux_gnu_awk_privilege_escalation.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Linux GNU Awk Privilege Escalation -id: 0dcf43b9-50d8-42a6-acd9-d1c9201fe6ae -version: 1 -date: '2022-08-09' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: gawk command in Linux is used for pattern scanning and processing language. - The awk command requires no compiling and allows the user to use variables, numeric - functions, string functions, and logical operators. It is a utility that enables - programmers to write tiny and effective programs in the form of statements that - define text patterns that are to be searched for, in a text document and the action - that is to be taken when a match is found within a line. If sudo right is given - to gawk tool for the user, then the user can run system commands as root and possibly - get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*BEGIN*{system*' - selection2: - CommandLine: '*gawk*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/gawk/ -- https://www.geeksforgeeks.org/gawk-command-in-linux-with-examples/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gawk/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_ingress_tool_transfer_hunting.yml b/dev/endpoint/linux_ingress_tool_transfer_hunting.yml deleted file mode 100644 index e9b1929248..0000000000 --- a/dev/endpoint/linux_ingress_tool_transfer_hunting.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Linux Ingress Tool Transfer Hunting -id: 52fd468b-cb6d-48f5-b16a-92f1c9bb10cf -version: 1 -date: '2022-07-29' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following analytic hunts for curl and wget being utilized in the - environment. This is meant to help with identifying normal usage and potentially - malicious. Utilize this query to tune other curl and wget analytics. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - curl - - wget - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives will be present. This query is meant to help - tune other curl and wget analytics. -references: -- https://gtfobins.github.io/gtfobins/curl/ -- https://curl.se/docs/manpage.html#-I -- https://gtfobins.github.io/gtfobins/curl/ -- https://github.com/rapid7/metasploit-framework/search?q=curl -tags: - analytic_story: - - Linux Living Off The Land - - Ingress Tool Transfer - asset_type: Endpoint - confidence: 10 - impact: 10 - message: An instance of $process_name$ was identified on endpoint $dest$ by user - $user$ utilizing curl or wget. - mitre_attack_id: - - T1105 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 1 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_ingress_tool_transfer_with_curl.yml b/dev/endpoint/linux_ingress_tool_transfer_with_curl.yml deleted file mode 100644 index 4d2822d3fc..0000000000 --- a/dev/endpoint/linux_ingress_tool_transfer_with_curl.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Linux Ingress Tool Transfer with Curl -id: 8c1de57d-abc1-4b41-a727-a7a8fc5e0857 -version: 1 -date: '2022-07-29' -author: Michael Haag, Splunk -status: production -type: Anomaly -description: The following analytic identifies curl with the command-line switches - that are commonly used to download, output, a remote script or binary. MetaSploit - Framework will combine the -sO switch with | chmod +x to enable a simple one liner - to download and set the execute bit to run the file immediately. During triage, - review the remote domain and file being downloaded for legitimacy. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: curl - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives will be present. Tune and then change type - to TTP. -references: -- https://gtfobins.github.io/gtfobins/curl/ -- https://curl.se/docs/manpage.html#-I -- https://gtfobins.github.io/gtfobins/curl/ -- https://github.com/rapid7/metasploit-framework/search?q=curl -tags: - analytic_story: - - Linux Living Off The Land - - Ingress Tool Transfer - asset_type: Endpoint - confidence: 30 - impact: 40 - message: An instance of $process_name$ was identified on endpoint $dest$ by user - $user$ to download a remote file. Review activity for further details. - mitre_attack_id: - - T1105 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 12 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_insert_kernel_module_using_insmod_utility.yml b/dev/endpoint/linux_insert_kernel_module_using_insmod_utility.yml deleted file mode 100644 index 08bf70fe8c..0000000000 --- a/dev/endpoint/linux_insert_kernel_module_using_insmod_utility.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Linux Insert Kernel Module Using Insmod Utility -id: 18b5a1a0-6326-11ec-943a-acde48001122 -version: 1 -date: '2021-12-22' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic looks for inserting of linux kernel module using insmod - utility function. This event can detect a installation of rootkit or malicious kernel - module to gain elevated privileges to their malicious code and bypassed detections. - This Anomaly detection is a good indicator that someone installing kernel module - in a linux host either admin or adversaries. filter is needed in this scenario -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*insmod*' - Image|endswith: - - kmod - - sudo - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/ -- https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup -- https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485 -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Rootkit - asset_type: Endpoint - confidence: 80 - impact: 80 - message: A commandline $process$ that may install kernel module on $dest$ - mitre_attack_id: - - T1547.006 - - T1547 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/loading_linux_kernel_module/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_install_kernel_module_using_modprobe_utility.yml b/dev/endpoint/linux_install_kernel_module_using_modprobe_utility.yml deleted file mode 100644 index f9be77532e..0000000000 --- a/dev/endpoint/linux_install_kernel_module_using_modprobe_utility.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Linux Install Kernel Module Using Modprobe Utility -id: 387b278a-6326-11ec-aa2c-acde48001122 -version: 1 -date: '2021-12-22' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic looks for possible installing a linux kernel module using - modprobe utility function. This event can detect a installation of rootkit or malicious - kernel module to gain elevated privileges to their malicious code and bypassed detections. - This Anomaly detection is a good indicator that someone installing kernel module - in a linux host either admin or adversaries. filter is needed in this scenario -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*modprobe*' - Image|endswith: - - kmod - - sudo - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/ -- https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup -- https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485 -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Rootkit - asset_type: Endpoint - confidence: 80 - impact: 80 - message: A commandline $process$ that may install kernel module on $dest$ - mitre_attack_id: - - T1547.006 - - T1547 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/loading_linux_kernel_module/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_iptables_firewall_modification.yml b/dev/endpoint/linux_iptables_firewall_modification.yml deleted file mode 100644 index bc64379af3..0000000000 --- a/dev/endpoint/linux_iptables_firewall_modification.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Linux Iptables Firewall Modification -id: 309d59dc-1e1b-49b2-9800-7cf18d12f7b7 -version: 3 -date: '2022-06-03' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic looks for suspicious commandline that modify the iptables - firewall setting of a linux machine. This technique was seen in cyclopsblink malware - where it modifies the firewall setting of the compromised machine to allow traffic - to its tcp port that will be used to communicate with its C2 server. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '* --dport *' - selection2: - CommandLine: '*iptables *' - selection3: - CommandLine: '* ACCEPT*' - selection4: - CommandLine: '*&>/dev/null*' - selection5: - CommandLine: '* tcp *' - condition: selection1 and selection2 and selection3 and selection4 and selection5 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: administrator may do this commandline for auditing and testing - purposes. In this scenario filter is needed. -references: -- https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf -- https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html -tags: - analytic_story: - - CyclopsBLink - asset_type: Endpoint - confidence: 50 - impact: 50 - message: A commandline $process$ that may modify iptables firewall on $dest$ - mitre_attack_id: - - T1562.004 - - T1562 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/cyclopsblink/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_java_spawning_shell.yml b/dev/endpoint/linux_java_spawning_shell.yml deleted file mode 100644 index b73e7ca450..0000000000 --- a/dev/endpoint/linux_java_spawning_shell.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Linux Java Spawning Shell -id: 7b09db8a-5c20-11ec-9945-acde48001122 -version: 1 -date: '2021-12-13' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the process name of Java, Apache, or - Tomcat spawning a Linux shell. This is potentially indicative of exploitation of - the Java application and may be related to current event CVE-2021-44228 (Log4Shell). - The shells included in the macro are "sh", "ksh", "zsh", "bash", "dash", "rbash", - "fish", "csh', "tcsh', "ion", "eshell". Upon triage, review parallel processes and - command-line arguments to determine legitimacy. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - java - - apache - - tomcat - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon for Linux, you will need to ensure mapping is - occurring correctly. Ensure EDR product is mapping OS Linux to the datamodel properly. - Add any additional java process names for your environment to the analytic as needed. -known_false_positives: Filtering may be required on internal developer build systems - or classify assets as web facing and restrict the analytic based on asset type. -references: -- https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/ -- https://gist.github.com/olafhartong/916ebc673ba066537740164f7e7e1d72 -tags: - analytic_story: - - Hermetic Wiper - - Log4Shell CVE-2021-44228 - - Spring4Shell CVE-2022-22965 - asset_type: Endpoint - confidence: 50 - cve: - - CVE-2021-44228 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ spawning a Linux shell, potentially indicative of exploitation. - mitre_attack_id: - - T1190 - - T1133 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 40 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/java/java_spawn_shell_nix.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_kernel_module_enumeration.yml b/dev/endpoint/linux_kernel_module_enumeration.yml deleted file mode 100644 index 6b41f0d000..0000000000 --- a/dev/endpoint/linux_kernel_module_enumeration.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Linux Kernel Module Enumeration -id: 6df99886-0e04-4c11-8b88-325747419278 -version: 1 -date: '2022-07-27' -author: Michael Haag, Splunk -status: production -type: Anomaly -description: The following analytic identifies the process kmod being utilized to - list kernel modules in use. Typically, this is not seen as malicious, however it - may be a precurser to the use of insmod to install a module. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*lsmod*' - - '*list*' - Image|endswith: kmod - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives are present based on automated tooling or system - administrative usage. Filter as needed. -references: -- https://man7.org/linux/man-pages/man8/kmod.8.html -tags: - analytic_story: - - Linux Rootkit - asset_type: Endpoint - confidence: 50 - impact: 30 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ enumeration kernel modules. - mitre_attack_id: - - T1082 - - T1014 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1082/atomic_red_team/linux-sysmon.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_kworker_process_in_writable_process_path.yml b/dev/endpoint/linux_kworker_process_in_writable_process_path.yml deleted file mode 100644 index 889fadb668..0000000000 --- a/dev/endpoint/linux_kworker_process_in_writable_process_path.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Linux Kworker Process In Writable Process Path -id: 1cefb270-74a5-4e27-aa0c-2b6fa7c5b4ed -version: 2 -date: '2022-04-30' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: This analytic looks for suspicious process kworker commandline in a linux - machine. kworker process name or thread are common names of kernel threads in linux - process. This hunting detections can lead to investigate process contains process - path in writable directory in linux like /home/, /var/log and /tmp/. This technique - was seen in cyclopsblink malware to blend its core and other of its child process - as normal kworker on the compromised machine. This detection might be a good pivot - to look for other IOC related to cyclopsblink malware or attacks. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Processes.parent_process_path: - - /home/* - - /tmp/* - - /var/log/* - ParentCommandLine: '*[kworker/*' - CommandLine: '*iptables*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: unknown -references: -- https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf -- https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html -tags: - analytic_story: - - CyclopsBLink - asset_type: Endpoint - confidence: 60 - impact: 60 - message: a $process_name$ with kworker commandline in $dest$ - mitre_attack_id: - - T1036.004 - - T1036 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 36 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/cyclopsblink/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_make_privilege_escalation.yml b/dev/endpoint/linux_make_privilege_escalation.yml deleted file mode 100644 index cdbe3bd005..0000000000 --- a/dev/endpoint/linux_make_privilege_escalation.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Linux Make Privilege Escalation -id: 80b22836-5091-4944-80ee-f733ac443f4f -version: 1 -date: '2022-08-09' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: The Linux make command is used to build and maintain groups of programs - and files from the source code. In Linux, it is one of the most frequently used - commands by the developers. It assists developers to install and compile many utilities - from the terminal. If sudo right is given to make utility for the user, then the - user can run system commands as root and possibly get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*--eval*' - selection2: - CommandLine: '*make*-s*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/make/ -- https://www.javatpoint.com/linux-make-command -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 40 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 20 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/make/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_mysql_privilege_escalation.yml b/dev/endpoint/linux_mysql_privilege_escalation.yml deleted file mode 100644 index 52b3c9f4b5..0000000000 --- a/dev/endpoint/linux_mysql_privilege_escalation.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Linux MySQL Privilege Escalation -id: c0d810f4-230c-44ea-b703-989da02ff145 -version: 1 -date: '2022-08-09' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: MySQL is an open-source relational database management system. Its name - is a combination of "My", the name of co-founder Michael Widenius's daughter My, - and "SQL", the abbreviation for Structured Query Language. If sudo right is given - to mysql utility for the user, then the user can run system commands as root and - possibly get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*\!**' - selection2: - CommandLine: '*mysql*-e*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives are present based on automated tooling or system - administrative usage. Filter as needed. -references: -- https://gtfobins.github.io/gtfobins/mysql/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/mysql/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_node_privilege_escalation.yml b/dev/endpoint/linux_node_privilege_escalation.yml deleted file mode 100644 index 5bbf8cabdc..0000000000 --- a/dev/endpoint/linux_node_privilege_escalation.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Linux Node Privilege Escalation -id: 2e58a4ff-398f-42f4-8fd0-e01ebfe2a8ce -version: 1 -date: '2022-07-31' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: Node.js is a back-end JavaScript runtime environment that is open-source, - cross-platform, runs on the V8 engine, and executes JavaScript code outside of a - web browser. It was created to help create scalable network applications. If the - binary is allowed to run as superuser by sudo, it does not drop the elevated privileges - and may be used to access the file system, escalate or maintain privileged access. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*-e*' - selection2: - CommandLine: '*sudo*node*' - selection3: - CommandLine: '*child_process.spawn*' - selection4: - CommandLine: '*stdio*' - condition: selection1 and selection2 and selection3 and selection4 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives are present based on automated tooling or system - administrative usage. Filter as needed. -references: -- https://gtfobins.github.io/gtfobins/docker/ -- https://en.wikipedia.org/wiki/Node.js -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 40 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/node/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_nopasswd_entry_in_sudoers_file.yml b/dev/endpoint/linux_nopasswd_entry_in_sudoers_file.yml deleted file mode 100644 index 583470b1e9..0000000000 --- a/dev/endpoint/linux_nopasswd_entry_in_sudoers_file.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Linux NOPASSWD Entry In Sudoers File -id: ab1e0d52-624a-11ec-8e0b-acde48001122 -version: 1 -date: '2021-12-21' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to look for suspicious command lines that may add entry - to /etc/sudoers with NOPASSWD attribute in linux platform. This technique is commonly - abuse by adversaries, malware author and red teamers to gain elevated privilege - to the targeted or compromised host. /etc/sudoers file controls who can run what - commands users can execute on the machines and can also control whether user need - a password to execute particular commands. This file is composed of aliases (basically - variables) and user specifications. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*NOPASSWD:*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands -- https://help.ubuntu.com/community/Sudoers -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 80 - impact: 80 - message: a commandline $process$ executed on $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/nopasswd_sudoers/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_obfuscated_files_or_information_base64_decode.yml b/dev/endpoint/linux_obfuscated_files_or_information_base64_decode.yml deleted file mode 100644 index 67991a8df0..0000000000 --- a/dev/endpoint/linux_obfuscated_files_or_information_base64_decode.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Linux Obfuscated Files or Information Base64 Decode -id: 303b38b2-c03f-44e2-8f41-4594606fcfc7 -version: 1 -date: '2022-07-27' -author: Michael Haag, Splunk -status: production -type: Anomaly -description: The following analytic identifies the use of base64 decode on Linux being - utilized to deobfuscate a file. Identify the source of the file and determine if - legitimate. Review parallel processes for further behavior before and after. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*base64 -d*' - - '*base64 --decode*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present and will require some tuning - based on processes. Filter as needed. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027/T1027.md#atomic-test-1---decode-base64-data-into-script -- https://redcanary.com/blog/lateral-movement-with-secure-shell/ -- https://linux.die.net/man/1/base64 -tags: - analytic_story: - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 30 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ decoding base64. - mitre_attack_id: - - T1027 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027/atomic_red_team/linux-sysmon.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_octave_privilege_escalation.yml b/dev/endpoint/linux_octave_privilege_escalation.yml deleted file mode 100644 index 33b16e8927..0000000000 --- a/dev/endpoint/linux_octave_privilege_escalation.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Linux Octave Privilege Escalation -id: 78f7487d-42ce-4f7f-8685-2159b25fb477 -version: 1 -date: '2022-08-11' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: GNU Octave is a high-level programming language primarily intended for - scientific computing and numerical computation. Octave helps in solving linear and - nonlinear problems numerically, and for performing other numerical experiments using - a language that is mostly compatible with MATLAB. If sudo right is given to the - application for the user, then the user can run system commands as root and possibly - get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*--eval*' - selection2: - CommandLine: '*octave-cli*' - selection3: - CommandLine: '*system*' - selection4: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 and selection4 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/octave/ -- https://en.wikipedia.org/wiki/GNU_Octave -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 40 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 20 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/octave/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_openvpn_privilege_escalation.yml b/dev/endpoint/linux_openvpn_privilege_escalation.yml deleted file mode 100644 index c28b187d4e..0000000000 --- a/dev/endpoint/linux_openvpn_privilege_escalation.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Linux OpenVPN Privilege Escalation -id: d25feebe-fa1c-4754-8a1e-afb03bedc0f2 -version: 1 -date: '2022-08-11' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: OpenVPN is a virtual private network system that implements techniques - to create secure point-to-point or site-to-site connections in routed or bridged - configurations and remote access facilities. It implements both client and server - applications. If sudo right is given to the OpenVPN application for the user, then - the user can run system commands as root and possibly get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*--dev*' - selection2: - CommandLine: '*openvpn*' - selection3: - CommandLine: '*--script-security*' - selection4: - CommandLine: '*--up*' - selection5: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 and selection4 and selection5 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/openvpn/ -- https://en.wikipedia.org/wiki/OpenVPN -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/openvpn/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_php_privilege_escalation.yml b/dev/endpoint/linux_php_privilege_escalation.yml deleted file mode 100644 index 8bca4dd1ad..0000000000 --- a/dev/endpoint/linux_php_privilege_escalation.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Linux PHP Privilege Escalation -id: 4fc4c031-e5be-4cc0-8cf9-49f9f507bcb5 -version: 1 -date: '2022-08-09' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: PHP is a general-purpose scripting language geared toward web development. - It was originally created by Danish-Canadian programmer Rasmus Lerdorf in 1994. - The PHP reference implementation is now produced by The PHP Group. If sudo right - is given to php application for the user, then the user can run system commands - as root and possibly get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*system*' - selection2: - CommandLine: '*php*-r*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/php/ -- https://en.wikipedia.org/wiki/PHP -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/php/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_pkexec_privilege_escalation.yml b/dev/endpoint/linux_pkexec_privilege_escalation.yml deleted file mode 100644 index 998f5630fd..0000000000 --- a/dev/endpoint/linux_pkexec_privilege_escalation.yml +++ /dev/null @@ -1,74 +0,0 @@ -name: Linux pkexec Privilege Escalation -id: 03e22c1c-8086-11ec-ac2e-acde48001122 -version: 1 -date: '2022-01-28' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies `pkexec` spawning with no command-line - arguments. A vulnerability in Polkit's pkexec component identified as CVE-2021-4034 - (PwnKit) which is present in the default configuration of all major Linux distributions - and can be exploited to gain full root privileges on the system. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: pkexec - condition: selection1 -how_to_implement: Depending on the EDR product in use, there are multiple ways to - "null" the command-line field, Processes.process. Two that may be useful `process="(^.{0}$)"` - or `| where isnull(process)`. To generate data for this behavior, Sysmon for Linux - was utilized. To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present, filter as needed. -references: -- https://www.reddit.com/r/crowdstrike/comments/sdfeig/20220126_cool_query_friday_hunting_pwnkit_local/ -- https://linux.die.net/man/1/pkexec -- https://www.bleepingcomputer.com/news/security/linux-system-service-bug-gives-root-on-all-major-distros-exploit-released/ -- https://access.redhat.com/security/security-updates/#/?q=polkit&p=1&sort=portal_publication_date%20desc&rows=10&portal_advisory_type=Security%20Advisory&documentKind=PortalProduct -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 70 - cve: - - CVE-2021-4034 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ related to a local privilege escalation in polkit - pkexec. - mitre_attack_id: - - T1068 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/pkexec/linux-sysmon.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml b/dev/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml deleted file mode 100644 index 488622ca90..0000000000 --- a/dev/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Linux Possible Access Or Modification Of sshd Config File -id: 7a85eb24-72da-11ec-ac76-acde48001122 -version: 1 -date: '2022-01-11' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to look for suspicious process command-line that might - be accessing or modifying sshd_config. This file is the ssh configuration file that - might be modify by threat actors or adversaries to redirect port connection, allow - user using authorized key generated during attack. This anomaly detection might - catch noise from administrator auditing or modifying ssh configuration file. In - this scenario filter is needed -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*/etc/ssh/sshd_config' - Image|endswith: - - cat - - nano* - - vim* - - vi* - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can use this commandline - for automation purposes. Please update the filter macros to remove false positives. -references: -- https://www.hackingarticles.in/ssh-penetration-testing-port-22/ -- https://attack.mitre.org/techniques/T1098/004/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 50 - message: a commandline $process$ executed on $dest$ - mitre_attack_id: - - T1098.004 - - T1098 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/ssh_authorized_keys/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_possible_access_to_credential_files.yml b/dev/endpoint/linux_possible_access_to_credential_files.yml deleted file mode 100644 index 44ad9ca6d8..0000000000 --- a/dev/endpoint/linux_possible_access_to_credential_files.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Linux Possible Access To Credential Files -id: 16107e0e-71fc-11ec-b862-acde48001122 -version: 1 -date: '2022-01-10' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to detect a possible attempt to dump or access the content - of /etc/passwd and /etc/shadow to enable offline credential cracking. "etc/passwd" - store user information within linux OS while "etc/shadow" contain the user passwords - hash. Adversaries and threat actors may attempt to access this to gain persistence - and/or privilege escalation. This anomaly detection can be a good indicator of possible - credential dumping technique but it might catch some normal administrator automation - scripts or during credential auditing. In this scenario filter is needed. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*/etc/shadow*' - - '*/etc/passwd*' - Image|endswith: - - cat - - nano* - - vim* - - vi* - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://askubuntu.com/questions/445361/what-is-difference-between-etc-shadow-and-etc-passwd -- https://attack.mitre.org/techniques/T1003/008/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 50 - impact: 50 - message: A commandline $process$ executed on $dest$ - mitre_attack_id: - - T1003.008 - - T1003 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_possible_access_to_sudoers_file.yml b/dev/endpoint/linux_possible_access_to_sudoers_file.yml deleted file mode 100644 index 8c3a2808b3..0000000000 --- a/dev/endpoint/linux_possible_access_to_sudoers_file.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Linux Possible Access To Sudoers File -id: 4479539c-71fc-11ec-b2e2-acde48001122 -version: 1 -date: '2022-01-10' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to detect a possible access or modification of /etc/sudoers - file. "/etc/sudoers" file controls who can run what command as what users on what - machine and can also control whether a specific user need a password for particular - commands. adversaries and threat actors abuse this file to gain persistence and/or - privilege escalation during attack on targeted host. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*/etc/sudoers*' - Image|endswith: - - cat - - nano* - - vim* - - vi* - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://attack.mitre.org/techniques/T1548/003/ -- https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 50 - impact: 50 - message: A commandline $process$ executed on $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_possible_append_command_to_at_allow_config_file.yml b/dev/endpoint/linux_possible_append_command_to_at_allow_config_file.yml deleted file mode 100644 index ec7f98aa12..0000000000 --- a/dev/endpoint/linux_possible_append_command_to_at_allow_config_file.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Linux Possible Append Command To At Allow Config File -id: 7bc20606-5f40-11ec-a586-acde48001122 -version: 2 -date: '2022-05-26' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic is designed to identify suspicious command lines that may append user entries to either /etc/at.allow or /etc/at.deny. These files can be exploited by malicious actors for persistence on a compromised Linux host by altering permissions for scheduled tasks using the at command. - - In this context, an attacker can create a user or add an existing user to these configuration files to execute their malicious code through scheduled tasks. The detection of such anomalous behavior can serve as an effective indicator warranting further investigation to validate if the activity is indeed malicious or a false positive. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*/etc/at.allow' - - '*/etc/at.deny' - selection2: - CommandLine: '*echo*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: False positives may occur when administrators or network operators use similar command lines for legitimate automation purposes. Therefore, it is recommended to update filter macros to reduce such instances. -references: -- https://linuxize.com/post/at-command-in-linux/ -- https://attack.mitre.org/techniques/T1053/001/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 30 - impact: 30 - message: A commandline $process$ that may modify at allow config file in $dest$ - mitre_attack_id: - - T1053.002 - - T1053 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/at_execution/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_possible_append_command_to_profile_config_file.yml b/dev/endpoint/linux_possible_append_command_to_profile_config_file.yml deleted file mode 100644 index 62cd8bb9cc..0000000000 --- a/dev/endpoint/linux_possible_append_command_to_profile_config_file.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Linux Possible Append Command To Profile Config File -id: 9c94732a-61af-11ec-91e3-acde48001122 -version: 1 -date: '2021-12-20' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic looks for suspicious command-lines that can be possibly - used to modify user profile files to automatically execute scripts/executables by - shell upon reboot of the machine. This technique is commonly abused by adversaries, - malware and red teamers as persistence mechanism to the targeted or compromised - host. This Anomaly detection is a good indicator that someone wants to run code - after reboot which can be done also by the administrator or network operator for - automation purposes. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*~/.bashrc' - - '*~/.bash_profile' - - '*/etc/profile' - - ~/.bash_login - - '*~/.profile' - - ~/.bash_logout - selection2: - CommandLine: '*echo*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can use this commandline - for automation purposes. Please update the filter macros to remove false positives. -references: -- https://unix.stackexchange.com/questions/129143/what-is-the-purpose-of-bashrc-and-how-does-it-work -- https://attack.mitre.org/techniques/T1546/004/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 70 - impact: 70 - message: a commandline $process$ that may modify profile files in $dest$ - mitre_attack_id: - - T1546.004 - - T1546 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml b/dev/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml deleted file mode 100644 index a6b0b89f94..0000000000 --- a/dev/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Linux Possible Append Cronjob Entry on Existing Cronjob File -id: b5b91200-5f27-11ec-bb4e-acde48001122 -version: 1 -date: '2021-12-17' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: This analytic looks for possible suspicious commandline that may use - to append a code to any existing cronjob files for persistence or privilege escalation. - This technique is commonly abused by malware, adversaries and red teamers to automatically - execute their code within a existing or sometimes in normal cronjob script file. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*/etc/cron*' - - '*/var/spool/cron/*' - - '*/etc/anacrontab*' - selection2: - CommandLine: '*echo*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can use this commandline - for automation purposes. Please update the filter macros to remove false positives. -references: -- https://attack.mitre.org/techniques/T1053/003/ -- https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability -- https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 70 - message: A commandline $process$ that may modify cronjob file in $dest$ - mitre_attack_id: - - T1053.003 - - T1053 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/cronjobs_entry/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_possible_cronjob_modification_with_editor.yml b/dev/endpoint/linux_possible_cronjob_modification_with_editor.yml deleted file mode 100644 index c88b5bd5d1..0000000000 --- a/dev/endpoint/linux_possible_cronjob_modification_with_editor.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Linux Possible Cronjob Modification With Editor -id: dcc89bde-5f24-11ec-87ca-acde48001122 -version: 1 -date: '2021-12-17' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: This analytic looks for possible modification of cronjobs file using - editor. This event is can be seen in normal user but can also be a good hunting - indicator for unwanted user modifying cronjobs for possible persistence or privilege - escalation. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*nano *' - - '*vi *' - - '*vim *' - selection2: - Image|endswith: - - nano - - vim.basic - selection3: - CommandLine: - - '*/etc/cron*' - - '*/var/spool/cron/*' - - '*/etc/anacrontab*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can use this commandline - for automation purposes. Please update the filter macros to remove false positives. -references: -- https://attack.mitre.org/techniques/T1053/003/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Living Off The Land - asset_type: Endpoint - confidence: 30 - impact: 20 - message: A commandline $process$ that may modify cronjob file using editor in $dest$ - mitre_attack_id: - - T1053.003 - - T1053 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 6 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/cronjobs_entry/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_possible_ssh_key_file_creation.yml b/dev/endpoint/linux_possible_ssh_key_file_creation.yml deleted file mode 100644 index 6b8eadaae4..0000000000 --- a/dev/endpoint/linux_possible_ssh_key_file_creation.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Linux Possible Ssh Key File Creation -id: c04ef40c-72da-11ec-8eac-acde48001122 -version: 1 -date: '2022-01-11' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to look for possible ssh key file creation on ~/.ssh/ - folder. This technique is commonly abused by threat actors and adversaries to gain - persistence and privilege escalation to the targeted host. by creating ssh private - and public key and passing the public key to the attacker server. threat actor can - access remotely the machine using openssh daemon service. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: '*/.ssh*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the file name, file path, and process_guid executions from your endpoints. - If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. -known_false_positives: Administrator or network operator can create file in ~/.ssh - folders for automation purposes. Please update the filter macros to remove false - positives. -references: -- https://www.hackingarticles.in/ssh-penetration-testing-port-22/ -- https://attack.mitre.org/techniques/T1098/004/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Living Off The Land - asset_type: Endpoint - confidence: 60 - impact: 60 - message: A file $file_name$ is created in $file_path$ on $dest$ - mitre_attack_id: - - T1098.004 - - T1098 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 36 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/ssh_authorized_keys/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_preload_hijack_library_calls.yml b/dev/endpoint/linux_preload_hijack_library_calls.yml deleted file mode 100644 index c0b57f5515..0000000000 --- a/dev/endpoint/linux_preload_hijack_library_calls.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Linux Preload Hijack Library Calls -id: cbe2ca30-631e-11ec-8670-acde48001122 -version: 1 -date: '2021-12-22' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to detect a suspicious command that may hijack a library - function in linux platform. This technique is commonly abuse by adversaries, malware - author and red teamers to gain privileges and persist on the machine. This detection - pertains to loading a dll to hijack or hook a library function of specific program - using LD_PRELOAD command. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*LD_PRELOAD*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://compilepeace.medium.com/memory-malware-part-0x2-writing-userland-rootkits-via-ld-preload-30121c8343d5 -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 80 - impact: 80 - message: A commandline $process$ that may hijack library function on $dest$ - mitre_attack_id: - - T1574.006 - - T1574 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/lib_hijack/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_proxy_socks_curl.yml b/dev/endpoint/linux_proxy_socks_curl.yml deleted file mode 100644 index 542282e84b..0000000000 --- a/dev/endpoint/linux_proxy_socks_curl.yml +++ /dev/null @@ -1,83 +0,0 @@ -name: Linux Proxy Socks Curl -id: bd596c22-ad1e-44fc-b242-817253ce8b08 -version: 1 -date: '2022-07-29' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies curl being utilized with a proxy based - on command-line arguments - -x, socks, --preproxy and --proxy. This behavior is - built into the MetaSploit Framework as a auxiliary module. What does socks buy an - adversary? SOCKS4a extends the SOCKS4 protocol to allow a client to specify a destination - domain name rather than an IP address. The SOCKS5 protocol is defined in RFC 1928. - It is an incompatible extension of the SOCKS4 protocol; it offers more choices for - authentication and adds support for IPv6 and UDP, the latter of which can be used - for DNS lookups. The protocols, and a proxy itself, allow an adversary to evade - controls in place monitoring traffic, making it harder for the defender to identify - and track activity. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*-x *' - - '*socks4a://*' - - '*socks5h://*' - - '*socks4://*' - - '*socks5://*' - - '*--preproxy *' - - --proxy* - Image|endswith: curl - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present based on proxy usage internally. - Filter as needed. -references: -- https://www.offensive-security.com/metasploit-unleashed/proxytunnels/ -- https://curl.se/docs/manpage.html -- https://en.wikipedia.org/wiki/SOCKS -- https://oxylabs.io/blog/curl-with-proxy -- https://reqbin.com/req/c-ddxflki5/curl-proxy-server#:~:text=To%20use%20a%20proxy%20with,be%20URL%20decoded%20by%20Curl. -- https://gtfobins.github.io/gtfobins/curl/ -tags: - analytic_story: - - Linux Living Off The Land - - Ingress Tool Transfer - asset_type: Endpoint - confidence: 80 - impact: 70 - message: An instance of $process_name$ was identified on endpoint $dest$ by user - $user$ utilizing a proxy. Review activity for further details. - mitre_attack_id: - - T1090 - - T1095 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_puppet_privilege_escalation.yml b/dev/endpoint/linux_puppet_privilege_escalation.yml deleted file mode 100644 index 4f905e2f17..0000000000 --- a/dev/endpoint/linux_puppet_privilege_escalation.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Linux Puppet Privilege Escalation -id: 1d19037f-466e-4d56-8d87-36fafd9aa3ce -version: 1 -date: '2022-08-11' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: In computing, Puppet is a software configuration management tool which - includes its own declarative language to describe system configuration. It is a - model-driven solution that requires limited programming knowledge to use. If sudo - right is given to the tool for the user, then the user can run system commands as - root and possibly get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*apply*' - selection2: - CommandLine: '*puppet*' - selection3: - CommandLine: '*-e*' - selection4: - CommandLine: '*exec*' - selection5: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 and selection4 and selection5 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/puppet/ -- https://en.wikipedia.org/wiki/Puppet_(software) -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 10 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 5 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/puppet/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_rpm_privilege_escalation.yml b/dev/endpoint/linux_rpm_privilege_escalation.yml deleted file mode 100644 index c5419adc39..0000000000 --- a/dev/endpoint/linux_rpm_privilege_escalation.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Linux RPM Privilege Escalation -id: f8e58a23-cecd-495f-9c65-6c76b4cb9774 -version: 1 -date: '2022-08-09' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: RPM Package Manager is a free and open-source package management system. - The name RPM refers to the .rpm file format and the package manager program itself. - RPM was intended primarily for Linux distributions; the file format is the baseline - package format of the Linux Standard Base. If sudo right is given to rpm utility - for the user, then the user can run system commands as root and possibly get a root - shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*lua:os.execute*' - selection2: - CommandLine: '*rpm*--eval*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives are present based on automated tooling or system - administrative usage. Filter as needed. -references: -- https://gtfobins.github.io/gtfobins/rpm/ -- https://en.wikipedia.org/wiki/RPM_Package_Manager -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/rpm/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_ruby_privilege_escalation.yml b/dev/endpoint/linux_ruby_privilege_escalation.yml deleted file mode 100644 index 62d1f2593c..0000000000 --- a/dev/endpoint/linux_ruby_privilege_escalation.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Linux Ruby Privilege Escalation -id: 097b28b5-7004-4d40-a715-7e390501788b -version: 1 -date: '2022-08-09' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: Ruby is one of the most used and easy to use programming languages. Ruby - is an open-source, object-oriented interpreter that can be installed on a Linux - system. If sudo right is given to ruby application for the user, then the user can - run system commands as root and possibly get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*exec*' - selection2: - CommandLine: '*ruby*-e*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives are present based on automated tooling or system - administrative usage. Filter as needed. -references: -- https://gtfobins.github.io/gtfobins/ruby/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/ruby/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_service_file_created_in_systemd_directory.yml b/dev/endpoint/linux_service_file_created_in_systemd_directory.yml deleted file mode 100644 index 32366a555e..0000000000 --- a/dev/endpoint/linux_service_file_created_in_systemd_directory.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Linux Service File Created In Systemd Directory -id: c7495048-61b6-11ec-9a37-acde48001122 -version: 1 -date: '2021-12-20' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic looks for suspicious file creation in systemd timer directory - in linux platform. systemd is a system and service manager for Linux distributions. - From the Windows perspective, this process fulfills the duties of wininit.exe and - services.exe combined. At the risk of simplifying the functionality of systemd, - it initializes a Linux system and starts relevant services that are defined in service - unit files. Adversaries, malware and red teamers may abuse this this feature by - stashing systemd service file to persist on the targetted or compromised host. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: - - '*/etc/systemd/system*' - - '*/lib/systemd/system*' - - '*/usr/lib/systemd/system*' - - '*/run/systemd/system*' - - '*~/.config/systemd/*' - - '*~/.local/share/systemd/*' - - '*/etc/systemd/user*' - - '*/lib/systemd/user*' - - '*/usr/lib/systemd/user*' - - '*/run/systemd/user*' - Filesystem.file_name: '*.service' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the file name, file path, and process_guid executions from your endpoints. - If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. -known_false_positives: Administrator or network operator can create file in systemd - folders for automation purposes. Please update the filter macros to remove false - positives. -references: -- https://attack.mitre.org/techniques/T1053/006/ -- https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/ -- https://redcanary.com/blog/attck-t1501-understanding-systemd-service-persistence/ -- https://github.com/microsoft/MSTIC-Sysmon/blob/main/linux/configs/attack-based/persistence/T1053.003_Cron_Activity.xml -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Living Off The Land - asset_type: Endpoint - confidence: 80 - impact: 80 - message: A service file named as $file_path$ is created in systemd folder on $dest$ - mitre_attack_id: - - T1053.006 - - T1053 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_service_restarted.yml b/dev/endpoint/linux_service_restarted.yml deleted file mode 100644 index 71b034318a..0000000000 --- a/dev/endpoint/linux_service_restarted.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Linux Service Restarted -id: 084275ba-61b8-11ec-8d64-acde48001122 -version: 1 -date: '2021-12-20' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic looks for restarted or re-enable services in linux platform. - This technique can be executed or performed using systemctl or service tool application. - Adversaries may create or modify Windows services to repeatedly execute malicious - payloads as part of persistence. When Windows boots up, it starts programs or applications - called services that perform background system functions. Administrator may also - create a legitimated service for a specific tool or normal application as part of - task or automation, in this scenario it is suggested to look for the service path - of the actual script or executable that register as service and who created the - service for further verification. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*systemctl *' - - '*service *' - selection2: - Image|endswith: - - systemctl - - service - selection3: - CommandLine: - - '*restart*' - - '*reload*' - - '*reenable*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and commandline executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can use this commandline - for automation purposes. Please update the filter macros to remove false positives. -references: -- https://attack.mitre.org/techniques/T1543/003/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 50 - message: A commandline $process$ that may create or start a service on $dest$ - mitre_attack_id: - - T1053.006 - - T1053 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_service_started_or_enabled.yml b/dev/endpoint/linux_service_started_or_enabled.yml deleted file mode 100644 index aebf6a979d..0000000000 --- a/dev/endpoint/linux_service_started_or_enabled.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Linux Service Started Or Enabled -id: e0428212-61b7-11ec-88a3-acde48001122 -version: 1 -date: '2021-12-20' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic looks for created or enable services in linux platform. - This technique can be executed or performed using systemctl or service tool application. - Adversaries may create or modify Windows services to repeatedly execute malicious - payloads as part of persistence. When Windows boots up, it starts programs or applications - called services that perform background system functions. Administrator may also - create a legitimated service for a specific tool or normal application as part of - task or automation, in this scenario it is suggested to look for the service path - of the actual script or executable that register as service and who created the - service for further verification. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*systemctl *' - - '*service *' - selection2: - Image|endswith: - - systemctl - - service - selection3: - CommandLine: - - '* start *' - - '* enable *' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can use this commandline - for automation purposes. Please update the filter macros to remove false positives. -references: -- https://attack.mitre.org/techniques/T1543/003/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 60 - message: a commandline $process$ that may create or start a service on $dest - mitre_attack_id: - - T1053.006 - - T1053 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 42 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_setuid_using_setcap_utility.yml b/dev/endpoint/linux_setuid_using_setcap_utility.yml deleted file mode 100644 index 74ca3e98a1..0000000000 --- a/dev/endpoint/linux_setuid_using_setcap_utility.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Linux Setuid Using Setcap Utility -id: 9d96022e-6250-11ec-9a19-acde48001122 -version: 1 -date: '2021-12-21' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic looks for suspicious setcap utility execution to enable - SUID bit. This allows a user to temporarily gain root access, usually in order to - run a program. For example, only the root account is allowed to change the password - information contained in the password database; If the SUID bit appears as an s, - the file's owner also has execute permission to the file; if it appears as an S, - the file's owner does not have execute permission. The second specialty permission - is the SGID, or set group id bit. It is similar to the SUID bit, except it can temporarily - change group membership, usually to execute a program. The SGID bit is set if an - s or an S appears in the group section of permissions. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*setcap *' - selection2: - Image|endswith: setcap - selection3: - CommandLine: '* cap_setuid=' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 70 - impact: 70 - message: A commandline $process$ that may set suid or sgid on $dest$ - mitre_attack_id: - - T1548.001 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/linux_setcap/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_shred_overwrite_command.yml b/dev/endpoint/linux_shred_overwrite_command.yml deleted file mode 100644 index 1502728e3f..0000000000 --- a/dev/endpoint/linux_shred_overwrite_command.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Linux Shred Overwrite Command -id: c1952cf1-643c-4965-82de-11c067cbae76 -version: 1 -date: '2022-04-22' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to detect a shred process to overwrite a files in a - linux machine. Shred Linux application is designed to overwrite file to hide its - contents or make the deleted file un-recoverable. Weve seen this technique in industroyer2 - malware that tries to wipe energy facilities of targeted sector as part of its destructive - attack. It might be some normal user may use this command for valid purposes but - it is recommended to check what files, disk or folder it tries to shred that might - be good pivot for incident response in this type of destructive malware. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*-n*' - - '*-u*' - - '*-z*' - - '*-s*' - Image|endswith: shred - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. -references: -- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ -- https://cert.gov.ua/article/39518 -tags: - analytic_story: - - Industroyer2 - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 70 - impact: 70 - message: A possible shred overwrite command $process$ executed on $dest$ - mitre_attack_id: - - T1485 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/rm_shred_critical_dir/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_sqlite3_privilege_escalation.yml b/dev/endpoint/linux_sqlite3_privilege_escalation.yml deleted file mode 100644 index 3ca3ee937b..0000000000 --- a/dev/endpoint/linux_sqlite3_privilege_escalation.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Linux Sqlite3 Privilege Escalation -id: ab75dbb7-c3ba-4689-9c1b-8d2717bdcba1 -version: 1 -date: '2022-08-11' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: sqlite3 is a terminal-based front-end to the SQLite library that can - evaluate queries interactively and display the results in multiple formats. sqlite3 - can also be used within shell scripts and other applications to provide batch processing - features. If sudo right is given to this application for the user, then the user - can run system commands as root and possibly get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*.shell*' - selection2: - CommandLine: '*sqlite3*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/sqlite3/ -- https://manpages.ubuntu.com/manpages/trusty/en/man1/sqlite3.1.html -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/sqlite3/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_ssh_authorized_keys_modification.yml b/dev/endpoint/linux_ssh_authorized_keys_modification.yml deleted file mode 100644 index e829fefaad..0000000000 --- a/dev/endpoint/linux_ssh_authorized_keys_modification.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Linux SSH Authorized Keys Modification -id: f5ab595e-28e5-4327-8077-5008ba97c850 -version: 1 -date: '2022-07-27' -author: Michael Haag, Splunk -status: production -type: Anomaly -description: The following analytic identifies based on process execution the modification - of SSH Authorized Keys. Adversaries perform this behavior to persist on endpoints. - During triage, review parallel processes and capture any additional file modifications - for review. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*/authorized_keys*' - Image|endswith: - - bash - - cat - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Filtering will be required as system administrators will add - and remove. One way to filter query is to add "echo". -references: -- https://redcanary.com/blog/lateral-movement-with-secure-shell/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1098.004/T1098.004.md -tags: - analytic_story: - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 30 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ modifying SSH Authorized Keys. - mitre_attack_id: - - T1098.004 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/ssh_authorized_keys/authkey_linux-sysmon.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_ssh_remote_services_script_execute.yml b/dev/endpoint/linux_ssh_remote_services_script_execute.yml deleted file mode 100644 index 0260d12c2e..0000000000 --- a/dev/endpoint/linux_ssh_remote_services_script_execute.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Linux SSH Remote Services Script Execute -id: aa1748dd-4a5c-457a-9cf6-ca7b4eb711b3 -version: 1 -date: '2022-07-27' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies SSH being utilized to move laterally - and execute a script or file on the remote host. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*oStrictHostKeyChecking*' - - '*oConnectTimeout*' - - '*oBatchMode*' - Image|endswith: ssh - selection2: - CommandLine: - - '*http:*' - - '*https:*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: This is not a common command to be executed. Filter as needed. -references: -- https://redcanary.com/blog/lateral-movement-with-secure-shell/ -tags: - analytic_story: - - Linux Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 80 - message: An instance of $process_name$ was identified on endpoint $dest$ by user - $user$ attempting to move laterally and download a file. - mitre_attack_id: - - T1021.004 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.004/atomic_red_team/linux-sysmon.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_stdout_redirection_to_dev_null_file.yml b/dev/endpoint/linux_stdout_redirection_to_dev_null_file.yml deleted file mode 100644 index 6a891ee3cc..0000000000 --- a/dev/endpoint/linux_stdout_redirection_to_dev_null_file.yml +++ /dev/null @@ -1,55 +0,0 @@ -name: Linux Stdout Redirection To Dev Null File -id: de62b809-a04d-46b5-9a15-8298d330f0c8 -version: 1 -date: '2022-04-05' -author: Teoderick Contreras, Splunk -status: experimental -type: Anomaly -description: This analytic looks for suspicious commandline that redirect the stdout - or possible stderror to dev/null file. This technique was seen in cyclopsblink malware - where it redirect the possible output or error while modify the iptables firewall - setting of the compromised machine to hide its action from the user. This Anomaly - detection is a good pivot to look further why process or user use this un common - approach. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*&>/dev/null*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: unknown -references: -- https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf -- https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html -tags: - analytic_story: - - CyclopsBLink - - Industroyer2 - asset_type: Endpoint - confidence: 60 - impact: 60 - message: a commandline $process$ that redirect stdout to dev/null in $dest$ - mitre_attack_id: - - T1562.004 - - T1562 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 36 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/cyclopsblink/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_stop_services.yml b/dev/endpoint/linux_stop_services.yml deleted file mode 100644 index 74752efd21..0000000000 --- a/dev/endpoint/linux_stop_services.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Linux Stop Services -id: d05204a5-9f1c-4946-a7f3-4fa58d76d5fd -version: 1 -date: '2022-04-22' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic is to detect events that attempt to stop or clear - a service. This is typically identified in parallel with other instances of service - enumeration of attempts to stop a service and then delete it. Adversaries utilize - this technique like industroyer2 malware to terminate security services or other - related services to continue there objective as a destructive payload. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*stop*' - Image|endswith: - - systemctl - - service - - svcadm - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. -references: -- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ -- https://cert.gov.ua/article/39518 -tags: - analytic_story: - - Industroyer2 - asset_type: Endpoint - confidence: 70 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - attempting to stop services on endpoint $dest$ by $user$. - mitre_attack_id: - - T1489 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/linux_service_stop_disable/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_sudo_or_su_execution.yml b/dev/endpoint/linux_sudo_or_su_execution.yml deleted file mode 100644 index 3e101898c0..0000000000 --- a/dev/endpoint/linux_sudo_or_su_execution.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Linux Sudo OR Su Execution -id: 4b00f134-6d6a-11ec-a90c-acde48001122 -version: 1 -date: '2022-01-04' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: This analytic is to detect the execution of sudo or su command in linux - operating system. The "sudo" command allows a system administrator to delegate authority - to give certain users (or groups of users) the ability to run some (or all) commands - as root or another user while providing an audit trail of the commands and their - arguments. This command is commonly abused by adversaries, malware author and red - teamers to elevate privileges to the targeted host. This command can be executed - by administrator for legitimate purposes or to execute process that need admin privileges, - In this scenario filter is needed. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - sudo - - su - selection2: - Image|endswith: - - sudo - - su - condition: selection1 or selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. If you are - using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://attack.mitre.org/techniques/T1548/003/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 30 - impact: 30 - message: A commandline $process$ that execute sudo or su in $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/sudo_su/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_sudoers_tmp_file_creation.yml b/dev/endpoint/linux_sudoers_tmp_file_creation.yml deleted file mode 100644 index 4d2f1f80c4..0000000000 --- a/dev/endpoint/linux_sudoers_tmp_file_creation.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Linux Sudoers Tmp File Creation -id: be254a5c-63e7-11ec-89da-acde48001122 -version: 1 -date: '2021-12-23' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to looks for file creation of sudoers.tmp file cause - by editing /etc/sudoers using visudo or editor in linux platform. This technique - may abuse by adversaries, malware author and red teamers to gain elevated privilege - to targeted or compromised host. /etc/sudoers file controls who can run what commands - as what users on what machines and can also control special things such as whether - you need a password for particular commands. The file is composed of aliases (basically - variables) and user specifications (which control who can run what). -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: '*sudoers.tmp*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://forum.ubuntuusers.de/topic/sudo-visudo-gibt-etc-sudoers-tmp/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 90 - impact: 80 - message: A file $file_name$ is created in $file_path$ on $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 72 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/sudoers_temp/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_system_network_discovery.yml b/dev/endpoint/linux_system_network_discovery.yml deleted file mode 100644 index 5118a822f1..0000000000 --- a/dev/endpoint/linux_system_network_discovery.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Linux System Network Discovery -id: 535cb214-8b47-11ec-a2c7-acde48001122 -version: 1 -date: '2022-02-11' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to look for possible enumeration of local network configuration. - This technique is commonly used as part of recon of adversaries or threat actor - to know some network information for its next or further attack. This anomaly detections - may capture normal event made by administrator during auditing or testing network - connection of specific host or network to network. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - arp - - ifconfig - - ip - - netstat - - firewall-cmd - - ufw - - iptables - - ss - - route - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1016/T1016.md -tags: - analytic_story: - - Network Discovery - - Industroyer2 - asset_type: endpoint - confidence: 30 - impact: 30 - message: A commandline $process$ executed on $dest$ - mitre_attack_id: - - T1016 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1016/atomic_red_team/linux_net_discovery/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_visudo_utility_execution.yml b/dev/endpoint/linux_visudo_utility_execution.yml deleted file mode 100644 index 3847f71449..0000000000 --- a/dev/endpoint/linux_visudo_utility_execution.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Linux Visudo Utility Execution -id: 08c41040-624c-11ec-a71f-acde48001122 -version: 1 -date: '2021-12-21' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to looks for suspicious commandline that add entry to - /etc/sudoers by using visudo utility tool in linux platform. This technique may - abuse by adversaries, malware author and red teamers to gain elevated privilege - to targeted or compromised host. /etc/sudoers file controls who can run what commands - as what users on what machines and can also control special things such as whether - you need a password for particular commands. The file is composed of aliases (basically - variables) and user specifications (which control who can run what). -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: visudo - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 40 - impact: 40 - message: A commandline $process$ executed on $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 16 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/visudo/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/local_account_discovery_with_net.yml b/dev/endpoint/local_account_discovery_with_net.yml deleted file mode 100644 index 128635eaa4..0000000000 --- a/dev/endpoint/local_account_discovery_with_net.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Local Account Discovery with Net -id: 5d0d4830-0133-11ec-bae3-acde48001122 -version: 2 -date: '2021-09-16' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `net.exe` or `net1.exe` with - command-line arguments utilized to query for local users. The two arguments `user` - and 'users', return a list of all local users. Red Teams and adversaries alike use - net.exe to enumerate users for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: net.exe - selection2: - Image|endswith: net.exe - selection3: - Image|endswith: net1.exe - selection4: - OriginalFileName: net1.exe - selection5: - CommandLine: - - '*user' - - '*users' - condition: (selection1 or selection2 or selection3 or selection4) and selection5 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1087/001/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Local user discovery enumeration on $dest$ by $user$ - mitre_attack_id: - - T1087 - - T1087.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/local_account_discovery_with_wmic.yml b/dev/endpoint/local_account_discovery_with_wmic.yml deleted file mode 100644 index 0f40e13dc5..0000000000 --- a/dev/endpoint/local_account_discovery_with_wmic.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Local Account Discovery With Wmic -id: 4902d7aa-0134-11ec-9d65-acde48001122 -version: 2 -date: '2021-09-16' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `wmic.exe` with command-line - arguments utilized to query for local users. The argument `useraccount` is used - to leverage WMI to return a list of all local users. Red Teams and adversaries alike - use net.exe to enumerate users for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: wmic.exe - selection2: - Image|endswith: wmic.exe - selection3: - CommandLine: '*useraccount*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1087/001/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Local user discovery enumeration on $dest$ by $user$ - mitre_attack_id: - - T1087 - - T1087.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/logon_script_event_trigger_execution.yml b/dev/endpoint/logon_script_event_trigger_execution.yml deleted file mode 100644 index 2dab6661fd..0000000000 --- a/dev/endpoint/logon_script_event_trigger_execution.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Logon Script Event Trigger Execution -id: 4c38c264-1f74-11ec-b5fa-acde48001122 -version: 1 -date: '2021-09-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious modification of registry entry - to persist and gain privilege escalation upon booting up of compromised host. This - technique was seen in several APT and malware where it modify UserInitMprLogonScript - registry entry to its malicious payload to be executed upon boot up of the machine. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: '*\\Environment\\UserInitMprLogonScript' - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: unknown -references: -- https://attack.mitre.org/techniques/T1037/001/ -tags: - analytic_story: - - Windows Persistence Techniques - - Windows Privilege Escalation - - Hermetic Wiper - asset_type: Endpoint - confidence: 100 - impact: 80 - message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ - mitre_attack_id: - - T1037 - - T1037.001 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1037.001/logonscript_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/macos___re_opened_applications.yml b/dev/endpoint/macos___re_opened_applications.yml deleted file mode 100644 index 0f0e174b9c..0000000000 --- a/dev/endpoint/macos___re_opened_applications.yml +++ /dev/null @@ -1,50 +0,0 @@ -name: MacOS - Re-opened Applications -id: 40bb64f9-f619-4e3d-8732-328d40377c4b -version: 1 -date: '2020-02-07' -author: Jamie Windley, Splunk -status: experimental -type: TTP -description: This search looks for processes referencing the plist files that determine - which applications are re-opened when a user reboots their machine. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*com.apple.loginwindow*' - condition: selection1 -how_to_implement: In order to properly run this search, Splunk needs to ingest process - data from your osquery deployed agents with the [splunk.conf](https://github.com/splunk/TA-osquery/blob/master/config/splunk.conf) - pack enabled. Also the [TA-OSquery](https://github.com/splunk/TA-osquery) must be - deployed across your indexers and universal forwarders in order to have the data - populate the Endpoint data model. -known_false_positives: At this stage, there are no known false positives. During testing, - no process events refering the com.apple.loginwindow.plist files were observed during - normal operation of re-opening applications on reboot. Therefore, it can be asumed - that any occurences of this in the process events would be worth investigating. - In the event that the legitimate modification by the system of these files is in - fact logged to the process log, then the process_name of that process can be added - to an allow list. -references: [] -tags: - analytic_story: - - ColdRoot MacOS RAT - asset_type: Endpoint - confidence: 50 - impact: 50 - message: tbd - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: threat diff --git a/dev/endpoint/malicious_powershell_process___encoded_command.yml b/dev/endpoint/malicious_powershell_process___encoded_command.yml deleted file mode 100644 index 150451fd61..0000000000 --- a/dev/endpoint/malicious_powershell_process___encoded_command.yml +++ /dev/null @@ -1,82 +0,0 @@ -name: Malicious PowerShell Process - Encoded Command -id: c4db14d9-7909-48b4-a054-aa14d89dbb19 -version: 7 -date: '2022-01-18' -author: David Dorsey, Michael Haag, Splunk -status: production -type: Hunting -description: 'The following analytic identifies the use of the EncodedCommand PowerShell - parameter. This is typically used by Administrators to run complex scripts, but - commonly used by adversaries to hide their code. - - The analytic identifies all variations of EncodedCommand, as PowerShell allows the - ability to shorten the parameter. For example enc, enco, encod and so forth. In - addition, through our research it was identified that PowerShell will interpret - different command switch types beyond the hyphen. We have added endash, emdash, - horizontal bar, and forward slash. - - During triage, review parallel events to determine legitimacy. Tune as needed based - on admin scripts in use. - - Alternatively, may use regex per matching here https://regexr.com/662ov.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: pwsh.dll - selection2: - Image|endswith: - - pwsh.exe - - sqlps.exe - - sqltoolsps.exe - - powershell.exe - - powershell_ise.exe - selection3: - OriginalFileName: PowerShell.EXE - selection4: - OriginalFileName: powershell_ise.EXE - condition: (selection1 or selection2 or selection3 or selection4) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: System administrators may use this option, but it's not common. -references: -- https://regexr.com/662ov -- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/Windows/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1 -- https://ss64.com/ps/powershell.html -- https://twitter.com/M_haggis/status/1440758396534214658?s=20 -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -tags: - analytic_story: - - Hermetic Wiper - - Malicious PowerShell - - NOBELIUM Group - - WhisperGate - - DarkCrystal RAT - - Qakbot - - CISA AA22-320A - asset_type: Endpoint - confidence: 50 - impact: 70 - message: Powershell.exe running potentially malicious encodede commands on $dest$ - mitre_attack_id: - - T1027 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml b/dev/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml deleted file mode 100644 index 6330b449aa..0000000000 --- a/dev/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Malicious PowerShell Process With Obfuscation Techniques -id: cde75cf6-3c7a-4dd6-af01-27cdb4511fd4 -version: 5 -date: '2021-01-19' -author: David Dorsey, Splunk -status: production -type: TTP -description: This search looks for PowerShell processes launched with arguments that - have characters indicative of obfuscation on the command-line. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: pwsh.dll - selection2: - Image|endswith: - - pwsh.exe - - sqlps.exe - - sqltoolsps.exe - - powershell.exe - - powershell_ise.exe - selection3: - OriginalFileName: PowerShell.EXE - selection4: - OriginalFileName: powershell_ise.EXE - condition: (selection1 or selection2 or selection3 or selection4) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: These characters might be legitimately on the command-line, - but it is not common. -references: [] -tags: - analytic_story: - - Hermetic Wiper - - Malicious PowerShell - asset_type: Endpoint - confidence: 60 - impact: 70 - message: Powershell.exe running with potential obfuscated arguments on $dest$ - mitre_attack_id: - - T1059 - - T1059.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 42 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/obfuscated_powershell/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/mimikatz_passtheticket_commandline_parameters.yml b/dev/endpoint/mimikatz_passtheticket_commandline_parameters.yml deleted file mode 100644 index afaf47eb72..0000000000 --- a/dev/endpoint/mimikatz_passtheticket_commandline_parameters.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Mimikatz PassTheTicket CommandLine Parameters -id: 13bbd574-83ac-11ec-99d4-acde48001122 -version: 1 -date: '2022-02-01' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: The following analytic looks for the use of Mimikatz command line parameters - leveraged to execute pass the ticket attacks. Red teams and adversaries alike may - use the pass the ticket technique using stolen Kerberos tickets to move laterally - within an environment, bypassing normal system access controls. Defenders should - be aware that adversaries may customize the source code of Mimikatz and modify the - command line parameters. This would effectively bypass this analytic. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*sekurlsa::tickets /export*' - - '*kerberos::ptt*' - condition: (selection1) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Although highly unlikely, legitimate applications may use the - same command line parameters as Mimikatz. -references: -- https://github.com/gentilkiwi/mimikatz -- https://attack.mitre.org/techniques/T1550/003/ -tags: - analytic_story: - - Active Directory Kerberos Attacks - - CISA AA22-320A - asset_type: endpoint - confidence: 60 - impact: 60 - message: Mimikatz command line parameters for pass the ticket attacks were used - on $dest$ - mitre_attack_id: - - T1550 - - T1550.003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 36 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/mimikatz/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/mmc_lolbas_execution_process_spawn.yml b/dev/endpoint/mmc_lolbas_execution_process_spawn.yml deleted file mode 100644 index 829f0e63b3..0000000000 --- a/dev/endpoint/mmc_lolbas_execution_process_spawn.yml +++ /dev/null @@ -1,114 +0,0 @@ -name: Mmc LOLBAS Execution Process Spawn -id: f6601940-4c74-11ec-b9b7-3e22fbd008af -version: 1 -date: '2021-11-23' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: The following analytic identifies `mmc.exe` spawning a LOLBAS execution - process. When adversaries execute code on remote endpoints abusing the DCOM protocol - and the MMC20 COM object, the executed command is spawned as a child processs of - `mmc.exe`. The LOLBAS project documents Windows native binaries that can be abused - by threat actors to perform tasks like executing malicious code. Looking for child - processes of mmc.exe that are part of the LOLBAS project can help defenders identify - lateral movement activity. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - Regsvcs.exe - - Ftp.exe - - OfflineScannerShell.exe - - Rasautou.exe - - Schtasks.exe - - Xwizard.exe - - Dllhost.exe - - Pnputil.exe - - Atbroker.exe - - Pcwrun.exe - - Ttdinject.exe - - Mshta.exe - - Bitsadmin.exe - - Certoc.exe - - Ieexec.exe - - Microsoft.Workflow.Compiler.exe - - Runscripthelper.exe - - Forfiles.exe - - Msbuild.exe - - Register-cimprovider.exe - - Tttracer.exe - - Ie4uinit.exe - - Bash.exe - - Hh.exe - - SettingSyncHost.exe - - Cmstp.exe - - Mmc.exe - - Stordiag.exe - - Scriptrunner.exe - - Odbcconf.exe - - Extexport.exe - - Msdt.exe - - WorkFolders.exe - - Diskshadow.exe - - Mavinject.exe - - Regasm.exe - - Gpscript.exe - - Rundll32.exe - - Regsvr32.exe - - Msiexec.exe - - Wuauclt.exe - - Presentationhost.exe - - Wmic.exe - - Runonce.exe - - Syncappvpublishingserver.exe - - Verclsid.exe - - Infdefaultinstall.exe - - Explorer.exe - - Installutil.exe - - Netsh.exe - - Wab.exe - - Dnscmd.exe - - At.exe - - Pcalua.exe - - Msconfig.exe - ParentImage: mmc.exe - condition: (selection1) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -known_false_positives: Legitimate applications may trigger this behavior, filter as - needed. -references: -- https://attack.mitre.org/techniques/T1021/003/ -- https://www.cybereason.com/blog/dcom-lateral-movement-techniques -- https://lolbas-project.github.io/ -tags: - analytic_story: - - Active Directory Lateral Movement - - Living Off The Land - asset_type: Endpoint - confidence: 60 - impact: 90 - message: Mmc.exe spawned a LOLBAS process on $dest$. - mitre_attack_id: - - T1021 - - T1021.003 - - T1218.014 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 54 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement_lolbas/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/monitor_registry_keys_for_print_monitors.yml b/dev/endpoint/monitor_registry_keys_for_print_monitors.yml deleted file mode 100644 index 9baec47a2a..0000000000 --- a/dev/endpoint/monitor_registry_keys_for_print_monitors.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Monitor Registry Keys for Print Monitors -id: f5f6af30-7ba7-4295-bfe9-07de87c01bbc -version: 3 -date: '2020-01-28' -author: Bhavin Patel, Teoderick Contreras, Splunk -status: production -type: TTP -description: This search looks for registry activity associated with modifications - to the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors`. In this - scenario, an attacker can load an arbitrary .dll into the print-monitor registry - by giving the full path name to the after.dll. The system will execute the .dll - with elevated (SYSTEM) permissions and will persist after reboot. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: '*CurrentControlSet\\Control\\Print\\Monitors*' - Registry.action: modified - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. - The data used for this search is typically generated via logs that report registry - modifications. -known_false_positives: You will encounter noise from legitimate print-monitor registry - entries. -references: [] -tags: - analytic_story: - - Suspicious Windows Registry Activities - - Windows Persistence Techniques - - Windows Registry Abuse - asset_type: Endpoint - confidence: 80 - impact: 80 - message: New print monitor added on $dest$ - mitre_attack_id: - - T1547.010 - - T1547 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.010/atomic_red_team/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml b/dev/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml deleted file mode 100644 index db1edb3b9f..0000000000 --- a/dev/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml +++ /dev/null @@ -1,76 +0,0 @@ -name: MS Exchange Mailbox Replication service writing Active Server Pages -id: 985f322c-57a5-11ec-b9ac-acde48001122 -version: 1 -date: '2021-12-07' -author: Michael Haag, Splunk -status: experimental -type: TTP -description: 'The following query identifies suspicious .aspx created in 3 paths identified - by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM - group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`, - `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. The analytic is limited - to process name MSExchangeMailboxReplication.exe, which typically does not write - .aspx files to disk. Upon triage, the suspicious .aspx file will likely look obvious - on the surface. inspect the contents for script code inside. Identify additional - log sources, IIS included, to review source and other potential exploitation. It - is often the case that a particular threat is only applicable to a specific subset - of systems in your environment. Typically analytics to detect those threats are - written without the benefit of being able to only target those systems as well. - Writing analytics against all systems when those behaviors are limited to identifiable - subsets of those systems is suboptimal. Consider the case ProxyShell vulnerability - on Microsoft Exchange Servers. With asset information, a hunter can limit their - analytics to systems that have been identified as Exchange servers. A hunter may - start with the theory that the exchange server is communicating with new systems - that it has not previously. If this theory is run against all publicly facing systems, - the amount of noise it will generate will likely render this theory untenable. However, - using the asset information to limit this analytic to just the Exchange servers - will reduce the noise allowing the hunter to focus only on the systems where this - behavioral change is relevant.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: MSExchangeMailboxReplication.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` - node. -known_false_positives: The query is structured in a way that `action` (read, create) - is not defined. Review the results of this query, filter, and tune as necessary. - It may be necessary to generate this query specific to your endpoint product. -references: -- https://redcanary.com/blog/blackbyte-ransomware/ -tags: - analytic_story: - - ProxyShell - - Ransomware - asset_type: Endpoint - confidence: 90 - impact: 90 - message: A file - $file_name$ was written to disk that is related to IIS exploitation - related to ProxyShell. Review further file modifications on endpoint $dest$ by - user $user$. - mitre_attack_id: - - T1505 - - T1505.003 - - T1190 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: file_name - type: File Name - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 81 - security_domain: endpoint diff --git a/dev/endpoint/msbuild_suspicious_spawned_by_script_process.yml b/dev/endpoint/msbuild_suspicious_spawned_by_script_process.yml deleted file mode 100644 index 212740aa76..0000000000 --- a/dev/endpoint/msbuild_suspicious_spawned_by_script_process.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: MSBuild Suspicious Spawned By Script Process -id: 213b3148-24ea-11ec-93a2-acde48001122 -version: 1 -date: '2021-10-04' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to detect a suspicious child process of MSBuild spawned - by Windows Script Host - cscript or wscript. This behavior or event are commonly - seen and used by malware or adversaries to execute malicious msbuild process using - malicious script in the compromised host. During triage, review parallel processes - and identify any file modifications. MSBuild may load a script from the same path - without having command-line arguments. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - wscript.exe - - cscript.exe - selection2: - OriginalFileName: MSBuild.exe - selection3: - Image|endswith: msbuild.exe - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited as developers do not spawn - MSBuild via a WSH. -references: -- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/ -tags: - analytic_story: - - Trusted Developer Utilities Proxy Execution MSBuild - asset_type: Endpoint - confidence: 70 - impact: 70 - message: Msbuild.exe process spawned by $parent_process_name$ on $dest$ executed - by $user$ - mitre_attack_id: - - T1127.001 - - T1127 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/regsvr32_silent/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml b/dev/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml deleted file mode 100644 index 0446a2ec37..0000000000 --- a/dev/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Mshta spawning Rundll32 OR Regsvr32 Process -id: 4aa5d062-e893-11eb-9eb2-acde48001122 -version: 2 -date: '2021-07-19' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious mshta.exe process that spawn rundll32 - or regsvr32 child process. This technique was seen in several malware nowadays like - trickbot to load its initial .dll stage loader to execute and download the the actual - trickbot payload. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: mshta.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: limitted. this anomaly behavior is not commonly seen in clean - host. -references: -- https://twitter.com/cyb3rops/status/1416050325870587910?s=21 -tags: - analytic_story: - - Trickbot - - IcedID - - Living Off The Land - asset_type: Endpoint - confidence: 80 - impact: 70 - message: a mshta parent process $parent_process_name$ spawn child process $process_name$ - in host $dest$ - mitre_attack_id: - - T1218 - - T1218.005 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/spear_phish/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/net_localgroup_discovery.yml b/dev/endpoint/net_localgroup_discovery.yml deleted file mode 100644 index 230232b494..0000000000 --- a/dev/endpoint/net_localgroup_discovery.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Net Localgroup Discovery -id: 54f5201e-155b-11ec-a6e2-acde48001122 -version: 1 -date: '2021-09-14' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following hunting analytic will identify the use of localgroup discovery - using `net localgroup`. During triage, review parallel processes and identify any - further suspicious behavior. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*localgroup*' - Image|endswith: - - net1.exe - - net.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present. Tune as needed. -references: -- https://attack.mitre.org/techniques/T1069/001/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md -- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF -tags: - analytic_story: - - Active Directory Discovery - - Windows Discovery Techniques - - Azorult - - Windows Post-Exploitation - - Prestige Ransomware - - Volt Typhoon - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Local group discovery on $dest$ by $user$. - mitre_attack_id: - - T1069 - - T1069.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/net_profiler_uac_bypass.yml b/dev/endpoint/net_profiler_uac_bypass.yml deleted file mode 100644 index fa53e9769e..0000000000 --- a/dev/endpoint/net_profiler_uac_bypass.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: NET Profiler UAC bypass -id: 0252ca80-e30d-11eb-8aa3-acde48001122 -version: 2 -date: '2022-02-18' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect modification of registry to bypass UAC windows - feature. This technique is to add a payload dll path on .NET COR file path that - will be loaded by mmc.exe as soon it was executed. This detection rely on monitoring - the registry key and values in the detection area. It may happened that windows - update some dll related to mmc.exe and add dll path in this registry. In this case - filtering is needed. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '*.dll' - TargetObject: '*\\Environment\\COR_PROFILER_PATH' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: limited false positive. It may trigger by some windows update - that will modify this registry. -references: -- https://offsec.almond.consulting/UAC-bypass-dotnet.html -tags: - analytic_story: - - Windows Defense Evasion Tactics - asset_type: Endpoint - confidence: 90 - impact: 70 - message: Suspicious modification of registry $registry_path$ with possible payload - path $registry_value_name$ in $dest$ - mitre_attack_id: - - T1548.002 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon2.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/network_connection_discovery_with_arp.yml b/dev/endpoint/network_connection_discovery_with_arp.yml deleted file mode 100644 index ae6d707bbd..0000000000 --- a/dev/endpoint/network_connection_discovery_with_arp.yml +++ /dev/null @@ -1,52 +0,0 @@ -name: Network Connection Discovery With Arp -id: ae008c0f-83bd-4ed4-9350-98d4328e15d2 -version: 1 -date: '2021-09-10' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `arp.exe` utilized to get a - listing of network connections on a compromised system. Red Teams and adversaries - alike may use arp.exe for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*-a*' - Image|endswith: arp.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1049/ -tags: - analytic_story: - - Active Directory Discovery - - Qakbot - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Network Connection discovery on $dest$ by $user$ - mitre_attack_id: - - T1049 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1049/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/network_connection_discovery_with_net.yml b/dev/endpoint/network_connection_discovery_with_net.yml deleted file mode 100644 index 36c0237cb3..0000000000 --- a/dev/endpoint/network_connection_discovery_with_net.yml +++ /dev/null @@ -1,55 +0,0 @@ -name: Network Connection Discovery With Net -id: 640337e5-6e41-4b7f-af06-9d9eab5e1e2d -version: 1 -date: '2021-09-10' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `net.exe` with command-line - arguments utilized to get a listing of network connections on a compromised system. - Red Teams and adversaries alike may use net.exe for situational awareness and Active - Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*use*' - Image|endswith: - - net1.exe - - net.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1049/ -tags: - analytic_story: - - Active Directory Discovery - - Azorult - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Network Connection discovery on $dest$ by $user$ - mitre_attack_id: - - T1049 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1049/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/network_connection_discovery_with_netstat.yml b/dev/endpoint/network_connection_discovery_with_netstat.yml deleted file mode 100644 index c19c688b6d..0000000000 --- a/dev/endpoint/network_connection_discovery_with_netstat.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Network Connection Discovery With Netstat -id: 2cf5cc25-f39a-436d-a790-4857e5995ede -version: 1 -date: '2021-09-10' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `netstat.exe` with command-line - arguments utilized to get a listing of network connections on a compromised system. - Red Teams and adversaries alike may use netstat.exe for situational awareness and - Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*-a*' - Image|endswith: netstat.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1049/ -tags: - analytic_story: - - Active Directory Discovery - - Qakbot - - CISA AA22-277A - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Network Connection discovery on $dest$ by $user$ - mitre_attack_id: - - T1049 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1049/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/network_discovery_using_route_windows_app.yml b/dev/endpoint/network_discovery_using_route_windows_app.yml deleted file mode 100644 index 1e5b6bd96e..0000000000 --- a/dev/endpoint/network_discovery_using_route_windows_app.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Network Discovery Using Route Windows App -id: dd83407e-439f-11ec-ab8e-acde48001122 -version: 1 -date: '2021-11-12' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: This analytic look for a spawned process of route.exe windows application. - Adversaries and red teams alike abuse this application the recon or do a network - discovery on a target host. but one possible false positive might be an automated - tool used by a system administator or a powershell script in amazon ec2 config services. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: route.exe - selection2: - Image|endswith: route.exe - condition: (selection1 or selection2) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: A network operator or systems administrator may utilize an - automated host discovery application that may generate false positives or an amazon - ec2 script that uses this application. Filter as needed. -references: -- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/ -tags: - analytic_story: - - Active Directory Discovery - - Qakbot - - CISA AA22-277A - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 30 - impact: 30 - message: Network Connection discovery on $dest$ by $user$ - mitre_attack_id: - - T1016 - - T1016.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: WinEventLog diff --git a/dev/endpoint/nishang_powershelltcponeline.yml b/dev/endpoint/nishang_powershelltcponeline.yml deleted file mode 100644 index dc90e58d79..0000000000 --- a/dev/endpoint/nishang_powershelltcponeline.yml +++ /dev/null @@ -1,74 +0,0 @@ -name: Nishang PowershellTCPOneLine -id: 1a382c6c-7c2e-11eb-ac69-acde48001122 -version: 2 -date: '2021-03-03' -author: Michael Haag, Splunk -status: production -type: TTP -description: This query detects the Nishang Invoke-PowerShellTCPOneLine utility that - spawns a call back to a remote Command And Control server. This is a powershell - oneliner. In addition, this will capture on the command-line additional utilities - used by Nishang. Triage the endpoint and identify any parallel processes that look - suspicious. Review the reputation of the remote IP or domain contacted by the powershell - process. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: pwsh.dll - selection2: - Image|endswith: - - pwsh.exe - - sqlps.exe - - sqltoolsps.exe - - powershell.exe - - powershell_ise.exe - selection3: - OriginalFileName: PowerShell.EXE - selection4: - OriginalFileName: powershell_ise.EXE - selection5: - CommandLine: '*System.Text.ASCIIEncoding*' - selection6: - CommandLine: '*Net.Sockets.TCPClient*' - condition: (selection1 or selection2 or selection3 or selection4) and selection5 - and selection6 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives may be present. Filter as needed based - on initial analysis. -references: -- https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcpOneLine.ps1 -- https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/ -- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/ -- https://www.rapid7.com/blog/post/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day/ -tags: - analytic_story: - - HAFNIUM Group - asset_type: Endpoint - confidence: 60 - impact: 70 - message: Possible Nishang Invoke-PowerShellTCPOneLine behavior on $dest$ - mitre_attack_id: - - T1059 - - T1059.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 42 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/nltest_domain_trust_discovery.yml b/dev/endpoint/nltest_domain_trust_discovery.yml deleted file mode 100644 index dd8178f845..0000000000 --- a/dev/endpoint/nltest_domain_trust_discovery.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: NLTest Domain Trust Discovery -id: c3e05466-5f22-11eb-ae93-0242ac130002 -version: 2 -date: '2022-04-18' -author: Michael Haag, Splunk -status: production -type: TTP -description: This search looks for the execution of `nltest.exe` with command-line - arguments utilized to query for Domain Trust information. Two arguments `/domain - trusts`, returns a list of trusted domains, and `/all_trusts`, returns all trusted - domains. Red Teams and adversaries alike use NLTest.exe to enumerate the current - domain to assist with further understanding where to pivot next. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: nltestrk.exe - selection2: - Image|endswith: nltest.exe - selection3: - CommandLine: - - '*/domain_trusts*' - - '*/all_trusts*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators may use nltest for troubleshooting purposes, - otherwise, rarely used. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md -- https://malware.news/t/lets-learn-trickbot-implements-network-collector-module-leveraging-cmd-wmi-ldap/19104 -- https://attack.mitre.org/techniques/T1482/ -- https://owasp.org/www-pdf-archive/Red_Team_Operating_in_a_Modern_Environment.pdf -- https://ss64.com/nt/nltest.html -- https://redcanary.com/threat-detection-report/techniques/domain-trust-discovery/ -- https://thedfirreport.com/2020/10/08/ryuks-return/ -tags: - analytic_story: - - Ryuk Ransomware - - Domain Trust Discovery - - IcedID - - Active Directory Discovery - - Qakbot - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Domain trust discovery execution on $dest$ - mitre_attack_id: - - T1482 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/ntdsutil_export_ntds.yml b/dev/endpoint/ntdsutil_export_ntds.yml deleted file mode 100644 index 2eb56965b3..0000000000 --- a/dev/endpoint/ntdsutil_export_ntds.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Ntdsutil Export NTDS -id: da63bc76-61ae-11eb-ae93-0242ac130002 -version: 1 -date: '2021-01-28' -author: Michael Haag, Patrick Bareiss, Splunk -status: production -type: TTP -description: 'Monitor for signs that Ntdsutil is being used to Extract Active Directory - database - NTDS.dit, typically used for offline password cracking. It may be used - in normal circumstances with no command line arguments or shorthand variations of - more common arguments. Ntdsutil.exe is typically seen run on a Windows Server. Typical - command used to dump ntds.dit - - ntdsutil "ac i ntds" "ifm" "create full C:\Temp" q q - - This technique uses "Install from Media" (IFM), which will extract a copy of the - Active Directory database. A successful export of the Active Directory database - will yield a file modification named ntds.dit to the destination.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*ntds*' - Image|endswith: ntdsutil.exe - selection2: - CommandLine: '*create*' - condition: (selection1 and selection2) -how_to_implement: You must be ingesting endpoint data that tracks process activity, - including parent-child relationships from your endpoints, to populate the Endpoint - data model in the Processes node. The command-line arguments are mapped to the "process" - field in the Endpoint data model. -known_false_positives: Highly possible Server Administrators will troubleshoot with - ntdsutil.exe, generating false positives. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.003/T1003.003.md#atomic-test-3---dump-active-directory-database-with-ntdsutil -- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753343(v=ws.11) -- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf -- https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html -- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ -tags: - analytic_story: - - Credential Dumping - - HAFNIUM Group - - Living Off The Land - - Prestige Ransomware - - Ntdsutil Export NTDS - asset_type: Endpoint - confidence: 50 - impact: 100 - message: Active Directory NTDS export on $dest$ - mitre_attack_id: - - T1003.003 - - T1003 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 50 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/office_application_drop_executable.yml b/dev/endpoint/office_application_drop_executable.yml deleted file mode 100644 index 102ba11b4f..0000000000 --- a/dev/endpoint/office_application_drop_executable.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Office Application Drop Executable -id: 73ce70c4-146d-11ec-9184-acde48001122 -version: 1 -date: '2021-09-13' -author: Teoderick Contreras, Michael Haag Splunk -status: production -type: TTP -description: This search is to detect a suspicious MS office application that drops - or creates executables or scripts in a Windows Operating System. This behavior is - commonly seen in spear phishing office attachment where it drop malicious files - or script to compromised the host. It might be some normal macro may drop script - or tools as part of automation but still this behavior is reallly suspicious and - not commonly seen in normal office application -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - winword.exe - - excel.exe - - powerpnt.exe - - mspub.exe - - visio.exe - - wordpad.exe - - wordview.exe - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -known_false_positives: office macro for automation may do this behavior -references: -- https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation -- https://attack.mitre.org/groups/G0046/ -- https://www.joesandbox.com/analysis/702680/0/html -tags: - analytic_story: - - FIN7 - - AgentTesla - asset_type: Endpoint - confidence: 80 - impact: 80 - message: process $process_name$ drops a file $TargetFilename$ in host $dest$ - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: Computer - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/office_application_spawn_regsvr32_process.yml b/dev/endpoint/office_application_spawn_regsvr32_process.yml deleted file mode 100644 index b149c06ee5..0000000000 --- a/dev/endpoint/office_application_spawn_regsvr32_process.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Office Application Spawn Regsvr32 process -id: 2d9fc90c-f11f-11eb-9300-acde48001122 -version: 2 -date: '2021-07-30' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: this detection was designed to identifies suspicious spawned process - of known MS office application due to macro or malicious code. this technique can - be seen in so many malware like IcedID that used MS office as its weapon or attack - vector to initially infect the machines. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - winword.exe - - excel.exe - - powerpnt.exe - - outlook.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: unknown -references: -- https://www.joesandbox.com/analysis/380662/0/html -tags: - analytic_story: - - IcedID - - Qakbot - asset_type: Endpoint - confidence: 90 - impact: 70 - message: Office application spawning regsvr32.exe on $dest$ - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/phish_icedid/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/office_application_spawn_rundll32_process.yml b/dev/endpoint/office_application_spawn_rundll32_process.yml deleted file mode 100644 index 5fa8a8b166..0000000000 --- a/dev/endpoint/office_application_spawn_rundll32_process.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Office Application Spawn rundll32 process -id: 958751e4-9c5f-11eb-b103-acde48001122 -version: 2 -date: '2021-04-13' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This detection was designed to identify suspicious spawned processes - of known MS office applications due to macro or malicious code. this technique can - be seen in so many malware like trickbot that used MS office as its weapon or attack - vector to initially infect the machines. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - winword.exe - - excel.exe - - powerpnt.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: unknown -references: -- https://any.run/malware-trends/trickbot -- https://any.run/report/47561b4e949041eff0a0f4693c59c81726591779fe21183ae9185b5eb6a69847/aba3722a-b373-4dae-8273-8730fb40cdbe -- https://www.joesandbox.com/analysis/702680/0/html -tags: - analytic_story: - - Spearphishing Attachments - - Trickbot - - IcedID - - AgentTesla - asset_type: Endpoint - confidence: 90 - impact: 70 - message: Office application spawning rundll32.exe on $dest$ - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/office_document_spawned_child_process_to_download.yml b/dev/endpoint/office_document_spawned_child_process_to_download.yml deleted file mode 100644 index 55fc72c0b4..0000000000 --- a/dev/endpoint/office_document_spawned_child_process_to_download.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Office Document Spawned Child Process To Download -id: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3 -version: 3 -date: '2021-09-20' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect potential malicious office document executing - lolbin child process to download payload or other malware. Since most of the attacker - abused the capability of office document to execute living on land application to - blend it to the normal noise in the infected machine to cover its track. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*http:*' - - '*https:*' - ParentImage: - - winword.exe - - excel.exe - - powerpnt.exe - - mspub.exe - - visio.exe - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances office application and browser may be - used. -known_false_positives: Default browser not in the filter list. -references: -- https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/ -tags: - analytic_story: - - Spearphishing Attachments - asset_type: Endpoint - confidence: 50 - impact: 70 - message: Office document spawning suspicious child process on $dest$ - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets2/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/office_product_spawn_cmd_process.yml b/dev/endpoint/office_product_spawn_cmd_process.yml deleted file mode 100644 index c287949e18..0000000000 --- a/dev/endpoint/office_product_spawn_cmd_process.yml +++ /dev/null @@ -1,73 +0,0 @@ -name: Office Product Spawn CMD Process -id: b8b19420-e892-11eb-9244-acde48001122 -version: 2 -date: '2021-07-19' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: this search is to detect a suspicious office product process that spawn - cmd child process. This is commonly seen in a ms office product having macro to - execute shell command to download or execute malicious lolbin relative to its malicious - code. This is seen in trickbot spear phishing doc where it execute shell cmd to - run mshta payload. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - winword.exe - - excel.exe - - powerpnt.exe - selection2: - OriginalFileName: Cmd.Exe - selection3: - Image|endswith: cmd.exe - condition: (selection1) and selection2 and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: IT or network admin may create an document automation that - will run shell script. -references: -- https://twitter.com/cyb3rops/status/1416050325870587910?s=21 -- https://bazaar.abuse.ch/sample/02cbc1ab80695fc12ff8822b926957c3a600247b9ca412a137f69cb5716c8781/ -- https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing -tags: - analytic_story: - - Trickbot - - DarkCrystal RAT - - Azorult - - Remcos - - Qakbot - - AgentTesla - asset_type: Endpoint - confidence: 80 - impact: 70 - message: an office product parent process $parent_process_name$ spawn child process - $process_name$ in host $dest$ - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/spear_phish/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/office_product_spawning_bitsadmin.yml b/dev/endpoint/office_product_spawning_bitsadmin.yml deleted file mode 100644 index b8b0bf3acc..0000000000 --- a/dev/endpoint/office_product_spawning_bitsadmin.yml +++ /dev/null @@ -1,73 +0,0 @@ -name: Office Product Spawning BITSAdmin -id: e8c591f4-a6d7-11eb-8cf7-acde48001122 -version: 2 -date: '2021-04-26' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following detection identifies the latest behavior utilized by different - malware families (including TA551, IcedID). This detection identifies any Windows - Office Product spawning `bitsadmin.exe`. In malicious instances, the command-line - of `bitsadmin.exe` will contain a URL to a remote destination or similar command-line - arguments as transfer, Download, priority, Foreground. In addition, Threat Research - has released a detections identifying suspicious use of `bitsadmin.exe`. In this - instance, we narrow our detection down to the Office suite as a parent process. - During triage, review all file modifications. Capture and analyze any artifacts - on disk. The Office Product, or `bitsadmin.exe` will have reached out to a remote - destination, capture and block the IPs or domain. Review additional parallel processes - for further activity. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - winword.exe - - excel.exe - - powerpnt.exe - - mspub.exe - - visio.exe - selection2: - OriginalFileName: bitsadmin.exe - selection3: - Image|endswith: bitsadmin.exe - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: No false positives known. Filter as needed. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md -tags: - analytic_story: - - Spearphishing Attachments - asset_type: Endpoint - confidence: 90 - impact: 70 - message: office parent process $parent_process_name$ will execute a suspicious child - process $process_name$ with process id $process_id$ in host $dest$ - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/office_product_spawning_certutil.yml b/dev/endpoint/office_product_spawning_certutil.yml deleted file mode 100644 index 96d984e8a0..0000000000 --- a/dev/endpoint/office_product_spawning_certutil.yml +++ /dev/null @@ -1,75 +0,0 @@ -name: Office Product Spawning CertUtil -id: 6925fe72-a6d5-11eb-9e17-acde48001122 -version: 2 -date: '2021-04-26' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following detection identifies the latest behavior utilized by different - malware families (including TA551, IcedID). This detection identifies any Windows - Office Product spawning `certutil.exe`. In malicious instances, the command-line - of `certutil.exe` will contain a URL to a remote destination. In addition, Threat - Research has released a detections identifying suspicious use of `certutil.exe`. - In this instance, we narrow our detection down to the Office suite as a parent process. - During triage, review all file modifications. Capture and analyze any artifacts - on disk. The Office Product, or `certutil.exe` will have reached out to a remote - destination, capture and block the IPs or domain. Review additional parallel processes - for further activity. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - winword.exe - - excel.exe - - powerpnt.exe - - mspub.exe - - visio.exe - selection2: - OriginalFileName: CertUtil.exe - selection3: - Image|endswith: certutil.exe - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: No false positives known. Filter as needed. -references: -- https://redcanary.com/threat-detection-report/threats/TA551/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md -tags: - analytic_story: - - Spearphishing Attachments - - AgentTesla - - Trickbot - asset_type: Endpoint - confidence: 90 - impact: 70 - message: office parent process $parent_process_name$ will execute a suspicious child - process $process_name$ with process id $process_id$ in host $dest$ - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process Name - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/office_product_spawning_mshta.yml b/dev/endpoint/office_product_spawning_mshta.yml deleted file mode 100644 index bba3a5c4e2..0000000000 --- a/dev/endpoint/office_product_spawning_mshta.yml +++ /dev/null @@ -1,74 +0,0 @@ -name: Office Product Spawning MSHTA -id: 6078fa20-a6d2-11eb-b662-acde48001122 -version: 2 -date: '2021-04-26' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following detection identifies the latest behavior utilized by different - malware families (including TA551, IcedID). This detection identifies any Windows - Office Product spawning `mshta.exe`. In malicious instances, the command-line of - `mshta.exe` will contain the `hta` file locally, or a URL to the remote destination. - In addition, Threat Research has released a detections identifying suspicious use - of `mshta.exe`. In this instance, we narrow our detection down to the Office suite - as a parent process. During triage, review all file modifications. Capture and analyze - any artifacts on disk. The Office Product, or `mshta.exe` will have reached out - to a remote destination, capture and block the IPs or domain. Review additional - parallel processes for further activity. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - winword.exe - - excel.exe - - powerpnt.exe - - mspub.exe - - visio.exe - selection2: - OriginalFileName: MSHTA.EXE - selection3: - Image|endswith: mshta.exe - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: No false positives known. Filter as needed. -references: -- https://redcanary.com/threat-detection-report/threats/TA551/ -tags: - analytic_story: - - Spearphishing Attachments - - IcedID - - Azorult - asset_type: Endpoint - confidence: 90 - impact: 70 - message: office parent process $parent_process_name$ will execute a suspicious child - process $process_name$ with process id $process_id$ in host $dest$ - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/office_product_spawning_rundll32_with_no_dll.yml b/dev/endpoint/office_product_spawning_rundll32_with_no_dll.yml deleted file mode 100644 index a83797854c..0000000000 --- a/dev/endpoint/office_product_spawning_rundll32_with_no_dll.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Office Product Spawning Rundll32 with no DLL -id: c661f6be-a38c-11eb-be57-acde48001122 -version: 2 -date: '2021-04-22' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following detection identifies the latest behavior utilized by IcedID - malware family. This detection identifies any Windows Office Product spawning `rundll32.exe` - without a `.dll` file extension. In malicious instances, the command-line of `rundll32.exe` - will look like `rundll32 ..\oepddl.igk2,DllRegisterServer`. In addition, Threat - Research has released a detection identifying the use of `DllRegisterServer` on - the command-line of `rundll32.exe`. In this instance, we narrow our detection down - to the Office suite as a parent process. During triage, review all file modifications. - Capture and analyze the `DLL` that was dropped to disk. The Office Product will - have reached out to a remote destination, capture and block the IPs or domain. Review - additional parallel processes for further activity. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - winword.exe - - excel.exe - - powerpnt.exe - - mspub.exe - - visio.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited, but if any are present, - filter as needed. -references: -- https://www.joesandbox.com/analysis/395471/0/html -- https://app.any.run/tasks/cef4b8ba-023c-4b3b-b2ef-6486a44f6ed9/ -- https://any.run/malware-trends/icedid -tags: - analytic_story: - - Spearphishing Attachments - asset_type: Endpoint - confidence: 90 - impact: 70 - message: office parent process $parent_process_name$ will execute a suspicious child - process $process_name$ with process id $process_id$ and no dll commandline $process$ - in host $dest$ - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_icedid.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/office_product_spawning_windows_script_host.yml b/dev/endpoint/office_product_spawning_windows_script_host.yml deleted file mode 100644 index 6a369aaea2..0000000000 --- a/dev/endpoint/office_product_spawning_windows_script_host.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Office Product Spawning Windows Script Host -id: b3628a5b-8d02-42fa-a891-eebf2351cbe1 -version: 1 -date: '2022-09-26' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic will identify a Windows Office Product spawning - WScript.exe or CScript.exe. Tuning may be required based on legitimate application - usage that may spawn scripts from an Office product. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - wscript.exe - - cscript.exe - ParentImage: - - winword.exe - - excel.exe - - powerpnt.exe - - mspub.exe - - visio.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present based on macro based approved - documents in the organization. Filtering may be needed. -references: -- https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/ -- https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing -tags: - analytic_story: - - Spearphishing Attachments - - Remcos - asset_type: Endpoint - confidence: 90 - impact: 70 - message: office parent process $parent_process_name$ will execute a suspicious child - process $process_name$ on host $dest$. - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/office_product_spawning_wmic.yml b/dev/endpoint/office_product_spawning_wmic.yml deleted file mode 100644 index 5462ef532e..0000000000 --- a/dev/endpoint/office_product_spawning_wmic.yml +++ /dev/null @@ -1,75 +0,0 @@ -name: Office Product Spawning Wmic -id: ffc236d6-a6c9-11eb-95f1-acde48001122 -version: 3 -date: '2021-09-16' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following detection identifies the latest behavior utilized by Ursnif - malware family. This detection identifies any Windows Office Product spawning `wmic.exe`. - In malicious instances, the command-line of `wmic.exe` will contain `wmic process - call create`. In addition, Threat Research has released a detection identifying - the use of `wmic process call create` on the command-line of `wmic.exe`. In this - instance, we narrow our detection down to the Office suite as a parent process. - During triage, review all file modifications. Capture and analyze any artifacts - on disk. The Office Product, or `wmic.exe` will have reached out to a remote destination, - capture and block the IPs or domain. Review additional parallel processes for further - activity. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - winword.exe - - excel.exe - - powerpnt.exe - - mspub.exe - - visio.exe - selection2: - OriginalFileName: wmic.exe - selection3: - Image|endswith: wmic.exe - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: No false positives known. Filter as needed. -references: -- https://app.any.run/tasks/fb894ab8-a966-4b72-920b-935f41756afd/ -- https://attack.mitre.org/techniques/T1047/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.md -tags: - analytic_story: - - Spearphishing Attachments - - FIN7 - asset_type: Endpoint - confidence: 90 - impact: 70 - message: office parent process $parent_process_name$ will execute a suspicious child - process $process_name$ with process id $process_id$ in host $dest$ - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process Name - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/office_product_writing_cab_or_inf.yml b/dev/endpoint/office_product_writing_cab_or_inf.yml deleted file mode 100644 index 587f21a67e..0000000000 --- a/dev/endpoint/office_product_writing_cab_or_inf.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Office Product Writing cab or inf -id: f48cd1d4-125a-11ec-a447-acde48001122 -version: 2 -date: '2022-07-07' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies behavior related to CVE-2021-40444. - Whereas the malicious document will load ActiveX and download the remote payload - (.inf, .cab). During triage, review parallel processes and further activity on endpoint - to identify additional patterns. Retrieve the file modifications and analyze further. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - winword.exe - - excel.exe - - powerpnt.exe - - mspub.exe - - visio.exe - - wordpad.exe - - wordview.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` - node. -known_false_positives: The query is structured in a way that `action` (read, create) - is not defined. Review the results of this query, filter, and tune as necessary. - It may be necessary to generate this query specific to your endpoint product. -references: -- https://twitter.com/vxunderground/status/1436326057179860992?s=20 -- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ -- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 -- https://twitter.com/RonnyTNL/status/1436334640617373699?s=20 -tags: - analytic_story: - - Spearphishing Attachments - - Microsoft MSHTML Remote Code Execution CVE-2021-40444 - asset_type: Endpoint - confidence: 100 - cve: - - CVE-2021-40444 - impact: 80 - message: An instance of $process_name$ was identified on $dest$ writing an inf or - cab file to this. This is not typical of $process_name$. - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_cabinf.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/office_spawning_control.yml b/dev/endpoint/office_spawning_control.yml deleted file mode 100644 index 5433271d66..0000000000 --- a/dev/endpoint/office_spawning_control.yml +++ /dev/null @@ -1,80 +0,0 @@ -name: Office Spawning Control -id: 053e027c-10c7-11ec-8437-acde48001122 -version: 1 -date: '2021-09-08' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following detection identifies control.exe spawning from an office - product. This detection identifies any Windows Office Product spawning `control.exe`. - In malicious instances, the command-line of `control.exe` will contain a file path - to a .cpl or .inf, related to CVE-2021-40444. In this instance, we narrow our detection - down to the Office suite as a parent process. During triage, review all file modifications. - Capture and analyze any artifacts on disk. review parallel and child processes to - identify further suspicious behavior -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: control.exe - ParentImage: - - winword.exe - - excel.exe - - powerpnt.exe - - mspub.exe - - visio.exe - - wordpad.exe - - wordview.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives should be present. -references: -- https://strontic.github.io/xcyclopedia/library/control.exe-1F13E714A0FEA8887707DFF49287996F.html -- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ -- https://attack.mitre.org/techniques/T1218/011/ -- https://www.echotrail.io/insights/search/control.exe/ -- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml -tags: - analytic_story: - - Spearphishing Attachments - - Microsoft MSHTML Remote Code Execution CVE-2021-40444 - asset_type: Endpoint - confidence: 100 - cve: - - CVE-2021-40444 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ clicking a suspicious attachment. - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_control.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/outbound_network_connection_from_java_using_default_ports.yml b/dev/endpoint/outbound_network_connection_from_java_using_default_ports.yml deleted file mode 100644 index c55fd5c445..0000000000 --- a/dev/endpoint/outbound_network_connection_from_java_using_default_ports.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Outbound Network Connection from Java Using Default Ports -id: d2c14d28-5c47-11ec-9892-acde48001122 -version: 2 -date: '2022-06-28' -author: Mauricio Velazco, Lou Stella, Splunk -status: production -type: TTP -description: A required step while exploiting the CVE-2021-44228-Log4j vulnerability - is that the victim server will perform outbound connections to attacker-controlled - infrastructure. This is required as part of the JNDI lookup as well as for retrieving - the second stage .class payload. The following analytic identifies the Java process - reaching out to default ports used by the LDAP and RMI protocols. This behavior - could represent successfull exploitation. Note that adversaries can easily decide - to use arbitrary ports for these protocols and potentially bypass this detection. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - java.exe - - javaw.exe - - javaw.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Legitimate Java applications may use perform outbound connections - to these ports. Filter as needed -references: -- https://www.lunasec.io/docs/blog/log4j-zero-day/ -- https://www.govcert.admin.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/ -tags: - analytic_story: - - Log4Shell CVE-2021-44228 - asset_type: Endpoint - confidence: 60 - cve: - - CVE-2021-44228 - impact: 90 - message: Java performed outbound connections to default ports of LDAP or RMI on - $dest$ - mitre_attack_id: - - T1190 - - T1133 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 54 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_java/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/overwriting_accessibility_binaries.yml b/dev/endpoint/overwriting_accessibility_binaries.yml deleted file mode 100644 index c49d1bdc9c..0000000000 --- a/dev/endpoint/overwriting_accessibility_binaries.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Overwriting Accessibility Binaries -id: 13c2f6c3-10c5-4deb-9ba1-7c4460ebe4ae -version: 4 -date: '2020-07-21' -author: David Dorsey, Splunk -status: production -type: TTP -description: Microsoft Windows contains accessibility features that can be launched - with a key combination before a user has logged in. An adversary can modify or replace - these programs so they can get a command prompt or backdoor without logging in to - the system. This search looks for modifications to these binaries. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: - - '*\\Windows\\System32\\sethc.exe*' - - '*\\Windows\\System32\\utilman.exe*' - - '*\\Windows\\System32\\osk.exe*' - - '*\\Windows\\System32\\Magnify.exe*' - - '*\\Windows\\System32\\Narrator.exe*' - - '*\\Windows\\System32\\DisplaySwitch.exe*' - - '*\\Windows\\System32\\AtBroker.exe*' - condition: (selection1) -how_to_implement: You must be ingesting data that records the filesystem activity - from your hosts to populate the Endpoint file-system data model node. If you are - using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which - you want to collect data. -known_false_positives: Microsoft may provide updates to these binaries. Verify that - these changes do not correspond with your normal software update cycle. -references: [] -tags: - analytic_story: - - Windows Privilege Escalation - - Hermetic Wiper - asset_type: Endpoint - confidence: 90 - impact: 80 - message: A suspicious file modification or replace in $file_path$ in host $dest$ - mitre_attack_id: - - T1546 - - T1546.008 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: file_path - type: File - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 72 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.008/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/password_policy_discovery_with_net.yml b/dev/endpoint/password_policy_discovery_with_net.yml deleted file mode 100644 index 04238cb5cb..0000000000 --- a/dev/endpoint/password_policy_discovery_with_net.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Password Policy Discovery with Net -id: 09336538-065a-11ec-8665-acde48001122 -version: 1 -date: '2021-08-26' -author: Teoderick Contreras, Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `net.exe` or `net1.exe` with - command line arguments used to obtain the domain password policy. Red Teams and - adversaries may leverage `net.exe` for situational awareness and Active Directory - Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*accounts*' - Image|endswith: - - net1.exe - - net.exe - selection2: - CommandLine: '*/domain*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 30 - impact: 30 - message: an instance of process $process_name$ with commandline $process$ in $dest$ - mitre_attack_id: - - T1201 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/permission_modification_using_takeown_app.yml b/dev/endpoint/permission_modification_using_takeown_app.yml deleted file mode 100644 index b43e142618..0000000000 --- a/dev/endpoint/permission_modification_using_takeown_app.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Permission Modification using Takeown App -id: fa7ca5c6-c9d8-11eb-bce9-acde48001122 -version: 1 -date: '2021-06-10' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a modification of file or directory permission - using takeown.exe windows app. This technique was seen in some ransomware that take - the ownership of a folder or files to encrypt or delete it. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*/f*' - Image|endswith: takeown.exe - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: takeown.exe is a normal windows application that may used by - network operator. -references: -- https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/ -tags: - analytic_story: - - Ransomware - asset_type: Endpoint - confidence: 80 - impact: 70 - message: A suspicious of execution of $process_name$ with process id $process_id$ - and commandline $process$ to modify permission of directory or files in host $dest$ - mitre_attack_id: - - T1222 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/ping_sleep_batch_command.yml b/dev/endpoint/ping_sleep_batch_command.yml deleted file mode 100644 index b196132e31..0000000000 --- a/dev/endpoint/ping_sleep_batch_command.yml +++ /dev/null @@ -1,77 +0,0 @@ -name: Ping Sleep Batch Command -id: ce058d6c-79f2-11ec-b476-acde48001122 -version: 1 -date: '2022-01-20' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic will identify the possible execution of ping sleep batch - commands. This technique was seen in several malware samples and is used to trigger - sleep times without explicitly calling sleep functions or commandlets. The goal - is to delay the execution of malicious code and bypass detection or sandbox analysis. - This detection can be a good indicator of a process delaying its execution for - malicious purposes. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: ping.exe - selection2: - Image|endswith: ping.exe - selection3: - ParentCommandLine: '*-n*' - selection4: - ParentCommandLine: '*ping*' - selection5: - ParentCommandLine: '* Nul*' - selection6: - ParentCommandLine: '*>*' - selection7: - CommandLine: '*-n*' - selection8: - CommandLine: '*ping*' - selection9: - CommandLine: '* Nul*' - selection10: - CommandLine: '*>*' - condition: (selection1 or selection2) and selection3 and selection4 and selection5 - and selection6 or selection7 or selection8 or selection9 or selection10 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrator or network operator may execute this command. - Please update the filter macros to remove false positives. -references: -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -tags: - analytic_story: - - WhisperGate - asset_type: Endpoint - confidence: 60 - impact: 60 - message: suspicious $process$ commandline run in $dest$ - mitre_attack_id: - - T1497 - - T1497.003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 36 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1497.003/ping_sleep/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/possible_browser_pass_view_parameter.yml b/dev/endpoint/possible_browser_pass_view_parameter.yml deleted file mode 100644 index dd051df54a..0000000000 --- a/dev/endpoint/possible_browser_pass_view_parameter.yml +++ /dev/null @@ -1,81 +0,0 @@ -name: Possible Browser Pass View Parameter -id: 8ba484e8-4b97-11ec-b19a-acde48001122 -version: 1 -date: '2021-11-22' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: This analytic will detect if a suspicious process contains a commandline - parameter related to a web browser credential dumper. This technique is used by - Remcos RAT malware which uses the Nirsoft webbrowserpassview.exe application to - dump web browser credentials. Remcos uses the "/stext" command line to dump the - credentials in text format. This Hunting query is a good indicator of hosts suffering - from possible Remcos RAT infection. Since the hunting query is based on the parameter - command and the possible path where it will save the text credential information, - it may catch normal tools that are using the same command and behavior. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*\\temp\\*' - - '*\\users\\public\\*' - - '*\\programdata\\*' - selection2: - CommandLine: - - '*/stext *' - - '*/shtml *' - - '*/LoadPasswordsIE*' - - '*/LoadPasswordsFirefox*' - - '*/LoadPasswordsChrome*' - - '*/LoadPasswordsOpera*' - - '*/LoadPasswordsSafari*' - - '*/UseOperaPasswordFile*' - - '*/OperaPasswordFile*' - - '*/stab*' - - '*/scomma*' - - '*/stabular*' - - '*/shtml*' - - '*/sverhtml*' - - '*/sxml*' - - '*/skeepass*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: False positive is quite limited. Filter is needed -references: -- https://www.nirsoft.net/utils/web_browser_password.html -- https://app.any.run/tasks/df0baf9f-8baf-4c32-a452-16562ecb19be/ -tags: - analytic_story: - - Remcos - asset_type: Endpoint - confidence: 40 - impact: 40 - message: suspicious process $process_name$ contains commandline $process$ on $dest$ - mitre_attack_id: - - T1555.003 - - T1555 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 16 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/web_browser_pass_view/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/possible_lateral_movement_powershell_spawn.yml b/dev/endpoint/possible_lateral_movement_powershell_spawn.yml deleted file mode 100644 index 2b373cf1b4..0000000000 --- a/dev/endpoint/possible_lateral_movement_powershell_spawn.yml +++ /dev/null @@ -1,83 +0,0 @@ -name: Possible Lateral Movement PowerShell Spawn -id: cb909b3e-512b-11ec-aa31-3e22fbd008af -version: 1 -date: '2021-11-29' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: The following analytic assists with identifying a PowerShell process - spawned as a child or grand child process of commonly abused processes during lateral - movement techniques including `services.exe`, `wmiprsve.exe`, `svchost.exe`, `wsmprovhost.exe` - and `mmc.exe`. Legitimate Windows features such as the Service Control Manager, - Windows Management Instrumentation, Task Scheduler, Windows Remote Management and - the DCOM protocol can be abused to start a process on a remote endpoint. Looking - for PowerShell spawned out of this processes may reveal a lateral movement attack. - Red Teams and adversaries alike may abuse these services during a breach for lateral - movement and remote code execution. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - mmc.exe - - wsmprovhost.exe - - svchost.exe - - services.exe - - wmiprvse.exe - selection2: - CommandLine: '*powershell.exe*' - Image|endswith: - - cmd.exe - - powershell.exe - - pwsh.exe - selection3: - CommandLine: '*pwsh.exe*' - Image|endswith: cmd.exe - condition: (selection1) and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -known_false_positives: Legitimate applications may spawn PowerShell as a child process - of the the identified processes. Filter as needed. -references: -- https://attack.mitre.org/techniques/T1021/003/ -- https://attack.mitre.org/techniques/T1021/006/ -- https://attack.mitre.org/techniques/T1047/ -- https://attack.mitre.org/techniques/T1053/005/ -- https://attack.mitre.org/techniques/T1543/003/ -tags: - analytic_story: - - Hermetic Wiper - - Active Directory Lateral Movement - - Malicious PowerShell - asset_type: Endpoint - confidence: 50 - impact: 90 - message: A PowerShell process was spawned as a child process of typically abused - processes on $dest$ - mitre_attack_id: - - T1021 - - T1021.003 - - T1021.006 - - T1047 - - T1053.005 - - T1543.003 - - T1059.001 - - T1218.014 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 45 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_powershell/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/powershell___connect_to_internet_with_hidden_window.yml b/dev/endpoint/powershell___connect_to_internet_with_hidden_window.yml deleted file mode 100644 index eeaf6c9ecd..0000000000 --- a/dev/endpoint/powershell___connect_to_internet_with_hidden_window.yml +++ /dev/null @@ -1,90 +0,0 @@ -name: PowerShell - Connect To Internet With Hidden Window -id: ee18ed37-0802-4268-9435-b3b91aaa18db -version: 8 -date: '2022-01-12' -author: David Dorsey, Michael Haag Splunk -status: production -type: Hunting -description: The following hunting analytic identifies PowerShell commands utilizing - the WindowStyle parameter to hide the window on the compromised endpoint. This combination - of command-line options is suspicious because it is overriding the default PowerShell - execution policy, attempts to hide its activity from the user, and connects to the - Internet. Removed in this version of the query is New-Object. The analytic identifies - all variations of WindowStyle, as PowerShell allows the ability to shorten the parameter. - For example w, win, windowsty and so forth. In addition, through our research it - was identified that PowerShell will interpret different command switch types beyond - the hyphen. We have added endash, emdash, horizontal bar, and forward slash. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: pwsh.dll - selection2: - Image|endswith: - - pwsh.exe - - sqlps.exe - - sqltoolsps.exe - - powershell.exe - - powershell_ise.exe - selection3: - OriginalFileName: PowerShell.EXE - selection4: - OriginalFileName: powershell_ise.EXE - condition: (selection1 or selection2 or selection3 or selection4) -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. -known_false_positives: Legitimate process can have this combination of command-line - options, but it's not common. -references: -- https://regexr.com/663rr -- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/Windows/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1 -- https://ss64.com/ps/powershell.html -- https://twitter.com/M_haggis/status/1440758396534214658?s=20 -- https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/ -tags: - analytic_story: - - Hermetic Wiper - - Malicious PowerShell - - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns - - HAFNIUM Group - - Log4Shell CVE-2021-44228 - - AgentTesla - asset_type: Endpoint - confidence: 90 - cve: - - CVE-2021-44228 - impact: 90 - message: PowerShell processes $process$ started with parameters to modify the execution - policy of the run, run in a hidden window, and connect to the Internet on host - $dest$ executed by user $user$. - mitre_attack_id: - - T1059.001 - - T1059 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - - name: process - type: Process - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 81 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/hidden_powershell/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/powershell_disable_security_monitoring.yml b/dev/endpoint/powershell_disable_security_monitoring.yml deleted file mode 100644 index de32698a2d..0000000000 --- a/dev/endpoint/powershell_disable_security_monitoring.yml +++ /dev/null @@ -1,81 +0,0 @@ -name: Powershell Disable Security Monitoring -id: c148a894-dd93-11eb-bf2a-acde48001122 -version: 3 -date: '2022-07-15' -author: Michael Haag, Splunk -status: production -type: TTP -description: This search is to identifies a modification in registry to disable the - windows denfender real time behavior monitoring. This event or technique is commonly - seen in RAT, bot, or Trojan to disable AV to evade detections. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: pwsh.dll - selection2: - Image|endswith: - - pwsh.exe - - sqlps.exe - - sqltoolsps.exe - - powershell.exe - - powershell_ise.exe - selection3: - OriginalFileName: PowerShell.EXE - selection4: - OriginalFileName: powershell_ise.EXE - selection5: - CommandLine: '*set-mppreference*' - selection6: - CommandLine: - - '*disablerealtimemonitoring*' - - '*disableioavprotection*' - - '*disableintrusionpreventionsystem*' - - '*disablescriptscanning*' - - '*disableblockatfirstseen*' - - '*DisableBehaviorMonitoring*' - - '*drtm *' - - '*dioavp *' - - '*dscrptsc *' - - '*dbaf *' - - '*dbm *' - condition: (selection1 or selection2 or selection3 or selection4) and selection5 - and selection6 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives. However, tune based on scripts that - may perform this action. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell -- https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps -tags: - analytic_story: - - Ransomware - - Revil Ransomware - asset_type: Endpoint - confidence: 50 - impact: 50 - message: '' - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: ComputerName - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25.0 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/pwh_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/powershell_get_localgroup_discovery.yml b/dev/endpoint/powershell_get_localgroup_discovery.yml deleted file mode 100644 index 7dadfe2572..0000000000 --- a/dev/endpoint/powershell_get_localgroup_discovery.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: PowerShell Get LocalGroup Discovery -id: b71adfcc-155b-11ec-9413-acde48001122 -version: 1 -date: '2021-09-14' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following hunting analytic identifies the use of `get-localgroup` - being used with PowerShell to identify local groups on the endpoint. During triage, - review parallel processes and identify any further suspicious behavior. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*get-localgroup*' - Image|endswith: - - cmd.exe - - powershell.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present. Tune as needed. -references: -- https://attack.mitre.org/techniques/T1069/001/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Local group discovery on $dest$ by $user$. - mitre_attack_id: - - T1069 - - T1069.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/powershell_start_bitstransfer.yml b/dev/endpoint/powershell_start_bitstransfer.yml deleted file mode 100644 index 489a25b523..0000000000 --- a/dev/endpoint/powershell_start_bitstransfer.yml +++ /dev/null @@ -1,75 +0,0 @@ -name: PowerShell Start-BitsTransfer -id: 39e2605a-90d8-11eb-899e-acde48001122 -version: 2 -date: '2021-03-29' -author: Michael Haag, Splunk -status: production -type: TTP -description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar - functionality is present. This technique variation is not as commonly used by adversaries, - but has been abused in the past. Lesser known uses include the ability to set the - `-TransferType` to `Upload` for exfiltration of files. In an instance where `Upload` - is used, it is highly possible files will be archived. During triage, review parallel - processes and process lineage. Capture any files on disk and review. For the remote - domain or IP, what is the reputation? -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: pwsh.dll - selection2: - Image|endswith: - - pwsh.exe - - sqlps.exe - - sqltoolsps.exe - - powershell.exe - - powershell_ise.exe - selection3: - OriginalFileName: PowerShell.EXE - selection4: - OriginalFileName: powershell_ise.EXE - selection5: - CommandLine: '*start-bitstransfer*' - condition: (selection1 or selection2 or selection3 or selection4) and selection5 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives. It is possible administrators will - utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent - process or command-line arguments. -references: -- https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281 -- https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs -tags: - analytic_story: - - BITS Jobs - asset_type: Endpoint - confidence: 80 - impact: 70 - message: A suspicious process $process_name$ with commandline $process$ that are - related to bittransfer functionality in host $dest$ - mitre_attack_id: - - T1197 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml b/dev/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml deleted file mode 100644 index cca022a366..0000000000 --- a/dev/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Prevent Automatic Repair Mode using Bcdedit -id: 7742aa92-c9d9-11eb-bbfc-acde48001122 -version: 1 -date: '2021-06-10' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious bcdedit.exe execution to ignore - all failures. This technique was used by ransomware to prevent the compromise machine - automatically boot in repair mode. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*bootstatuspolicy*' - Image|endswith: bcdedit.exe - selection2: - CommandLine: '*ignoreallfailures*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed bcdedit.exe may be used. -known_false_positives: Administrators may modify the boot configuration ignore failure - during testing and debugging. -references: -- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf -tags: - analytic_story: - - Ransomware - asset_type: Endpoint - confidence: 80 - impact: 70 - message: A suspicious process $process_name$ with process id $process_id$ contains - commandline $process$ to ignore all bcdedit execution failure in host $dest$ - mitre_attack_id: - - T1490 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/print_processor_registry_autostart.yml b/dev/endpoint/print_processor_registry_autostart.yml deleted file mode 100644 index 0d853c0f0a..0000000000 --- a/dev/endpoint/print_processor_registry_autostart.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Print Processor Registry Autostart -id: 1f5b68aa-2037-11ec-898e-acde48001122 -version: 1 -date: '2021-09-28' -author: Teoderick Contreras, Splunk -status: experimental -type: TTP -description: This analytic is to detect a suspicious modification or new registry - entry regarding print processor. This registry is known to be abuse by turla or - other APT to gain persistence and privilege escalation to the compromised machine. - This is done by adding the malicious dll payload on the new created key in this - registry that will be executed as it restarted the spoolsv.exe process and services. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: '*\\Control\\Print\\Environments\\Windows x64\\Print Processors*' - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: possible new printer installation may add driver component - on this registry. -references: -- https://attack.mitre.org/techniques/T1547/012/ -- https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/ -tags: - analytic_story: - - Windows Persistence Techniques - - Windows Privilege Escalation - - Hermetic Wiper - asset_type: Endpoint - confidence: 100 - impact: 80 - message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ - mitre_attack_id: - - T1547.012 - - T1547 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/print_reg/sysmon_print.log - source: WinEventLog:Microsoft-Windows-PrintService/Operational - sourcetype: WinEventLog diff --git a/dev/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/dev/endpoint/process_creating_lnk_file_in_suspicious_location.yml deleted file mode 100644 index d66e60739f..0000000000 --- a/dev/endpoint/process_creating_lnk_file_in_suspicious_location.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Process Creating LNK file in Suspicious Location -id: 5d814af1-1041-47b5-a9ac-d754e82e9a26 -version: 6 -date: '2024-05-16' -author: Jose Hernandez, Michael Haag, Splunk -status: production -type: TTP -description: This search looks for a process launching an `*.lnk` file under `C:\User*` - or `*\Local\Temp\*`. This is common behavior used by various spear phishing tools. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: - - '*\\Temp\\*' - - C:\\Users\\* - Filesystem.file_name: '*.lnk' - condition: (selection1) -how_to_implement: You must be ingesting data that records filesystem and process activity - from your hosts to populate the Endpoint data model. This is typically populated - via endpoint detection-and-response product, such as Carbon Black, or endpoint data - sources, such as Sysmon. -known_false_positives: This detection should yield little or no false positive results. - It is uncommon for LNK files to be executed from temporary or user directories. -references: -- https://attack.mitre.org/techniques/T1566/001/ -- https://www.trendmicro.com/en_us/research/17/e/rising-trend-attackers-using-lnk-files-download-malware.html -- https://twitter.com/pr0xylife/status/1590394227758104576 -tags: - analytic_story: - - Spearphishing Attachments - - Qakbot - - IcedID - asset_type: Endpoint - confidence: 90 - impact: 70 - message: A process $process_name$ that launching .lnk file in $file_path$ in host - $dest$ - mitre_attack_id: - - T1566 - - T1566.002 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: network -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/lnk_file_temp_folder/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/process_execution_via_wmi.yml b/dev/endpoint/process_execution_via_wmi.yml deleted file mode 100644 index e78d98f016..0000000000 --- a/dev/endpoint/process_execution_via_wmi.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Process Execution via WMI -id: 24869767-8579-485d-9a4f-d9ddfd8f0cac -version: 4 -date: '2020-03-16' -author: Rico Valdez, Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies `WmiPrvSE.exe` spawning a process. - This typically occurs when a process is instantiated from a local or remote process - using `wmic.exe`. During triage, review parallel processes for suspicious behavior - or commands executed. Review the process and command-line spawning from `wmiprvse.exe`. - Contain and remediate the endpoint as necessary. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: WmiPrvSE.exe - condition: selection1 -how_to_implement: You must be ingesting endpoint data that tracks process activity, - including parent-child relationships from your endpoints to populate the Endpoint - data model in the Processes node. The command-line arguments are mapped to the "process" - field in the Endpoint data model. -known_false_positives: Although unlikely, administrators may use wmi to execute commands - for legitimate purposes. -references: [] -tags: - analytic_story: - - Suspicious WMI Use - asset_type: Endpoint - confidence: 70 - impact: 70 - message: A remote instance execution of wmic.exe that will spawn $parent_process_name$ - in host $dest$ - mitre_attack_id: - - T1047 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/processes_launching_netsh.yml b/dev/endpoint/processes_launching_netsh.yml deleted file mode 100644 index 5764442644..0000000000 --- a/dev/endpoint/processes_launching_netsh.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Processes launching netsh -id: b89919ed-fe5f-492c-b139-95dbb162040e -version: 4 -date: '2021-09-16' -author: Michael Haag, Josef Kuepker, Splunk -status: production -type: Anomaly -description: This search looks for processes launching netsh.exe. Netsh is a command-line - scripting utility that allows you to, either locally or remotely, display or modify - the network configuration of a computer that is currently running. Netsh can be - used as a persistence proxy technique to execute a helper DLL when netsh.exe is - executed. In this search, we are looking for processes spawned by netsh.exe and - executing commands via the command line. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: netsh.exe - selection2: - Image|endswith: netsh.exe - condition: (selection1 or selection2) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Some VPN applications are known to launch netsh.exe. Outside - of these instances, it is unusual for an executable to launch netsh.exe and run - commands. -references: [] -tags: - analytic_story: - - Netsh Abuse - - Disabling Security Tools - - DHS Report TA18-074A - - Azorult - asset_type: Endpoint - confidence: 70 - impact: 20 - message: A process $process_name$ has launched netsh with command-line $process$ - on $dest$. - mitre_attack_id: - - T1562.004 - - T1562 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 14 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.004/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/recursive_delete_of_directory_in_batch_cmd.yml b/dev/endpoint/recursive_delete_of_directory_in_batch_cmd.yml deleted file mode 100644 index c77bed5fda..0000000000 --- a/dev/endpoint/recursive_delete_of_directory_in_batch_cmd.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Recursive Delete of Directory In Batch CMD -id: ba570b3a-d356-11eb-8358-acde48001122 -version: 3 -date: '2022-11-12' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious commandline designed to delete - files or directory recursive using batch command. This technique was seen in ransomware - (reddot) where it it tries to delete the files in recycle bin to impaire user from - recovering deleted files. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: Cmd.Exe - selection2: - Image|endswith: cmd.exe - selection3: - CommandLine: '*/c*' - selection4: - CommandLine: '* rd *' - selection5: - CommandLine: '*/s*' - selection6: - CommandLine: '*/q*' - condition: (selection1 or selection2) and selection3 and selection4 and selection5 - and selection6 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: network operator may use this batch command to delete recursively - a directory or files within directory -references: -- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ -tags: - analytic_story: - - Ransomware - asset_type: Endpoint - confidence: 50 - impact: 50 - message: Recursive Delete of Directory In Batch CMD - mitre_attack_id: - - T1070.004 - - T1070 - observable: - - name: User - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25.0 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml b/dev/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml deleted file mode 100644 index 2803370cf9..0000000000 --- a/dev/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Reg exe Manipulating Windows Services Registry Keys -id: 8470d755-0c13-45b3-bd63-387a373c10cf -version: 5 -date: '2020-11-26' -author: Rico Valdez, Splunk -status: production -type: TTP -description: The search looks for reg.exe modifying registry keys that define Windows - services and their configurations. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*reg*' - Image|endswith: reg.exe - selection2: - CommandLine: '*add*' - selection3: - CommandLine: '*Services*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: It is unusual for a service to be created or modified by directly - manipulating the registry. However, there may be legitimate instances of this behavior. - It is important to validate and investigate, as appropriate. -references: [] -tags: - analytic_story: - - Windows Service Abuse - - Windows Persistence Techniques - - Living Off The Land - asset_type: Endpoint - confidence: 60 - impact: 75 - message: A reg.exe process $process_name$ with commandline $process$ in host $dest$ - mitre_attack_id: - - T1574.011 - - T1574 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 45 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.011/change_registry_path_service/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/registry_keys_for_creating_shim_databases.yml b/dev/endpoint/registry_keys_for_creating_shim_databases.yml deleted file mode 100644 index b8d5c6e0b9..0000000000 --- a/dev/endpoint/registry_keys_for_creating_shim_databases.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Registry Keys for Creating SHIM Databases -id: f5f6af30-7aa7-4295-bfe9-07fe87c01bbb -version: 4 -date: '2020-01-28' -author: Bhavin Patel, Patrick Bareiss, Teoderick Contreras, Splunk -status: production -type: TTP -description: This search looks for registry activity associated with application compatibility - shims, which can be leveraged by attackers for various nefarious purposes. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: - - '*CurrentVersion\\AppCompatFlags\\Custom*' - - '*CurrentVersion\\AppCompatFlags\\InstalledSDB*' - condition: selection1 -how_to_implement: To successfully implement this search, you must populate the Change_Analysis - data model. This is typically populated via endpoint detection and response product, - such as Carbon Black or other endpoint data sources such as Sysmon. The data used - for this search is typically generated via logs that report reads and writes to - the registry. -known_false_positives: There are many legitimate applications that leverage shim databases - for compatibility purposes for legacy applications -references: [] -tags: - analytic_story: - - Suspicious Windows Registry Activities - - Windows Persistence Techniques - - Windows Registry Abuse - asset_type: Endpoint - confidence: 80 - impact: 70 - message: A registry activity in $registry_path$ related to shim modication in host - $dest$ - mitre_attack_id: - - T1546.011 - - T1546 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.011/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/registry_keys_used_for_persistence.yml b/dev/endpoint/registry_keys_used_for_persistence.yml deleted file mode 100644 index bcea209e1f..0000000000 --- a/dev/endpoint/registry_keys_used_for_persistence.yml +++ /dev/null @@ -1,104 +0,0 @@ -name: Registry Keys Used For Persistence -id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b -version: 9 -date: '2022-09-19' -author: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk -status: production -type: TTP -description: The search looks for modifications to registry keys that can be used - to launch an application or service at system startup. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_key_name: Debugger - TargetObject: - - '*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*' - - '*\\Classes\\htmlfile\\shell\\open\\command' - - '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SharedTaskScheduler' - - '*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Common - Startup' - - HKLM\\SOFTWARE\\Microsoft\\Netsh\\* - - '*\\currentversion\\runservices*' - - '*\\currentversion\\policies\\explorer\\run*' - - '*\\CurrentVersion\\Winlogon\\VmApplet*' - - '*\\CurrentVersion\\Winlogon\\Userinit*' - - '*\\CurrentVersion\\Winlogon\\Notify*' - - '*\\CurrentVersion\\Winlogon\\Shell*' - - '*\\currentVersion\\Windows\\Appinit_Dlls*' - - '*\\currentversion\\run*' - - '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run' - - '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce' - selection2: - Registry.registry_key_name: Security Packages - TargetObject: '*\\CurrentControlSet\\Control\\Lsa' - selection3: - Registry.registry_key_name: Security Packages - TargetObject: '*\\CurrentControlSet\\Control\\Lsa\\OSConfig' - selection4: - TargetObject: '*\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*' - selection5: - Registry.registry_key_name: Load - TargetObject: '*currentVersion\\Windows' - selection6: - Registry.registry_key_name: Svchost - TargetObject: '*\\CurrentVersion' - selection7: - Registry.registry_key_name: BootExecute - TargetObject: '*\\CurrentControlSet\Control\Session Manager' - selection8: - Registry.registry_key_name: auto_update - TargetObject: '*\\Software\\Run' - condition: (selection1 or selection2 or selection3 or selection4 or selection5 or - selection6 or selection7 or selection8) -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: There are many legitimate applications that must execute on - system startup and will use these registry keys to accomplish that task. -references: [] -tags: - analytic_story: - - Suspicious Windows Registry Activities - - Suspicious MSHTA Activity - - DHS Report TA18-074A - - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns - - Ransomware - - Windows Persistence Techniques - - 'Emotet Malware DHS Report TA18-201A ' - - IcedID - - Remcos - - Windows Registry Abuse - - Azorult - - Qakbot - asset_type: Endpoint - confidence: 95 - impact: 80 - message: A registry activity in $registry_path$ related to persistence in host $dest$ - mitre_attack_id: - - T1547.001 - - T1547 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 76 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/registry_keys_used_for_privilege_escalation.yml b/dev/endpoint/registry_keys_used_for_privilege_escalation.yml deleted file mode 100644 index b499c1f1ee..0000000000 --- a/dev/endpoint/registry_keys_used_for_privilege_escalation.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Registry Keys Used For Privilege Escalation -id: c9f4b923-f8af-4155-b697-1354f5bcbc5e -version: 5 -date: '2022-01-26' -author: David Dorsey, Teoderick Contreras, Splunk -status: production -type: TTP -description: This search looks for modifications to registry keys that can be used - to elevate privileges. The registry keys under "Image File Execution Options" are - used to intercept calls to an executable and can be used to attach malicious binaries - to benign system binaries. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: - - Debugger - - GlobalFlag - TargetObject: '*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*' - condition: (selection1) -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black, or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: There are many legitimate applications that must execute upon - system startup and will use these registry keys to accomplish that task. -references: -- https://blog.malwarebytes.com/101/2015/12/an-introduction-to-image-file-execution-options/ -tags: - analytic_story: - - Windows Privilege Escalation - - Suspicious Windows Registry Activities - - Cloud Federated Credential Abuse - - Windows Registry Abuse - - Hermetic Wiper - asset_type: Endpoint - confidence: 95 - impact: 80 - message: A registry activity in $registry_path$ related to privilege escalation - in host $dest$ - mitre_attack_id: - - T1546.012 - - T1546 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 76 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.012/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/remcos_client_registry_install_entry.yml b/dev/endpoint/remcos_client_registry_install_entry.yml deleted file mode 100644 index 22d63c4fa3..0000000000 --- a/dev/endpoint/remcos_client_registry_install_entry.yml +++ /dev/null @@ -1,50 +0,0 @@ -name: Remcos client registry install entry -id: f2a1615a-1d63-11ec-97d2-acde48001122 -version: 2 -date: '2022-01-26' -author: Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk -status: production -type: TTP -description: This search detects registry key license at host where Remcos RAT agent - is installed. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_key_name: '*\\Software\\Remcos*' - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: unknown -references: -- https://attack.mitre.org/software/S0332/ -tags: - analytic_story: - - Remcos - - Windows Registry Abuse - asset_type: Endpoint - confidence: 100 - impact: 90 - message: A registry entry $registry_path$ with registry keyname $registry_key_name$ - related to Remcos RAT in host $dest$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_registry/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/remcos_rat_file_creation_in_remcos_folder.yml b/dev/endpoint/remcos_rat_file_creation_in_remcos_folder.yml deleted file mode 100644 index 1dd3263304..0000000000 --- a/dev/endpoint/remcos_rat_file_creation_in_remcos_folder.yml +++ /dev/null @@ -1,52 +0,0 @@ -name: Remcos RAT File Creation in Remcos Folder -id: 25ae862a-1ac3-11ec-94a1-acde48001122 -version: 2 -date: '2021-09-21' -author: Teoderick Contreras, Splunk, Sanjay Govind -status: production -type: TTP -description: This search is to detect file creation in remcos folder in appdata which - is the keylog and clipboard logs that will be send to its c2 server. This is really - a good TTP indicator that there is a remcos rat in the system that do keylogging, - clipboard grabbing and audio recording. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: '*\\remcos\\*' - Filesystem.file_name: '*.dat' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: unknown -references: -- https://success.trendmicro.com/dcx/s/solution/1123281-remcos-malware-information?language=en_US -- https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/ -tags: - analytic_story: - - Remcos - asset_type: Endpoint - confidence: 100 - impact: 100 - message: file $file_name$ created in $file_path$ of $dest$ - mitre_attack_id: - - T1113 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 100 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/remote_desktop_process_running_on_system.yml b/dev/endpoint/remote_desktop_process_running_on_system.yml deleted file mode 100644 index 72da8f4959..0000000000 --- a/dev/endpoint/remote_desktop_process_running_on_system.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Remote Desktop Process Running On System -id: f5939373-8054-40ad-8c64-cec478a22a4a -version: 5 -date: '2020-07-21' -author: David Dorsey, Splunk -status: experimental -type: Hunting -description: This search looks for the remote desktop process mstsc.exe running on - systems upon which it doesn't typically run. This is accomplished by filtering out - all systems that are noted in the `common_rdp_source category` in the Assets and - Identity framework. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Processes.dest_category: common_rdp_source - CommandLine: '*mstsc.exe' - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records process activity from your hosts to populate the endpoint data model - in the processes node. The search requires you to identify systems that do not commonly - use remote desktop. You can use the included support search "Identify Systems Using - Remote Desktop" to identify these systems. After identifying them, you will need - to add the "common_rdp_source" category to that system using the Enterprise Security - Assets and Identities framework. This can be done by adding an entry in the assets.csv - file located in `SA-IdentityManagement/lookups`. -known_false_positives: Remote Desktop may be used legitimately by users on the network. -references: [] -tags: - analytic_story: - - Hidden Cobra Malware - - Active Directory Lateral Movement - asset_type: Endpoint - confidence: 50 - impact: 50 - message: tbd - mitre_attack_id: - - T1021.001 - - T1021 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint diff --git a/dev/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml b/dev/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml deleted file mode 100644 index e8606c64e0..0000000000 --- a/dev/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Remote Process Instantiation via DCOM and PowerShell -id: d4f42098-4680-11ec-ad07-3e22fbd008af -version: 1 -date: '2021-11-15' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `powershell.exe` with arguments - utilized to start a process on a remote endpoint by abusing the DCOM protocol. Specifically, - this search looks for the abuse of ShellExecute and ExecuteShellCommand. Red Teams - and adversaries alike may abuse DCOM and `powershell.exe` for lateral movement and - remote code execution. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: pwsh.dll - selection2: - Image|endswith: - - pwsh.exe - - sqlps.exe - - sqltoolsps.exe - - powershell.exe - - powershell_ise.exe - selection3: - OriginalFileName: PowerShell.EXE - selection4: - OriginalFileName: powershell_ise.EXE - selection5: - CommandLine: - - '*Document.ActiveView.ExecuteShellCommand*' - - '*Document.Application.ShellExecute*' - condition: (selection1 or selection2 or selection3 or selection4) and selection5 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -known_false_positives: Administrators may leverage DCOM to start a process on remote - systems, but this activity is usually limited to a small set of hosts or users. -references: -- https://attack.mitre.org/techniques/T1021/003/ -- https://www.cybereason.com/blog/dcom-lateral-movement-techniques -tags: - analytic_story: - - Active Directory Lateral Movement - asset_type: Endpoint - confidence: 70 - impact: 90 - message: A process was started on a remote endpoint from $dest by abusing DCOM using - PowerShell.exe - mitre_attack_id: - - T1021 - - T1021.003 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml b/dev/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml deleted file mode 100644 index 51123c33b2..0000000000 --- a/dev/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Remote Process Instantiation via WinRM and PowerShell -id: ba24cda8-4716-11ec-8009-3e22fbd008af -version: 1 -date: '2021-11-16' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `powershell.exe` with arguments - utilized to start a process on a remote endpoint by abusing the WinRM protocol. - Specifically, this search looks for the abuse of the `Invoke-Command` commandlet. - Red Teams and adversaries alike may abuse WinRM and `powershell.exe` for lateral - movement and remote code execution. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: pwsh.dll - selection2: - Image|endswith: - - pwsh.exe - - sqlps.exe - - sqltoolsps.exe - - powershell.exe - - powershell_ise.exe - selection3: - OriginalFileName: PowerShell.EXE - selection4: - OriginalFileName: powershell_ise.EXE - selection5: - CommandLine: '*-ComputerName*' - selection6: - CommandLine: '*Invoke-Command*' - condition: (selection1 or selection2 or selection3 or selection4) and selection5 - and selection6 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -known_false_positives: Administrators may leverage WinRM and `Invoke-Command` to start - a process on remote systems for system administration or automation use cases. However, - this activity is usually limited to a small set of hosts or users. -references: -- https://attack.mitre.org/techniques/T1021/006/ -- https://pentestlab.blog/2018/05/15/lateral-movement-winrm/ -tags: - analytic_story: - - Active Directory Lateral Movement - asset_type: Endpoint - confidence: 50 - impact: 90 - message: A process was started on a remote endpoint from $dest by abusing WinRM - using PowerShell.exe - mitre_attack_id: - - T1021 - - T1021.006 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 45 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml b/dev/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml deleted file mode 100644 index 97d65ebfb9..0000000000 --- a/dev/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Remote Process Instantiation via WinRM and Winrs -id: 0dd296a2-4338-11ec-ba02-3e22fbd008af -version: 1 -date: '2021-11-11' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `winrs.exe` with command-line - arguments utilized to start a process on a remote endpoint. Red Teams and adversaries - alike may abuse the WinRM protocol and this binary for lateral movement and remote - code execution. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: winrs.exe - selection2: - Image|endswith: winrs.exe - selection3: - CommandLine: - - '*-r:*' - - '*-remote:*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -known_false_positives: Administrators may leverage WinRM and WinRs to start a process - on remote systems, but this activity is usually limited to a small set of hosts - or users. -references: -- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/winrs -- https://attack.mitre.org/techniques/T1021/006/ -tags: - analytic_story: - - Active Directory Lateral Movement - asset_type: Endpoint - confidence: 60 - impact: 90 - message: A process was started on a remote endpoint from $dest - mitre_attack_id: - - T1021 - - T1021.006 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 54 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/remote_process_instantiation_via_wmi.yml b/dev/endpoint/remote_process_instantiation_via_wmi.yml deleted file mode 100644 index f7bf5129ad..0000000000 --- a/dev/endpoint/remote_process_instantiation_via_wmi.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Remote Process Instantiation via WMI -id: d25d2c3d-d9d8-40ec-8fdf-e86fe155a3da -version: 7 -date: '2021-11-12' -author: Rico Valdez, Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic identifies wmic.exe being launched with parameters to spawn - a process on a remote system. Red Teams and adversaries alike may abuse WMI and - this binary for lateral movement and remote code execution. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: wmic.exe - selection2: - Image|endswith: wmic.exe - selection3: - CommandLine: '*process*' - selection4: - CommandLine: '*/node:*' - selection5: - CommandLine: '*call*' - selection6: - CommandLine: '*create*' - condition: (selection1 or selection2) and selection3 and selection4 and selection5 - and selection6 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: The wmic.exe utility is a benign Windows application. It may - be used legitimately by Administrators with these parameters for remote system administration, - but it's relatively uncommon. -references: -- https://attack.mitre.org/techniques/T1047/ -- https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/create-method-in-class-win32-process -tags: - analytic_story: - - Ransomware - - Suspicious WMI Use - - Active Directory Lateral Movement - asset_type: Endpoint - confidence: 70 - impact: 70 - message: A wmic.exe process $process$ contain process spawn commandline $process$ - in host $dest$ - mitre_attack_id: - - T1047 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml b/dev/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml deleted file mode 100644 index ede8883eb5..0000000000 --- a/dev/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml +++ /dev/null @@ -1,73 +0,0 @@ -name: Remote Process Instantiation via WMI and PowerShell -id: 112638b4-4634-11ec-b9ab-3e22fbd008af -version: 1 -date: '2021-11-15' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `powershell.exe` leveraging - the `Invoke-WmiMethod` commandlet complemented with arguments utilized to start - a process on a remote endpoint by abusing WMI. Red Teams and adversaries alike may - abuse WMI and `powershell.exe` for lateral movement and remote code execution. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: pwsh.dll - selection2: - Image|endswith: - - pwsh.exe - - sqlps.exe - - sqltoolsps.exe - - powershell.exe - - powershell_ise.exe - selection3: - OriginalFileName: PowerShell.EXE - selection4: - OriginalFileName: powershell_ise.EXE - selection5: - CommandLine: '*-CN*' - selection6: - CommandLine: '*Invoke-WmiMethod*' - selection7: - CommandLine: '*-Class Win32_Process*' - selection8: - CommandLine: '*-Name create*' - condition: (selection1 or selection2 or selection3 or selection4) and selection5 - and selection6 and selection7 and selection8 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -known_false_positives: Administrators may leverage WWMI and powershell.exe to start - a process on remote systems, but this activity is usually limited to a small set - of hosts or users. -references: -- https://attack.mitre.org/techniques/T1047/ -- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1 -tags: - analytic_story: - - Active Directory Lateral Movement - asset_type: Endpoint - confidence: 70 - impact: 90 - message: A process was started on a remote endpoint from $dest by abusing WMI using - PowerShell.exe - mitre_attack_id: - - T1047 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/remote_system_discovery_with_dsquery.yml b/dev/endpoint/remote_system_discovery_with_dsquery.yml deleted file mode 100644 index cd3b858235..0000000000 --- a/dev/endpoint/remote_system_discovery_with_dsquery.yml +++ /dev/null @@ -1,52 +0,0 @@ -name: Remote System Discovery with Dsquery -id: 9fb562f4-42f8-4139-8e11-a82edf7ed718 -version: 1 -date: '2021-08-31' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `dsquery.exe` with command-line - arguments utilized to discover remote systems. The `computer` argument returns a - list of all computers registered in the domain. Red Teams and adversaries alike - engage in remote system discovery for situational awareness and Active Directory - Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*computer*' - Image|endswith: dsquery.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1018/ -- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc732952(v=ws.11) -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Remote system discovery enumeration on $dest$ by $user$ - mitre_attack_id: - - T1018 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/remote_system_discovery_with_net.yml b/dev/endpoint/remote_system_discovery_with_net.yml deleted file mode 100644 index 083e4eef41..0000000000 --- a/dev/endpoint/remote_system_discovery_with_net.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Remote System Discovery with Net -id: 9df16706-04a2-41e2-bbfe-9b38b34409d3 -version: 1 -date: '2021-08-30' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `net.exe` or `net1.exe` with - command-line arguments utilized to discover remote systems. The argument `domain - computers /domain` returns a list of all domain computers. Red Teams and adversaries - alike use net.exe to identify remote systems for situational awareness and Active - Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - net.exe - - net1.exe - selection2: - CommandLine: '*/do*' - selection3: - CommandLine: '*domain computers*' - selection4: - CommandLine: '*/do*' - selection5: - CommandLine: '*view*' - condition: (selection1) and selection2 and selection3 or selection4 or selection5 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1018/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Remote system discovery enumeration on $dest$ by $user$ - mitre_attack_id: - - T1018 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/remote_system_discovery_with_wmic.yml b/dev/endpoint/remote_system_discovery_with_wmic.yml deleted file mode 100644 index 1eb1c2aeb0..0000000000 --- a/dev/endpoint/remote_system_discovery_with_wmic.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Remote System Discovery with Wmic -id: d82eced3-b1dc-42ab-859e-a2fc98827359 -version: 1 -date: '2021-09-01' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `wmic.exe` with command-line - arguments utilized to discover remote systems. The arguments utilized in this command - return a list of all the systems registered in the domain. Red Teams and adversaries - alike may leverage WMI and wmic.exe to identify remote systems for situational awareness - and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: wmic.exe - selection2: - CommandLine: '*ds_computer*' - selection3: - CommandLine: '*/NAMESPACE:\\\\root\\directory\\ldap*' - selection4: - CommandLine: '*GET ds_samaccountname*' - condition: (selection1) and selection2 and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1018/ -- https://docs.microsoft.com/en-us/windows/win32/wmisdk/wmic -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Remote system discovery enumeration on $dest$ by $user$ - mitre_attack_id: - - T1018 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/remote_wmi_command_attempt.yml b/dev/endpoint/remote_wmi_command_attempt.yml deleted file mode 100644 index 7695ba4502..0000000000 --- a/dev/endpoint/remote_wmi_command_attempt.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Remote WMI Command Attempt -id: 272df6de-61f1-4784-877c-1fbc3e2d0838 -version: 4 -date: '2018-12-03' -author: Rico Valdez, Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies usage of `wmic.exe` spawning a local - or remote process, identified by the `node` switch. During triage, review parallel - processes for additional commands executed. Look for any file modifications before - and after `wmic.exe` execution. In addition, identify the remote endpoint and confirm - execution or file modifications. Contain and isolate the endpoint as needed. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: wmic.exe - selection2: - Image|endswith: wmic.exe - selection3: - CommandLine: '*node*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. Deprecated because duplicate of Remote Process Instantiation via - WMI. -known_false_positives: Administrators may use this legitimately to gather info from - remote systems. Filter as needed. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.yaml -tags: - analytic_story: - - Suspicious WMI Use - - Living Off The Land - asset_type: Endpoint - confidence: 60 - impact: 60 - message: A wmic.exe process $process$ contain node commandline $process$ in host - $dest$ - mitre_attack_id: - - T1047 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 36 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/revil_common_exec_parameter.yml b/dev/endpoint/revil_common_exec_parameter.yml deleted file mode 100644 index de89d010fe..0000000000 --- a/dev/endpoint/revil_common_exec_parameter.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Revil Common Exec Parameter -id: 85facebe-c382-11eb-9c3e-acde48001122 -version: 2 -date: '2021-06-02' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic identifies suspicious commandline parameter that are commonly - used by REVIL ransomware to encrypts the compromise machine. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '* -nolan *' - - '* -nolocal *' - - '* -fast *' - - '* -full *' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: third party tool may have same command line parameters as revil - ransomware. -references: -- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ -- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ -tags: - analytic_story: - - Ransomware - - Revil Ransomware - asset_type: Endpoint - confidence: 90 - impact: 60 - message: A process $process_name$ with commandline $process$ related to revil ransomware - in host $dest$ - mitre_attack_id: - - T1204 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 54 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/revil_registry_entry.yml b/dev/endpoint/revil_registry_entry.yml deleted file mode 100644 index 0c51d178a6..0000000000 --- a/dev/endpoint/revil_registry_entry.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Revil Registry Entry -id: e3d3f57a-c381-11eb-9e35-acde48001122 -version: 2 -date: '2021-01-26' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic identifies suspicious modification in registry entry to - keep some malware data during its infection. This technique seen in several apt - implant, malware and ransomware like REVIL where it keep some information like the - random generated file extension it uses for all the encrypted files and ransomware - notes file name in the compromised host. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: - - '*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*' - - '*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*' - condition: (selection1) -how_to_implement: to successfully implement this search, you need to be ingesting - logs with the Image, TargetObject registry key, registry Details from your endpoints. - If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: unknown -references: -- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ -- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ -tags: - analytic_story: - - Ransomware - - Revil Ransomware - - Windows Registry Abuse - asset_type: Endpoint - confidence: 100 - impact: 60 - message: A registry entry $registry_path$ with registry value $registry_value_name$ - and $registry_value_name$ related to revil ransomware in host $dest$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 60 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/rubeus_command_line_parameters.yml b/dev/endpoint/rubeus_command_line_parameters.yml deleted file mode 100644 index faed94b2b9..0000000000 --- a/dev/endpoint/rubeus_command_line_parameters.yml +++ /dev/null @@ -1,83 +0,0 @@ -name: Rubeus Command Line Parameters -id: cca37478-8377-11ec-b59a-acde48001122 -version: 1 -date: '2022-02-01' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is - heavily adapted from Benjamin Delpys Kekeo project and Vincent LE TOUXs MakeMeEnterpriseAdmin - project. This analytic looks for the use of Rubeus command line arguments utilized - in common Kerberos attacks like exporting and importing tickets, forging silver - and golden tickets, requesting a TGT or TGS, kerberoasting, password spraying, etc. - Red teams and adversaries alike use Rubeus for Kerberos attacks within Active Directory - networks. Defenders should be aware that adversaries may customize the source code - of Rubeus and modify the command line parameters. This would effectively bypass - this analytic. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*ptt /ticket*' - - '* monitor /interval*' - - '* asktgt* /user:*' - - '* asktgs* /service:*' - - '* golden* /user:*' - - '* silver* /service:*' - - '* kerberoast*' - - '* asreproast*' - - '* renew* /ticket:*' - - '* brute* /password:*' - - '* brute* /passwords:*' - - '* harvest*' - condition: (selection1) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Although unlikely, legitimate applications may use the same - command line parameters as Rubeus. Filter as needed. -references: -- https://github.com/GhostPack/Rubeus -- https://web.archive.org/web/20210725005734/http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/ -- https://attack.mitre.org/techniques/T1550/003/ -- https://en.hackndo.com/kerberos-silver-golden-tickets/ -tags: - analytic_story: - - Active Directory Kerberos Attacks - asset_type: Endpoint - confidence: 60 - impact: 60 - message: Rubeus command line parameters were used on $dest$ - mitre_attack_id: - - T1550 - - T1550.003 - - T1558 - - T1558.003 - - T1558.004 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 36 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/runas_execution_in_commandline.yml b/dev/endpoint/runas_execution_in_commandline.yml deleted file mode 100644 index 88d5c30770..0000000000 --- a/dev/endpoint/runas_execution_in_commandline.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Runas Execution in CommandLine -id: 4807e716-43a4-11ec-a0e7-acde48001122 -version: 1 -date: '2021-11-12' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: This analytic look for a spawned runas.exe process with a administrator - user option parameter. This parameter was abused by adversaries, malware author - or even red teams to gain elevated privileges in target host. This is a good hunting - query to figure out privilege escalation tactics that may used for different stages - like lateral movement but take note that administrator may use this command in purpose - so its better to see other event context before and after this analytic. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: runas.exe - selection2: - Image|endswith: runas.exe - selection3: - CommandLine: '*/user:*' - selection4: - CommandLine: '*admin*' - condition: (selection1 or selection2) and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: A network operator or systems administrator may utilize an - automated or manual execute this command that may generate false positives. filter - is needed. -references: -- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/ -tags: - analytic_story: - - Windows Privilege Escalation - - Hermetic Wiper - asset_type: Endpoint - confidence: 50 - impact: 50 - message: elevated process using runas on $dest$ by $user$ - mitre_attack_id: - - T1134 - - T1134.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/rundll32_lockworkstation.yml b/dev/endpoint/rundll32_lockworkstation.yml deleted file mode 100644 index b7f5eae597..0000000000 --- a/dev/endpoint/rundll32_lockworkstation.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Rundll32 LockWorkStation -id: fa90f372-f91d-11eb-816c-acde48001122 -version: 2 -date: '2021-08-09' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This search is to detect a suspicious rundll32 commandline to lock the - workstation through command line. This technique was seen in CONTI leak tooling - and script as part of its defense evasion. This technique is not a common practice - to lock a screen and maybe a good indicator of compromise. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*user32.dll,LockWorkStation*' - Image|endswith: rundll32.exe - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -known_false_positives: unknown -references: -- https://threadreaderapp.com/thread/1423361119926816776.html -tags: - analytic_story: - - Ransomware - asset_type: Endpoint - confidence: 50 - impact: 50 - message: process $process_name$ with cmdline $process$ in host $dest$ - mitre_attack_id: - - T1218 - - T1218.011 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: SourceImage - type: Process Name - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/ryuk_wake_on_lan_command.yml b/dev/endpoint/ryuk_wake_on_lan_command.yml deleted file mode 100644 index 94d4a7d117..0000000000 --- a/dev/endpoint/ryuk_wake_on_lan_command.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Ryuk Wake on LAN Command -id: 538d0152-7aaa-11eb-beaa-acde48001122 -version: 1 -date: '2021-03-01' -author: Michael Haag, Splunk -status: production -type: TTP -description: This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk - ransomware. The Ryuk Ransomware uses the Wake-on-Lan feature to turn on powered - off devices on a compromised network to have greater success encrypting them. This - is a high fidelity indicator of Ryuk ransomware executing on an endpoint. Upon triage, - isolate the endpoint. Additional file modification events will be within the users - profile (\appdata\roaming) and in public directories (users\public\). Review all - Scheduled Tasks on the isolated endpoint and across the fleet. Suspicious Scheduled - Tasks will include a path to a unknown binary and those endpoints should be isolated - until triaged. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*8 LAN*' - - '*9 REP*' - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Limited to no known false positives. -references: -- https://www.bleepingcomputer.com/news/security/ryuk-ransomware-uses-wake-on-lan-to-encrypt-offline-devices/ -- https://www.bleepingcomputer.com/news/security/ryuk-ransomware-now-self-spreads-to-other-windows-lan-devices/ -- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-006.pdf -tags: - analytic_story: - - Ryuk Ransomware - asset_type: Endpoint - confidence: 90 - impact: 70 - message: A process $process_name$ with wake on LAN commandline $process$ in host - $dest$ - mitre_attack_id: - - T1059 - - T1059.003 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/ryuk/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/samsam_test_file_write.yml b/dev/endpoint/samsam_test_file_write.yml deleted file mode 100644 index 99739e8e8e..0000000000 --- a/dev/endpoint/samsam_test_file_write.yml +++ /dev/null @@ -1,51 +0,0 @@ -name: Samsam Test File Write -id: 493a879d-519d-428f-8f57-a06a0fdc107e -version: 1 -date: '2018-12-14' -author: Rico Valdez, Splunk -status: production -type: TTP -description: The search looks for a file named "test.txt" written to the windows system - directory tree, which is consistent with Samsam propagation. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: '*\\windows\\system32\\test.txt' - condition: selection1 -how_to_implement: You must be ingesting data that records the file-system activity - from your hosts to populate the Endpoint file-system data-model node. If you are - using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which - you want to collect data. -known_false_positives: No false positives have been identified. -references: [] -tags: - analytic_story: - - SamSam Ransomware - asset_type: Endpoint - confidence: 20 - impact: 60 - message: A samsam ransomware test file creation in $file_path$ in host $dest$ - mitre_attack_id: - - T1486 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 12 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/sam_sam_note/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml b/dev/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml deleted file mode 100644 index b1d5570034..0000000000 --- a/dev/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Scheduled Task Creation on Remote Endpoint using At -id: 4be54858-432f-11ec-8209-3e22fbd008af -version: 1 -date: '2021-11-11' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `at.exe` with command-line arguments - utilized to create a Scheduled Task on a remote endpoint. Red Teams and adversaries - alike may abuse the Task Scheduler for lateral movement and remote code execution. - The `at.exe` binary internally leverages the AT protocol which was deprecated starting - with Windows 8 and Windows Server 2012 but may still work on previous versions of - Windows. Furthermore, attackers may enable this protocol on demand by changing a - sytem registry key. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: at.exe - selection2: - Image|endswith: at.exe - selection3: - CommandLine: '*\\\\*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -known_false_positives: Administrators may create scheduled tasks on remote systems, - but this activity is usually limited to a small set of hosts or users. -references: -- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/at -- https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-scheduledjob?redirectedfrom=MSDN -tags: - analytic_story: - - Active Directory Lateral Movement - - Living Off The Land - asset_type: Endpoint - confidence: 60 - impact: 90 - message: A Windows Scheduled Task was created on a remote endpoint from $dest - mitre_attack_id: - - T1053 - - T1053.002 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 54 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/lateral_movement/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/dev/endpoint/scheduled_task_deleted_or_created_via_cmd.yml deleted file mode 100644 index dd63a3e5a6..0000000000 --- a/dev/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Scheduled Task Deleted Or Created via CMD -id: d5af132c-7c17-439c-9d31-13d55340f36c -version: 6 -date: '2022-02-22' -author: Bhavin Patel, Splunk -status: production -type: TTP -description: The following analytic identifies the creation or deletion of a scheduled - task using schtasks.exe with flags - create or delete being passed on the command-line. - This has been associated with the Dragonfly threat actor, and the SUNBURST attack - against Solarwinds. This analytic replaces "Scheduled Task used in BadRabbit Ransomware". -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*create*' - - '*delete*' - Image|endswith: schtasks.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: It is possible scripts or administrators may trigger this analytic. - Filter as needed based on parent process, application. -references: -- https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/ -- https://www.joesandbox.com/analysis/691823/0/html -tags: - analytic_story: - - DHS Report TA18-074A - - NOBELIUM Group - - Windows Persistence Techniques - - Living Off The Land - - Azorult - - DarkCrystal RAT - - CISA AA22-257A - - AgentTesla - - Qakbot - - Trickbot - - Prestige Ransomware - asset_type: Endpoint - confidence: 80 - impact: 70 - message: A schedule task process $process_name$ with create or delete commandline - $process$ in host $dest$ - mitre_attack_id: - - T1053.005 - - T1053 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/scheduled_task_initiation_on_remote_endpoint.yml b/dev/endpoint/scheduled_task_initiation_on_remote_endpoint.yml deleted file mode 100644 index 22f55349d5..0000000000 --- a/dev/endpoint/scheduled_task_initiation_on_remote_endpoint.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Scheduled Task Initiation on Remote Endpoint -id: 95cf4608-4302-11ec-8194-3e22fbd008af -version: 1 -date: '2021-11-11' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `schtasks.exe` with command-line - arguments utilized to start a Scheduled Task on a remote endpoint. Red Teams and - adversaries alike may abuse the Task Scheduler for lateral movement and remote code - execution. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: schtasks.exe - selection2: - Image|endswith: schtasks.exe - selection3: - CommandLine: '*/run*' - selection4: - CommandLine: '*/s*' - condition: (selection1 or selection2) and selection3 and selection4 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -known_false_positives: Administrators may start scheduled tasks on remote systems, - but this activity is usually limited to a small set of hosts or users. -references: -- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks -- https://attack.mitre.org/techniques/T1053/005/ -tags: - analytic_story: - - Active Directory Lateral Movement - - Living Off The Land - asset_type: Endpoint - confidence: 60 - impact: 90 - message: A Windows Scheduled Task was ran on a remote endpoint from $dest - mitre_attack_id: - - T1053 - - T1053.005 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 54 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/schtasks_scheduling_job_on_remote_system.yml b/dev/endpoint/schtasks_scheduling_job_on_remote_system.yml deleted file mode 100644 index e0cbe193a3..0000000000 --- a/dev/endpoint/schtasks_scheduling_job_on_remote_system.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Schtasks scheduling job on remote system -id: 1297fb80-f42a-4b4a-9c8a-88c066237cf6 -version: 6 -date: '2022-05-23' -author: David Dorsey, Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `schtasks.exe` with command-line - arguments utilized to create a Scheduled Task on a remote endpoint. Red Teams and - adversaries alike may abuse the Task Scheduler for lateral movement and remote code - execution. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: schtasks.exe - selection2: - Image|endswith: schtasks.exe - selection3: - CommandLine: '*/s*' - selection4: - CommandLine: '*/create*' - condition: (selection1 or selection2) and selection3 and selection4 -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. -known_false_positives: Administrators may create scheduled tasks on remote systems, - but this activity is usually limited to a small set of hosts or users. It is important - to validate and investigate as appropriate. -references: [] -tags: - analytic_story: - - Active Directory Lateral Movement - - NOBELIUM Group - - Living Off The Land - - Prestige Ransomware - asset_type: Endpoint - confidence: 90 - impact: 70 - message: A schedule task process $process_name$ with remote job command-line $process$ - in host $dest$ by $user$. - mitre_attack_id: - - T1053.005 - - T1053 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/screensaver_event_trigger_execution.yml b/dev/endpoint/screensaver_event_trigger_execution.yml deleted file mode 100644 index e49861132d..0000000000 --- a/dev/endpoint/screensaver_event_trigger_execution.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Screensaver Event Trigger Execution -id: 58cea3ec-1f6d-11ec-8560-acde48001122 -version: 1 -date: '2021-09-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is developed to detect possible event trigger execution - through screensaver registry entry modification for persistence or privilege escalation. - This technique was seen in several APT and malware where they put the malicious - payload path to the SCRNSAVE.EXE registry key to redirect the execution to their - malicious payload path. This TTP is a good indicator that some attacker may modify - this entry for their persistence and privilege escalation. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: '*\\Control Panel\\Desktop\\SCRNSAVE.EXE*' - condition: (selection1) -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: unknown -references: -- https://attack.mitre.org/techniques/T1546/002/ -- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/screensaver -tags: - analytic_story: - - Windows Persistence Techniques - - Windows Privilege Escalation - - Windows Registry Abuse - - Hermetic Wiper - asset_type: Endpoint - confidence: 90 - impact: 80 - message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ - mitre_attack_id: - - T1546 - - T1546.002 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 72 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.002/scrnsave_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/script_execution_via_wmi.yml b/dev/endpoint/script_execution_via_wmi.yml deleted file mode 100644 index e9d947ccc7..0000000000 --- a/dev/endpoint/script_execution_via_wmi.yml +++ /dev/null @@ -1,52 +0,0 @@ -name: Script Execution via WMI -id: aa73f80d-d728-4077-b226-81ea0c8be589 -version: 4 -date: '2020-03-16' -author: Rico Valdez, Michael Haag, Splunk -status: production -type: TTP -description: This search looks for scripts launched via WMI. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: scrcons.exe - condition: selection1 -how_to_implement: You must be ingesting endpoint data that tracks process activity, - including parent-child relationships from your endpoints to populate the Endpoint - data model in the Processes node. The command-line arguments are mapped to the "process" - field in the Endpoint data model. -known_false_positives: Although unlikely, administrators may use wmi to launch scripts - for legitimate purposes. Filter as needed. -references: -- https://redcanary.com/blog/child-processes/ -tags: - analytic_story: - - Suspicious WMI Use - asset_type: Endpoint - confidence: 60 - impact: 60 - message: A wmic.exe process $process_name$ taht execute script in host $dest$ - mitre_attack_id: - - T1047 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 36 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/execution_scrcons/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/sdclt_uac_bypass.yml b/dev/endpoint/sdclt_uac_bypass.yml deleted file mode 100644 index 041b072604..0000000000 --- a/dev/endpoint/sdclt_uac_bypass.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Sdclt UAC Bypass -id: d71efbf6-da63-11eb-8c6e-acde48001122 -version: 2 -date: '2020-01-28' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious sdclt.exe registry modification. - This technique is commonly seen when attacker try to bypassed UAC by using sdclt.exe - application by modifying some registry that sdclt.exe tries to open or query with - payload file path on it to be executed. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: - - IsolatedCommand - - (Default) - TargetObject: - - '*\\exefile\\shell\\runas\\command\\*' - - '*\\Windows\\CurrentVersion\\App Paths\\control.exe*' - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Limited to no false positives are expected. -references: -- https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/ -- https://github.com/hfiref0x/UACME -- https://www.cyborgsecurity.com/cyborg-labs/threat-hunt-deep-dives-user-account-control-bypass-via-registry-modification/ -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 90 - impact: 70 - message: Suspicious modification of registry $registry_path$ with possible payload - path $registry_value_name$ in $dest$ - mitre_attack_id: - - T1548.002 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/dev/endpoint/searchprotocolhost_with_no_command_line_with_network.yml deleted file mode 100644 index e00d283ca3..0000000000 --- a/dev/endpoint/searchprotocolhost_with_no_command_line_with_network.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: SearchProtocolHost with no Command Line with Network -id: b690df8c-a145-11eb-a38b-acde48001122 -version: 3 -date: '2022-03-15' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies searchprotocolhost.exe with no command - line arguments and with a network connection. It is unusual for searchprotocolhost.exe - to execute with no command line arguments present. This particular behavior is common - with malicious software, including Cobalt Strike. During investigation, identify - any network connections and parallel processes. Identify any suspicious module loads - related to credential dumping or file writes. searchprotocolhost.exe is natively - found in C:\Windows\system32 and C:\Windows\syswow64. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: searchprotocolhost.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `ports` node. -known_false_positives: Limited false positives may be present in small environments. - Tuning may be required based on parent process. -references: -- https://github.com/mandiant/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc -tags: - analytic_story: - - Cobalt Strike - asset_type: Endpoint - confidence: 100 - impact: 70 - message: A searchprotocolhost.exe process $process_name$ with no commandline in - host $dest$ - mitre_attack_id: - - T1055 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process Name - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 70 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_searchprotocolhost.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/secretdumps_offline_ntds_dumping_tool.yml b/dev/endpoint/secretdumps_offline_ntds_dumping_tool.yml deleted file mode 100644 index 0a7b86b367..0000000000 --- a/dev/endpoint/secretdumps_offline_ntds_dumping_tool.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: SecretDumps Offline NTDS Dumping Tool -id: 5672819c-be09-11eb-bbfb-acde48001122 -version: 1 -date: '2021-05-26' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic detects a potential usage of secretsdump.py tool for dumping - credentials (ntlm hash) from a copy of ntds.dit and SAM.Security,SYSTEM registrry - hive. This technique was seen in some attacker that dump ntlm hashes offline after - having a copy of ntds.dit and SAM/SYSTEM/SECURITY registry hive. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*.py*' - Image|endswith: python*.exe - selection2: - CommandLine: '*-ntds*' - selection3: - CommandLine: - - '*-bootkey*' - - '*-security*' - - '*-sam*' - - '*-system*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: unknown -references: -- https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py -tags: - analytic_story: - - Credential Dumping - asset_type: Endpoint - confidence: 100 - impact: 80 - message: A secretdump process $process_name$ with secretdump commandline $process$ - to dump credentials in host $dest$ - mitre_attack_id: - - T1003.003 - - T1003 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/serviceprincipalnames_discovery_with_setspn.yml b/dev/endpoint/serviceprincipalnames_discovery_with_setspn.yml deleted file mode 100644 index dbe71c66ec..0000000000 --- a/dev/endpoint/serviceprincipalnames_discovery_with_setspn.yml +++ /dev/null @@ -1,108 +0,0 @@ -name: ServicePrincipalNames Discovery with SetSPN -id: ae8b3efc-2d2e-11ec-8b57-acde48001122 -version: 1 -date: '2021-10-14' -author: Michael Haag, Splunk -status: production -type: TTP -description: 'The following analytic identifies `setspn.exe` usage related to querying - the domain for Service Principle Names. typically, this is a precursor activity - related to kerberoasting or the silver ticket attack. - - What is a ServicePrincipleName? - - A service principal name (SPN) is a unique identifier of a service instance. SPNs - are used by Kerberos authentication to associate a service instance with a service - logon account. This allows a client application to request that the service authenticate - an account even if the client does not have the account name. - - Example usage includes the following - - 1. setspn -T offense -Q */* 1. setspn -T attackrange.local -F -Q MSSQLSvc/* 1. setspn - -Q */* > allspns.txt 1. setspn -q - - Values - - 1. -F = perform queries at the forest, rather than domain level 1. -T = perform - query on the specified domain or forest (when -F is also used) 1. -Q = query for - existence of SPN - - During triage, review parallel processes for further suspicious activity.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: setspn.exe - selection2: - Image|endswith: setspn.exe - selection3: - CommandLine: '*-f*' - selection4: - CommandLine: '*-t*' - selection5: - CommandLine: '**/**' - selection6: - CommandLine: '*-q*' - selection7: - CommandLine: '*-q*' - selection8: - CommandLine: '*-s*' - condition: (selection1 or selection2) and selection3 and selection4 or selection5 - or selection6 or selection7 or selection8 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be caused by Administrators resetting SPNs - or querying for SPNs. Filter as needed. -references: -- https://docs.microsoft.com/en-us/windows/win32/ad/service-principal-names -- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting -- https://strontic.github.io/xcyclopedia/library/setspn.exe-5C184D581524245DAD7A0A02B51FD2C2.html -- https://attack.mitre.org/techniques/T1558/003/ -- https://social.technet.microsoft.com/wiki/contents/articles/717.service-principal-names-spn-setspn-syntax.aspx -- https://web.archive.org/web/20220212163642/https://www.harmj0y.net/blog/powershell/kerberoasting-without-mimikatz/ -- https://blog.zsec.uk/paving-2-da-wholeset/ -- https://msitpros.com/?p=3113 -- https://adsecurity.org/?p=3466 -tags: - analytic_story: - - Active Directory Discovery - - Active Directory Kerberos Attacks - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to identify service principle names. - mitre_attack_id: - - T1558.003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-sysmon_setspn.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/services_escalate_exe.yml b/dev/endpoint/services_escalate_exe.yml deleted file mode 100644 index b56e2db7fe..0000000000 --- a/dev/endpoint/services_escalate_exe.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Services Escalate Exe -id: c448488c-b7ec-11eb-8253-acde48001122 -version: 1 -date: '2021-05-18' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the use of `svc-exe` with Cobalt Strike. - The behavior typically follows after an adversary has already gained initial access - and is escalating privileges. Using `svc-exe`, a randomly named binary will be downloaded - from the remote Teamserver and placed on disk within `C:\Windows\400619a.exe`. Following, - the binary will be added to the registry under key `HKLM\System\CurrentControlSet\Services\400619a\` - with multiple keys and values added to look like a legitimate service. Upon loading, - `services.exe` will spawn the randomly named binary from `\\127.0.0.1\ADMIN$\400619a.exe`. - The process lineage is completed with `400619a.exe` spawning rundll32.exe, which - is the default `spawnto_` value for Cobalt Strike. The `spawnto_` value is arbitrary - and may be any process on disk (typically system32/syswow64 binary). The `spawnto_` - process will also contain a network connection. During triage, review parallel procesess - and identify any additional file modifications. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Processes.process_path: '*admin$*' - ParentImage: services.exe - condition: selection1 -how_to_implement: To successfully implement this search, you will need to ensure that - DNS data is populating the Network_Resolution data model. -known_false_positives: False positives should be limited as `services.exe` should - never spawn a process from `ADMIN$`. Filter as needed. -references: -- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ -- https://attack.mitre.org/techniques/T1548/ -- https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/index.htm#cshid=1085 -tags: - analytic_story: - - Cobalt Strike - asset_type: Endpoint - confidence: 95 - impact: 80 - message: A service process $parent_process_name$ with process path $process_path$ - in host $dest$ - mitre_attack_id: - - T1548 - observable: - - name: Processes.dest - type: Hostname - role: - - Victim - - name: Processes.user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 76 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/services_lolbas_execution_process_spawn.yml b/dev/endpoint/services_lolbas_execution_process_spawn.yml deleted file mode 100644 index ced0dbe4a4..0000000000 --- a/dev/endpoint/services_lolbas_execution_process_spawn.yml +++ /dev/null @@ -1,114 +0,0 @@ -name: Services LOLBAS Execution Process Spawn -id: ba9e1954-4c04-11ec-8b74-3e22fbd008af -version: 1 -date: '2021-11-22' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: The following analytic identifies `services.exe` spawning a LOLBAS execution - process. When adversaries execute code on remote endpoints abusing the Service Control - Manager and creating a remote malicious service, the executed command is spawned - as a child process of `services.exe`. The LOLBAS project documents Windows native - binaries that can be abused by threat actors to perform tasks like executing malicious - code. Looking for child processes of services.exe that are part of the LOLBAS project - can help defenders identify lateral movement activity. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - Regsvcs.exe - - Ftp.exe - - OfflineScannerShell.exe - - Rasautou.exe - - Schtasks.exe - - Xwizard.exe - - Dllhost.exe - - Pnputil.exe - - Atbroker.exe - - Pcwrun.exe - - Ttdinject.exe - - Mshta.exe - - Bitsadmin.exe - - Certoc.exe - - Ieexec.exe - - Microsoft.Workflow.Compiler.exe - - Runscripthelper.exe - - Forfiles.exe - - Msbuild.exe - - Register-cimprovider.exe - - Tttracer.exe - - Ie4uinit.exe - - Bash.exe - - Hh.exe - - SettingSyncHost.exe - - Cmstp.exe - - Mmc.exe - - Stordiag.exe - - Scriptrunner.exe - - Odbcconf.exe - - Extexport.exe - - Msdt.exe - - WorkFolders.exe - - Diskshadow.exe - - Mavinject.exe - - Regasm.exe - - Gpscript.exe - - Rundll32.exe - - Regsvr32.exe - - Msiexec.exe - - Wuauclt.exe - - Presentationhost.exe - - Wmic.exe - - Runonce.exe - - Syncappvpublishingserver.exe - - Verclsid.exe - - Infdefaultinstall.exe - - Explorer.exe - - Installutil.exe - - Netsh.exe - - Wab.exe - - Dnscmd.exe - - At.exe - - Pcalua.exe - - Msconfig.exe - ParentImage: services.exe - condition: (selection1) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -known_false_positives: Legitimate applications may trigger this behavior, filter as - needed. -references: -- https://attack.mitre.org/techniques/T1543/003/ -- https://pentestlab.blog/2020/07/21/lateral-movement-services/ -- https://lolbas-project.github.io/ -tags: - analytic_story: - - Active Directory Lateral Movement - - Living Off The Land - - Qakbot - asset_type: Endpoint - confidence: 60 - impact: 90 - message: Services.exe spawned a LOLBAS process on $dest - mitre_attack_id: - - T1543 - - T1543.003 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 54 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_lolbas/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/dev/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml deleted file mode 100644 index 3ff618a744..0000000000 --- a/dev/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Set Default PowerShell Execution Policy To Unrestricted or Bypass -id: c2590137-0b08-4985-9ec5-6ae23d92f63d -version: 7 -date: '2022-02-18' -author: Patrick Bareiss, Splunk -status: production -type: TTP -description: Monitor for changes of the ExecutionPolicy in the registry to the values - "unrestricted" or "bypass," which allows the execution of malicious scripts. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: ExecutionPolicy - TargetObject: '*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell*' - Details: - - Bypass - - Unrestricted - condition: selection1 -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Registry node. You must also be - ingesting logs with the fields registry_path, registry_key_name, and registry_value_name - from your endpoints. -known_false_positives: Administrators may attempt to change the default execution - policy on a system for a variety of reasons. However, setting the policy to "unrestricted" - or "bypass" as this search is designed to identify, would be unusual. Hits should - be reviewed and investigated as appropriate. -references: [] -tags: - analytic_story: - - Hermetic Wiper - - Malicious PowerShell - - Credential Dumping - - HAFNIUM Group - asset_type: Endpoint - confidence: 80 - impact: 60 - message: A registry modification in $registry_path$ with reg key $registry_key_name$ - and reg value $registry_value_name$ in host $dest$ - mitre_attack_id: - - T1059 - - T1059.001 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: registry_path - type: Unknown - role: - - Other - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 48 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_execution_policy/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/shim_database_file_creation.yml b/dev/endpoint/shim_database_file_creation.yml deleted file mode 100644 index 8923d0e503..0000000000 --- a/dev/endpoint/shim_database_file_creation.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Shim Database File Creation -id: 6e4c4588-ba2f-42fa-97e6-9f6f548eaa33 -version: 3 -date: '2020-12-08' -author: David Dorsey, Splunk -status: production -type: TTP -description: This search looks for shim database files being written to default directories. - The sdbinst.exe application is used to install shim database files (.sdb). According - to Microsoft, a shim is a small library that transparently intercepts an API, changes - the parameters passed, handles the operation itself, or redirects the operation - elsewhere. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: '*Windows\\AppPatch\\Custom*' - condition: selection1 -how_to_implement: You must be ingesting data that records the filesystem activity - from your hosts to populate the Endpoint file-system data model node. If you are - using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which - you want to collect data. -known_false_positives: Because legitimate shim files are created and used all the - time, this event, in itself, is not suspicious. However, if there are other correlating - events, it may warrant further investigation. -references: [] -tags: - analytic_story: - - Windows Persistence Techniques - asset_type: Endpoint - confidence: 80 - impact: 70 - message: A process that possibly write shim database in $file_path$ in host $dest$ - mitre_attack_id: - - T1546.011 - - T1546 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: file_path - type: File - role: - - Other - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.011/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/silentcleanup_uac_bypass.yml b/dev/endpoint/silentcleanup_uac_bypass.yml deleted file mode 100644 index 5f773b75c6..0000000000 --- a/dev/endpoint/silentcleanup_uac_bypass.yml +++ /dev/null @@ -1,55 +0,0 @@ -name: SilentCleanup UAC Bypass -id: 56d7cfcc-da63-11eb-92d4-acde48001122 -version: 2 -date: '2020-01-28' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious modification of registry that may - related to UAC bypassed. This registry will be trigger once the attacker abuse the - silentcleanup task schedule to gain high privilege execution that will bypass User - control account. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '*.exe*' - TargetObject: '*\\Environment\\windir' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: unknown -references: -- https://github.com/hfiref0x/UACME -- https://www.intezer.com/blog/malware-analysis/klingon-rat-holding-on-for-dear-life/ -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 90 - impact: 70 - message: Suspicious modification of registry $registry_path$ with possible payload - path $registry_value_name$ in $dest$ - mitre_attack_id: - - T1548.002 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/slui_runas_elevated.yml b/dev/endpoint/slui_runas_elevated.yml deleted file mode 100644 index 81e12d3a75..0000000000 --- a/dev/endpoint/slui_runas_elevated.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: SLUI RunAs Elevated -id: 8d124810-b3e4-11eb-96c7-acde48001122 -version: 1 -date: '2021-05-13' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the Microsoft Software Licensing User - Interface Tool, `slui.exe`, elevating access using the `-verb runas` function. This - particular bypass utilizes a registry key/value. Identified by two sources, the - registry keys are `HKCU\Software\Classes\exefile\shell` and `HKCU\Software\Classes\launcher.Systemsettings\Shell\open\command`. - To simulate this behavior, multiple POC are available. The analytic identifies the - use of `runas` by `slui.exe`. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: slui.exe - selection2: - CommandLine: '*runas*' - selection3: - CommandLine: '*-verb*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Limited false positives should be present as this is not commonly - used by legitimate applications. -references: -- https://www.exploit-db.com/exploits/46998 -- https://mattharr0ey.medium.com/privilege-escalation-uac-bypass-in-changepk-c40b92818d1b -- https://gist.github.com/r00t-3xp10it/0c92cd554d3156fd74f6c25660ccc466 -- https://www.rapid7.com/db/modules/exploit/windows/local/bypassuac_sluihijack/ -- https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations -tags: - analytic_story: - - DarkSide Ransomware - - Windows Defense Evasion Tactics - asset_type: Endpoint - confidence: 90 - impact: 70 - message: A slui process $process_name$ with elevated commandline $process$ in host - $dest$ - mitre_attack_id: - - T1548.002 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/slui/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/slui_spawning_a_process.yml b/dev/endpoint/slui_spawning_a_process.yml deleted file mode 100644 index 4357e3ce29..0000000000 --- a/dev/endpoint/slui_spawning_a_process.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: SLUI Spawning a Process -id: 879c4330-b3e0-11eb-b1b1-acde48001122 -version: 1 -date: '2021-05-13' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the Microsoft Software Licensing User - Interface Tool, `slui.exe`, spawning a child process. This behavior is associated - with publicly known UAC bypass. `slui.exe` is commonly associated with software - updates and is most often spawned by `svchost.exe`. The `slui.exe` process should - not have child processes, and any processes spawning from it will be running with - elevated privileges. During triage, review the child process and additional parallel - processes. Identify any file modifications that may have lead to the bypass. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: slui.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Certain applications may spawn from `slui.exe` that are legitimate. - Filtering will be needed to ensure proper monitoring. -references: -- https://www.exploit-db.com/exploits/46998 -- https://www.rapid7.com/db/modules/exploit/windows/local/bypassuac_sluihijack/ -- https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations -tags: - analytic_story: - - DarkSide Ransomware - - Windows Defense Evasion Tactics - asset_type: Endpoint - confidence: 90 - impact: 70 - message: A slui process $parent_process_name$ spawning child process $process_name$ - in host $dest$ - mitre_attack_id: - - T1548.002 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/slui/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/spike_in_file_writes.yml b/dev/endpoint/spike_in_file_writes.yml deleted file mode 100644 index c98582bf64..0000000000 --- a/dev/endpoint/spike_in_file_writes.yml +++ /dev/null @@ -1,44 +0,0 @@ -name: Spike in File Writes -id: fdb0f805-74e4-4539-8c00-618927333aae -version: 3 -date: '2020-03-16' -author: David Dorsey, Splunk -status: experimental -type: Anomaly -description: The search looks for a sharp increase in the number of files written - to a particular host -data_source: -- Sysmon Event ID 11 -search: - selection1: - Filesystem.action: created - condition: selection1 -how_to_implement: In order to implement this search, you must populate the Endpoint - file-system data model node. This is typically populated via endpoint detection - and response product, such as Carbon Black or endpoint data sources such as Sysmon. - The data used for this search is typically generated via logs that report reads - and writes to the file system. -known_false_positives: It is important to understand that if you happen to install - any new applications on your hosts or are copying a large number of files, you can - expect to see a large increase of file modifications. -references: [] -tags: - analytic_story: - - SamSam Ransomware - - Ryuk Ransomware - - Ransomware - asset_type: Endpoint - confidence: 50 - impact: 50 - message: tbd - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint diff --git a/dev/endpoint/spoolsv_spawning_rundll32.yml b/dev/endpoint/spoolsv_spawning_rundll32.yml deleted file mode 100644 index e69e79397f..0000000000 --- a/dev/endpoint/spoolsv_spawning_rundll32.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Spoolsv Spawning Rundll32 -id: 15d905f6-da6b-11eb-ab82-acde48001122 -version: 2 -date: '2021-07-01' -author: Mauricio Velazco, Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies a suspicious child process, `rundll32.exe`, - with no command-line arguments being spawned from `spoolsv.exe`. This was identified - during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. - Typically, this is not normal behavior for `spoolsv.exe` to spawn a process. During - triage, isolate the endpoint and review for source of exploitation. Capture any - additional file modification events. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: spoolsv.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives have been identified. There are limited - instances where `rundll32.exe` may be spawned by a legitimate print driver. -references: -- https://www.truesec.com/hub/blog/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available -- https://www.truesec.com/hub/blog/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675 -- https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes -tags: - analytic_story: - - PrintNightmare CVE-2021-34527 - asset_type: Endpoint - confidence: 90 - cve: - - CVE-2021-34527 - impact: 80 - message: $parent_process$ has spawned $process_name$ on endpoint $ComputerName$. - This behavior is suspicious and related to PrintNightmare. - mitre_attack_id: - - T1547.012 - - T1547 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: parent_process_id - type: Process - role: - - Parent Process - - Attacker - - name: process_id - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 72 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/spoolsv_writing_a_dll.yml b/dev/endpoint/spoolsv_writing_a_dll.yml deleted file mode 100644 index 74c423ebab..0000000000 --- a/dev/endpoint/spoolsv_writing_a_dll.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Spoolsv Writing a DLL -id: d5bf5cf2-da71-11eb-92c2-acde48001122 -version: 1 -date: '2021-07-01' -author: Mauricio Velazco, Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies a `.dll` being written by `spoolsv.exe`. - This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) - or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write - a `.dll`. Current POC code used will write the suspicious DLL to disk within a path - of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source - of exploitation. Capture any additional file modification events. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: spoolsv.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` - node. -known_false_positives: Unknown. -references: -- https://www.truesec.com/hub/blog/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available -- https://www.truesec.com/hub/blog/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675 -- https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes -tags: - analytic_story: - - PrintNightmare CVE-2021-34527 - asset_type: Endpoint - confidence: 90 - cve: - - CVE-2021-34527 - impact: 80 - message: $process_name$ has been identified writing dll's to $file_path$ on endpoint - $dest$. This behavior is suspicious and related to PrintNightmare. - mitre_attack_id: - - T1547.012 - - T1547 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: process_id - type: Process - role: - - Child Process - - name: file_path - type: File - role: - - Other - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 72 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/suspicious_copy_on_system32.yml b/dev/endpoint/suspicious_copy_on_system32.yml deleted file mode 100644 index cfa3e6f24a..0000000000 --- a/dev/endpoint/suspicious_copy_on_system32.yml +++ /dev/null @@ -1,80 +0,0 @@ -name: Suspicious Copy on System32 -id: ce633e56-25b2-11ec-9e76-acde48001122 -version: 1 -date: '2021-10-05' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to detect a suspicious copy of file from systemroot - folder of the windows OS. This technique is commonly used by APT or other malware - as part of execution (LOLBIN) to run its malicious code using the available legitimate - tool in OS. this type of event may seen or may execute of normal user in some instance - but this is really a anomaly that needs to be check within the network. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - cmd.exe - - powershell* - - pwsh.exe - - sqlps.exe - - sqltoolsps.exe - - powershell_ise.exe - selection2: - OriginalFileName: copy.exe - selection3: - Image|endswith: copy.exe - selection4: - Image|endswith: xcopy.exe - selection5: - OriginalFileName: xcopy.exe - selection6: - CommandLine: - - '*\\Windows\\System32\*' - - '*\\Windows\\SysWow64\\*' - selection7: - CommandLine: '*copy*' - condition: selection1 and selection2 and selection3 and selection4 and selection5 - and selection6 and selection7 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: every user may do this event but very un-ussual. -references: -- https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 -tags: - analytic_story: - - Unusual Processes - - Qakbot - - IcedID - asset_type: Endpoint - confidence: 90 - impact: 70 - message: execution of copy exe to copy file from $process$ in $dest$ - mitre_attack_id: - - T1036.003 - - T1036 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/copy_sysmon/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/suspicious_curl_network_connection.yml b/dev/endpoint/suspicious_curl_network_connection.yml deleted file mode 100644 index a33b4729e5..0000000000 --- a/dev/endpoint/suspicious_curl_network_connection.yml +++ /dev/null @@ -1,51 +0,0 @@ -name: Suspicious Curl Network Connection -id: 3f613dc0-21f2-4063-93b1-5d3c15eef22f -version: 1 -date: '2021-02-22' -author: Michael Haag, Splunk -status: experimental -type: TTP -description: The following analytic identifies the use of a curl contacting suspicious - remote domains to checkin to Command And Control servers or download further implants. - In the context of Silver Sparrow, curl is identified contacting s3.amazonaws.com. - This particular behavior is common with MacOS adware-malicious software. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: s3.amazonaws.com - Image|endswith: curl - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Unknown. Filter as needed. -references: -- https://redcanary.com/blog/clipping-silver-sparrows-wings/ -- https://www.marcosantadev.com/manage-plist-files-plistbuddy/ -tags: - analytic_story: - - Silver Sparrow - - Ingress Tool Transfer - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 50 - message: tbd - mitre_attack_id: - - T1105 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint diff --git a/dev/endpoint/suspicious_dllhost_no_command_line_arguments.yml b/dev/endpoint/suspicious_dllhost_no_command_line_arguments.yml deleted file mode 100644 index 9b607333e1..0000000000 --- a/dev/endpoint/suspicious_dllhost_no_command_line_arguments.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Suspicious DLLHost no Command Line Arguments -id: ff61e98c-0337-4593-a78f-72a676c56f26 -version: 3 -date: '2022-03-15' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies DLLHost.exe with no command line arguments. - It is unusual for DLLHost.exe to execute with no command line arguments present. - This particular behavior is common with malicious software, including Cobalt Strike. - During investigation, identify any network connections and parallel processes. Identify - any suspicious module loads related to credential dumping or file writes. DLLHost.exe - is natively found in C:\Windows\system32 and C:\Windows\syswow64. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: dllhost.exe - selection2: - Image|endswith: dllhost.exe - condition: (selection1 or selection2) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives may be present in small environments. - Tuning may be required based on parent process. -references: -- https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile -- https://www.cobaltstrike.com/blog/learn-pipe-fitting-for-all-of-your-offense-projects/ -tags: - analytic_story: - - Cobalt Strike - asset_type: Endpoint - confidence: 70 - impact: 70 - message: Suspicious dllhost.exe process with no command line arguments executed - on $dest$ by $user$ - mitre_attack_id: - - T1055 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/suspicious_gpupdate_no_command_line_arguments.yml b/dev/endpoint/suspicious_gpupdate_no_command_line_arguments.yml deleted file mode 100644 index 01b90e7429..0000000000 --- a/dev/endpoint/suspicious_gpupdate_no_command_line_arguments.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Suspicious GPUpdate no Command Line Arguments -id: f308490a-473a-40ef-ae64-dd7a6eba284a -version: 3 -date: '2022-03-15' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies gpupdate.exe with no command line arguments. - It is unusual for gpupdate.exe to execute with no command line arguments present. - This particular behavior is common with malicious software, including Cobalt Strike. - During investigation, identify any network connections and parallel processes. Identify - any suspicious module loads related to credential dumping or file writes. gpupdate.exe - is natively found in C:\Windows\system32 and C:\Windows\syswow64. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: GPUpdate.exe - selection2: - Image|endswith: gpupdate.exe - condition: (selection1 or selection2) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Limited false positives may be present in small environments. - Tuning may be required based on parent process. -references: -- https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile -- https://www.cobaltstrike.com/blog/learn-pipe-fitting-for-all-of-your-offense-projects/ -tags: - analytic_story: - - Cobalt Strike - asset_type: Endpoint - confidence: 70 - impact: 70 - message: Suspicious gpupdate.exe process with no command line arguments executed - on $dest$ by $user$ - mitre_attack_id: - - T1055 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/suspicious_image_creation_in_appdata_folder.yml b/dev/endpoint/suspicious_image_creation_in_appdata_folder.yml deleted file mode 100644 index f9634400c5..0000000000 --- a/dev/endpoint/suspicious_image_creation_in_appdata_folder.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Suspicious Image Creation In Appdata Folder -id: f6f904c4-1ac0-11ec-806b-acde48001122 -version: 2 -date: '2022-07-07' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious creation of image in appdata folder - made by process that also has a file reference in appdata folder. This technique - was seen in remcos rat that capture screenshot of the compromised machine and place - it in the appdata and will be send to its C2 server. This TTP is really a good indicator - to check that process because it is in suspicious folder path and image files are - not commonly created by user in this folder path. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Processes.process_path: '*\\appdata\\Roaming\\*' - Image|endswith: '*.exe' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: unknown -references: -- https://success.trendmicro.com/dcx/s/solution/1123281-remcos-malware-information?language=en_US -- https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/ -tags: - analytic_story: - - Remcos - asset_type: Endpoint - confidence: 70 - impact: 70 - message: process $process_name$ creating image file $file_path$ in $dest$ - mitre_attack_id: - - T1113 - observable: - - name: Computer - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/suspicious_microsoft_workflow_compiler_rename.yml b/dev/endpoint/suspicious_microsoft_workflow_compiler_rename.yml deleted file mode 100644 index ab3b1211ce..0000000000 --- a/dev/endpoint/suspicious_microsoft_workflow_compiler_rename.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Suspicious microsoft workflow compiler rename -id: f0db4464-55d9-11eb-ae93-0242ac130002 -version: 4 -date: '2022-04-07' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following analytic identifies a renamed instance of microsoft.workflow.compiler.exe. - Microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319 - and is rarely utilized. When investigating, identify the executed code on disk and - review. A spawned child process from microsoft.workflow.compiler.exe is uncommon. - In any instance, microsoft.workflow.compiler.exe spawning from an Office product - or any living off the land binary is highly suspect. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: Microsoft.Workflow.Compiler.exe - Image|endswith: microsoft.workflow.compiler.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Although unlikely, some legitimate applications may use a moved - copy of microsoft.workflow.compiler.exe, triggering a false positive. -references: -- https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-6---microsoftworkflowcompilerexe-payload-execution -tags: - analytic_story: - - Trusted Developer Utilities Proxy Execution - - Cobalt Strike - - Masquerading - Rename System Utilities - - Living Off The Land - asset_type: Endpoint - confidence: 90 - impact: 70 - message: Suspicious renamed microsoft.workflow.compiler.exe binary ran on $dest$ - by $user$ - mitre_attack_id: - - T1036 - - T1127 - - T1036.003 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/suspicious_microsoft_workflow_compiler_usage.yml b/dev/endpoint/suspicious_microsoft_workflow_compiler_usage.yml deleted file mode 100644 index d6d4e294e8..0000000000 --- a/dev/endpoint/suspicious_microsoft_workflow_compiler_usage.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Suspicious microsoft workflow compiler usage -id: 9bbc62e8-55d8-11eb-ae93-0242ac130002 -version: 2 -date: '2021-01-12' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies microsoft.workflow.compiler.exe usage. - microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319 - and is rarely utilized. When investigating, identify the executed code on disk and - review. It is not a commonly used process by many applications. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: Microsoft.Workflow.Compiler.exe - selection2: - Image|endswith: microsoft.workflow.compiler.exe - condition: (selection1 or selection2) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Although unlikely, limited instances have been identified coming - from native Microsoft utilities similar to SCCM. -references: -- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-6---microsoftworkflowcompilerexe-payload-execution -tags: - analytic_story: - - Trusted Developer Utilities Proxy Execution - - Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 70 - message: Suspicious microsoft.workflow.compiler.exe process ran on $dest$ by $user$ - mitre_attack_id: - - T1127 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/suspicious_msbuild_path.yml b/dev/endpoint/suspicious_msbuild_path.yml deleted file mode 100644 index 7cfc14ab1d..0000000000 --- a/dev/endpoint/suspicious_msbuild_path.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Suspicious msbuild path -id: f5198224-551c-11eb-ae93-0242ac130002 -version: 3 -date: '2022-03-08' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies msbuild.exe executing from a non-standard - path. Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 - and C:\Windows\Microsoft.NET\Framework64\v4.0.30319. Instances of Visual Studio - will run a copy of msbuild.exe. A moved instance of MSBuild is suspicious, however - there are instances of build applications that will move or use a copy of MSBuild. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: MSBuild.exe - selection2: - Image|endswith: msbuild.exe - selection3: - Processes.process_path: '*\\framework*\\v*\\*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Some legitimate applications may use a moved copy of msbuild.exe, - triggering a false positive. Baselining of MSBuild.exe usage is recommended to better - understand it's path usage. Visual Studio runs an instance out of a path that will - need to be filtered on. -references: -- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md -tags: - analytic_story: - - Trusted Developer Utilities Proxy Execution MSBuild - - Cobalt Strike - - Masquerading - Rename System Utilities - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 70 - message: Msbuild.exe ran from an uncommon path on $dest$ execyted by $user$ - mitre_attack_id: - - T1036 - - T1127 - - T1036.003 - - T1127.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/suspicious_msbuild_rename.yml b/dev/endpoint/suspicious_msbuild_rename.yml deleted file mode 100644 index 35ab9130cb..0000000000 --- a/dev/endpoint/suspicious_msbuild_rename.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Suspicious MSBuild Rename -id: 4006adac-5937-11eb-ae93-0242ac130002 -version: 3 -date: '2022-04-07' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following analytic identifies renamed instances of msbuild.exe executing. - Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and - C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify - the code executed and what is executing a renamed instance of MSBuild. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: MSBuild.exe - Image|endswith: msbuild.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Although unlikely, some legitimate applications may use a moved - copy of msbuild, triggering a false positive. -references: -- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md -- https://github.com/infosecn1nja/MaliciousMacroMSBuild/ -tags: - analytic_story: - - Trusted Developer Utilities Proxy Execution MSBuild - - Cobalt Strike - - Masquerading - Rename System Utilities - - Living Off The Land - asset_type: Endpoint - confidence: 90 - impact: 70 - message: Suspicious renamed msbuild.exe binary ran on $dest$ by $user$ - mitre_attack_id: - - T1036 - - T1127 - - T1036.003 - - T1127.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/suspicious_msbuild_spawn.yml b/dev/endpoint/suspicious_msbuild_spawn.yml deleted file mode 100644 index 3725e3b744..0000000000 --- a/dev/endpoint/suspicious_msbuild_spawn.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Suspicious MSBuild Spawn -id: a115fba6-5514-11eb-ae93-0242ac130002 -version: 2 -date: '2021-01-12' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies wmiprvse.exe spawning msbuild.exe. - This behavior is indicative of a COM object being utilized to spawn msbuild from - wmiprvse.exe. It is common for MSBuild.exe to be spawned from devenv.exe while using - Visual Studio. In this instance, there will be command line arguments and file paths. - In a malicious instance, MSBuild.exe will spawn from non-standard processes and - have no command line arguments. For example, MSBuild.exe spawning from explorer.exe, - powershell.exe is far less common and should be investigated. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: wmiprvse.exe - selection2: - OriginalFileName: MSBuild.exe - selection3: - Image|endswith: msbuild.exe - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Although unlikely, some legitimate applications may exhibit - this behavior, triggering a false positive. -references: -- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md -tags: - analytic_story: - - Trusted Developer Utilities Proxy Execution MSBuild - - Living Off The Land - asset_type: Endpoint - confidence: 60 - impact: 70 - message: Suspicious msbuild.exe process executed on $dest$ by $user$ - mitre_attack_id: - - T1127 - - T1127.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 42 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/suspicious_mshta_child_process.yml b/dev/endpoint/suspicious_mshta_child_process.yml deleted file mode 100644 index 393ffd5313..0000000000 --- a/dev/endpoint/suspicious_mshta_child_process.yml +++ /dev/null @@ -1,74 +0,0 @@ -name: Suspicious mshta child process -id: 60023bb6-5500-11eb-ae93-0242ac130002 -version: 1 -date: '2021-01-12' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies child processes spawning from "mshta.exe". - The search will return the first time and last time these command-line arguments - were used for these executions, as well as the target system, the user, parent process - "mshta.exe" and its child process. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - cmd.exe - - powershell.exe - - wscript.exe - - cscript.exe - - scrcons.exe - - searchprotocolhost.exe - - microsoft.workflow.compiler.exe - - msbuild.exe - - colorcpl.exe - - powershell.exe - ParentImage: mshta.exe - condition: (selection1) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Although unlikely, some legitimate applications may exhibit - this behavior, triggering a false positive. -references: -- https://github.com/redcanaryco/AtomicTestHarnesses -- https://redcanary.com/blog/introducing-atomictestharnesses/ -tags: - analytic_story: - - Suspicious MSHTA Activity - - Living Off The Land - asset_type: Endpoint - confidence: 80 - impact: 50 - message: suspicious mshta child process detected on host $dest$ by user $user$. - mitre_attack_id: - - T1218 - - T1218.005 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Endpoint - role: - - Victim - - name: parent_process - type: Process Name - role: - - Parent Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 40 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/suspicious_mshta_spawn.yml b/dev/endpoint/suspicious_mshta_spawn.yml deleted file mode 100644 index e274b6089a..0000000000 --- a/dev/endpoint/suspicious_mshta_spawn.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Suspicious mshta spawn -id: 4d33a488-5b5f-11eb-ae93-0242ac130002 -version: 2 -date: '2021-01-20' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies wmiprvse.exe spawning mshta.exe. This - behavior is indicative of a DCOM object being utilized to spawn mshta from wmiprvse.exe - or svchost.exe. In this instance, adversaries may use LethalHTA that will spawn - mshta.exe from svchost.exe. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - svchost.exe - - wmiprvse.exe - selection2: - OriginalFileName: MSHTA.EXE - selection3: - Image|endswith: mshta.exe - condition: (selection1) and selection2 and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Although unlikely, some legitimate applications may exhibit - this behavior, triggering a false positive. -references: -- https://codewhitesec.blogspot.com/2018/07/lethalhta.html -- https://github.com/redcanaryco/AtomicTestHarnesses -- https://redcanary.com/blog/introducing-atomictestharnesses/ -tags: - analytic_story: - - Suspicious MSHTA Activity - - Living Off The Land - asset_type: Endpoint - confidence: 60 - impact: 70 - message: mshta.exe spawned by wmiprvse.exe on $dest$ - mitre_attack_id: - - T1218 - - T1218.005 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 42 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/suspicious_plistbuddy_usage.yml b/dev/endpoint/suspicious_plistbuddy_usage.yml deleted file mode 100644 index ad4cd9630d..0000000000 --- a/dev/endpoint/suspicious_plistbuddy_usage.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Suspicious PlistBuddy Usage -id: c3194009-e0eb-4f84-87a9-4070f8688f00 -version: 1 -date: '2021-02-22' -author: Michael Haag, Splunk -status: experimental -type: TTP -description: 'The following analytic identifies the use of a native MacOS utility, - PlistBuddy, creating or modifying a properly list (.plist) file. In the instance - of Silver Sparrow, the following commands were executed: - - * PlistBuddy -c "Add :Label string init_verx" ~/Library/Launchagents/init_verx.plist - - * PlistBuddy -c "Add :RunAtLoad bool true" ~/Library/Launchagents/init_verx.plist - - * PlistBuddy -c "Add :StartInterval integer 3600" ~/Library/Launchagents/init_verx.plist - - * PlistBuddy -c "Add :ProgramArguments array" ~/Library/Launchagents/init_verx.plist - - * PlistBuddy -c "Add :ProgramArguments:0 string /bin/sh" ~/Library/Launchagents/init_verx.plist - - * PlistBuddy -c "Add :ProgramArguments:1 string -c" ~/Library/Launchagents/init_verx.plist - - Upon triage, capture the property list file being written to disk and review for - further indicators. Contain the endpoint and triage further.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*true*' - - '*RunAtLoad*' - - '*LaunchAgents*' - Image|endswith: PlistBuddy - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Some legitimate applications may use PlistBuddy to create or - modify property lists and possibly generate false positives. Review the property - list being modified or created to confirm. -references: -- https://www.marcosantadev.com/manage-plist-files-plistbuddy/ -tags: - analytic_story: - - Silver Sparrow - asset_type: Endpoint - confidence: 50 - impact: 50 - message: tbd - mitre_attack_id: - - T1543.001 - - T1543 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint diff --git a/dev/endpoint/suspicious_process_file_path.yml b/dev/endpoint/suspicious_process_file_path.yml deleted file mode 100644 index 85df202287..0000000000 --- a/dev/endpoint/suspicious_process_file_path.yml +++ /dev/null @@ -1,92 +0,0 @@ -name: Suspicious Process File Path -id: 9be25988-ad82-11eb-a14f-acde48001122 -version: 1 -date: '2021-05-05' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic will detect a suspicious process running in a - file path where a process is not commonly seen and is most commonly used by malicious - software. This behavior has been used by adversaries where they drop and run an - exe in a path that is accessible without admin privileges. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Processes.process_path.file_path: '*\\Users\\Administrator\\Music\\*' - selection2: - Processes.process_path: - - '*\\windows\\fonts\\*' - - '*\\windows\\temp\\*' - - '*\\users\\public\\*' - - '*\\windows\\debug\\*' - selection3: - Processes.process_path.file_path: '*\\Windows\\servicing\\*' - selection4: - Processes.process_path.file_path: '*\\Users\\Default\\*' - selection5: - Processes.process_path.file_path: '*Recycle.bin*' - selection6: - Processes.process_path: '*\\Windows\\Media\\*' - selection7: - Processes.process_path: \\Windows\\repair\\* - selection8: - Processes.process_path: '*\\temp\\*' - selection9: - Processes.process_path: '*\\PerfLogs\\*' - condition: selection1 or selection2 or selection3 or selection4 or selection5 or - selection6 or selection7 or selection8 or selection9 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators may allow execution of specific binaries in - non-standard paths. Filter as needed. -references: -- https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -- https://twitter.com/pr0xylife/status/1590394227758104576 -tags: - analytic_story: - - Data Destruction - - Double Zero Destructor - - XMRig - - Remcos - - WhisperGate - - Hermetic Wiper - - Industroyer2 - - DarkCrystal RAT - - Brute Ratel C4 - - AgentTesla - - Qakbot - - IcedID - - Trickbot - - Azorult - - Prestige Ransomware - asset_type: Endpoint - confidence: 50 - impact: 70 - message: Suspicioues process $Processes.process_path.file_path$ running from suspicious - location - mitre_attack_id: - - T1543 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: Processes.process_path.file_path - type: File Name - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/suspicious_reg_exe_process.yml b/dev/endpoint/suspicious_reg_exe_process.yml deleted file mode 100644 index 023853296d..0000000000 --- a/dev/endpoint/suspicious_reg_exe_process.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Suspicious Reg exe Process -id: a6b3ab4e-dd77-4213-95fa-fc94701995e0 -version: 4 -date: '2020-07-22' -author: David Dorsey, Splunk -status: production -type: Anomaly -description: This search looks for reg.exe being launched from a command prompt not - started by the user. When a user launches cmd.exe, the parent process is usually - explorer.exe. This search filters out those instances. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: cmd.exe - ParentImage: explorer.exe - condition: selection1 -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. -known_false_positives: It's possible for system administrators to write scripts that - exhibit this behavior. If this is the case, the search will need to be modified - to filter them out. -references: -- https://car.mitre.org/wiki/CAR-2013-03-001/ -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Disabling Security Tools - - DHS Report TA18-074A - asset_type: Endpoint - confidence: 50 - impact: 70 - message: Suspicious $Processes.process_path.file_path$ process running with an uncommon - parent process $Processes.parent_process_name$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: Processes.process_path.file_path - type: File Name - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/suspicious_scheduled_task_from_public_directory.yml b/dev/endpoint/suspicious_scheduled_task_from_public_directory.yml deleted file mode 100644 index 9d71acc874..0000000000 --- a/dev/endpoint/suspicious_scheduled_task_from_public_directory.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Suspicious Scheduled Task from Public Directory -id: 7feb7972-7ac3-11eb-bac8-acde48001122 -version: 1 -date: '2021-03-01' -author: Michael Haag, Splunk -status: production -type: Anomaly -description: The following detection identifies Scheduled Tasks registering (creating - a new task) a binary or script to run from a public directory which includes users\public, - \programdata\ and \windows\temp. Upon triage, review the binary or script in the - command line for legitimacy, whether an approved binary/script or not. In addition, - capture the binary or script in question and analyze for further behaviors. Identify - the source and contain the endpoint. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*windows\\temp*' - - '*\\programdata\\*' - - '*\\users\\public\\*' - Image|endswith: schtasks.exe - selection2: - CommandLine: '*/create*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Limited false positives may be present. Filter as needed by - parent process or command line argument. -references: -- https://attack.mitre.org/techniques/T1053/005/ -tags: - analytic_story: - - Ransomware - - Ryuk Ransomware - - Windows Persistence Techniques - - Living Off The Land - - Azorult - - DarkCrystal RAT - asset_type: Endpoint - confidence: 50 - impact: 70 - message: Suspicious scheduled task registered on $dest$ - mitre_attack_id: - - T1053.005 - - T1053 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtasks/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml b/dev/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml deleted file mode 100644 index 5b8acbc7b7..0000000000 --- a/dev/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Suspicious SearchProtocolHost no Command Line Arguments -id: f52d2db8-31f9-4aa7-a176-25779effe55c -version: 3 -date: '2022-03-15' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies searchprotocolhost.exe with no command - line arguments. It is unusual for searchprotocolhost.exe to execute with no command - line arguments present. This particular behavior is common with malicious software, - including Cobalt Strike. During investigation, identify any network connections - and parallel processes. Identify any suspicious module loads related to credential - dumping or file writes. searchprotocolhost.exe is natively found in C:\Windows\system32 - and C:\Windows\syswow64. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: searchprotocolhost.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives may be present in small environments. - Tuning may be required based on parent process. -references: -- https://github.com/mandiant/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc -tags: - analytic_story: - - Cobalt Strike - asset_type: Endpoint - confidence: 70 - impact: 70 - message: Suspicious searchprotocolhost.exe process with no command line arguments - executed on $dest$ by $user$ - mitre_attack_id: - - T1055 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml b/dev/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml deleted file mode 100644 index 809447e04f..0000000000 --- a/dev/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml +++ /dev/null @@ -1,49 +0,0 @@ -name: Suspicious SQLite3 LSQuarantine Behavior -id: e1997b2e-655f-4561-82fd-aeba8e1c1a86 -version: 1 -date: '2021-02-22' -author: Michael Haag, Splunk -status: experimental -type: TTP -description: The following analytic identifies the use of a SQLite3 querying the MacOS - preferences to identify the original URL the pkg was downloaded from. This particular - behavior is common with MacOS adware-malicious software. Upon triage, review other - processes in parallel for suspicious activity. Identify any recent package installations. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*LSQuarantine*' - Image|endswith: sqlite3 - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Unknown. -references: -- https://redcanary.com/blog/clipping-silver-sparrows-wings/ -- https://www.marcosantadev.com/manage-plist-files-plistbuddy/ -tags: - analytic_story: - - Silver Sparrow - asset_type: Endpoint - confidence: 50 - impact: 50 - message: tbd - mitre_attack_id: - - T1074 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint diff --git a/dev/endpoint/suspicious_wav_file_in_appdata_folder.yml b/dev/endpoint/suspicious_wav_file_in_appdata_folder.yml deleted file mode 100644 index 944550bfe6..0000000000 --- a/dev/endpoint/suspicious_wav_file_in_appdata_folder.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Suspicious WAV file in Appdata Folder -id: 5be109e6-1ac5-11ec-b421-acde48001122 -version: 2 -date: '2022-07-07' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to detect a suspicious creation of .wav file in appdata - folder. This behavior was seen in Remcos RAT malware where it put the audio recording - in the appdata\audio folde as part of data collection. this recording can be send - to its C2 server as part of its exfiltration to the compromised machine. creation - of wav files in this folder path is not a ussual disk place used by user to save - audio format file. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Processes.process_path: '*\\appdata\\Roaming\\*' - Image|endswith: '*.exe' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, file_name, file_path and command-line - executions from your endpoints. If you are using Sysmon, you must have at least - version 6.0.4 of the Sysmon TA. -known_false_positives: unknown -references: -- https://success.trendmicro.com/dcx/s/solution/1123281-remcos-malware-information?language=en_US -- https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/ -tags: - analytic_story: - - Remcos - asset_type: Endpoint - confidence: 70 - impact: 70 - message: process $process_name$ creating image file $file_path$ in $dest$ - mitre_attack_id: - - T1113 - observable: - - name: Computer - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon_wav.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/suspicious_writes_to_windows_recycle_bin.yml b/dev/endpoint/suspicious_writes_to_windows_recycle_bin.yml deleted file mode 100644 index ebd0e4bda4..0000000000 --- a/dev/endpoint/suspicious_writes_to_windows_recycle_bin.yml +++ /dev/null @@ -1,52 +0,0 @@ -name: Suspicious writes to windows Recycle Bin -id: b5541828-8ffd-4070-9d95-b3da4de924cb -version: 4 -date: '2020-07-22' -author: Rico Valdez, Splunk -status: production -type: TTP -description: This search detects writes to the recycle bin by a process other than - explorer.exe. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: '*$Recycle.Bin*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on filesystem and process logs responsible for the changes from your endpoints into - the `Endpoint` datamodel in the `Processes` and `Filesystem` nodes. -known_false_positives: Because the Recycle Bin is a hidden folder in modern versions - of Windows, it would be unusual for a process other than explorer.exe to write to - it. Incidents should be investigated as appropriate. -references: [] -tags: - analytic_story: - - Collection and Staging - asset_type: Windows - confidence: 70 - impact: 40 - message: Suspicious writes to windows Recycle Bin process $Processes.process_name$ - mitre_attack_id: - - T1036 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: Processes.process_name - type: Process - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 28 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/write_to_recycle_bin/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/svchost_lolbas_execution_process_spawn.yml b/dev/endpoint/svchost_lolbas_execution_process_spawn.yml deleted file mode 100644 index 484c06f9c1..0000000000 --- a/dev/endpoint/svchost_lolbas_execution_process_spawn.yml +++ /dev/null @@ -1,109 +0,0 @@ -name: Svchost LOLBAS Execution Process Spawn -id: 09e5c72a-4c0d-11ec-aa29-3e22fbd008af -version: 2 -date: '2021-11-22' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: The following analytic identifies `svchost.exe` spawning a LOLBAS execution - process. When adversaries execute code on remote endpoints abusing the Task Scheduler - and creating a malicious remote scheduled task, the executed command is spawned - as a child process of `svchost.exe`. The LOLBAS project documents Windows native - binaries that can be abused by threat actors to perform tasks like executing malicious - code. Looking for child processes of svchost.exe that are part of the LOLBAS project - can help defenders identify lateral movement activity. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - Regsvcs.exe - - Ftp.exe - - OfflineScannerShell.exe - - Rasautou.exe - - Schtasks.exe - - Xwizard.exe - - Pnputil.exe - - Atbroker.exe - - Pcwrun.exe - - Ttdinject.exe - - Mshta.exe - - Bitsadmin.exe - - Certoc.exe - - Ieexec.exe - - Microsoft.Workflow.Compiler.exe - - Runscripthelper.exe - - Forfiles.exe - - Msbuild.exe - - Register-cimprovider.exe - - Tttracer.exe - - Ie4uinit.exe - - Bash.exe - - Hh.exe - - SettingSyncHost.exe - - Cmstp.exe - - Stordiag.exe - - Scriptrunner.exe - - Odbcconf.exe - - Extexport.exe - - Msdt.exe - - WorkFolders.exe - - Diskshadow.exe - - Mavinject.exe - - Regasm.exe - - Gpscript.exe - - Regsvr32.exe - - Msiexec.exe - - Wuauclt.exe - - Presentationhost.exe - - Wmic.exe - - Runonce.exe - - Syncappvpublishingserver.exe - - Verclsid.exe - - Infdefaultinstall.exe - - Installutil.exe - - Netsh.exe - - Wab.exe - - Dnscmd.exe - - At.exe - - Pcalua.exe - - Msconfig.exe - ParentImage: svchost.exe - condition: (selection1) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -known_false_positives: Legitimate applications may trigger this behavior, filter as - needed. -references: -- https://attack.mitre.org/techniques/T1053/005/ -- https://www.ired.team/offensive-security/persistence/t1053-schtask -- https://lolbas-project.github.io/ -tags: - analytic_story: - - Active Directory Lateral Movement - - Living Off The Land - asset_type: Endpoint - confidence: 60 - impact: 90 - message: Svchost.exe spawned a LOLBAS process on $dest$ - mitre_attack_id: - - T1053 - - T1053.005 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 54 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement_lolbas/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog diff --git a/dev/endpoint/system_info_gathering_using_dxdiag_application.yml b/dev/endpoint/system_info_gathering_using_dxdiag_application.yml deleted file mode 100644 index a560e178ce..0000000000 --- a/dev/endpoint/system_info_gathering_using_dxdiag_application.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: System Info Gathering Using Dxdiag Application -id: f92d74f2-4921-11ec-b685-acde48001122 -version: 1 -date: '2021-11-19' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: This analytic is to detect a suspicious dxdiag.exe process command-line - execution. Dxdiag is used to collect the system info of the target host. This technique - has been used by Remcos RATS, various actors, and other malware to collect information - as part of the recon or collection phase of an attack. This behavior should rarely - be seen in a corporate network, but this command line can be used by a network administrator - to audit host machine specifications. Thus in some rare cases, this detection will - contain false positives in its results. To triage further, analyze what commands - were passed after it pipes out the result to a file for further processing. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: dxdiag.exe - selection2: - Image|endswith: dxdiag.exe - selection3: - CommandLine: '* /t *' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` - node. In addition, confirm the latest CIM App 4.20 or higher is installed and the - latest TA for the endpoint product. -known_false_positives: This commandline can be used by a network administrator to - audit host machine specifications. Thus, a filter is needed. -references: -- https://app.any.run/tasks/df0baf9f-8baf-4c32-a452-16562ecb19be/ -tags: - analytic_story: - - Remcos - asset_type: Endpoint - confidence: 50 - impact: 50 - message: dxdiag.exe process with commandline $process$ on $dest$ - mitre_attack_id: - - T1592 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1592/host_info_dxdiag/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/system_information_discovery_detection.yml b/dev/endpoint/system_information_discovery_detection.yml deleted file mode 100644 index c8d0ef5277..0000000000 --- a/dev/endpoint/system_information_discovery_detection.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: System Information Discovery Detection -id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72 -version: 2 -date: '2021-09-07' -author: Patrick Bareiss, Splunk -status: production -type: TTP -description: Detect system information discovery techniques used by attackers to understand - configurations of the system to further exploit it. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*wmic* qfe*' - - '*systeminfo*' - - '*hostname*' - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators debugging servers -references: -- https://web.archive.org/web/20210119205146/https://oscp.infosecsanyam.in/priv-escalation/windows-priv-escalation -tags: - analytic_story: - - Discovery Techniques - asset_type: Windows - confidence: 50 - impact: 30 - message: Potential system information discovery behavior on $dest$ by $User$ - mitre_attack_id: - - T1082 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1082/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/system_processes_run_from_unexpected_locations.yml b/dev/endpoint/system_processes_run_from_unexpected_locations.yml deleted file mode 100644 index 4dea44a9ab..0000000000 --- a/dev/endpoint/system_processes_run_from_unexpected_locations.yml +++ /dev/null @@ -1,73 +0,0 @@ -name: System Processes Run From Unexpected Locations -id: a34aae96-ccf8-4aef-952c-3ea21444444d -version: 6 -date: '2020-12-08' -author: David Dorsey, Michael Haag, Splunk -status: production -type: Anomaly -description: 'This search looks for system processes that typically execute from `C:\Windows\System32\` - or `C:\Windows\SysWOW64`. This may indicate a malicious process that is trying - to hide as a legitimate process. - - This detection utilizes a lookup that is deduped `system32` and `syswow64` directories - from Server 2016 and Windows 10. - - During triage, review the parallel processes - what process moved the native Windows - binary? identify any artifacts on disk and review. If a remote destination is contacted, - what is the reputation?' -data_source: -- Sysmon Event ID 1 -search: - selection1: - Processes.process_path: C:\\Windows\\SysWOW64* - selection2: - Processes.process_path: C:\\Windows\\System32* - condition: selection1 and selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: This detection may require tuning based on third party applications - utilizing native Windows binaries in non-standard paths. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml -- https://attack.mitre.org/techniques/T1036/003/ -tags: - analytic_story: - - Suspicious Command-Line Executions - - Unusual Processes - - Ransomware - - Masquerading - Rename System Utilities - - Qakbot - asset_type: Endpoint - confidence: 50 - impact: 60 - message: A System process $process_name$ is running from $process_path$ on $dest$, - potentially non-standard. - mitre_attack_id: - - T1036 - - T1036.003 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - - name: process_path - type: Other - role: - - Other - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/system_user_discovery_with_query.yml b/dev/endpoint/system_user_discovery_with_query.yml deleted file mode 100644 index 96feacc0df..0000000000 --- a/dev/endpoint/system_user_discovery_with_query.yml +++ /dev/null @@ -1,50 +0,0 @@ -name: System User Discovery With Query -id: ad03bfcf-8a91-4bc2-a500-112993deba87 -version: 1 -date: '2021-09-13' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `query.exe` with command-line - arguments utilized to discover the logged user. Red Teams and adversaries alike - may leverage `query.exe` to identify system users on a compromised endpoint for - situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*user*' - Image|endswith: query.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1033/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: System user discovery on $dest$ - mitre_attack_id: - - T1033 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/system_user_discovery_with_whoami.yml b/dev/endpoint/system_user_discovery_with_whoami.yml deleted file mode 100644 index 3ab6e9c70a..0000000000 --- a/dev/endpoint/system_user_discovery_with_whoami.yml +++ /dev/null @@ -1,50 +0,0 @@ -name: System User Discovery With Whoami -id: 894fc43e-6f50-47d5-a68b-ee9ee23e18f4 -version: 1 -date: '2021-09-13' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `whoami.exe` without any arguments. - This windows native binary prints out the current logged user. Red Teams and adversaries - alike may leverage `whoami.exe` to identify system users on a compromised endpoint - for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: whoami.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1033/ -tags: - analytic_story: - - Active Directory Discovery - - Qakbot - asset_type: Endpoint - confidence: 50 - impact: 30 - message: System user discovery on $dest$ - mitre_attack_id: - - T1033 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/time_provider_persistence_registry.yml b/dev/endpoint/time_provider_persistence_registry.yml deleted file mode 100644 index 9a142255f7..0000000000 --- a/dev/endpoint/time_provider_persistence_registry.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Time Provider Persistence Registry -id: 5ba382c4-2105-11ec-8d8f-acde48001122 -version: 2 -date: '2022-01-26' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to detect a suspicious modification of time provider - registry for persistence and autostart. This technique can allow the attacker to - persist on the compromised host and autostart as soon as the machine boot up. This - TTP can be a good indicator of suspicious behavior since this registry is not commonly - modified by normal user or even an admin. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: '*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*' - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: unknown -references: -- https://pentestlab.blog/2019/10/22/persistence-time-providers/ -- https://attack.mitre.org/techniques/T1547/003/ -tags: - analytic_story: - - Windows Persistence Techniques - - Windows Privilege Escalation - - Windows Registry Abuse - - Hermetic Wiper - asset_type: Endpoint - confidence: 100 - impact: 80 - message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ - mitre_attack_id: - - T1547.003 - - T1547 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.003/timeprovider_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/uninstall_app_using_msiexec.yml b/dev/endpoint/uninstall_app_using_msiexec.yml deleted file mode 100644 index 06e3e3edc1..0000000000 --- a/dev/endpoint/uninstall_app_using_msiexec.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Uninstall App Using MsiExec -id: 1fca2b28-f922-11eb-b2dd-acde48001122 -version: 1 -date: '2021-08-09' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious un-installation of application - using msiexec. This technique was seen in conti leak tool and script where it tries - to uninstall AV product using this commandline. This commandline to uninstall product - is not a common practice in enterprise network. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '* /qn *' - Image|endswith: msiexec.exe - selection2: - CommandLine: '*/X*' - selection3: - CommandLine: '*REBOOT=' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: unknown. -references: -- https://threadreaderapp.com/thread/1423361119926816776.html -tags: - analytic_story: - - Ransomware - asset_type: Endpoint - confidence: 60 - impact: 50 - message: process $process_name$ with a cmdline $process$ in host $dest$ - mitre_attack_id: - - T1218.007 - - T1218 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/unknown_process_using_the_kerberos_protocol.yml b/dev/endpoint/unknown_process_using_the_kerberos_protocol.yml deleted file mode 100644 index 0f45cb5b68..0000000000 --- a/dev/endpoint/unknown_process_using_the_kerberos_protocol.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Unknown Process Using The Kerberos Protocol -id: c91a0852-9fbb-11ec-af44-acde48001122 -version: 1 -date: '2022-03-09' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: The following analytic identifies a process performing an outbound connection - on port 88 used by default by the network authentication protocol Kerberos. Typically, - on a regular Windows endpoint, only the lsass.exe process is the one tasked with - connecting to the Kerberos Distribution Center to obtain Kerberos tickets. Identifying - an unknown process using this protocol may be evidence of an adversary abusing the - Kerberos protocol. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: lsass.exe - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting your - endpoint events and populating the Endpoint and Network data models. -known_false_positives: Custom applications may leverage the Kerberos protocol. Filter - as needed. -references: -- https://stealthbits.com/blog/how-to-detect-overpass-the-hash-attacks/ -- https://www.thehacker.recipes/ad/movement/kerberos/ptk -tags: - analytic_story: - - Active Directory Kerberos Attacks - asset_type: Endpoint - confidence: 60 - impact: 60 - message: '' - mitre_attack_id: - - T1550 - observable: - - name: src_ip - type: IP Address - role: - - Attacker - - name: dest_ip - type: IP Address - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 36 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550/rubeus/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550/rubeus/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/unload_sysmon_filter_driver.yml b/dev/endpoint/unload_sysmon_filter_driver.yml deleted file mode 100644 index d93fdae4de..0000000000 --- a/dev/endpoint/unload_sysmon_filter_driver.yml +++ /dev/null @@ -1,55 +0,0 @@ -name: Unload Sysmon Filter Driver -id: e5928ff3-23eb-4d8b-b8a4-dcbc844fdfbe -version: 4 -date: '2022-06-01' -author: Bhavin Patel, Splunk -status: production -type: TTP -description: Attackers often disable security tools to avoid detection. This search - looks for the usage of process `fltMC.exe` to unload a Sysmon Driver that will stop - sysmon from collecting the data. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*unload*' - Image|endswith: fltMC.exe - selection2: - CommandLine: '*SysmonDrv*' - condition: selection1 and selection2 -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. This search is also shipped with `unload_sysmon_filter_driver_filter` macro, - update this macro to filter out false positives. -known_false_positives: Unknown at the moment -references: -- https://www.ired.team/offensive-security/defense-evasion/unloading-sysmon-driver -tags: - analytic_story: - - Disabling Security Tools - asset_type: Endpoint - confidence: 90 - impact: 50 - message: Possible Sysmon filter driver unloading on $dest$ - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 45 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/unload_sysmon/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/user_discovery_with_env_vars_powershell.yml b/dev/endpoint/user_discovery_with_env_vars_powershell.yml deleted file mode 100644 index 7b660d6049..0000000000 --- a/dev/endpoint/user_discovery_with_env_vars_powershell.yml +++ /dev/null @@ -1,53 +0,0 @@ -name: User Discovery With Env Vars PowerShell -id: 0cdf318b-a0dd-47d7-b257-c621c0247de8 -version: 1 -date: '2021-09-13' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `powershell.exe` with command-line - arguments that leverage PowerShell environment variables to identify the current - logged user. Red Teams and adversaries may leverage this method to identify the - logged user on a compromised endpoint for situational awareness and Active Directory - Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*[System.Environment]::UserName*' - - '*$env:UserName*' - Image|endswith: powershell.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1033/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: System user discovery on $dest$ - mitre_attack_id: - - T1033 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/usn_journal_deletion.yml b/dev/endpoint/usn_journal_deletion.yml deleted file mode 100644 index bbc9662005..0000000000 --- a/dev/endpoint/usn_journal_deletion.yml +++ /dev/null @@ -1,51 +0,0 @@ -name: USN Journal Deletion -id: b6e0ff70-b122-4227-9368-4cf322ab43c3 -version: 2 -date: '2018-12-03' -author: David Dorsey, Splunk -status: production -type: TTP -description: The fsutil.exe application is a legitimate Windows utility used to perform - tasks related to the file allocation table (FAT) and NTFS file systems. The update - sequence number (USN) change journal provides a log of all changes made to the files - on the disk. This search looks for fsutil.exe deleting the USN journal. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: fsutil.exe - condition: selection1 -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. -known_false_positives: None identified -references: [] -tags: - analytic_story: - - Windows Log Manipulation - - Ransomware - asset_type: Endpoint - confidence: 90 - impact: 50 - message: Possible USN journal deletion on $dest$ - mitre_attack_id: - - T1070 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 45 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/vbscript_execution_using_wscript_app.yml b/dev/endpoint/vbscript_execution_using_wscript_app.yml deleted file mode 100644 index 3d6017631e..0000000000 --- a/dev/endpoint/vbscript_execution_using_wscript_app.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Vbscript Execution Using Wscript App -id: 35159940-228f-11ec-8a49-acde48001122 -version: 1 -date: '2021-10-01' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to detect a suspicious wscript commandline to execute - vbscript. This technique was seen in several malware to execute malicious vbs file - using wscript application. commonly vbs script is associated to cscript process - and this can be a technique to evade process parent child detections or even some - av script emulation system. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentCommandLine: '*//e:vbscript*' - ParentImage: wscript.exe - selection2: - CommandLine: '*//e:vbscript*' - Image|endswith: wscript.exe - condition: selection1 or selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: unknown -references: -- https://www.joesandbox.com/analysis/369332/0/html -tags: - analytic_story: - - FIN7 - - Remcos - asset_type: Endpoint - confidence: 70 - impact: 70 - message: Process name $process_name$ with commandline $process$ to execute vbsscript - mitre_attack_id: - - T1059.005 - - T1059 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/w3wp_spawning_shell.yml b/dev/endpoint/w3wp_spawning_shell.yml deleted file mode 100644 index e1467934d9..0000000000 --- a/dev/endpoint/w3wp_spawning_shell.yml +++ /dev/null @@ -1,78 +0,0 @@ -name: W3WP Spawning Shell -id: 0f03423c-7c6a-11eb-bc47-acde48001122 -version: 2 -date: '2021-03-03' -author: Michael Haag, Splunk -status: production -type: TTP -description: This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from - W3WP.exe, or IIS. In addition to IIS logs, this behavior with an EDR product will - capture potential webshell activity, similar to the HAFNIUM Group abusing CVEs, - on publicly available Exchange mail servers. During triage, review the parent process - and child process of the shell being spawned. Review the command-line arguments - and any file modifications that may occur. Identify additional parallel process, - child processes, that may highlight further commands executed. After triaging, work - to contain the threat and patch the system that is vulnerable. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: w3wp.exe - selection2: - OriginalFileName: Cmd.Exe - selection3: - Image|endswith: cmd.exe - selection4: - OriginalFileName: Cmd.Exe - selection5: - Image|endswith: cmd.exe - condition: selection1 and selection2 and selection3 or selection4 or selection5 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Baseline your environment before production. It is possible - build systems using IIS will spawn cmd.exe to perform a software build. Filter as - needed. -references: -- https://www.microsoft.com/security/blog/2020/02/04/ghost-in-the-shell-investigating-web-shell-attacks/ -- https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell -- https://www.youtube.com/watch?v=FC6iHw258RI -- https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do -tags: - analytic_story: - - Hermetic Wiper - - HAFNIUM Group - - ProxyShell - - CISA AA22-257A - - ProxyNotShell - - CISA AA22-264A - asset_type: Endpoint - confidence: 80 - cve: - - CVE-2021-34473 - - CVE-2021-34523 - - CVE-2021-31207 - impact: 70 - message: Possible Web Shell execution on $dest$ - mitre_attack_id: - - T1505 - - T1505.003 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/wbadmin_delete_system_backups.yml b/dev/endpoint/wbadmin_delete_system_backups.yml deleted file mode 100644 index ecfaebc0ec..0000000000 --- a/dev/endpoint/wbadmin_delete_system_backups.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: WBAdmin Delete System Backups -id: cd5aed7e-5cea-11eb-ae93-0242ac130002 -version: 1 -date: '2021-01-22' -author: Michael Haag, Splunk -status: production -type: TTP -description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator - Tool) that delete backup files. This is typically used by ransomware to prevent - recovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*delete*' - Image|endswith: wbadmin.exe - selection2: - CommandLine: - - '*systemstatebackup*' - - '*catalog*' - condition: selection1 and selection2 -how_to_implement: You must be ingesting endpoint data that tracks process activity, - including parent-child relationships from your endpoints to populate the Endpoint - data model in the Processes node. Tune based on parent process names. -known_false_positives: Administrators may modify the boot configuration. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md -- https://thedfirreport.com/2020/10/08/ryuks-return/ -- https://attack.mitre.org/techniques/T1490/ -- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin -tags: - analytic_story: - - Ryuk Ransomware - - Ransomware - - Prestige Ransomware - asset_type: Endpoint - confidence: 50 - impact: 30 - message: System backups deletion on $dest$ - mitre_attack_id: - - T1490 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/wget_download_and_bash_execution.yml b/dev/endpoint/wget_download_and_bash_execution.yml deleted file mode 100644 index 294f091fd4..0000000000 --- a/dev/endpoint/wget_download_and_bash_execution.yml +++ /dev/null @@ -1,77 +0,0 @@ -name: Wget Download and Bash Execution -id: 35682718-5a85-11ec-b8f7-acde48001122 -version: 1 -date: '2021-12-11' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the use of wget on Linux or MacOS attempting - to download a file from a remote source and pipe it to bash. This is typically found - with coinminers and most recently with CVE-2021-44228, a vulnerability in Log4j. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: wget - selection2: - CommandLine: '*-q *' - selection3: - CommandLine: '*-O- *' - selection4: - CommandLine: '*--quiet*' - selection5: - CommandLine: '*bash*' - selection6: - CommandLine: '*|*' - condition: selection1 and selection2 and selection3 and selection4 or selection5 - or selection6 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon for Linux, you will need to ensure mapping is - occurring correctly. If the EDR is not parsing the pipe bash in the command-line, - modifying the analytic will be required. Add parent process name (Processes.parent_process_name) - as needed to filter. -known_false_positives: False positives should be limited, however filtering may be - required. -references: -- https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java -- https://www.lunasec.io/docs/blog/log4j-zero-day/ -- https://gist.github.com/nathanqthai/01808c569903f41a52e7e7b575caa890 -tags: - analytic_story: - - Ingress Tool Transfer - - Log4Shell CVE-2021-44228 - asset_type: Endpoint - confidence: 100 - cve: - - CVE-2021-44228 - impact: 80 - message: An instance of $process_name$ was identified on endpoint $dest$ attempting - to download a remote file and run it with bash. - mitre_attack_id: - - T1105 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/linux-sysmon_curlwget.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/windows_adfind_exe.yml b/dev/endpoint/windows_adfind_exe.yml deleted file mode 100644 index 2b11596aab..0000000000 --- a/dev/endpoint/windows_adfind_exe.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Windows AdFind Exe -id: bd3b0187-189b-46c0-be45-f52da2bae67f -version: 2 -date: '2021-11-03' -author: Jose Hernandez, Bhavin Patel, Splunk -status: production -type: TTP -description: 'This search looks for the execution of `adfind.exe` with command-line - arguments that it uses by default. Specifically the filter or search functions. - It also considers the arguments necessary like objectcategory, see readme for more - details: https://www.joeware.net/freetools/tools/adfind/usage.htm. This has been - seen used before by Wizard Spider, FIN6 and actors whom also launched SUNBURST. - AdFind.exe is usually used a recon tool to enumare a domain controller.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*objectcategory*' - - '* -gcb *' - - '* -sc *' - selection2: - CommandLine: - - '* -f *' - - '* -b *' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, and command-line executions from your endpoints. If - you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: administrators rarely use adfind, usually not used for legitimate - reasons -references: -- https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/ -- https://www.mandiant.com/resources/a-nasty-trick-from-credential-theft-malware-to-business-disruption -tags: - analytic_story: - - NOBELIUM Group - - Domain Trust Discovery - asset_type: Endpoint - confidence: 50 - impact: 50 - message: Windows AdFind Exe - mitre_attack_id: - - T1018 - observable: - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25.0 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_apache_benchmark_binary.yml b/dev/endpoint/windows_apache_benchmark_binary.yml deleted file mode 100644 index 45fd4ac01f..0000000000 --- a/dev/endpoint/windows_apache_benchmark_binary.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Windows Apache Benchmark Binary -id: 894f48ea-8d85-4dcd-9132-c66cdb407c9b -version: 1 -date: '2022-11-21' -author: Michael Haag, Splunk -status: production -type: Anomaly -description: The following analytic identifies a default behavior of a MetaSploit - payload. MetaSploit uses Apache Benchmark to generate payloads. The payloads contain - standard artifacts including "Apache Benchmark" and the original file name is always - ab.exe. During triage, review the process and it's path. It is possible network - connections spawned from it. Review parallel processes for further behaviors. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: ab.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited as there is a small subset - of binaries that contain the original file name of ab.exe. Filter as needed. -references: -- https://seclists.org/metasploit/2013/q3/13 -tags: - analytic_story: - - MetaSploit - asset_type: Endpoint - confidence: 100 - impact: 100 - message: A known MetaSploit default payload has been identified on $dest$ ran by - $user$, $parent_process_name$ spawning $process_name$. - mitre_attack_id: - - T1059 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 100 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/metasploit/apachebench_windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml b/dev/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml deleted file mode 100644 index dadaaac918..0000000000 --- a/dev/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Windows Autostart Execution LSASS Driver Registry Modification -id: 57fb8656-141e-4d8a-9f51-62cff4ecb82a -version: 1 -date: '2022-08-22' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the abuse of two undocumented registry - keys that allow for a DLL to load into lsass.exe to potentially capture credentials. - Upon successful modification of \CurrentControlSet\Services\NTDS\DirectoryServiceExtPt - or \CurrentControlSet\Services\NTDS\LsaDbExtPt, a DLL either remote or local will - be set as the value and load up into lsass.exe. Based on POC code a text file may - be written to disk with credentials. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: - - '*\\CurrentControlSet\\Services\\NTDS\\DirectoryServiceExtPt' - - '*\\CurrentControlSet\\Services\\NTDS\\LsaDbExtPt' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present on recent Windows Operating - Systems. Filtering may be required based on process_name. In addition, look for - non-standard, unsigned, module loads into LSASS. If query is too noisy, modify by - adding Endpoint.processes process_name to query to identify the process making the - modification. -references: -- https://blog.xpnsec.com/exploring-mimikatz-part-1/ -- https://github.com/oxfemale/LogonCredentialsSteal/tree/master/lsass_lib -tags: - analytic_story: - - Windows Registry Abuse - asset_type: Endpoint - confidence: 70 - impact: 70 - message: The registry values for DirectoryServiceExtPt or LsaDbExtPt were modified - on $dest$. - mitre_attack_id: - - T1547.008 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.008/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml b/dev/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml deleted file mode 100644 index b97260411d..0000000000 --- a/dev/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml +++ /dev/null @@ -1,76 +0,0 @@ -name: Windows Binary Proxy Execution Mavinject DLL Injection -id: ccf4b61b-1b26-4f2e-a089-f2009c569c57 -version: 1 -date: '2022-07-07' -author: Michael Haag, Splunk -status: production -type: TTP -description: Adversaries may abuse mavinject.exe to inject malicious DLLs into running - processes (i.e. Dynamic-link Library Injection), allowing for arbitrary code execution - (ex. C:\Windows\system32\mavinject.exe PID /INJECTRUNNING PATH_DLL). In addition - to Dynamic-link Library Injection, Mavinject.exe can also be abused to perform import - descriptor injection via its /HMODULE command-line parameter (ex. mavinject.exe - PID /HMODULE=BASE_ADDRESS PATH_DLL ORDINAL_NUMBER). This command would inject an - import table entry consisting of the specified DLL into the module at the given - base address. During triage, review file modifcations and parallel processes. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*injectrunning*' - - '*hmodule=' - Image|endswith: mavinject.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present, filter on DLL name or parent - process. -references: -- https://attack.mitre.org/techniques/T1218/013/ -- https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-1---mavinject---inject-dll-into-running-process -tags: - analytic_story: - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting load a DLL. - mitre_attack_id: - - T1218.013 - - T1218 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process Name - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.013/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_cached_domain_credentials_reg_query.yml b/dev/endpoint/windows_cached_domain_credentials_reg_query.yml deleted file mode 100644 index d428a1125c..0000000000 --- a/dev/endpoint/windows_cached_domain_credentials_reg_query.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Windows Cached Domain Credentials Reg Query -id: 40ccb8e0-1785-466e-901e-6a8b75c04ecd -version: 1 -date: '2022-11-30' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic identifies a process command line related to the - discovery of cache domain credential logon count in the registry. This Technique - was being abused by several post exploitation tool like Winpeas where it query CachedLogonsCount - registry value in Winlogon registry. This value can be good information about the - login caching setting on the Windows OS target host. A value of 0 means login caching - is disable and values > 50 caches only 50 login attempts. By default all versions - of Windows 10 save cached logins except Windows Server 2008. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: reg.exe - selection2: - Image|endswith: reg.exe - selection3: - CommandLine: '* query *' - selection4: - CommandLine: '*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*' - selection5: - CommandLine: '*CACHEDLOGONSCOUNT*' - condition: (selection1 or selection2) and selection3 and selection4 and selection5 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. -known_false_positives: unknown -references: -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -- https://learn.microsoft.com/de-de/troubleshoot/windows-server/user-profiles-and-logon/cached-domain-logon-information -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -tags: - analytic_story: - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 30 - impact: 30 - message: a process with commandline $process$ tries to retrieve cache domain credential - logon count in $dest$ - mitre_attack_id: - - T1003.005 - - T1003 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_change_default_file_association_for_no_file_ext.yml b/dev/endpoint/windows_change_default_file_association_for_no_file_ext.yml deleted file mode 100644 index c5773a8857..0000000000 --- a/dev/endpoint/windows_change_default_file_association_for_no_file_ext.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Windows Change Default File Association For No File Ext -id: dbdf52ad-d6a1-4b68-975f-0a10939d8e38 -version: 1 -date: '2022-11-30' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is developed to detect suspicious process commandline to - change or set the default file association of a file without file extension with - notepad.exe. This technique was seen in some APT and ransomware Prestige where it - set/modify the default process to run file association, like .txt to notepad.exe. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: reg.exe - selection2: - Image|endswith: reg.exe - selection3: - CommandLine: '* add *' - selection4: - CommandLine: '* HKCR\\*' - selection5: - CommandLine: '*\\shell\\open\\command*' - selection6: - CommandLine: '*Notepad.exe*' - condition: (selection1 or selection2) and selection3 and selection4 and selection5 - and selection6 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: unknown -references: -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Prestige Ransomware - asset_type: Endpoint - confidence: 100 - impact: 80 - message: process with commandline $process$ set or change the file association of - a file with no file extension in $dest$ - mitre_attack_id: - - T1546.001 - - T1546 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/prestige_ransomware/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_com_hijacking_inprocserver32_modification.yml b/dev/endpoint/windows_com_hijacking_inprocserver32_modification.yml deleted file mode 100644 index 34facec810..0000000000 --- a/dev/endpoint/windows_com_hijacking_inprocserver32_modification.yml +++ /dev/null @@ -1,77 +0,0 @@ -name: Windows COM Hijacking InprocServer32 Modification -id: b7bd83c0-92b5-4fc7-b286-23eccfa2c561 -version: 1 -date: '2022-09-26' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the use of reg.exe performing an add - to the InProcServer32, which may be related to COM hijacking. Adversaries can use - the COM system to insert malicious code that can be executed in place of legitimate - software through hijacking the COM references and relationships as a means for persistence. - Hijacking a COM object requires a change in the Registry to replace a reference - to a legitimate system component which may cause that component to not work when - executed. When that system component is executed through normal system operation - the adversary's code will be executed instead. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: reg.exe - selection2: - Image|endswith: reg.exe - selection3: - CommandLine: '*inprocserver32*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present and some filtering may be required. -references: -- https://attack.mitre.org/techniques/T1546/015/ -- https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.015/T1546.015.md -tags: - analytic_story: - - Living Off The Land - asset_type: Endpoint - confidence: 80 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to modify InProcServer32 within the - registry. - mitre_attack_id: - - T1546.015 - - T1546 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml b/dev/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml deleted file mode 100644 index 604cb23107..0000000000 --- a/dev/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Windows Command and Scripting Interpreter Path Traversal Exec -id: 58fcdeb1-728d-415d-b0d7-3ab18a275ec2 -version: 2 -date: '2022-06-01' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies path traversal command-line execution. - This technique was seen in malicious document that execute malicious code using - msdt.exe and path traversal technique that serve as defense evasion. This TTP is - a good pivot to look for more suspicious process and command-line that runs before - and after this execution. This may help you to find possible downloaded malware - or other lolbin execution. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*\/..\/..\/..\/*' - - '*\\..\\..\\..\\*' - - '*\/\/..\/\/..\/\/..\/\/*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product -known_false_positives: Not known at this moment. -references: -- https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190 - asset_type: Endpoint - confidence: 100 - impact: 90 - message: A parent process $parent_process_name$ has spawned a child $process_name$ - with path traversal commandline $process$ in $dest$ - mitre_attack_id: - - T1059 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/path_traversal/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_command_shell_fetch_env_variables.yml b/dev/endpoint/windows_command_shell_fetch_env_variables.yml deleted file mode 100644 index 36217e7169..0000000000 --- a/dev/endpoint/windows_command_shell_fetch_env_variables.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Windows Command Shell Fetch Env Variables -id: 048839e4-1eaa-43ff-8a22-86d17f6fcc13 -version: 1 -date: '2022-10-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies a suspicious process command line fetching - the environment variables with a non-shell parent process. This technique was seen - in qakbot malware where it fetches the environment variable in the target or compromised - host. This TTP detection is a good pivot of possible malicious behavior since the - command line is executed by a common non-shell process like cmd.exe , powershell.exe - and many more. This can also be a good sign that the parent process has a malicious - code injected to it to execute this command. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*cmd /c set' - - '*cmd.exe /c set' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: shell process that are not included in this search may cause - False positive. Filter is needed. -references: -- https://twitter.com/pr0xylife/status/1585612370441031680?s=46&t=Dc3CJi4AnM-8rNoacLbScg -tags: - analytic_story: - - Qakbot - asset_type: Endpoint - confidence: 70 - impact: 80 - message: non-shell parent process has a child process $process_name$ with a commandline - $process$ to fetch env variables in $dest$ - mitre_attack_id: - - T1055 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot_wermgr/sysmon_wermgr.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_credentials_from_password_stores_query.yml b/dev/endpoint/windows_credentials_from_password_stores_query.yml deleted file mode 100644 index eb87fb4ec8..0000000000 --- a/dev/endpoint/windows_credentials_from_password_stores_query.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Windows Credentials from Password Stores Query -id: db02d6b4-5d5b-4c33-8d8f-f0577516a8c7 -version: 1 -date: '2022-11-30' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic identifies a process execution of Windows OS cmdkey.exe - tool. This tool is being abused or used by several post exploitation tool such as - winpeas that being used by ransomware prestige to list stored user names, passwords - or credentials in the targeted Windows OS host. This information can be used by - the attacker to gain privilege escalation and persistence in the targeted hosts - for further attacks. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*/list*' - OriginalFileName: cmdkey.exe - selection2: - Image|endswith: cmdkey.exe - condition: selection1 or selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. -known_false_positives: network administrator can use this tool for auditing process. -references: -- https://ss64.com/nt/cmdkey.html -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 50 - impact: 50 - message: a process $process_name$ was executed in $dest$ to display stored username - and credentials. - mitre_attack_id: - - T1555 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_cmdkeylist/cmdkey-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_credentials_in_registry_reg_query.yml b/dev/endpoint/windows_credentials_in_registry_reg_query.yml deleted file mode 100644 index 533c14ae25..0000000000 --- a/dev/endpoint/windows_credentials_in_registry_reg_query.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Windows Credentials in Registry Reg Query -id: a8b3124e-2278-4b73-ae9c-585117079fb2 -version: 1 -date: '2022-11-30' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic identifies a process command line related to the - discovery of possible password or credentials in the registry. This technique is - being abused by adversaries or post exploitation tools like winpeas to steal credentials - in the registry in the targeted host. Registry can contain several sensitive information - like username and credentials that can be used for privilege escalation, persistence - or even in lateral movement. This Anomaly detection can be a good pivot to detect - a suspicious process querying a registry related to password or private keys. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: reg.exe - selection2: - Image|endswith: reg.exe - selection3: - CommandLine: '* query *' - selection4: - CommandLine: - - '*\\Software\\ORL\\WinVNC3\\Password*' - - '*\\SOFTWARE\\RealVNC\\WinVNC4 /v password*' - - '*\\CurrentControlSet\\Services\\SNMP*' - - '*\\Software\\TightVNC\\Server*' - - '*\\Software\\SimonTatham\\PuTTY\\Sessions*' - - '*\\Software\\OpenSSH\\Agent\\Keys*' - - '*password*' - condition: (selection1 or selection2) and selection3 and selection4 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. -known_false_positives: unknown -references: -- https://attack.mitre.org/techniques/T1552/002/ -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 50 - impact: 50 - message: reg query commandline $process$ in $dest$ - mitre_attack_id: - - T1552.002 - - T1552 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_search_pwd/query-putty-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_curl_download_to_suspicious_path.yml b/dev/endpoint/windows_curl_download_to_suspicious_path.yml deleted file mode 100644 index 64d4740dad..0000000000 --- a/dev/endpoint/windows_curl_download_to_suspicious_path.yml +++ /dev/null @@ -1,84 +0,0 @@ -name: Windows Curl Download to Suspicious Path -id: c32f091e-30db-11ec-8738-acde48001122 -version: 1 -date: '2021-10-19' -author: Michael Haag, Splunk -status: production -type: TTP -description: 'The following analytic identifies the use of Windows Curl.exe downloading - a file to a suspicious location. - - -O or --output is used when a file is to be downloaded and placed in a specified - location. - - During triage, review parallel processes for further behavior. In addition, identify - if the download was successful. If a file was downloaded, capture and analyze.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: Curl.exe - selection2: - Image|endswith: curl.exe - selection3: - CommandLine: - - '*-O *' - - '*--output*' - selection4: - CommandLine: - - '*\\appdata\\*' - - '*\\programdata\\*' - - '*\\public\\*' - condition: (selection1 or selection2) and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: It is possible Administrators or super users will use Curl - for legitimate purposes. Filter as needed. -references: -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ -- https://attack.mitre.org/techniques/T1105/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md -tags: - analytic_story: - - IcedID - - Ingress Tool Transfer - - Forest Blizzard - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ to download a file to a suspicious directory. - mitre_attack_id: - - T1105 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_curl_upload_to_remote_destination.yml b/dev/endpoint/windows_curl_upload_to_remote_destination.yml deleted file mode 100644 index 879ba38f09..0000000000 --- a/dev/endpoint/windows_curl_upload_to_remote_destination.yml +++ /dev/null @@ -1,90 +0,0 @@ -name: Windows Curl Upload to Remote Destination -id: 42f8f1a2-4228-11ec-aade-acde48001122 -version: 1 -date: '2021-11-10' -author: Michael Haag, Splunk -status: production -type: TTP -description: 'The following analytic identifies the use of Windows Curl.exe uploading - a file to a remote destination. - - `-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination. - - - `-d` or `--data` POST is the HTTP method that was invented to send data to a receiving - web application, and it is, for example, how most common HTML forms on the web work. - - - HTTP multipart formposts are done with `-F`, but this appears to not be compatible - with the Windows version of Curl. Will update if identified adversary tradecraft. - - - Adversaries may use one of the three methods based on the remote destination and - what they are attempting to upload (zip vs txt). During triage, review parallel - processes for further behavior. In addition, identify if the upload was successful - in network logs. If a file was uploaded, isolate the endpoint and review.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: Curl.exe - selection2: - Image|endswith: curl.exe - selection3: - CommandLine: - - '*-T *' - - '*--upload-file *' - - '*-d *' - - '*--data *' - - '*-F *' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be limited to source control applications - and may be required to be filtered out. -references: -- https://everything.curl.dev/usingcurl/uploads -- https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409 -- https://twitter.com/d1r4c/status/1279042657508081664?s=20 -tags: - analytic_story: - - Ingress Tool Transfer - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ uploading a file to a remote destination. - mitre_attack_id: - - T1105 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml b/dev/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml deleted file mode 100644 index c7a293c184..0000000000 --- a/dev/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Windows Defacement Modify Transcodedwallpaper File -id: e11c3d90-5bc7-42ad-94cd-ba75db10d897 -version: 1 -date: '2022-08-25' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic identifies a modification to the Transcodedwallpaper - file in the wallpaper theme directory to change the wallpaper of the host machine. - This technique was seen in adversaries attempting to deface or change the desktop - wallpaper of the targeted host. During our testing, the common process that affects - or changes the wallpaper if a user changes it via desktop personalized setting is - explorer.exe. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Processes.process_path: '*\\Windows\\Explorer.EXE' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: 3rd part software application can change the wallpaper. Filter - is needed. -references: -- https://forums.ivanti.com/s/article/Wallpaper-Windows-Settings-Desktop-Settings-and-the-transcodedwallpaper-jpg?language=en_US -- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_sifreli.a -tags: - analytic_story: - - Brute Ratel C4 - asset_type: Endpoint - confidence: 30 - impact: 30 - message: modification or creation of transcodedwallpaper file by $process_name$ - in $dest$ - mitre_attack_id: - - T1491 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/wallpaper_via_transcodedwallpaper/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_defender_exclusion_registry_entry.yml b/dev/endpoint/windows_defender_exclusion_registry_entry.yml deleted file mode 100644 index 46bf721164..0000000000 --- a/dev/endpoint/windows_defender_exclusion_registry_entry.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Windows Defender Exclusion Registry Entry -id: 13395a44-4dd9-11ec-9df7-acde48001122 -version: 1 -date: '2021-11-25' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic will detect a suspicious process that modify a registry - related to windows defender exclusion feature. This registry is abused by adversaries, - malware author and red teams to bypassed Windows Defender Anti-Virus product by - excluding folder path, file path, process, extensions and etc. from its real time - or schedule scan to execute their malicious code. This is a good indicator for a - defense evasion and to look further for events after this behavior. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: '*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Exclusions\\*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: admin or user may choose to use this windows features. -references: -- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html -- https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/ -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -tags: - analytic_story: - - Remcos - - Windows Defense Evasion Tactics - - Azorult - - Qakbot - asset_type: Endpoint - confidence: 80 - impact: 80 - message: exclusion registry $registry_path$ modified or added on $dest$ - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/defender_exclusion_sysmon/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml b/dev/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml deleted file mode 100644 index 74b73eb3db..0000000000 --- a/dev/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml +++ /dev/null @@ -1,55 +0,0 @@ -name: Windows Deleted Registry By A Non Critical Process File Path -id: 15e70689-f55b-489e-8a80-6d0cd6d8aad2 -version: 1 -date: '2022-03-28' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to detect deletion of registry with suspicious process - file path. This technique was seen in Double Zero wiper malware where it will delete - all the subkey in HKLM, HKCU and HKU registry hive as part of its destructive payload - to the targeted hosts. This anomaly detections can catch possible malware or advesaries - deleting registry as part of defense evasion or even payload impact but can also - catch for third party application updates or installation. In this scenario false - positive filter is needed. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.action: deleted - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the registry value name, registry path, and registry value data from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: This detection can catch for third party application updates - or installation. In this scenario false positive filter is needed. -references: -- https://blog.talosintelligence.com/2022/03/threat-advisory-doublezero.html -tags: - analytic_story: - - Double Zero Destructor - asset_type: Endpoint - confidence: 60 - impact: 60 - message: registry was deleted by a suspicious $process_name$ with proces path $process_path - in $dest$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 36 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/doublezero_wiper/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_disable_change_password_through_registry.yml b/dev/endpoint/windows_disable_change_password_through_registry.yml deleted file mode 100644 index c1c8f3c544..0000000000 --- a/dev/endpoint/windows_disable_change_password_through_registry.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Windows Disable Change Password Through Registry -id: 0df33e1a-9ef6-11ec-a1ad-acde48001122 -version: 1 -date: '2022-03-08' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to detect a suspicious registry modification to disable - change password feature of the windows host. This registry modification may disables - the Change Password button on the Windows Security dialog box (which appears when - you press Ctrl+Alt+Del). As a result, users cannot change their Windows password - on demand. This technique was seen in some malware family like ransomware to prevent - the user to change the password after ownning the network or a system during attack. - This windows feature may implemented by administrator to prevent normal user to - change the password of a critical host or server, In this type of scenario filter - is needed to minimized false positive. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableChangePassword' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. -known_false_positives: This windows feature may implemented by administrator to prevent - normal user to change the password of a critical host or server, In this type of - scenario filter is needed to minimized false positive. -references: -- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_heartbleed.thdobah -tags: - analytic_story: - - Ransomware - - Windows Defense Evasion Tactics - asset_type: Endpoint - confidence: 70 - impact: 70 - message: Registry modification in "DisableChangePassword" on $dest$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_disable_lock_workstation_feature_through_registry.yml b/dev/endpoint/windows_disable_lock_workstation_feature_through_registry.yml deleted file mode 100644 index 61441ae1a4..0000000000 --- a/dev/endpoint/windows_disable_lock_workstation_feature_through_registry.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Windows Disable Lock Workstation Feature Through Registry -id: c82adbc6-9f00-11ec-a81f-acde48001122 -version: 1 -date: '2022-03-08' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to detect a suspicious registry modification to disable - Lock Computer windows features. This registry modification prevent the user from - locking its screen or computer that are being abused by several malware for example - ransomware. This technique was used by threat actor to make its payload more impactful - to the compromised host. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableLockWorkstation' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. -known_false_positives: unknown -references: -- https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/ -- https://heimdalsecurity.com/blog/fatalrat-targets-telegram/ -tags: - analytic_story: - - Ransomware - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 70 - impact: 70 - message: Registry modification in "DisableLockWorkstation" on $dest$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_disable_logoff_button_through_registry.yml b/dev/endpoint/windows_disable_logoff_button_through_registry.yml deleted file mode 100644 index 2edb0c546c..0000000000 --- a/dev/endpoint/windows_disable_logoff_button_through_registry.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Windows Disable LogOff Button Through Registry -id: b2fb6830-9ed1-11ec-9fcb-acde48001122 -version: 1 -date: '2022-03-08' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to detect a suspicious registry modification to disable - logoff feature in windows host. This registry when enable will prevent users to - log off of the system by using any method, including programs run from the command - line, such as scripts. It also disables or removes all menu items and buttons that - log the user off of the system. This technique was seen abused by ransomware malware - to make the compromised host un-useful and hard to remove other registry modification - made on the machine that needs restart to take effect. This windows feature may - implement by administrator in some server where shutdown is critical. In that scenario - filter of machine and users that can modify this registry is needed. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: - - NoLogOff - - StartMenuLogOff - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*' - Details: '0x00000001' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. -known_false_positives: This windows feature may implement by administrator in some - server where shutdown is critical. In that scenario filter of machine and users - that can modify this registry is needed. -references: -- https://www.hybrid-analysis.com/sample/e2d4018fd3bd541c153af98ef7c25b2bf4a66bc3bfb89e437cde89fd08a9dd7b/5b1f4d947ca3e10f22714774 -- https://malwiki.org/index.php?title=DigiPop.xp -- https://www.trendmicro.com/vinfo/be/threat-encyclopedia/search/js_noclose.e/2 -tags: - analytic_story: - - Ransomware - - Windows Registry Abuse - asset_type: Endpoint - confidence: 70 - impact: 70 - message: Registry modification in "NoLogOff" on $dest$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_disable_memory_crash_dump.yml b/dev/endpoint/windows_disable_memory_crash_dump.yml deleted file mode 100644 index eddabb9a92..0000000000 --- a/dev/endpoint/windows_disable_memory_crash_dump.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Windows Disable Memory Crash Dump -id: 59e54602-9680-11ec-a8a6-acde48001122 -version: 1 -date: '2022-02-25' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies a process that is attempting to disable - the ability on Windows to generate a memory crash dump. This was recently identified - being utilized by HermeticWiper. To disable crash dumps, the value must be set to - 0. This feature is typically modified to perform a memory crash dump when a computer - stops unexpectedly because of a Stop error (also known as a blue screen, system - crash, or bug check). -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000000' - TargetObject: '*\\CurrentControlSet\\Control\\CrashControl\\CrashDumpEnabled' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Filesystem` and `Registry` - node. -known_false_positives: unknown -references: -- https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html -- https://docs.microsoft.com/en-us/troubleshoot/windows-server/performance/memory-dump-file-options -tags: - analytic_story: - - Data Destruction - - Ransomware - - Hermetic Wiper - - Windows Registry Abuse - asset_type: Endpoint - confidence: 100 - impact: 90 - message: A process $process_name$ was identified attempting to disable memory crash - dumps on $dest$. - mitre_attack_id: - - T1485 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_disable_notification_center.yml b/dev/endpoint/windows_disable_notification_center.yml deleted file mode 100644 index 1aff106f83..0000000000 --- a/dev/endpoint/windows_disable_notification_center.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Windows Disable Notification Center -id: 1cd983c8-8fd6-11ec-a09d-acde48001122 -version: 1 -date: '2022-02-17' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following search identifies a modification of registry to disable - the windows notification center feature in a windows host machine. This registry - modification removes notification and action center from the notification area on - the task bar. This modification are seen in RAT malware to cover their tracks upon - downloading other of its component or other payload. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - Registry.registry_value_name: DisableNotificationCenter - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: admin or user may choose to disable this windows features. -references: -- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 80 - impact: 60 - message: The Windows notification center was disabled on $dest$ by $user$. - mitre_attack_id: - - T1112 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 48 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/disable_notif_center/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_disable_shutdown_button_through_registry.yml b/dev/endpoint/windows_disable_shutdown_button_through_registry.yml deleted file mode 100644 index c07a64015d..0000000000 --- a/dev/endpoint/windows_disable_shutdown_button_through_registry.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Windows Disable Shutdown Button Through Registry -id: 55fb2958-9ecd-11ec-a06a-acde48001122 -version: 1 -date: '2022-03-08' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to detect a suspicious registry modification to disable - shutdown button on the logon user. This technique was seen in several malware especially - in ransomware family like killdisk malware variant to make the compromised host - un-useful and hard to remove other registry modification made on the machine that - needs restart to take effect. This windows feature may implement by administrator - in some server where shutdown is critical. In that scenario filter of machine and - users that can modify this registry is needed. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000000' - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\shutdownwithoutlogon' - selection2: - Details: '0x00000001' - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose' - condition: selection1 or selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. -known_false_positives: This windows feature may implement by administrator in some - server where shutdown is critical. In that scenario filter of machine and users - that can modify this registry is needed. -references: -- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.msil.screenlocker.a/ -tags: - analytic_story: - - Ransomware - - Windows Registry Abuse - asset_type: Endpoint - confidence: 70 - impact: 70 - message: Registry modification in "shutdownwithoutlogon" on $dest$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_disable_windows_group_policy_features_through_registry.yml b/dev/endpoint/windows_disable_windows_group_policy_features_through_registry.yml deleted file mode 100644 index 7a9ec14244..0000000000 --- a/dev/endpoint/windows_disable_windows_group_policy_features_through_registry.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Windows Disable Windows Group Policy Features Through Registry -id: 63a449ae-9f04-11ec-945e-acde48001122 -version: 1 -date: '2022-03-08' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to detect a suspicious registry modification to disable - windows features. These techniques are seen in several ransomware malware to impair - the compromised host to make it hard for analyst to mitigate or response from the - attack. Disabling these known features make the analysis and forensic response more - hard. Disabling these feature is not so common but can still be implemented by the - administrator for security purposes. In this scenario filters for users that are - allowed doing this is needed. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: - - NoDesktop - - NoFind - - NoControlPanel - - NoFileMenu - - NoSetTaskbar - - NoTrayContextMenu - - TaskbarLockAll - - NoThemesTab - - NoPropertiesMyDocuments - - NoVisualStyleChoice - - NoColorChoice - - NoPropertiesMyDocuments - TargetObject: - - '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*' - - '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*' - Details: '0x00000001' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. -known_false_positives: unknown -references: -- https://hybrid-analysis.com/sample/ef1c427394c205580576d18ba68d5911089c7da0386f19d1ca126929d3e671ab?environmentId=120&lang=en -- https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Krotten-N/detailed-analysis -- https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details -tags: - analytic_story: - - Ransomware - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 70 - impact: 70 - message: Registry modification to disable windows features on $dest$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_disableantispyware_registry.yml b/dev/endpoint/windows_disableantispyware_registry.yml deleted file mode 100644 index 6218452336..0000000000 --- a/dev/endpoint/windows_disableantispyware_registry.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Windows DisableAntiSpyware Registry -id: 23150a40-9301-4195-b802-5bb4f43067fb -version: 2 -date: '2021-03-02' -author: Rod Soto, Jose Hernandez, Michael Haag, Splunk -status: production -type: TTP -description: The search looks for the Registry Key DisableAntiSpyware set to disable. - This is consistent with Ryuk infections across a fleet of endpoints. This particular - behavior is typically executed when an ransomware actor gains access to an endpoint - and beings to perform execution. Usually, a batch (.bat) will be executed and multiple - registry and scheduled task modifications will occur. During triage, review parallel - processes and identify any further file modifications. Endpoint should be isolated. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - Registry.registry_value_name: DisableAntiSpyware - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. -known_false_positives: It is unusual to turn this feature off a Windows system since - it is a default security control, although it is not rare for some policies to disable - it. Although no false positives have been identified, use the provided filter macro - to tune the search. -references: -- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ -tags: - analytic_story: - - Ryuk Ransomware - - Windows Defense Evasion Tactics - - Windows Registry Abuse - - Azorult - - CISA AA22-264A - asset_type: Endpoint - confidence: 80 - impact: 30 - message: Windows DisableAntiSpyware registry key set to 'disabled' on $dest$ - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 24 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_diskcryptor_usage.yml b/dev/endpoint/windows_diskcryptor_usage.yml deleted file mode 100644 index 42ad231949..0000000000 --- a/dev/endpoint/windows_diskcryptor_usage.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Windows DiskCryptor Usage -id: d56fe0c8-4650-11ec-a8fa-acde48001122 -version: 1 -date: '2021-11-15' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following analytic identifies DiskCryptor process name of dcrypt.exe - or internal name dcinst.exe. This utility has been utilized by adversaries to encrypt - disks manually during an operation. In addition, during install, a dcrypt.sys driver - is installed and requires a reboot in order to take effect. There are no command-line - arguments used. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: dcinst.exe - selection2: - Image|endswith: dcrypt.exe - condition: (selection1 or selection2) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: It is possible false positives may be present based on the - internal name dcinst.exe, filter as needed. It may be worthy to alert on the service - name. -references: -- https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/ -- https://github.com/DavidXanatos/DiskCryptor -tags: - analytic_story: - - Ransomware - asset_type: Endpoint - confidence: 50 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to encrypt disks. - mitre_attack_id: - - T1486 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/dcrypt/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_diskshadow_proxy_execution.yml b/dev/endpoint/windows_diskshadow_proxy_execution.yml deleted file mode 100644 index 8cb6eaa350..0000000000 --- a/dev/endpoint/windows_diskshadow_proxy_execution.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Windows Diskshadow Proxy Execution -id: 58adae9e-8ea3-11ec-90f6-acde48001122 -version: 1 -date: '2022-02-15' -author: Lou Stella, Splunk -status: production -type: TTP -description: DiskShadow.exe is a Microsoft Signed binary present on Windows Server. - It has a scripting mode intended for complex scripted backup operations. This feature - also allows for execution of arbitrary unsigned code. This analytic looks for the - usage of the scripting mode flags in executions of DiskShadow. During triage, compare - to known backup behavior in your environment and then review the scripts called - by diskshadow. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: diskshadow.exe - selection2: - Image|endswith: diskshadow.exe - selection3: - CommandLine: - - '*-s*' - - '*/s*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on processes that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,confirm - the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint - product. -known_false_positives: Administrators using the DiskShadow tool in their infrastructure - as a main backup tool with scripts will cause false positives that can be filtered - with `windows_diskshadow_proxy_execution_filter` -references: -- https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/ -tags: - analytic_story: - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 70 - message: Possible Signed Binary Proxy Execution on $dest$ - mitre_attack_id: - - T1218 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/diskshadow/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_dism_remove_defender.yml b/dev/endpoint/windows_dism_remove_defender.yml deleted file mode 100644 index 9ac9c1e439..0000000000 --- a/dev/endpoint/windows_dism_remove_defender.yml +++ /dev/null @@ -1,73 +0,0 @@ -name: Windows DISM Remove Defender -id: 8567da9e-47f0-11ec-99a9-acde48001122 -version: 1 -date: '2021-11-17' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the use of the Windows Disk Image Utility, - `dism.exe`, to remove Windows Defender. Adversaries may use `dism.exe` to disable - Defender before completing their objective. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: dism.exe - selection2: - CommandLine: '*/disable-feature*' - selection3: - CommandLine: '*/online*' - selection4: - CommandLine: '*Windows-Defender*' - selection5: - CommandLine: '*/remove*' - condition: selection1 and selection2 and selection3 and selection4 and selection5 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Some legitimate administrative tools leverage `dism.exe` to - manipulate packages and features of the operating system. Filter as needed. -references: -- https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/ -tags: - analytic_story: - - Windows Defense Evasion Tactics - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to disable Windows Defender. - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: access -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_dism.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_dll_search_order_hijacking_hunt.yml b/dev/endpoint/windows_dll_search_order_hijacking_hunt.yml deleted file mode 100644 index d177f63d71..0000000000 --- a/dev/endpoint/windows_dll_search_order_hijacking_hunt.yml +++ /dev/null @@ -1,76 +0,0 @@ -name: Windows DLL Search Order Hijacking Hunt -id: 79c7d0fc-60c7-41be-a616-ccda752efe89 -version: 1 -date: '2022-08-18' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following hunting analytic is an experimental query built against - a accidental feature using the latest Sysmon TA 3.0 (https://splunkbase.splunk.com/app/5709/) - which maps the module load (ImageLoaded) to process_name. This analytic will deprecate - once this is fixed. This hunting analytic identifies known libraries in Windows - that may be used in a DLL search order hijack or DLL Sideloading setting. This may - require recompiling the DLL, moving the DLL or moving the vulnerable process. The - query looks for any running out of system32 or syswow64. Some libraries natively - run out of other application paths and will need to be added to the exclusion as - needed. The lookup is comprised of Microsoft native libraries identified within - the Hijacklibs.net project. -data_source: -- Sysmon Event ID 1 -search: - selection1: - User: unknown - Computer: unknown - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. This may only with with Sysmon data and the Sysmon TA. Your mileage - may vary. -known_false_positives: False positives will be present based on paths. Filter or add - other paths to the exclusion as needed. -references: -- https://hijacklibs.net -tags: - analytic_story: - - Living Off The Land - - Windows Defense Evasion Tactics - asset_type: Endpoint - confidence: 10 - impact: 10 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to perform DLL search order hijacking. - mitre_attack_id: - - T1574.001 - - T1574 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 1 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml b/dev/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml deleted file mode 100644 index dd61616c75..0000000000 --- a/dev/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Windows DLL Search Order Hijacking with iscsicpl -id: f39ee679-3b1e-4f47-841c-5c3c580acda2 -version: 1 -date: '2022-07-29' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies a recently disclosed search ordler - DLL hijack in iscsicpl.exe. The malicious DLL must be in a new path and iscsicpl.exe, - upon load, will execute the payload. The analytic is restricted to Windows shells. - Two proof of concepts were identified and utilized to determine the behavior. The - command-line is an option to go after, but most likely identifying a child process - off iscsicpl.exe will be more effective. Monitoring for suspicious DLL loads is - also an option. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: iscsicpl.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present, filtering may be required. - Remove the Windows Shells macro to determine if other utilities are using iscsicpl.exe. -references: -- https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC -- https://github.com/422926799/csplugin/tree/master/bypassUAC -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Living Off The Land - asset_type: Endpoint - confidence: 80 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to elevate access. - mitre_attack_id: - - T1574.001 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/iscsicpl/iscsicpl-windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_dll_side_loading_process_child_of_calc.yml b/dev/endpoint/windows_dll_side_loading_process_child_of_calc.yml deleted file mode 100644 index 7e358727fc..0000000000 --- a/dev/endpoint/windows_dll_side_loading_process_child_of_calc.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Windows DLL Side-Loading Process Child Of Calc -id: 295ca9ed-e97b-4520-90f7-dfb6469902e1 -version: 1 -date: '2022-10-20' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies the suspicious child process of calc.exe - due to dll side loading technique to execute another executable. This technique - was seen in qakbot malware that uses dll side loading technique to calc applications - to load its malicious dll code. The malicious dll that abuses dll side loading technique - will load the actual qakbot loader dll using regsvr32.exe application. This TTP - is a good indicator of qakbot since the calc.exe will not load other child processes - aside from win32calc.exe. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: win32calc.exe - ParentImage: calc.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: unknown -references: -- https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot -tags: - analytic_story: - - Qakbot - asset_type: Endpoint - confidence: 90 - impact: 90 - message: calc.exe has a child process $process_name$ in $dest$ - mitre_attack_id: - - T1574.002 - - T1574 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 81 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_execute_arbitrary_commands_with_msdt.yml b/dev/endpoint/windows_execute_arbitrary_commands_with_msdt.yml deleted file mode 100644 index 0fb7cc701a..0000000000 --- a/dev/endpoint/windows_execute_arbitrary_commands_with_msdt.yml +++ /dev/null @@ -1,84 +0,0 @@ -name: Windows Execute Arbitrary Commands with MSDT -id: e1d5145f-38fe-42b9-a5d5-457796715f97 -version: 3 -date: '2022-06-29' -author: Michael Haag, Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies a recently disclosed arbitraty command - execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample - identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve - a remote payload. During triage, review file modifications for html. Identify parallel - process execution that may be related, including an Office Product. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*msdt*' - - '*ms-msdt:*' - - '*ms-msdt:/id*' - - '*ms-msdt:-id*' - - '*/id*' - Image|endswith: msdt.exe - selection2: - CommandLine: '*IT_BrowseForFile=' - selection3: - CommandLine: '*IT_RebrowseForFile=' - condition: selection1 and selection2 or selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present, filter as needed. Added .xml - to potentially capture any answer file usage. Remove as needed. -references: -- https://isc.sans.edu/diary/rss/28694 -- https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e -- https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A -- https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ -- https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection -- https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html -tags: - analytic_story: - - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190 - asset_type: Endpoint - confidence: 100 - cve: - - CVE-2022-30190 - impact: 100 - message: A parent process $parent_process_name$ has spawned a child process $process_name$ - on host $dest$ possibly indicative of indirect command execution. - mitre_attack_id: - - T1218 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 100 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_file_without_extension_in_critical_folder.yml b/dev/endpoint/windows_file_without_extension_in_critical_folder.yml deleted file mode 100644 index 04fbd4cd19..0000000000 --- a/dev/endpoint/windows_file_without_extension_in_critical_folder.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Windows File Without Extension In Critical Folder -id: 0dbcac64-963c-11ec-bf04-acde48001122 -version: 1 -date: '2022-02-25' -author: Teoderick Contreras, Bhavin Patel, Splunk -status: production -type: TTP -description: This analytic is to look for suspicious file creation in the critical - folder like "System32\Drivers" folder without file extension. This artifacts was - seen in latest hermeticwiper where it drops its driver component in Driver Directory - both the compressed(without file extension) and the actual driver component (with - .sys file extension). This TTP is really a good indication that a host might be - compromised by this destructive malware that wipes the boot sector of the system. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: - - '*\\System32\\drivers\\*' - - '*\\syswow64\\drivers\\*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Filesystem` node. -known_false_positives: Unknown at this point -references: -- https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html -tags: - analytic_story: - - Data Destruction - - Hermetic Wiper - asset_type: Endpoint - confidence: 100 - impact: 90 - message: Driver file with out file extension drop in $file_path$ in $dest$ - mitre_attack_id: - - T1485 - observable: - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_hide_notification_features_through_registry.yml b/dev/endpoint/windows_hide_notification_features_through_registry.yml deleted file mode 100644 index 4254416ae5..0000000000 --- a/dev/endpoint/windows_hide_notification_features_through_registry.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Windows Hide Notification Features Through Registry -id: cafa4bce-9f06-11ec-a7b2-acde48001122 -version: 1 -date: '2022-03-08' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to detect a suspicious registry modification to hide - common windows notification feature from compromised host. This technique was seen - in some ransomware family to add more impact to its payload that are visually seen - by user aside from the encrypted files and ransomware notes. Even this a good anomaly - detection, administrator may implement this changes for auditing or security reason. - In this scenario filter is needed. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: - - HideClock - - HideSCAHealth - - HideSCANetwork - - HideSCAPower - - HideSCAVolume - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*' - Details: '0x00000001' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. -known_false_positives: unknown -references: -- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Ransom.Win32.ONALOCKER.A/ -tags: - analytic_story: - - Ransomware - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 70 - impact: 70 - message: Registry modification to hide windows notification on $dest$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml b/dev/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml deleted file mode 100644 index 7d85516b02..0000000000 --- a/dev/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Windows Impair Defense Delete Win Defender Context Menu -id: 395ed5fe-ad13-4366-9405-a228427bdd91 -version: 1 -date: '2022-06-07' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: The search looks for the deletion of Windows Defender context menu within - the registry. This is consistent behavior with RAT malware across a fleet of endpoints. - This particular behavior is executed when an adversary gains access to an endpoint - and begins to perform execution. Usually, a batch (.bat) will be executed and multiple - registry and scheduled task modifications will occur. During triage, review parallel - processes and identify any further file modifications. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.action: deleted - TargetObject: '*\\shellex\\ContextMenuHandlers\\EPP' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. -known_false_positives: It is unusual to turn this feature off a Windows system since - it is a default security control, although it is not rare for some policies to disable - it. Although no false positives have been identified, use the provided filter macro - to tune the search. -references: -- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ -- https://app.any.run/tasks/45f5d114-91ea-486c-ab01-41c4093d2861/ -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 50 - impact: 50 - message: Windows Defender context menu registry key deleted on $dest$. - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml b/dev/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml deleted file mode 100644 index 22962145ac..0000000000 --- a/dev/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Windows Impair Defense Delete Win Defender Profile Registry -id: 65d4b105-ec52-48ec-ac46-289d0fbf7d96 -version: 1 -date: '2022-06-07' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The search looks for the deletion of Windows Defender main profile within - the registry. This was used by RAT malware across a fleet of endpoints. This particular - behavior is typically executed when an adversary gains access to an endpoint and - beings to perform execution. Usually, a batch (.bat) will be executed and multiple - registry and scheduled task modifications will occur. During triage, review parallel - processes and identify any further file modifications. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.action: deleted - TargetObject: '*\\Policies\\Microsoft\\Windows Defender' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. -known_false_positives: It is unusual to turn this feature off a Windows system since - it is a default security control, although it is not rare for some policies to disable - it. Although no false positives have been identified, use the provided filter macro - to tune the search. -references: -- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ -- https://app.any.run/tasks/45f5d114-91ea-486c-ab01-41c4093d2861/ -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 80 - impact: 80 - message: Windows Defender Logger registry key set to 'disabled' on $dest$. - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml b/dev/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml deleted file mode 100644 index 53b8f9b82f..0000000000 --- a/dev/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Windows Impair Defense Deny Security Software With Applocker -id: e0b6ca60-9e29-4450-b51a-bba0abae2313 -version: 1 -date: '2022-06-24' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies a modification in the Windows registry - by the Applocker utility that contains details or registry data values related to - denying the execution of several security products. This technique was seen in Azorult - malware where it drops an xml Applocker policy that will deny several AV products - and then loaded by using PowerShell Applocker commandlet. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: '*}Machine\\Software\\Policies\\Microsoft\\Windows\\SrpV2*' - selection2: - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy Objects\\*' - selection3: - Details: '*Action\=' - TargetObject: '*\\Software\\Policies\\Microsoft\\Windows\\SrpV2*' - condition: (selection1 and selection2) or selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: False positives may be present based on organization use of - Applocker. Filter as needed. -references: -- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ -- https://www.microsoftpressstore.com/articles/article.aspx?p=2228450&seqNum=11 -tags: - analytic_story: - - Azorult - asset_type: Endpoint - confidence: 100 - impact: 100 - message: Applocker registry modification to deny the action of several AV products - on $dest$. - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 100 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml b/dev/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml deleted file mode 100644 index 7668d814f3..0000000000 --- a/dev/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Windows Impair Defenses Disable Win Defender Auto Logging -id: 76406a0f-f5e0-4167-8e1f-337fdc0f1b0c -version: 1 -date: '2022-06-07' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The search looks for the Registry Key DefenderApiLogger or DefenderAuditLogger - set to disable. This is consistent with RAT malware across a fleet of endpoints. - This particular behavior is typically executed when an adversary gains access to - an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed - and multiple registry and scheduled task modifications will occur. During triage, - review parallel processes and identify any further file modifications. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000000' - TargetObject: - - '*WMI\\Autologger\\DefenderAuditLogger\\Start' - - '*WMI\\Autologger\\DefenderApiLogger\\Start' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. -known_false_positives: It is unusual to turn this feature off a Windows system since - it is a default security control, although it is not rare for some policies to disable - it. Although no false positives have been identified, use the provided filter macro - to tune the search. -references: -- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ -- https://app.any.run/tasks/45f5d114-91ea-486c-ab01-41c4093d2861/ -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 80 - impact: 30 - message: Windows Defender Logger registry key set to 'disabled' on $dest$. - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 24 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable_defender_logging/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_indirect_command_execution_via_forfiles.yml b/dev/endpoint/windows_indirect_command_execution_via_forfiles.yml deleted file mode 100644 index cad33e42ae..0000000000 --- a/dev/endpoint/windows_indirect_command_execution_via_forfiles.yml +++ /dev/null @@ -1,53 +0,0 @@ -name: Windows Indirect Command Execution Via forfiles -id: 1fdf31c9-ff4d-4c48-b799-0e8666e08787 -version: 1 -date: '2022-04-05' -author: Eric McGinnis, Splunk -status: production -type: TTP -description: The following analytic detects programs that have been started by forfiles.exe. - According to Microsoft, the 'The forfiles command lets you run a command on or pass - arguments to multiple files'. While this tool can be used to start legitimate programs, - usually within the context of a batch script, it has been observed being used to - evade protections on command line execution. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentCommandLine: '*forfiles* /c *' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the full process path in the process field of CIM's Process data model. - If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. - Tune and filter known instances where forfiles.exe may be used. -known_false_positives: Some legacy applications may be run using pcalua.exe. Similarly, - forfiles.exe may be used in legitimate batch scripts. Filter these results as needed. -references: -- https://twitter.com/KyleHanslovan/status/912659279806640128 -- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/forfiles -tags: - analytic_story: - - Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 50 - message: The Program Compatability Assistant (pcalua.exe) launched the process $process_name$ - mitre_attack_id: - - T1202 - observable: - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_indirect_command_execution_via_pcalua.yml b/dev/endpoint/windows_indirect_command_execution_via_pcalua.yml deleted file mode 100644 index 0a88c6e008..0000000000 --- a/dev/endpoint/windows_indirect_command_execution_via_pcalua.yml +++ /dev/null @@ -1,52 +0,0 @@ -name: Windows Indirect Command Execution Via pcalua -id: 3428ac18-a410-4823-816c-ce697d26f7a8 -version: 1 -date: '2022-04-05' -author: Eric McGinnis, Splunk -status: production -type: TTP -description: The following analytic detects programs that have been started by pcalua.exe. - pcalua.exe is the Microsoft Windows Program Compatability Assistant. While this - tool can be used to start legitimate programs, it has been observed being used to - evade protections on command line execution. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentCommandLine: '*pcalua* -a*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the full process path in the process field of CIM's Process data model. - If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. - Tune and filter known instances where pcalua.exe may be used. -known_false_positives: Some legacy applications may be run using pcalua.exe. Filter - these results as needed. -references: -- https://twitter.com/KyleHanslovan/status/912659279806640128 -- https://lolbas-project.github.io/lolbas/Binaries/Pcalua/ -tags: - analytic_story: - - Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 50 - message: The Program Compatability Assistant (pcalua.exe) launched the process $process_name$ - mitre_attack_id: - - T1202 - observable: - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_information_discovery_fsutil.yml b/dev/endpoint/windows_information_discovery_fsutil.yml deleted file mode 100644 index 6e3a85c9d3..0000000000 --- a/dev/endpoint/windows_information_discovery_fsutil.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Windows Information Discovery Fsutil -id: 2181f261-93e6-4166-a5a9-47deac58feff -version: 1 -date: '2022-11-30' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: The following analytic identifies a process execution of Windows OS built-in - tool FSUTIL to discover file system information. This tool is being abused or used - by several adversaries or threat actor to query/list all drives, drive type, volume - information or volume statistics by using the FSINFO parameter of this tool. This - technique was seen in WINPEAS post exploitation tool that is being used by ransomware - prestige to gain privilege and persistence to the targeted host. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*fsinfo*' - OriginalFileName: fsutil.exe - selection2: - Image|endswith: fsutil.exe - condition: selection1 or selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. -known_false_positives: unknown -references: -- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 30 - impact: 30 - message: process $process_name$ with commandline $process$ is executed in $dest$ - mitre_attack_id: - - T1082 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_fsutil/fsutil-fsinfo-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_ingress_tool_transfer_using_explorer.yml b/dev/endpoint/windows_ingress_tool_transfer_using_explorer.yml deleted file mode 100644 index 23ea660351..0000000000 --- a/dev/endpoint/windows_ingress_tool_transfer_using_explorer.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Windows Ingress Tool Transfer Using Explorer -id: 76753bab-f116-4ea3-8fb9-89b638be58a9 -version: 2 -date: '2022-08-30' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic identifies the Windows Explorer process with a - URL within the command-line. Explorer.exe is known Windows process that handles - start menu, taskbar, desktop and file manager. Many adversaries abuse this process, - like DCRat malware, where it attempts to open the URL with the default browser application - on the target host by putting the URL as a parameter on explorer.exe process. This - anomaly detection might be a good pivot to check which user and how this process - was executed, what is the parent process and what is the URL link. This technique - is not commonly used to open an URL. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: explorer.exe - selection2: - Image|endswith: explorer.exe - condition: (selection1 or selection2) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present based on legitimate applications - or third party utilities. Filter out any additional parent process names. -references: -- https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor -tags: - analytic_story: - - DarkCrystal RAT - asset_type: Endpoint - confidence: 50 - impact: 50 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to download a remote payload. - mitre_attack_id: - - T1105 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/dcrat_explorer_url/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_installutil_in_non_standard_path.yml b/dev/endpoint/windows_installutil_in_non_standard_path.yml deleted file mode 100644 index fe88972aa0..0000000000 --- a/dev/endpoint/windows_installutil_in_non_standard_path.yml +++ /dev/null @@ -1,78 +0,0 @@ -name: Windows InstallUtil in Non Standard Path -id: dcf74b22-7933-11ec-857c-acde48001122 -version: 1 -date: '2022-01-19' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the Windows binary InstallUtil.exe - running from a non-standard location. The analytic utilizes a macro for InstallUtil - and identifies both the process_name and original_file_name. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: InstallUtil.exe - selection2: - Image|endswith: installutil.exe - condition: (selection1 or selection2) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present and filtering may be required. - Certain utilities will run from non-standard paths based on the third-party application - in use. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml -- https://attack.mitre.org/techniques/T1036/003/ -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md -tags: - analytic_story: - - Masquerading - Rename System Utilities - - Unusual Processes - - Ransomware - - Signed Binary Proxy Execution InstallUtil - - WhisperGate - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ from a non-standard - path was identified on endpoint $dest$ by user $user$. - mitre_attack_id: - - T1036 - - T1036.003 - - T1218 - - T1218.004 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon_installutil_path.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_installutil_remote_network_connection.yml b/dev/endpoint/windows_installutil_remote_network_connection.yml deleted file mode 100644 index 70f10ed4a7..0000000000 --- a/dev/endpoint/windows_installutil_remote_network_connection.yml +++ /dev/null @@ -1,80 +0,0 @@ -name: Windows InstallUtil Remote Network Connection -id: 4fbf9270-43da-11ec-9486-acde48001122 -version: 2 -date: '2022-03-16' -author: Michael Haag, Splunk -status: production -type: TTP -description: 'The following analytic identifies the Windows InstallUtil.exe binary - making a remote network connection. This technique may be used to download and execute - code while bypassing application control. - - When `InstallUtil.exe` is used in a malicous manner, the path to an executable on - the filesystem is typically specified. Take note of the parent process. In a suspicious - instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` - or `Explorer.exe`. - - If used by a developer, typically this will be found with multiple command-line - switches/arguments and spawn from Visual Studio. - - During triage review resulting network connections, file modifications, and parallel - processes. Capture any artifacts and review further.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: InstallUtil.exe - selection2: - Image|endswith: installutil.exe - condition: (selection1 or selection2) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node. - In addition, confirm the latest CIM App 4.20 or higher is installed and the latest - TA for the endpoint product. -known_false_positives: Limited false positives should be present as InstallUtil is - not typically used to download remote files. Filter as needed based on Developers - requirements. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md -tags: - analytic_story: - - Signed Binary Proxy Execution InstallUtil - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ generating a remote download. - mitre_attack_id: - - T1218.004 - - T1218 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_installutil_uninstall_option.yml b/dev/endpoint/windows_installutil_uninstall_option.yml deleted file mode 100644 index 051f1afc44..0000000000 --- a/dev/endpoint/windows_installutil_uninstall_option.yml +++ /dev/null @@ -1,89 +0,0 @@ -name: Windows InstallUtil Uninstall Option -id: cfa7b9ac-43f0-11ec-9b48-acde48001122 -version: 1 -date: '2021-11-12' -author: Michael Haag, Splunk -status: production -type: TTP -description: 'The following analytic identifies the Windows InstallUtil.exe binary. - This will execute code while bypassing application control using the `/u` (uninstall) - switch. - - InstallUtil uses the functions install and uninstall within the System.Configuration.Install - namespace to process .net assembly. Install function requires admin privileges, - however, uninstall function can be run as an unprivileged user. - - When `InstallUtil.exe` is used in a malicous manner, the path to an executable on - the filesystem is typically specified. Take note of the parent process. In a suspicious - instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` - or `Explorer.exe`. - - If used by a developer, typically this will be found with multiple command-line - switches/arguments and spawn from Visual Studio. - - During triage review resulting network connections, file modifications, and parallel - processes. Capture any artifacts and review further.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: InstallUtil.exe - selection2: - Image|endswith: installutil.exe - selection3: - CommandLine: - - '*/u*' - - '*uninstall*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives should be present. Filter as needed - by parent process or application. -references: -- https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12 -- https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/md/Installutil.exe.md -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md -tags: - analytic_story: - - Signed Binary Proxy Execution InstallUtil - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ performing an uninstall. - mitre_attack_id: - - T1218.004 - - T1218 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_installutil_uninstall_option_with_network.yml b/dev/endpoint/windows_installutil_uninstall_option_with_network.yml deleted file mode 100644 index a98f9eae25..0000000000 --- a/dev/endpoint/windows_installutil_uninstall_option_with_network.yml +++ /dev/null @@ -1,90 +0,0 @@ -name: Windows InstallUtil Uninstall Option with Network -id: 1a52c836-43ef-11ec-a36c-acde48001122 -version: 2 -date: '2022-03-16' -author: Michael Haag, Splunk -status: production -type: TTP -description: 'The following analytic identifies the Windows InstallUtil.exe binary - making a remote network connection. This technique may be used to download and execute - code while bypassing application control using the `/u` (uninstall) switch. - - InstallUtil uses the functions install and uninstall within the System.Configuration.Install - namespace to process .net assembly. Install function requires admin privileges, - however, uninstall function can be run as an unprivileged user. - - When `InstallUtil.exe` is used in a malicous manner, the path to an executable on - the filesystem is typically specified. Take note of the parent process. In a suspicious - instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` - or `Explorer.exe`. - - If used by a developer, typically this will be found with multiple command-line - switches/arguments and spawn from Visual Studio. - - During triage review resulting network connections, file modifications, and parallel - processes. Capture any artifacts and review further.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: InstallUtil.exe - selection2: - Image|endswith: installutil.exe - selection3: - CommandLine: - - '*/u*' - - '*uninstall*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node. - In addition, confirm the latest CIM App 4.20 or higher is installed and the latest - TA for the endpoint product. -known_false_positives: Limited false positives should be present as InstallUtil is - not typically used to download remote files. Filter as needed based on Developers - requirements. -references: -- https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12 -- https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/md/Installutil.exe.md -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md -tags: - analytic_story: - - Signed Binary Proxy Execution InstallUtil - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ performing an uninstall. - mitre_attack_id: - - T1218.004 - - T1218 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_installutil_url_in_command_line.yml b/dev/endpoint/windows_installutil_url_in_command_line.yml deleted file mode 100644 index 2d60e59d71..0000000000 --- a/dev/endpoint/windows_installutil_url_in_command_line.yml +++ /dev/null @@ -1,85 +0,0 @@ -name: Windows InstallUtil URL in Command Line -id: 28e06670-43df-11ec-a569-acde48001122 -version: 1 -date: '2021-11-12' -author: Michael Haag, Splunk -status: production -type: TTP -description: 'The following analytic identifies the Windows InstallUtil.exe binary - passing a HTTP request on the command-line. This technique may be used to download - and execute code while bypassing application control. - - When `InstallUtil.exe` is used in a malicous manner, the path to an executable on - the filesystem is typically specified. Take note of the parent process. In a suspicious - instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` - or `Explorer.exe`. - - If used by a developer, typically this will be found with multiple command-line - switches/arguments and spawn from Visual Studio. - - During triage review resulting network connections, file modifications, and parallel - processes. Capture any artifacts and review further.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: InstallUtil.exe - selection2: - Image|endswith: installutil.exe - selection3: - CommandLine: - - '*http://*' - - '*https://*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives should be present as InstallUtil is - not typically used to download remote files. Filter as needed based on Developers - requirements. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md -- https://gist.github.com/DanielRTeixeira/0fd06ec8f041f34a32bf5623c6dd479d -tags: - analytic_story: - - Signed Binary Proxy Execution InstallUtil - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ passing a URL on the command-line. - mitre_attack_id: - - T1218.004 - - T1218 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_iso_lnk_file_creation.yml b/dev/endpoint/windows_iso_lnk_file_creation.yml deleted file mode 100644 index bb72102d92..0000000000 --- a/dev/endpoint/windows_iso_lnk_file_creation.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Windows ISO LNK File Creation -id: d7c2c09b-9569-4a9e-a8b6-6a39a99c1d32 -version: 2 -date: '2022-09-19' -author: Michael Haag, Teoderick Contreras, Splunk -status: production -type: Hunting -description: The following analytic identifies the use of a delivered ISO file that - has been mounted and the afformention lnk or file opened within it. When the ISO - file is opened, the files are saved in the %USER%\AppData\Local\Temp\\ path. The analytic identifies .iso.lnk written to the path. The name of the - ISO file is prepended. -data_source: -- Sysmon Event ID 11 -search: - selection1: - Filesystem.file_name: - - '*.iso.lnk' - - '*.img.lnk' - - '*.vhd.lnk' - - '*vhdx.lnk' - TargetFilename: '*\\Microsoft\\Windows\\Recent\\*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be high depending on the environment and - consistent use of ISOs mounting. Restrict to servers, or filter out based on commonly - used ISO names. Filter as needed. -references: -- https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/ -- https://github.com/MHaggis/notes/blob/master/utilities/ISOBuilder.ps1 -- https://isc.sans.edu/diary/Recent+AZORult+activity/25120 -- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html -tags: - analytic_story: - - Spearphishing Attachments - - Brute Ratel C4 - - AgentTesla - - Qakbot - - IcedID - - Azorult - - Remcos - asset_type: Endpoint - confidence: 50 - impact: 80 - message: An ISO file was mounted on $dest$ and should be reviewed and filtered as - needed. - mitre_attack_id: - - T1566.001 - - T1566 - - T1204.001 - - T1204 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 40 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.001/atomic_red_team/iso_windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_java_spawning_shells.yml b/dev/endpoint/windows_java_spawning_shells.yml deleted file mode 100644 index 7ed05c1314..0000000000 --- a/dev/endpoint/windows_java_spawning_shells.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Windows Java Spawning Shells -id: 28c81306-5c47-11ec-bfea-acde48001122 -version: 1 -date: '2021-12-13' -author: Michael Haag, Splunk -status: experimental -type: TTP -description: The following analytic identifies the process name of java.exe and w3wp.exe - spawning a Windows shell. This is potentially indicative of exploitation of the - Java application and may be related to current event CVE-2021-44228 (Log4Shell). - The shells included in the macro are "cmd.exe", "powershell.exe". Upon triage, review - parallel processes and command-line arguments to determine legitimacy. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - java.exe - - w3wp.exe - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. Restrict the analytic to publicly facing endpoints to reduce false positives. - Add any additional identified web application process name to the query. Add any - further Windows process names to the macro (ex. LOLBins) to further expand this - query. -known_false_positives: Filtering may be required on internal developer build systems - or classify assets as web facing and restrict the analytic based on that. -references: -- https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/ -- https://gist.github.com/olafhartong/916ebc673ba066537740164f7e7e1d72 -tags: - analytic_story: - - Log4Shell CVE-2021-44228 - asset_type: Endpoint - confidence: 50 - cve: - - CVE-2021-44228 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ spawning a Windows shell, potentially indicative of exploitation. - mitre_attack_id: - - T1190 - - T1133 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 40 - security_domain: endpoint diff --git a/dev/endpoint/windows_masquerading_explorer_as_child_process.yml b/dev/endpoint/windows_masquerading_explorer_as_child_process.yml deleted file mode 100644 index 598662430e..0000000000 --- a/dev/endpoint/windows_masquerading_explorer_as_child_process.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Windows Masquerading Explorer As Child Process -id: 61490da9-52a1-4855-a0c5-28233c88c481 -version: 1 -date: '2022-10-20' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies a suspicious parent process of explorer.exe. - Explorer is usually executed by userinit.exe that will exit after execution that - causes the main explorer.exe no parent process. Some malware like qakbot spawn another - explorer.exe to inject its code. This TTP detection is a good indicator that a process - spawning explorer.exe might inject code or masquerading its parent child process - to evade detections. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: explorer.exe - ParentImage: - - cmd.exe - - powershell.exe - - regsvr32.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: unknown -references: -- https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot -tags: - analytic_story: - - Qakbot - asset_type: Endpoint - confidence: 90 - impact: 90 - message: explorer.exe hash a suspicious parent process $parent_process_name$ in - $dest$ - mitre_attack_id: - - T1574.002 - - T1574 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 81 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_mimikatz_binary_execution.yml b/dev/endpoint/windows_mimikatz_binary_execution.yml deleted file mode 100644 index 07ccefde0a..0000000000 --- a/dev/endpoint/windows_mimikatz_binary_execution.yml +++ /dev/null @@ -1,76 +0,0 @@ -name: Windows Mimikatz Binary Execution -id: a9e0d6d3-9676-4e26-994d-4e0406bb4467 -version: 1 -date: '2022-11-16' -author: Michael Haag, Splunk -status: production -type: TTP -description: As simple as it sounds, this analytic identifies when the native mimikatz.exe - binary executes on Windows. It does look for the original file name as well, just - in case the binary is renamed. Adversaries sometimes bring in the default binary - and run it directly. Benjamin Delpy originally created Mimikatz as a proof of concept - to show Microsoft that its authentication protocols were vulnerable to an attack. - Instead, he inadvertently created one of the most widely used and downloaded threat - actor tools of the past 20 years. Mimikatz is an open-source application that allows - users to view and save authentication credentials such as Kerberos tickets. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: mimikatz.exe - selection2: - Image|endswith: mimikatz.exe - condition: (selection1 or selection2) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited as this is directly looking - for Mimikatz, the credential dumping utility. -references: -- https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf -- https://www.varonis.com/blog/what-is-mimikatz -- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF -tags: - analytic_story: - - Credential Dumping - - CISA AA22-320A - - Volt Typhoon - asset_type: Endpoint - confidence: 100 - impact: 100 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting dump credentials. - mitre_attack_id: - - T1003 - observable: - - name: user - type: User - role: - - Victim - - name: Computer - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 100 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/mimikatzwindows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_modify_registry_disable_toast_notifications.yml b/dev/endpoint/windows_modify_registry_disable_toast_notifications.yml deleted file mode 100644 index 5188442594..0000000000 --- a/dev/endpoint/windows_modify_registry_disable_toast_notifications.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Windows Modify Registry Disable Toast Notifications -id: ed4eeacb-8d5a-488e-bc97-1ce6ded63b84 -version: 1 -date: '2022-06-22' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic is to identify a modification in the Windows registry - to disable toast notifications. This Windows Operating System feature is responsible - for alerting or notifying user if application or OS need some updates. Adversaries - and malwares like Azorult abuse this technique to disable important update notification - in compromised host. This anomaly detection is a good pivot to look for further - events related to defense evasion and execution. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000000' - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PushNotifications\\ToastEnabled*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: administrators may enable or disable this feature that may - cause some false positive. -references: -- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp -- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ -tags: - analytic_story: - - Azorult - asset_type: Endpoint - confidence: 70 - impact: 70 - message: the registry for DisallowRun settings was modified to enable in $dest$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml b/dev/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml deleted file mode 100644 index 9056c4522a..0000000000 --- a/dev/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Windows Modify Registry Disable Win Defender Raw Write Notif -id: 0e5e25c3-32f4-46f7-ba4a-5b95c3b90f5b -version: 1 -date: '2022-06-23' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic identifies a modification in the Windows registry - to disable Windows Defender raw write notification feature. This policy controls - whether raw volume write notifications are sent to behavior monitoring or not. This - registry was recently identified in Azorult malware to bypass Windows Defender detections - or behavior monitoring in terms of volume write. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: '*\\Windows Defender\\Real-Time Protection\\DisableRawWriteNotification*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: Administrators may enable or disable this feature that may - cause some false positive. Filter as needed. -references: -- https://admx.help/?Category=SystemCenterEndpointProtection&Policy=Microsoft.Policies.Antimalware::real-time_protection_disablerawwritenotification -- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ -tags: - analytic_story: - - Azorult - asset_type: Endpoint - confidence: 70 - impact: 70 - message: The registry for raw write notification settings was modified to disable - in $dest$. - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml b/dev/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml deleted file mode 100644 index 5ee490f66a..0000000000 --- a/dev/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Windows Modify Registry Disable Windows Security Center Notif -id: 27ed3e79-6d86-44dd-b9ab-524451c97a7b -version: 1 -date: '2022-06-22' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic is to identify a modification in the Windows registry - to disable windows center notifications. This Windows Operating System feature is - responsible for alerting or notifying user if application or OS need some updates. - Adversaries and malwares like Azorult abuse this technique to disable important - update notification in compromised host. This anomaly detection is a good pivot - to look for further events related to defense evasion and execution. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000000' - TargetObject: '*\\Windows\\CurrentVersion\\ImmersiveShell\\UseActionCenterExperience*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: administrators may enable or disable this feature that may - cause some false positive. -references: -- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp -- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ -tags: - analytic_story: - - Azorult - asset_type: Endpoint - confidence: 70 - impact: 70 - message: the registry for security center notification settings was modified to - disable mode in $dest$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_modify_registry_disabling_wer_settings.yml b/dev/endpoint/windows_modify_registry_disabling_wer_settings.yml deleted file mode 100644 index 0536e3687d..0000000000 --- a/dev/endpoint/windows_modify_registry_disabling_wer_settings.yml +++ /dev/null @@ -1,55 +0,0 @@ -name: Windows Modify Registry Disabling WER Settings -id: 21cbcaf1-b51f-496d-a0c1-858ff3070452 -version: 1 -date: '2022-06-22' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies a modification in the Windows registry - to disable Windows error reporting settings. This Windows feature allows the user - to report bugs, errors, failure or problems encountered in specific application - or processes. Adversaries use this technique to hide any error or failure that some - of its malicious components trigger. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\disable*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: Administrators may enable or disable this feature that may - cause some false positive, however is not common. Filter as needed. -references: -- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp -- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ -tags: - analytic_story: - - Azorult - asset_type: Endpoint - confidence: 70 - impact: 70 - message: the registry for WER settings was modified to be disabled on $dest$. - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_modify_registry_disallow_windows_app.yml b/dev/endpoint/windows_modify_registry_disallow_windows_app.yml deleted file mode 100644 index 3ea6d17514..0000000000 --- a/dev/endpoint/windows_modify_registry_disallow_windows_app.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Windows Modify Registry DisAllow Windows App -id: 4bc788d3-c83a-48c5-a4e2-e0c6dba57889 -version: 1 -date: '2022-06-22' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies modification in the Windows registry - to prevent user running specific computer programs that could aid them in manually - removing malware or detecting it using security products. This technique was recently - identified in Azorult malware where it uses this registry value to prevent several - AV products to execute on the compromised host machine. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: Administrators may enable or disable this feature that may - cause some false positive. Filter as needed. -references: -- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ -tags: - analytic_story: - - Azorult - asset_type: Endpoint - confidence: 70 - impact: 70 - message: The registry for DisallowRun settings was modified to enable in $dest$. - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml b/dev/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml deleted file mode 100644 index 60d521f3e9..0000000000 --- a/dev/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Windows Modify Registry Qakbot Binary Data Registry -id: 2e768497-04e0-4188-b800-70dd2be0e30d -version: 1 -date: '2022-11-10' -author: Teoderick Contreras, Bhavin Patel, Splunk -status: production -type: Anomaly -description: The following analytic identifies a suspicious registry entry created - by Qakbot malware as part of its malicious execution. This "Binary Data" Registry was - created by newly spawn explorer.exe where its malicious code is injected to it. - The registry consist of 8 random registry value name with encrypted binary data - on its registry value data. This anomaly detections can be a good pivot for possible - Qakbot malware infection or other malware that uses registry to save or store there - config or malicious code on the registry data stream. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: Binary Data - TargetObject: '*\\SOFTWARE\\Microsoft\\*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: unknown -references: -- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/decrypting-qakbots-encrypted-registry-keys/ -tags: - analytic_story: - - Qakbot - asset_type: Endpoint - confidence: 70 - impact: 70 - message: registry with binary data $registry_path$ created by $process_name$ in - $dest$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot2/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_modify_registry_reg_restore.yml b/dev/endpoint/windows_modify_registry_reg_restore.yml deleted file mode 100644 index 63b91baca8..0000000000 --- a/dev/endpoint/windows_modify_registry_reg_restore.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Windows Modify Registry Reg Restore -id: d0072bd2-6d73-4c1b-bc77-ded6d2da3a4e -version: 1 -date: '2022-12-12' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: The following analytic identifies a process execution of reg.exe with - "restore" parameter. This reg.exe parameter is commonly used to restore registry - backup data in a targeted host. This approach or technique was also seen in post-exploitation - tool like winpeas where it uses "reg save" and "reg restore" to check the registry - modification restriction in targeted host after gaining access to it. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: reg.exe - selection2: - Image|endswith: reg.exe - selection3: - CommandLine: '* restore *' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. -known_false_positives: network administrator can use this command tool to backup registry - before updates or modifying critical registries. -references: -- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/quser -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 30 - impact: 30 - message: execution of process $process_name$ in $dest$ - mitre_attack_id: - - T1012 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_modify_registry_suppress_win_defender_notif.yml b/dev/endpoint/windows_modify_registry_suppress_win_defender_notif.yml deleted file mode 100644 index 47035483ce..0000000000 --- a/dev/endpoint/windows_modify_registry_suppress_win_defender_notif.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Windows Modify Registry Suppress Win Defender Notif -id: e3b42daf-fff4-429d-bec8-2a199468cea9 -version: 1 -date: '2022-06-22' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic is to identify a modification in the Windows registry - to suppress windows defender notification. This technique was abuse by adversaries - and threat actor to bypassed windows defender on the targeted host. Azorult malware - is one of the malware use this technique that also disable toast notification and - other windows features as part of its malicious behavior. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: '*\\Windows Defender\\UX Configuration\\Notification_Suppress*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: administrators may enable or disable this feature that may - cause some false positive. -references: -- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp -- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ -tags: - analytic_story: - - Azorult - asset_type: Endpoint - confidence: 70 - impact: 70 - message: the registry for suppresing windows fdefender notification settings was - modified to disabled in $dest$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/dev/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml deleted file mode 100644 index 736bb71bfb..0000000000 --- a/dev/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Windows Modify Show Compress Color And Info Tip Registry -id: b7548c2e-9a10-11ec-99e3-acde48001122 -version: 1 -date: '2022-03-02' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to look for suspicious registry modification related - to file compression color and information tips. This IOC was seen in hermetic wiper - where it has a thread that will create this registry entry to change the color of - compressed or encrypted files in NTFS file system as well as the pop up information - tips. This is a good indicator that a process tries to modified one of the registry - GlobalFolderOptions related to file compression attribution in terms of color in - NTFS file system. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: - - ShowCompColor - - ShowInfoTip - TargetObject: '*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. -known_false_positives: unknown -references: -- https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html -tags: - analytic_story: - - Data Destruction - - Windows Defense Evasion Tactics - - Hermetic Wiper - - Windows Registry Abuse - asset_type: Endpoint - confidence: 50 - impact: 50 - message: Registry modification in "ShowCompColor" and "ShowInfoTips" on $dest$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/globalfolderoptions_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_mof_event_triggered_execution_via_wmi.yml b/dev/endpoint/windows_mof_event_triggered_execution_via_wmi.yml deleted file mode 100644 index afec810115..0000000000 --- a/dev/endpoint/windows_mof_event_triggered_execution_via_wmi.yml +++ /dev/null @@ -1,83 +0,0 @@ -name: Windows MOF Event Triggered Execution via WMI -id: e59b5a73-32bf-4467-a585-452c36ae10c1 -version: 1 -date: '2022-07-15' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following anaytic identifies MOFComp.exe loading a MOF file. The - Managed Object Format (MOF) compiler parses a file containing MOF statements and - adds the classes and class instances defined in the file to the WMI repository. - Typically, MOFComp.exe does not reach out to the public internet or load a MOF file - from User Profile paths. A filter and consumer is typically registered in WMI. Review - parallel processes and query WMI subscriptions to gather artifacts. The default - path of mofcomp.exe is C:\Windows\System32\wbem. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: mofcomp.exe - ParentImage: - - cmd.exe - - powershell.exe - selection2: - CommandLine: - - '*\\AppData\\Local\\*' - - '*\\Users\\Public\\*' - - '*\\WINDOWS\\Temp\\*' - Image|endswith: mofcomp.exe - condition: selection1 or selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present from automation based applications - (SCCM), filtering may be required. In addition, break the query out based on volume - of usage. Filter process names or f -references: -- https://attack.mitre.org/techniques/T1546/003/ -- https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ -- https://docs.microsoft.com/en-us/windows/win32/wmisdk/mofcomp -- https://pentestlab.blog/2020/01/21/persistence-wmi-event-subscription/ -- https://www.sakshamdixit.com/wmi-events/ -tags: - analytic_story: - - Living Off The Land - asset_type: Endpoint - confidence: 80 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ loading a MOF file. - mitre_attack_id: - - T1546.003 - observable: - - name: user - type: User - role: - - Victim - - name: Computer - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team/mofcomp.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_mshta_execution_in_registry.yml b/dev/endpoint/windows_mshta_execution_in_registry.yml deleted file mode 100644 index 62ccbd455f..0000000000 --- a/dev/endpoint/windows_mshta_execution_in_registry.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Windows Mshta Execution In Registry -id: e13ceade-b673-4d34-adc4-4d9c01729753 -version: 1 -date: '2022-10-14' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies the usage of mshta.exe Windows binary - in registry to execute malicious script. This technique was seen in kovter malware - where it create several registry entry which is a encoded javascript and will be - executed by another registry containing mshta and javascript activexobject to execute - the encoded script using wscript.shell. This TTP is a good indication of kovter - malware or other adversaries or threat actors leveraging fileless detection that - survive system reboot. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: - - '*mshta*' - - '*javascript:*' - - '*vbscript:*' - - '*WScript.Shell*' - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: unknown -references: -- https://redcanary.com/threat-detection-report/techniques/mshta/ -- https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/fileless-threats?view=o365-worldwide -tags: - analytic_story: - - Suspicious Windows Registry Activities - - Windows Persistence Techniques - asset_type: Endpoint - confidence: 90 - impact: 80 - message: a registry $registry_path$ contains mshta $registry_value_data$ in $dest$ - mitre_attack_id: - - T1218.005 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 72 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/mshta_in_registry/sysmon3.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_msiexec_dllregisterserver.yml b/dev/endpoint/windows_msiexec_dllregisterserver.yml deleted file mode 100644 index 24a8e13ed9..0000000000 --- a/dev/endpoint/windows_msiexec_dllregisterserver.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Windows MSIExec DLLRegisterServer -id: fdb59aef-d88f-4909-8369-ec2afbd2c398 -version: 1 -date: '2022-06-14' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the usage of msiexec.exe using the - /y switch parameter, which grants the ability for msiexec to load DLLRegisterServer. - Upon triage, review parent process and capture any artifacts for further review. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: msiexec.exe - selection2: - Image|endswith: msiexec.exe - selection3: - CommandLine: - - '*/y*' - - '*-y*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: This analytic will need to be tuned for your environment based - on legitimate usage of msiexec.exe. Filter as needed. -references: -- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md -tags: - analytic_story: - - Windows System Binary Proxy Execution MSIExec - asset_type: Endpoint - confidence: 50 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to register a file. - mitre_attack_id: - - T1218.007 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process Name - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_msiexec_remote_download.yml b/dev/endpoint/windows_msiexec_remote_download.yml deleted file mode 100644 index 377014020b..0000000000 --- a/dev/endpoint/windows_msiexec_remote_download.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Windows MSIExec Remote Download -id: 6aa49ff2-3c92-4586-83e0-d83eb693dfda -version: 1 -date: '2022-06-16' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies msiexec.exe with http in the command-line. - This procedure will utilize msiexec.exe to download a remote file and load it. During - triage, review parallel processes and capture any artifacts on disk for review. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: msiexec.exe - selection2: - Image|endswith: msiexec.exe - selection3: - CommandLine: - - '*http://*' - - '*https://*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present, filter by destination or parent - process as needed. -references: -- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md -tags: - analytic_story: - - Windows System Binary Proxy Execution MSIExec - asset_type: Endpoint - confidence: 50 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to download a remote file. - mitre_attack_id: - - T1218.007 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process Name - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_msiexec_spawn_discovery_command.yml b/dev/endpoint/windows_msiexec_spawn_discovery_command.yml deleted file mode 100644 index 78a49b8d02..0000000000 --- a/dev/endpoint/windows_msiexec_spawn_discovery_command.yml +++ /dev/null @@ -1,73 +0,0 @@ -name: Windows MSIExec Spawn Discovery Command -id: e9d05aa2-32f0-411b-930c-5b8ca5c4fcee -version: 1 -date: '2022-06-13' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies MSIExec spawning multiple discovery - commands, including spawning Cmd.exe or PowerShell.exe. Typically, child processes - are not common from MSIExec other than MSIExec spawning itself. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - powershell.exe - - cmd.exe - - nltest.exe - - ipconfig.exe - - systeminfo.exe - ParentImage: msiexec.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives will be present with MSIExec spawning Cmd or - PowerShell. Filtering will be needed. In addition, add other known discovery processes - to enhance query. -references: -- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md -tags: - analytic_story: - - Windows System Binary Proxy Execution MSIExec - asset_type: Endpoint - confidence: 50 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ running different discovery commands. - mitre_attack_id: - - T1218.007 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process Name - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_msiexec_unregister_dllregisterserver.yml b/dev/endpoint/windows_msiexec_unregister_dllregisterserver.yml deleted file mode 100644 index 0ae294c82a..0000000000 --- a/dev/endpoint/windows_msiexec_unregister_dllregisterserver.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Windows MSIExec Unregister DLLRegisterServer -id: a27db3c5-1a9a-46df-a577-765d3f1a3c24 -version: 1 -date: '2022-06-14' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the usage of msiexec.exe using the - /z switch parameter, which grants the ability for msiexec to unload DLLRegisterServer. - Upon triage, review parent process and capture any artifacts for further review. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: msiexec.exe - selection2: - Image|endswith: msiexec.exe - selection3: - CommandLine: - - '*/z*' - - '*-z*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: This analytic will need to be tuned for your environment based - on legitimate usage of msiexec.exe. Filter as needed. -references: -- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md -tags: - analytic_story: - - Windows System Binary Proxy Execution MSIExec - asset_type: Endpoint - confidence: 50 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to unregister a file. - mitre_attack_id: - - T1218.007 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process Name - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_msiexec_with_network_connections.yml b/dev/endpoint/windows_msiexec_with_network_connections.yml deleted file mode 100644 index 07143a5831..0000000000 --- a/dev/endpoint/windows_msiexec_with_network_connections.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Windows MSIExec With Network Connections -id: 827409a1-5393-4d8d-8da4-bbb297c262a7 -version: 1 -date: '2022-06-16' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies MSIExec with any network connection - over port 443 or 80. Typically, MSIExec does not perform network communication to - the internet. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: msiexec.exe - selection2: - Image|endswith: msiexec.exe - condition: (selection1 or selection2) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. Add parent process as a filter, filter known good processes. This - may be voluminous due to the join on process_id. All_Traffic does not have process_guid, - yet. -known_false_positives: False positives will be present and filtering is required. -references: -- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md -tags: - analytic_story: - - Windows System Binary Proxy Execution MSIExec - asset_type: Endpoint - confidence: 50 - impact: 70 - message: An instance of $process_name$ was identified on endpoint $dest$ contacting - a remote destination. - mitre_attack_id: - - T1218.007 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process Name - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_ngrok_reverse_proxy_usage.yml b/dev/endpoint/windows_ngrok_reverse_proxy_usage.yml deleted file mode 100644 index 5ec8ee1485..0000000000 --- a/dev/endpoint/windows_ngrok_reverse_proxy_usage.yml +++ /dev/null @@ -1,77 +0,0 @@ -name: Windows Ngrok Reverse Proxy Usage -id: e2549f2c-0aef-408a-b0c1-e0f270623436 -version: 1 -date: '2022-11-16' -author: Michael Haag, Splunk -status: production -type: Anomaly -description: The following analytic identifies the use of ngrok.exe being utilized - on the Windows operating system. Unfortunately, there is no original file name for - Ngrok, so it may be worth an additional hunt to identify any command-line arguments. - The sign of someone using Ngrok is not malicious, however, more recenctly it has - become an adversary tool. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*start*' - - '*--config*' - - '*http*' - - '*authtoken*' - - '*http*' - - (*tcp* - Image|endswith: ngrok.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives will be present based on organizations that - allow the use of Ngrok. Filter or monitor as needed. -references: -- https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf -tags: - analytic_story: - - Reverse Network Proxy - - CISA AA22-320A - asset_type: Endpoint - confidence: 100 - impact: 50 - message: A reverse proxy was identified spawning from $parent_process_name$ - $process_name$ - on endpoint $dest$ by user $user$. - mitre_attack_id: - - T1572 - - T1090 - - T1102 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 50 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1572/ngrok/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_nirsoft_advancedrun.yml b/dev/endpoint/windows_nirsoft_advancedrun.yml deleted file mode 100644 index 9d9add0019..0000000000 --- a/dev/endpoint/windows_nirsoft_advancedrun.yml +++ /dev/null @@ -1,77 +0,0 @@ -name: Windows NirSoft AdvancedRun -id: bb4f3090-7ae4-11ec-897f-acde48001122 -version: 1 -date: '2022-01-21' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the use of AdvancedRun.exe. AdvancedRun.exe - has similar capabilities as other remote programs like psexec. AdvancedRun may also - ingest a configuration file with all settings defined and perform its activity. - The analytic is written in a way to identify a renamed binary and also the common - command-line arguments. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: advancedrun.exe - selection2: - Image|endswith: advancedrun.exe - selection3: - CommandLine: - - '*EXEFilename*' - - '*/cfg*' - - '*RunAs*' - - '*WindowState*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited as it is specific to AdvancedRun. - Filter as needed based on legitimate usage. -references: -- http://www.nirsoft.net/utils/advanced_run.html -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -tags: - analytic_story: - - Unusual Processes - - Ransomware - - WhisperGate - asset_type: Endpoint - confidence: 100 - impact: 60 - message: An instance of advancedrun.exe, $process_name$, was spawned by $parent_process_name$ - on $dest$ by $user$. - mitre_attack_id: - - T1588.002 - observable: - - name: user - type: User - role: - - Victim - - name: Computer - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 60 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_odbcconf_hunting.yml b/dev/endpoint/windows_odbcconf_hunting.yml deleted file mode 100644 index 347150579e..0000000000 --- a/dev/endpoint/windows_odbcconf_hunting.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Windows Odbcconf Hunting -id: 0562ad4b-fdaa-4882-b12f-7b8e0034cd72 -version: 1 -date: '2022-06-30' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following analytic identifies Odbcconf.exe running in the environment - to assist with identifying tuning higher fidelity analytics related to Odbcconf.exe. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: odbcconf.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives will be present as this is meant to assist - with filtering and tuning. -references: -- https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html -- https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw -tags: - analytic_story: - - Living Off The Land - asset_type: Endpoint - confidence: 20 - impact: 30 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to circumvent controls. - mitre_attack_id: - - T1218.008 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process Name - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 6 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-regsvr.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_odbcconf_load_dll.yml b/dev/endpoint/windows_odbcconf_load_dll.yml deleted file mode 100644 index 640426438a..0000000000 --- a/dev/endpoint/windows_odbcconf_load_dll.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Windows Odbcconf Load DLL -id: 141e7fca-a9f0-40fd-a539-9aac8be41f1b -version: 1 -date: '2022-06-28' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies odbcconf.exe, Windows Open Database - Connectivity utility, utilizing the action function of regsvr to load a DLL. An - example will look like - odbcconf.exe /A { REGSVR T1218-2.dll }. During triage, - review parent process, parallel procesess and file modifications. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*/a *' - - '*-a*' - Image|endswith: odbcconf.exe - selection2: - CommandLine: '*regsvr*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present and filtering may need to occur - based on legitimate application usage. Filter as needed. -references: -- https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html -- https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw -tags: - analytic_story: - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to circumvent controls. - mitre_attack_id: - - T1218.008 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process Name - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 42 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-regsvr.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_odbcconf_load_response_file.yml b/dev/endpoint/windows_odbcconf_load_response_file.yml deleted file mode 100644 index 65ad99df02..0000000000 --- a/dev/endpoint/windows_odbcconf_load_response_file.yml +++ /dev/null @@ -1,73 +0,0 @@ -name: Windows Odbcconf Load Response File -id: 1acafff9-1347-4b40-abae-f35aa4ba85c1 -version: 1 -date: '2022-06-30' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the odbcconf.exe, Windows Open Database - Connectivity utility, loading up a resource file. The file extension is arbitrary - and may be named anything. The resource file itself may have different commands - supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands. - During triage, review file modifications and parallel processes. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*-f *' - - '*/f *' - Image|endswith: odbcconf.exe - selection2: - CommandLine: '*.rsp*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present and filtering may need to occur - based on legitimate application usage. Filter as needed. -references: -- https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html -- https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw -tags: - analytic_story: - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to circumvent controls. - mitre_attack_id: - - T1218.008 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process Name - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 42 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-rsp.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_office_product_spawning_msdt.yml b/dev/endpoint/windows_office_product_spawning_msdt.yml deleted file mode 100644 index 200ba04428..0000000000 --- a/dev/endpoint/windows_office_product_spawning_msdt.yml +++ /dev/null @@ -1,83 +0,0 @@ -name: Windows Office Product Spawning MSDT -id: 127eba64-c981-40bf-8589-1830638864a7 -version: 1 -date: '2022-05-30' -author: Michael Haag, Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies a Microsoft Office product spawning - the Windows msdt.exe process. MSDT is a Diagnostics Troubleshooting Wizard native - to Windows. This behavior is related to a recently identified sample utilizing protocol - handlers to evade preventative controls, including if macros are disabled in the - document. During triage, review file modifications for html. In addition, parallel - processes including PowerShell and CertUtil. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: msdt.exe - ParentImage: - - winword.exe - - excel.exe - - powerpnt.exe - - outlook.exe - - mspub.exe - - visio.exe - condition: selection1 -how_to_implement: how To successfully implement this search you need to be ingesting - information on process that include the name of the process responsible for the - changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. - In addition, confirm the latest CIM App 4.20 or higher is installed and the latest - TA for the endpoint product. -known_false_positives: False positives should be limited, however filter as needed. -references: -- https://isc.sans.edu/diary/rss/28694 -- https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e -- https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A -- https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ -- https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection -- https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html -tags: - analytic_story: - - Spearphishing Attachments - - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190 - asset_type: Endpoint - confidence: 100 - cve: - - CVE-2022-30190 - impact: 100 - message: Office parent process $parent_process_name$ has spawned a child process - $process_name$ on host $dest$. - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 100 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_os_credential_dumping_security_manager_reg.yml b/dev/endpoint/windows_os_credential_dumping_security_manager_reg.yml deleted file mode 100644 index b817d0a08c..0000000000 --- a/dev/endpoint/windows_os_credential_dumping_security_manager_reg.yml +++ /dev/null @@ -1,81 +0,0 @@ -name: Windows OS Credential Dumping Security Account Manager Reg -id: e9fb4a59-c5fb-440a-9f24-191fbc6b2911 -version: 6 -date: '2021-09-16' -author: Patrick Bareiss, Splunk -type: TTP -status: production -description: Monitor for execution of reg.exe with parameters specifying an export - of keys that contain hashed credentials that attackers may try to crack offline. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - cmd.exe - - reg.exe - CommandLine|contains: - - HKEY_LOCAL_MACHINE\\Security - - HKEY_LOCAL_MACHINE\\SAM - - HKEY_LOCAL_MACHINE\\System - - HKLM\\Security - - HKLM\\System - - HKLM\\SAM - selection2: - CommandLine|contains: save - condition: selection1 and selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: None identified. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets -tags: - analytic_story: - - Credential Dumping - - DarkSide Ransomware - - Windows Registry Abuse - - Industroyer2 - asset_type: Endpoint - atomic_guid: - - 5c2571d0-1572-416d-9676-812e64ca9f44 - confidence: 100 - impact: 90 - drilldown_search: spl here - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to export the registry keys. - mitre_attack_id: - - T1003.002 - - T1003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - - Splunk Behavioral Analytics - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog \ No newline at end of file diff --git a/dev/endpoint/windows_password_managers_discovery.yml b/dev/endpoint/windows_password_managers_discovery.yml deleted file mode 100644 index bb2123caf4..0000000000 --- a/dev/endpoint/windows_password_managers_discovery.yml +++ /dev/null @@ -1,75 +0,0 @@ -name: Windows Password Managers Discovery -id: a3b3bc96-1c4f-4eba-8218-027cac739a48 -version: 1 -date: '2022-11-30' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: The following analytic identifies a process command line that retrieves - information related to password manager software. This technique was seen in several - post exploitation tools like winpeas that are being used by Ransomware Prestige - to gather this type of information. Password Managers applications are designed - to store user credentials, normally in an encrypted database. Credentials are typically - accessible after a user provides a master password that unlocks the database. After - the database is unlocked, these credentials may be copied to memory. These databases - can be stored as files on disk. Due to this password manager software designed adversaries - may find or look for keywords related to the Password Manager databases that can - be stolen or extracted for further attacks. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*dir *' - selection2: - CommandLine: - - '*.kdbx*' - - '*credential*' - - '*key3.db*' - - '*pass*' - - '*cred*' - - '*key4.db*' - - '*accessTokens*' - - '*access_tokens*' - - '*.htpasswd*' - - '*Ntds.dit*' - selection3: - CommandLine: '*findstr*' - condition: selection1 or selection2 or selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. -known_false_positives: unknown -references: -- https://attack.mitre.org/techniques/T1555/005/ -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 50 - impact: 50 - message: a process with commandline $process$ that can retrieve information related - to password manager databases in $dest$ - mitre_attack_id: - - T1555.005 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_search_pwd_db/dir-db-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_phishing_recent_iso_exec_registry.yml b/dev/endpoint/windows_phishing_recent_iso_exec_registry.yml deleted file mode 100644 index 40887ce100..0000000000 --- a/dev/endpoint/windows_phishing_recent_iso_exec_registry.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Windows Phishing Recent ISO Exec Registry -id: cb38ee66-8ae5-47de-bd66-231c7bbc0b2c -version: 2 -date: '2022-09-19' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: The following hunting analytic identifies registry artifacts when an - ISO container is opened, clicked or mounted on the Windows operating system. As - Microsoft makes changes to macro based document execution, adversaries have begun - to utilize container based initial access based phishing campaigns to evade preventative - controls. Once the ISO is clicked or mounted it will create a registry artifact - related to this event as a recent application executed or opened. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_key_name: - - '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\\.iso' - - '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\\.img' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be high depending on the environment and - consistent use of ISOs. Restrict to servers, or filter out based on commonly used - ISO names. Filter as needed. -references: -- https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/ -- https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ -- https://isc.sans.edu/diary/Recent+AZORult+activity/25120 -- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html -tags: - analytic_story: - - Brute Ratel C4 - - AgentTesla - - Qakbot - - IcedID - - Azorult - - Remcos - asset_type: Endpoint - confidence: 80 - impact: 50 - message: An ISO file was mounted on $dest$ and should be reviewed and filtered as - needed. - mitre_attack_id: - - T1566.001 - - T1566 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 40 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_private_keys_discovery.yml b/dev/endpoint/windows_private_keys_discovery.yml deleted file mode 100644 index f48ccb725c..0000000000 --- a/dev/endpoint/windows_private_keys_discovery.yml +++ /dev/null @@ -1,79 +0,0 @@ -name: Windows Private Keys Discovery -id: 5c1c2877-06c0-40ee-a1a2-db71f1372b5b -version: 1 -date: '2022-11-30' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic identifies a process command line that retrieves - information related to private keys files. This technique was seen in several post - exploitation tools like winpeas that are being used by Ransomware Prestige to search - for private key certificates on the compromised host for insecurely stored credentials. - This files can be used by adversaries to gain privileges, persistence or remote - service authentication to collect more sensitive information. Some private keys - required password for operation, so in this case adversaries may need to have that - passphrase either via keylogging or brute force attack. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*dir *' - selection2: - CommandLine: - - '*.rdg*' - - '*.gpg*' - - '*.pgp*' - - '*.p12*' - - '*.der*' - - '*.csr*' - - '*.cer*' - - '*.ovpn*' - - '*.key*' - - '*.ppk*' - - '*.p12*' - - '*.pem*' - - '*.pfx*' - - '*.p7b*' - - '*.asc*' - selection3: - CommandLine: '*findstr*' - condition: selection1 or selection2 or selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. -known_false_positives: unknown -references: -- https://attack.mitre.org/techniques/T1552/004/ -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 50 - impact: 50 - message: a process with commandline $process$ that can retrieve information related - to private keys in $dest$ - mitre_attack_id: - - T1552.004 - - T1552 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_search_private_key/dir-private-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_process_injection_wermgr_child_process.yml b/dev/endpoint/windows_process_injection_wermgr_child_process.yml deleted file mode 100644 index a99ad3ead3..0000000000 --- a/dev/endpoint/windows_process_injection_wermgr_child_process.yml +++ /dev/null @@ -1,55 +0,0 @@ -name: Windows Process Injection Wermgr Child Process -id: 360ae6b0-38b5-4328-9e2b-bc9436cddb17 -version: 1 -date: '2022-10-27' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic identifies a suspicious wermgr.exe parent process - having a child process not related to error, fault or windows werfault event. This - technique was seen in Qakbot malware where it inject its malicious code in wermgr - to evade detections and hide from the analyst to execute its recon and its malicious - behavior. This Anomaly detection can be a good pivot to start investigating a possible - qakbot infection in the network. The Wermgr.exe process is not known to have other - child processes aside from itself or werfault.exe -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: wermgr.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: unknown -references: -- https://twitter.com/pr0xylife/status/1585612370441031680?s=46&t=Dc3CJi4AnM-8rNoacLbScg -tags: - analytic_story: - - Qakbot - asset_type: Endpoint - confidence: 70 - impact: 80 - message: wermgr parent process has a child process $process_name$ in $dest$ - mitre_attack_id: - - T1055 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot_wermgr/sysmon_wermgr.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_process_with_namedpipe_commandline.yml b/dev/endpoint/windows_process_with_namedpipe_commandline.yml deleted file mode 100644 index a73b10ce94..0000000000 --- a/dev/endpoint/windows_process_with_namedpipe_commandline.yml +++ /dev/null @@ -1,55 +0,0 @@ -name: Windows Process With NamedPipe CommandLine -id: e64399d4-94a8-11ec-a9da-acde48001122 -version: 1 -date: '2022-02-23' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to look for process commandline that contains named - pipe. This technique was seen in some adversaries, threat actor and malware like - olympic destroyer to communicate to its other child processes after process injection - that serve as defense evasion and privilege escalation. On the other hand this analytic - may catch some normal process that using this technique for example browser application. - In that scenario we include common process path we've seen during testing that cause - false positive which is the program files. False positive may still be arise if - the normal application is in other folder path. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*\\\\.\\pipe\\*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Normal browser application may use this technique. Please update - the filter macros to remove false positives. -references: -- https://blog.talosintelligence.com/2018/02/olympic-destroyer.html -tags: - analytic_story: - - Windows Defense Evasion Tactics - asset_type: Endpoint - confidence: 70 - impact: 70 - message: Process with named pipe in $process$ on $dest$ - mitre_attack_id: - - T1055 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/olympic_destroyer/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_protocol_tunneling_with_plink.yml b/dev/endpoint/windows_protocol_tunneling_with_plink.yml deleted file mode 100644 index 6b781bfc77..0000000000 --- a/dev/endpoint/windows_protocol_tunneling_with_plink.yml +++ /dev/null @@ -1,78 +0,0 @@ -name: Windows Protocol Tunneling with Plink -id: 8aac5e1e-0fab-4437-af0b-c6e60af23eed -version: 1 -date: '2022-09-15' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the use of Plink being utilized to - proxy egress or laterally in an organization. The analytic is limited to specific - Plink options on the command-line, including -R -L and -D which will have the remote - and local IP address or port and -l for a username. Modify the options as seen fit - for your organization. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*-R *' - - '*-L *' - - '*-D *' - - '*-l *' - OriginalFileName: Plink - selection2: - Image|endswith: plink.exe - condition: selection1 or selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present if the organization allows for - SSH tunneling outbound or internally. Filter as needed. -references: -- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ -- https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html -- https://attack.mitre.org/techniques/T1572/ -- https://documentation.help/PuTTY/using-cmdline-portfwd.html#S3.8.3.5 -tags: - analytic_story: - - CISA AA22-257A - asset_type: Endpoint - confidence: 80 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to tunnel to a remote destination. - mitre_attack_id: - - T1572 - - T1021.004 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1572/plink/plink-windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_query_registry_reg_save.yml b/dev/endpoint/windows_query_registry_reg_save.yml deleted file mode 100644 index c44eee4ac6..0000000000 --- a/dev/endpoint/windows_query_registry_reg_save.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Windows Query Registry Reg Save -id: cbee60c1-b776-456f-83c2-faa56bdbe6c6 -version: 1 -date: '2022-12-12' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: The following analytic identifies a process execution of reg.exe with - "save" parameter. This reg.exe parameter is commonly being abused by threat actors, - adversaries and red-teamers to dump credentials or to check the registry modification - capabilities of certain users or administrators in targeted hosts. This approach - was seen in post-exploitation tool like winpeas where it uses "reg save" and "reg - restore" to check registry modification restriction in targeted host after gaining - access to it. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: reg.exe - selection2: - Image|endswith: reg.exe - selection3: - CommandLine: '* save *' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. -known_false_positives: network administrator can use this command tool to backup registry - before updates or modifying critical registries. -references: -- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/quser -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 30 - impact: 30 - message: execution of process $process_name$ in $dest$ - mitre_attack_id: - - T1012 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_raccine_scheduled_task_deletion.yml b/dev/endpoint/windows_raccine_scheduled_task_deletion.yml deleted file mode 100644 index 73557d09de..0000000000 --- a/dev/endpoint/windows_raccine_scheduled_task_deletion.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Windows Raccine Scheduled Task Deletion -id: c9f010da-57ab-11ec-82bd-acde48001122 -version: 1 -date: '2021-12-07' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the Raccine Rules Updater scheduled - task being deleted. Adversaries may attempt to remove this task in order to prevent - the update of Raccine. Raccine is a "ransomware vaccine" created by security researcher - Florian Roth, designed to intercept and prevent precursors and active ransomware - behavior. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*delete*' - Image|endswith: schtasks.exe - selection2: - CommandLine: '*Raccine*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited, however filter as needed. -references: -- https://redcanary.com/blog/blackbyte-ransomware/ -- https://github.com/Neo23x0/Raccine -tags: - analytic_story: - - Ransomware - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user user$ attempting to disable Raccines scheduled task. - mitre_attack_id: - - T1562.001 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_raccine.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_rasautou_dll_execution.yml b/dev/endpoint/windows_rasautou_dll_execution.yml deleted file mode 100644 index 54924e2566..0000000000 --- a/dev/endpoint/windows_rasautou_dll_execution.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Windows Rasautou DLL Execution -id: 6f42b8be-8e96-11ec-ad5a-acde48001122 -version: 1 -date: '2022-02-15' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the Windows Windows Remote Auto Dialer, - rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary - shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review - parent and child process behavior including file and image loads. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '* -d *' - Image|endswith: rasautou.exe - selection2: - CommandLine: '* -p *' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives will be limited to applications that require - Rasautou.exe to load a DLL from disk. Filter as needed. -references: -- https://github.com/mandiant/DueDLLigence -- https://github.com/MHaggis/notes/blob/master/utilities/Invoke-SPLDLLigence.ps1 -- https://gist.github.com/NickTyrer/c6043e4b302d5424f701f15baf136513 -- https://www.mandiant.com/resources/staying-hidden-on-the-endpoint-evading-detection-with-shellcode -tags: - analytic_story: - - Windows Defense Evasion Tactics - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ attempting to load a DLL in a suspicious manner. - mitre_attack_id: - - T1055.001 - - T1218 - - T1055 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_registry_certificate_added.yml b/dev/endpoint/windows_registry_certificate_added.yml deleted file mode 100644 index 9224370dd1..0000000000 --- a/dev/endpoint/windows_registry_certificate_added.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Windows Registry Certificate Added -id: 5ee98b2f-8b9e-457a-8bdc-dd41aaba9e87 -version: 1 -date: '2022-03-31' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies installation of a root CA certificate - by monitoring the registry. The base paths may be found [here](https://gist.github.com/mattifestation/75d6117707bcf8c26845b3cbb6ad2b6b/raw/ae65ef15c706140ffc2e165615204e20f2903028/RootCAInstallationDetection.xml). - In short, there are specific certificate registry paths that will be written to - (SetValue) when a new certificate is added. The high-fidelity events to pay attention - to are SetValue events where the TargetObject property ends with "\Blob" - as this indicates the direct installation or modification of a root certificate - binary blob. The other high fidelity reference will be which process is making the - registry modifications. There are very few processes that modify these day to day, - therefore monitoring for all to start (hunting) provides a great beginning. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: Blob - TargetObject: '*\\certificates\\*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. - In addition, confirm the latest CIM App 4.20 or higher is installed and the latest - TA for the endpoint product. -known_false_positives: False positives will be limited to a legitimate business applicating - consistently adding new root certificates to the endpoint. Filter by user, process, - or thumbprint. -references: -- https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec -- https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1553.004 -tags: - analytic_story: - - Windows Drivers - - Windows Registry Abuse - asset_type: Endpoint - confidence: 70 - impact: 60 - message: A root certificate was added on $dest$. - mitre_attack_id: - - T1553.004 - - T1553 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 42 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1587.002/atomic_red_team/certblob_windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_registry_delete_task_sd.yml b/dev/endpoint/windows_registry_delete_task_sd.yml deleted file mode 100644 index f8278f66f4..0000000000 --- a/dev/endpoint/windows_registry_delete_task_sd.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Windows Registry Delete Task SD -id: ffeb7893-ff06-446f-815b-33ca73224e92 -version: 1 -date: '2022-04-13' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies a process attempting to delete a scheduled - task SD (Security Descriptor) from within the registry path of that task. This may - occur from a non-standard process running and may not come from reg.exe. This particular - behavior will remove the actual Task Name from the Task Scheduler GUI and from the - command-line query - schtasks.exe /query. In addition, in order to perform this - action, the user context will need to be SYSTEM. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.user: SYSTEM - TargetObject: '*\\Schedule\\TaskCache\\Tree\\*' - Registry.registry_value_name: SD - Registry.action: - - modified - - Deleted - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited as the activity is not common - to delete ONLY the SD from the registry. Filter as needed. Update the analytic Modified - or Deleted values based on product that is in the datamodel. -references: -- https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/ -- https://gist.github.com/MHaggis/5f7fd6745915166fc6da863d685e2728 -- https://gist.github.com/MHaggis/b246e2fae6213e762a6e694cabaf0c17 -tags: - analytic_story: - - Windows Registry Abuse - - Windows Persistence Techniques - asset_type: Endpoint - confidence: 70 - impact: 70 - message: A scheduled task security descriptor was deleted from the registry on $dest$. - mitre_attack_id: - - T1053.005 - - T1562 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/taskschedule/sd_delete_windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_registry_modification_for_safe_mode_persistence.yml b/dev/endpoint/windows_registry_modification_for_safe_mode_persistence.yml deleted file mode 100644 index 935eb4eab9..0000000000 --- a/dev/endpoint/windows_registry_modification_for_safe_mode_persistence.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Windows Registry Modification for Safe Mode Persistence -id: c6149154-c9d8-11eb-9da7-acde48001122 -version: 3 -date: '2022-03-31' -author: Teoderick Contreras, Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies a modification or registry add to the - safeboot registry as an autostart mechanism. This technique is utilized by adversaries - to persist a driver or service into Safe Mode. Two keys are monitored in this analytic, Minimal - and Network. adding values to Minimal will load into Safe Mode and by adding into - Network it will provide the service or drive the ability to perform network connections - in Safe Mode. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: - - '*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Minimal\\*' - - '*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Network\\*' - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: updated windows application needed in safe boot may used this - registry -references: -- https://malware.news/t/threat-analysis-unit-tau-threat-intelligence-notification-snatch-ransomware/36365 -- https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1112/T1112.md -- https://blog.didierstevens.com/2007/03/26/playing-with-safe-mode/ -tags: - analytic_story: - - Ransomware - - Windows Registry Abuse - - Windows Drivers - asset_type: Endpoint - confidence: 70 - impact: 60 - message: Safeboot registry $registry_path$ was added or modified with a new value - $registry_value_name$ on $dest$ - mitre_attack_id: - - T1547.001 - - T1547 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 42 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_regsvr32_renamed_binary.yml b/dev/endpoint/windows_regsvr32_renamed_binary.yml deleted file mode 100644 index c17a84a3a9..0000000000 --- a/dev/endpoint/windows_regsvr32_renamed_binary.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Windows Regsvr32 Renamed Binary -id: 7349a9e9-3cf6-4171-bb0c-75607a8dcd1a -version: 1 -date: '2022-10-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following hunting analytic identifies renamed instances of regsv32.exe - executing. regsv32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. - During investigation, validate if it is the legitimate regsv32.exe executing and - what dll module content it is loading. This query relies on the original filename - or internal name from the PE meta data. Expand the query as needed by looking for - specific command line arguments outlined in other analytics. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: regsvr32.exe - Image|endswith: regsvr32.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: unknown -references: -- https://twitter.com/pr0xylife/status/1585612370441031680?s=46&t=Dc3CJi4AnM-8rNoacLbScg -tags: - analytic_story: - - Qakbot - asset_type: Endpoint - confidence: 80 - impact: 80 - message: regsvr32 was renamed as $process_name$ in $dest$ - mitre_attack_id: - - T1218.010 - - T1218 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot_3/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_remote_access_software_hunt.yml b/dev/endpoint/windows_remote_access_software_hunt.yml deleted file mode 100644 index 02ee149fa4..0000000000 --- a/dev/endpoint/windows_remote_access_software_hunt.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Windows Remote Access Software Hunt -id: 8bd22c9f-05a2-4db1-b131-29271f28cb0a -version: 1 -date: '2022-08-22' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following hunting analytic is meant to help organizations understand - what remote access software is being used in the environment. When reviewing this - hunt, confirm the software identified is authorized to be utilized. Based on fidelity, - create a new analytic for specific utilities banned within the organization. Adversaries - use these utilities to retain remote access capabilities to the environment. Utilities - in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review - the lookup for the entire list and add any others. -data_source: -- Sysmon Event ID 1 -search: - selection1: - User: unknown - Computer: unknown - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives will be found. Filter as needed and create - higher fidelity analytics based off banned remote access software. -references: -- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1219/T1219.md -- https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/ -tags: - analytic_story: - - Insider Threat - - Command And Control - - Ransomware - asset_type: Endpoint - confidence: 10 - impact: 10 - message: The following Remote Access Software $process_name$ was identified on $dest$. - mitre_attack_id: - - T1219 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 1 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_remote_access_software_rms_registry.yml b/dev/endpoint/windows_remote_access_software_rms_registry.yml deleted file mode 100644 index fda7cfa581..0000000000 --- a/dev/endpoint/windows_remote_access_software_rms_registry.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Windows Remote Access Software RMS Registry -id: e5b7b5a9-e471-4be8-8c5d-4083983ba329 -version: 1 -date: '2022-06-22' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic is to identify a modification or creation of Windows - registry related to the Remote Manipulator System (RMS) Remote Admin tool. RMS is - a legitimate tool developed by russian organization TektonIT and has been observed - being abused by adversaries to gain remote access to the targeted host. Azorult - malware utilized RMS to gain remote access. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: '*\\SYSTEM\\Remote Manipulator System*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: administrators may enable or disable this feature that may - cause some false positive. -references: -- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ -- https://malpedia.caad.fkie.fraunhofer.de/details/win.rms -tags: - analytic_story: - - Azorult - asset_type: Endpoint - confidence: 90 - impact: 100 - message: the registry related to RMS tool is created in $dest$ - mitre_attack_id: - - T1219 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_remote_assistance_spawning_process.yml b/dev/endpoint/windows_remote_assistance_spawning_process.yml deleted file mode 100644 index 05d8176244..0000000000 --- a/dev/endpoint/windows_remote_assistance_spawning_process.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Windows Remote Assistance Spawning Process -id: ced50492-8849-11ec-9f68-acde48001122 -version: 1 -date: '2022-02-07' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the use of Microsoft Remote Assistance, - msra.exe, spawning PowerShell.exe or cmd.exe as a child process. Msra.exe by default - has no command-line arguments and typically spawns itself. It will generate a network - connection to the remote system that is connected. This behavior is indicative of - another process injected into msra.exe. Review the parent process or cross process - events to identify source. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: msra.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited, filter as needed. Add additional - shells as needed. -references: -- https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/ -tags: - analytic_story: - - Unusual Processes - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$, generating behavior not common with msra.exe. - mitre_attack_id: - - T1055 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/msra/msra-windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_remote_services_allow_remote_assistance.yml b/dev/endpoint/windows_remote_services_allow_remote_assistance.yml deleted file mode 100644 index f009b59cd7..0000000000 --- a/dev/endpoint/windows_remote_services_allow_remote_assistance.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Windows Remote Services Allow Remote Assistance -id: 9bce3a97-bc97-4e89-a1aa-ead151c82fbb -version: 1 -date: '2022-06-21' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic is to identify a modification in the Windows registry - to enable remote desktop assistance on a targeted machine. This technique was seen - in several adversaries, malware or red teamer like azorult to remotely access the - compromised or targeted host by enabling this protocol in registry. Even this protocol - might be allowed in some production environment, This Anomaly behavior is a good - pivot to check who and why the user want to enable this feature through registry - which is un-common. And as per stated in microsoft documentation the default value - of this registry is false that makes this a good indicator of suspicious behavior. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: '*\\Control\\Terminal Server\\fAllowToGetHelp*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: administrators may enable or disable this feature that may - cause some false positive. -references: -- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp -- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ -tags: - analytic_story: - - Azorult - asset_type: Endpoint - confidence: 70 - impact: 70 - message: the registry for rdp protocol was modified to enable in $dest$ - mitre_attack_id: - - T1021.001 - - T1021 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_remote_services_rdp_enable.yml b/dev/endpoint/windows_remote_services_rdp_enable.yml deleted file mode 100644 index 71e8e1ce51..0000000000 --- a/dev/endpoint/windows_remote_services_rdp_enable.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Windows Remote Services Rdp Enable -id: 8fbd2e88-4ea5-40b9-9217-fd0855e08cc0 -version: 1 -date: '2022-06-21' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic is to identify a modification in the Windows registry - to enable remote desktop protocol on a targeted machine. This technique was seen - in several adversaries, malware or red teamer to remotely access the compromised - or targeted host by enabling this protocol in registry. Even this protocol might - be allowed in some production environment, This TTP behavior is a good pivot to - check who and why the user want to enable this feature through registry which is - un-common. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000000' - TargetObject: '*\\Control\\Terminal Server\\fDenyTSConnections*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: administrators may enable or disable this feature that may - cause some false positive. -references: -- https://www.hybrid-analysis.com/sample/9d6611c2779316f1ef4b4a6edcfdfb5e770fe32b31ec2200df268c3bd236ed75?environmentId=100 -tags: - analytic_story: - - Azorult - asset_type: Endpoint - confidence: 70 - impact: 70 - message: the registry for rdp protocol was modified to enable in $dest$ - mitre_attack_id: - - T1021.001 - - T1021 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_schtasks_create_run_as_system.yml b/dev/endpoint/windows_schtasks_create_run_as_system.yml deleted file mode 100644 index 7f3a346c77..0000000000 --- a/dev/endpoint/windows_schtasks_create_run_as_system.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Windows Schtasks Create Run As System -id: 41a0e58e-884c-11ec-9976-acde48001122 -version: 1 -date: '2022-02-07' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies Schtasks.exe creating a new task to - start and run as an elevated user - SYSTEM. This is commonly used by adversaries - to spawn a process in an elevated state. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: schtasks.exe - selection2: - Image|endswith: schtasks.exe - selection3: - CommandLine: '*/create *' - selection4: - CommandLine: '*/ru *' - selection5: - CommandLine: '*system*' - condition: (selection1 or selection2) and selection3 and selection4 and selection5 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives will be limited to legitimate applications - creating a task to run as SYSTEM. Filter as needed based on parent process, or modify - the query to have world writeable paths to restrict it. -references: -- https://pentestlab.blog/2019/11/04/persistence-scheduled-tasks/ -- https://www.ired.team/offensive-security/persistence/t1053-schtask -- https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/ -tags: - analytic_story: - - Windows Persistence Techniques - - Qakbot - asset_type: Endpoint - confidence: 60 - impact: 80 - message: An $process_name$ was created on endpoint $dest$ attempting to spawn as - SYSTEM. - mitre_attack_id: - - T1053.005 - - T1053 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 48 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtask_system/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_security_support_provider_reg_query.yml b/dev/endpoint/windows_security_support_provider_reg_query.yml deleted file mode 100644 index e25716b3e7..0000000000 --- a/dev/endpoint/windows_security_support_provider_reg_query.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Windows Security Support Provider Reg Query -id: 31302468-93c9-4eca-9ae3-2d41f53a4e2b -version: 1 -date: '2022-11-30' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic identifies a process command line related to the - discovery of possible Security Support Providers in the registry. This technique - is being abused by adversaries or post exploitation tools like winpeas to gather - LSA protection and configuration in the registry in the targeted host. This registry - entry can contain several information related to LSA that validates users for local - and remote sign-ins and enforces local security policies. Understanding LSA protection - may give a good information in accessing LSA content in memory which is commonly - attack by adversaries and tool like mimikatz to scrape password hashes or clear - plain text passwords. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: reg.exe - selection2: - Image|endswith: reg.exe - selection3: - CommandLine: '* query *' - selection4: - CommandLine: - - '*RunAsPPL*' - - '*LsaCfgFlags*' - selection5: - CommandLine: '*\\SYSTEM\\CurrentControlSet\\Control\\LSA*' - condition: (selection1 or selection2) and selection3 and selection4 and selection5 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. -known_false_positives: unknown -references: -- https://blog.netwrix.com/2022/01/11/understanding-lsa-protection/ -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 30 - impact: 30 - message: process with reg query command line $process$ in $dest$ - mitre_attack_id: - - T1547.005 - - T1547 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_service_create_kernel_mode_driver.yml b/dev/endpoint/windows_service_create_kernel_mode_driver.yml deleted file mode 100644 index 002322709e..0000000000 --- a/dev/endpoint/windows_service_create_kernel_mode_driver.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Windows Service Create Kernel Mode Driver -id: 0b4e3b06-1b2b-4885-b752-cf06d12a90cb -version: 1 -date: '2022-05-05' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifes a new kernel driver being added to Windows - using sc.exe. Adding a Kernel driver is not common day to day and should be investigated - to further understand the source. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*kernel*' - Image|endswith: sc.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present based on common applications - adding new drivers, however, filter as needed. -references: -- https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/ -tags: - analytic_story: - - Windows Drivers - - CISA AA22-320A - asset_type: Endpoint - confidence: 80 - impact: 60 - message: Service control, $process_name$, loaded a new kernel mode driver on $dest$ - by $user$. - mitre_attack_id: - - T1543.003 - - T1543 - - T1068 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 48 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/drivers/sc_kernel.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_service_creation_on_remote_endpoint.yml b/dev/endpoint/windows_service_creation_on_remote_endpoint.yml deleted file mode 100644 index c4b6edaeef..0000000000 --- a/dev/endpoint/windows_service_creation_on_remote_endpoint.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Windows Service Creation on Remote Endpoint -id: e0eea4fa-4274-11ec-882b-3e22fbd008af -version: 1 -date: '2021-11-10' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `sc.exe` with command-line arguments - utilized to create a Windows Service on a remote endpoint. Red Teams and adversaries - alike may abuse the Service Control Manager for lateral movement and remote code - execution. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: sc.exe - selection2: - Image|endswith: sc.exe - selection3: - CommandLine: '*create*' - selection4: - CommandLine: '*\\\\*' - selection5: - CommandLine: '*binpath*' - condition: (selection1 or selection2) and selection3 and selection4 and selection5 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -known_false_positives: Administrators may create Windows Services on remote systems, - but this activity is usually limited to a small set of hosts or users. -references: -- https://docs.microsoft.com/en-us/windows/win32/services/service-control-manager -- https://docs.microsoft.com/en-us/windows/win32/services/controlling-a-service-using-sc -- https://attack.mitre.org/techniques/T1543/003/ -tags: - analytic_story: - - Active Directory Lateral Movement - asset_type: Endpoint - confidence: 60 - impact: 90 - message: A Windows Service was created on a remote endpoint from $dest - mitre_attack_id: - - T1543 - - T1543.003 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 54 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_service_creation_using_registry_entry.yml b/dev/endpoint/windows_service_creation_using_registry_entry.yml deleted file mode 100644 index f522ee10fc..0000000000 --- a/dev/endpoint/windows_service_creation_using_registry_entry.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Windows Service Creation Using Registry Entry -id: 25212358-948e-11ec-ad47-acde48001122 -version: 1 -date: '2022-02-23' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to look for suspicious modification or creation of registry - to have service entry. This technique is abused by adversaries or threat actor to - persist, gain privileges in the machine or even lateral movement. This technique - can be executed using reg.exe application or using windows API like for example - the CrashOveride malware. This detection is a good indicator that a process is trying - to create a service entry using registry ImagePath. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: ImagePath - TargetObject: '*\\SYSTEM\\CurrentControlSet\\Services*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: Third party tools may used this technique to create services - but not so common. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1574.011/T1574.011.md -tags: - analytic_story: - - Active Directory Lateral Movement - - Suspicious Windows Registry Activities - - Windows Persistence Techniques - - Windows Registry Abuse - - Brute Ratel C4 - asset_type: Endpoint - confidence: 80 - impact: 80 - message: A Windows Service was created on a endpoint from $dest$ - mitre_attack_id: - - T1574.011 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.011/change_registry_path_service/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_service_deletion_in_registry.yml b/dev/endpoint/windows_service_deletion_in_registry.yml deleted file mode 100644 index 8e39fa666a..0000000000 --- a/dev/endpoint/windows_service_deletion_in_registry.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Windows Service Deletion In Registry -id: daed6823-b51c-4843-a6ad-169708f1323e -version: 1 -date: '2022-08-24' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic identifies a service being deleted from the Windows - Registry under CurrentControlSet\Services. Adversaries may delete a service as part - of defense evasion. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - Registry.registry_value_name: DeleteFlag - Registry.action: - - modified - - deleted - TargetObject: '*\\SYSTEM\\CurrentControlSet\\Services*' - condition: ((selection1)) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: This event can be seen when administrator delete a service - or uninstall/reinstall a software that creates service entry, but it is still recommended - to check this alert with high priority. -references: -- https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ -tags: - analytic_story: - - Brute Ratel C4 - asset_type: Endpoint - confidence: 30 - impact: 60 - message: A service was deleted on $dest$ within the Windows registry. - mitre_attack_id: - - T1489 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 18 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/service_deletion/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_service_initiation_on_remote_endpoint.yml b/dev/endpoint/windows_service_initiation_on_remote_endpoint.yml deleted file mode 100644 index c78d34d96a..0000000000 --- a/dev/endpoint/windows_service_initiation_on_remote_endpoint.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Windows Service Initiation on Remote Endpoint -id: 3f519894-4276-11ec-ab02-3e22fbd008af -version: 1 -date: '2021-11-10' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `sc.exe` with command-line arguments - utilized to start a Windows Service on a remote endpoint. Red Teams and adversaries - alike may abuse the Service Control Manager for lateral movement and remote code - execution. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: sc.exe - selection2: - Image|endswith: sc.exe - selection3: - CommandLine: '*start*' - selection4: - CommandLine: '*\\\\*' - condition: (selection1 or selection2) and selection3 and selection4 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -known_false_positives: Administrators may start Windows Services on remote systems, - but this activity is usually limited to a small set of hosts or users. -references: -- https://docs.microsoft.com/en-us/windows/win32/services/controlling-a-service-using-sc -- https://attack.mitre.org/techniques/T1543/003/ -tags: - analytic_story: - - Active Directory Lateral Movement - asset_type: Endpoint - confidence: 60 - impact: 90 - message: A Windows Service was started on a remote endpoint from $dest - mitre_attack_id: - - T1543 - - T1543.003 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 54 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_service_stop_via_net__and_sc_application.yml b/dev/endpoint/windows_service_stop_via_net__and_sc_application.yml deleted file mode 100644 index c7be7829f6..0000000000 --- a/dev/endpoint/windows_service_stop_via_net__and_sc_application.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Windows Service Stop Via Net and SC Application -id: 827af04b-0d08-479b-9b84-b7d4644e4b80 -version: 1 -date: '2022-11-30' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic identifies suspicious attempts to stop services on a system - using either `net.exe` or `sc.exe`. This technique is used by adversaries to terminate - security services or other related services to continue their objective and evade - detections. This technique is also commonly used by ransomware threat actors to - successfully encrypt databases or files being processed or used by Windows OS Services. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: net.exe - selection2: - Image|endswith: net.exe - selection3: - Image|endswith: net1.exe - selection4: - OriginalFileName: net1.exe - selection5: - Image|endswith: sc.exe - selection6: - CommandLine: '*stop*' - OriginalFileName: sc.exe - condition: (selection1 or selection2 or selection3 or selection4) or selection5 - or selection6 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Windows OS or software may stop and restart services due to - some critical update. -references: -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Prestige Ransomware - asset_type: Endpoint - confidence: 70 - impact: 70 - message: $process$ was executed on $dest$ attempting to stop service. - mitre_attack_id: - - T1489 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/prestige_ransomware/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml b/dev/endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml deleted file mode 100644 index 9a511149f3..0000000000 --- a/dev/endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Windows Steal or Forge Kerberos Tickets Klist -id: 09d88404-1e29-46cb-806c-1eedbc85ad5d -version: 1 -date: '2022-11-30' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: The following analytic identifies a process execution of Windows OS klist.exe - tool. This tool is being abused or used by several post exploitation tool such as - winpeas that being used by ransomware prestige to display or gather list of currently - cached kerberos ticket. This cahced data can be used for lateral movement or even - privilege escalation on the targeted host. This hunting query can be a good pivot - in possible kerberos attack or pass the hash technique. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - cmd.exe - - powershell* - OriginalFileName: klist.exe - selection2: - Image|endswith: klist.exe - condition: selection1 or selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. -known_false_positives: unknown -references: -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 30 - impact: 30 - message: process klist.exe executed in $dest$ - mitre_attack_id: - - T1558 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/dev/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml deleted file mode 100644 index f0ca8ca4a5..0000000000 --- a/dev/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Windows System Binary Proxy Execution Compiled HTML File Decompile -id: 2acf0e19-4149-451c-a3f3-39cd3c77e37d -version: 1 -date: '2022-08-31' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the decompile parameter with the HTML - Help application, HH.exe. This is a uncommon command to see ran and behavior. Most - recently this was seen in a APT41 campaign where a CHM file was delivered and a - script inside used a technique for running an arbitrary command in a CHM file via - an ActiveX object. This unpacks an HTML help file to a specified path for launching - the next stage. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: HH.EXE - selection2: - Image|endswith: hh.exe - selection3: - CommandLine: '*-decompile*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited, filter as needed. -references: -- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/ -- https://redcanary.com/blog/introducing-atomictestharnesses/ -- https://attack.mitre.org/techniques/T1218/001/ -- https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa -tags: - analytic_story: - - Suspicious Compiled HTML Activity - - Living Off The Land - asset_type: Endpoint - confidence: 90 - impact: 100 - message: $process_name$ has been identified using decompile against a CHM on $dest$ - under user $user$. - mitre_attack_id: - - T1218.001 - - T1218 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/hh_decom_windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_system_discovery_using_ldap_nslookup.yml b/dev/endpoint/windows_system_discovery_using_ldap_nslookup.yml deleted file mode 100644 index 3f2e7acc6b..0000000000 --- a/dev/endpoint/windows_system_discovery_using_ldap_nslookup.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Windows System Discovery Using ldap Nslookup -id: 2418780f-7c3e-4c45-b8b4-996ea850cd49 -version: 1 -date: '2022-10-21' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: The following analytic identifies the execution of nslookup.exe tool - to get domain information. Nslookup.exe is a command-line tool that can display - information to diagnose domain name systems. This Nslookup feature is being abused - by Qakbot malware to gather domain information such as SRV service location records, - server name and many more. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: nslookup.exe - selection2: - Image|endswith: nslookup.exe - selection3: - CommandLine: '*_ldap._tcp.dc._msdcs*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: dministrator may execute this commandline tool for auditing - purposes. Filter as needed. -references: -- https://securelist.com/qakbot-technical-analysis/103931/ -- https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/verify-srv-dns-records-have-been-created -tags: - analytic_story: - - Qakbot - asset_type: Endpoint - confidence: 50 - impact: 50 - message: System nslookup domain discovery on $dest$ - mitre_attack_id: - - T1033 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/qakbot_discovery_cmdline/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_system_discovery_using_qwinsta.yml b/dev/endpoint/windows_system_discovery_using_qwinsta.yml deleted file mode 100644 index e44d8fe6f3..0000000000 --- a/dev/endpoint/windows_system_discovery_using_qwinsta.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Windows System Discovery Using Qwinsta -id: 2e765c1b-144a-49f0-93d0-1df4287cca04 -version: 1 -date: '2022-10-21' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: The following analytic identifies the execution of qwinsta.exe executable - in Windows Operating System. This Windows executable file can display information - about sessions on a remote desktop session host server. The information includes - servername, sessionname, username and many more. This tool is being abused of Qakbot - malware to gather information to the targeted or compromised host that will be send - back to its Command And Control server. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: qwinsta.exe - selection2: - Image|endswith: qwinsta.exe - condition: selection1 or selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Administrator may execute this commandline tool for auditing - purposes. Filter as needed. -references: -- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/qwinsta -- https://securelist.com/qakbot-technical-analysis/103931/ -tags: - analytic_story: - - Qakbot - asset_type: Endpoint - confidence: 50 - impact: 50 - message: System qwinsta domain discovery on $dest$ - mitre_attack_id: - - T1033 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/qakbot_discovery_cmdline/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_system_file_on_disk.yml b/dev/endpoint/windows_system_file_on_disk.yml deleted file mode 100644 index f1bc450da3..0000000000 --- a/dev/endpoint/windows_system_file_on_disk.yml +++ /dev/null @@ -1,55 +0,0 @@ -name: Windows System File on Disk -id: 993ce99d-9cdd-42c7-a2cf-733d5954e5a6 -version: 2 -date: '2022-05-16' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following hunting analytic will assist with identifying new .sys - files introduced in the environment. This query is meant to identify sys file creates - on disk. There will be noise, but reducing common process names or applications - should help to limit any volume. The idea is to identify new sys files written to - disk and identify them before they're added as a new kernel mode driver. -data_source: -- Sysmon Event ID 11 -search: - selection1: - Filesystem.file_name: '*.sys*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on files from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. - In addition, confirm the latest CIM App 4.20 or higher is installed and the latest - TA for the endpoint product. In addition, filtering may occur by adding NOT (Filesystem.file_path - IN ("*\\Windows\\*", "*\\Program File*", "*\\systemroot\\*","%SystemRoot%*", "system32\*")). - This will level out the noise generated to potentally lead to generating notables. -known_false_positives: False positives will be present. Filter as needed. -references: -- https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ -tags: - analytic_story: - - Windows Drivers - - CISA AA22-264A - asset_type: Endpoint - confidence: 50 - impact: 20 - message: A new driver is present on $dest$. - mitre_attack_id: - - T1068 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 10 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/drivers/sysmon_sys_filemod.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_system_network_config_discovery_display_dns.yml b/dev/endpoint/windows_system_network_config_discovery_display_dns.yml deleted file mode 100644 index 22c07667ed..0000000000 --- a/dev/endpoint/windows_system_network_config_discovery_display_dns.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Windows System Network Config Discovery Display DNS -id: e24f0a0e-41a9-419f-9999-eacab15efc36 -version: 1 -date: '2022-11-30' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: The following analytic identifies a process command line that retrieves - dns reply information using Windows OS built-in tool IPConfig. This technique is - being abused by threat actors, adversaries and post exploitation tools like WINPEAS - to retrieve DNS information for the targeted host. This IPConfig parameter (/displaydns) - can show dns server resource record, record name, record type, time to live data - length and dns reply. This hunting detection can be a good pivot to check which - process is executing this command line in specific host system that may lead to - malware or adversaries gathering network information. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*/displaydns*' - OriginalFileName: ipconfig.exe - selection2: - Image|endswith: ipconfig.exe - condition: selection1 or selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. -known_false_positives: unknown -references: -- https://superuser.com/questions/230308/explain-output-of-ipconfig-displaydns -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 30 - impact: 30 - message: process $process_name$ with commandline $process$ is executed in $dest$ - mitre_attack_id: - - T1016 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_system_network_connections_discovery_netsh.yml b/dev/endpoint/windows_system_network_connections_discovery_netsh.yml deleted file mode 100644 index 25ca26a428..0000000000 --- a/dev/endpoint/windows_system_network_connections_discovery_netsh.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Windows System Network Connections Discovery Netsh -id: abfb7cc5-c275-4a97-9029-62cd8d4ffeca -version: 1 -date: '2022-11-30' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: The following analytic identifies a process execution of Windows OS built-in - tool netsh.exe to show state, configuration and profile of host firewall. This tool - is being used or abused by several adversaries or even post exploitation tool to - bypass firewall rules or to discover firewall settings. This hunting detection can - help to detect a possible suspicious usage of netsh.exe to retrieve firewall settings - or even firewall wlan profile. We recommend checking which parent process and process - name execute this command. Also check the process file path for verification that - may lead to further TTP's threat behavior. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: netsh.exe - selection2: - Image|endswith: netsh.exe - selection3: - CommandLine: - - '*state*' - - '*config*' - - '*wlan*' - - '*profile*' - selection4: - CommandLine: '* show *' - condition: (selection1 or selection2) and selection3 and selection4 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. -known_false_positives: network administrator can use this tool for auditing process. -references: -- https://attack.mitre.org/techniques/T1049/ -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 30 - impact: 30 - message: netsh process with command line $process$ in $dest$ - mitre_attack_id: - - T1049 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml b/dev/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml deleted file mode 100644 index 7bdbfcdcb8..0000000000 --- a/dev/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Windows System Script Proxy Execution Syncappvpublishingserver -id: 8dd73f89-682d-444c-8b41-8e679966ad3c -version: 1 -date: '2022-09-26' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the abuse of Syncappvpublishingserver.vbs, - which is a native script on Windows that may be utilized to download remote files - or perform privilege escalation. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*syncappvpublishingserver.vbs*' - Image|endswith: - - wscript.exe - - cscript.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present if the vbscript syncappvpublishingserver - is used for legitimate purposes. Filter as needed. Adding a n; to the command-line - arguments may help reduce any noise. -references: -- https://lolbas-project.github.io/lolbas/Scripts/Syncappvpublishingserver/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1216/T1216.md#atomic-test-1---syncappvpublishingserver-signed-script-powershell-command-execution -tags: - analytic_story: - - Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to download files or evade critical - controls. - mitre_attack_id: - - T1216 - - T1218 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1216/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_system_user_discovery_via_quser.yml b/dev/endpoint/windows_system_user_discovery_via_quser.yml deleted file mode 100644 index 4ec18a59a8..0000000000 --- a/dev/endpoint/windows_system_user_discovery_via_quser.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Windows System User Discovery Via Quser -id: 0c3f3e09-e47a-410e-856f-a02a5c5fafb0 -version: 1 -date: '2022-11-30' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: The following analytic identifies a process execution of Windows OS quser.exe - tool. This tool is being abused or used by several post exploitation tool such as - winpeas that being used by ransomware prestige to display or gather information - about user sessions on a Remote Desktop Session Host server. This command can find - out if a specific user is logged on to a specific Remote Desktop Session Host server. - This tool can retrieve some RDP information that can be use by attacker for further - attack like Name of the user , Name of the session on the Remote Desktop Session - Host server, Session ID, State of the session (active or disconnected), Idle time - (the number of minutes since the last keystroke or mouse movement at the session) - and Date and time the user logged on. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: quser.exe - selection2: - Image|endswith: quser.exe - condition: selection1 or selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. -known_false_positives: network administrator can use this command tool to audit RDP - access of user in specific network or host. -references: -- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/quser -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 30 - impact: 30 - message: execution of process $process_name$ in $dest$ - mitre_attack_id: - - T1033 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_wmi_process_and_service_list.yml b/dev/endpoint/windows_wmi_process_and_service_list.yml deleted file mode 100644 index 526919dcb1..0000000000 --- a/dev/endpoint/windows_wmi_process_and_service_list.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Windows WMI Process And Service List -id: ef3c5ef2-3f6d-4087-aa75-49bf746dc907 -version: 1 -date: '2022-11-30' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic identifies suspicious process command line, where - WMI is performing an event query looking for running processes or running services. - This technique is commonly found where the adversary will identify services and - system information on the compromised machine. During triage, review parallel processes - within the same timeframe. Review the full script block to identify other related - artifacts. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: wmic.exe - selection2: - Image|endswith: wmic.exe - selection3: - CommandLine: - - '*process list*' - - '*service list*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. -known_false_positives: netowrk administrator or IT may execute this command for auditing - processes and services. -references: -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 20 - impact: 20 - message: wmi command $process$ to list processes and services in $dest$ - mitre_attack_id: - - T1047 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 4 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_wmi_process_call_create.yml b/dev/endpoint/windows_wmi_process_call_create.yml deleted file mode 100644 index cd9d38c459..0000000000 --- a/dev/endpoint/windows_wmi_process_call_create.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Windows WMI Process Call Create -id: 0661c2de-93de-11ec-9833-acde48001122 -version: 1 -date: '2022-02-22' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: This analytic is to look for wmi commandlines to execute or create process. - This technique was used by adversaries or threat actor to execute their malicious - payload in local or remote host. This hunting query is a good pivot to start to - look further which process trigger the wmi or what process it execute locally or - remotely. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: wmic.exe - selection2: - Image|endswith: wmic.exe - selection3: - CommandLine: '* process *' - selection4: - CommandLine: '* call *' - selection5: - CommandLine: '* create *' - condition: (selection1 or selection2) and selection3 and selection4 and selection5 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrators may execute this command for testing or auditing. -references: -- https://github.com/NVISOsecurity/sigma-public/blob/master/rules/windows/process_creation/win_susp_wmi_execution.yml -- https://github.com/redcanaryco/atomic-red-team/blob/2b804d25418004a5f1ba50e9dc637946ab8733c7/atomics/T1047/T1047.md -tags: - analytic_story: - - Suspicious WMI Use - - Qakbot - asset_type: Endpoint - confidence: 50 - impact: 50 - message: process with $process$ commandline executed in $dest$ - mitre_attack_id: - - T1047 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/winhlp32_spawning_a_process.yml b/dev/endpoint/winhlp32_spawning_a_process.yml deleted file mode 100644 index 75abe361eb..0000000000 --- a/dev/endpoint/winhlp32_spawning_a_process.yml +++ /dev/null @@ -1,77 +0,0 @@ -name: Winhlp32 Spawning a Process -id: d17dae9e-2618-11ec-b9f5-acde48001122 -version: 1 -date: '2021-10-05' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies winhlp32.exe, found natively in `c:\windows\`, - spawning a child process that loads a file out of appdata, programdata, or temp. - Winhlp32.exe has a rocky past in that multiple vulnerabilities were found and added - to MetaSploit. WinHlp32.exe is required to display 32-bit Help files that have the - ".hlp" file name extension. This particular instance is related to a Remcos sample - where dynwrapx.dll is added to the registry under inprocserver32, and later module - loaded by winhlp32.exe to spawn wscript.exe and load a vbs or file from disk. During - triage, review parallel processes to identify further suspicious behavior. Review - module loads for unsuspecting unsigned modules. Capture any file modifications and - analyze. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*\\appdata\\*' - - '*\\programdata\\*' - - '*\\temp\\*' - ParentImage: winhlp32.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited as winhlp32.exe is typically - not used with the latest flavors of Windows OS. However, filter as needed. -references: -- https://www.exploit-db.com/exploits/16541 -- https://tria.ge/210929-ap75vsddan -- https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89 -tags: - analytic_story: - - Remcos - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$, and is not typical activity for this process. - mitre_attack_id: - - T1055 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/winrm_spawning_a_process.yml b/dev/endpoint/winrm_spawning_a_process.yml deleted file mode 100644 index a8cf2f42de..0000000000 --- a/dev/endpoint/winrm_spawning_a_process.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: WinRM Spawning a Process -id: a081836a-ba4d-11eb-8593-acde48001122 -version: 1 -date: '2021-05-21' -author: Drew Church, Michael Haag, Splunk -status: experimental -type: TTP -description: The following analytic identifies suspicious processes spawning from - WinRM (wsmprovhost.exe). This analytic is related to potential exploitation of CVE-2021-31166. - which is a kernel-mode device driver http.sys vulnerability. Current proof of concept - code will blue-screen the operating system. However, http.sys used by many different - Windows processes, including WinRM. In this case, identifying suspicious process - create (child processes) from `wsmprovhost.exe` is what this analytic is identifying. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - cmd.exe - - sh.exe - - bash.exe - - powershell.exe - - pwsh.exe - - schtasks.exe - - certutil.exe - - whoami.exe - - bitsadmin.exe - - scp.exe - ParentImage: wsmprovhost.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Unknown. Add new processes or filter as needed. It is possible - system management software may spawn processes from `wsmprovhost.exe`. -references: -- https://github.com/SigmaHQ/sigma/blob/9b7fb0c0f3af2e53ed483e29e0d0f88ccf1c08ca/rules/windows/process_access/win_susp_shell_spawn_from_winrm.yml -- https://www.zerodayinitiative.com/blog/2021/5/17/cve-2021-31166-a-wormable-code-execution-bug-in-httpsys -- https://github.com/0vercl0k/CVE-2021-31166/blob/main/cve-2021-31166.py -tags: - analytic_story: - - Unusual Processes - asset_type: Endpoint - confidence: 50 - cve: - - CVE-2021-31166 - impact: 50 - message: tbd - mitre_attack_id: - - T1190 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint diff --git a/dev/endpoint/winword_spawning_cmd.yml b/dev/endpoint/winword_spawning_cmd.yml deleted file mode 100644 index 493a5faaa4..0000000000 --- a/dev/endpoint/winword_spawning_cmd.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Winword Spawning Cmd -id: 6fcbaedc-a37b-11eb-956b-acde48001122 -version: 2 -date: '2021-04-22' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following detection identifies Microsoft Word spawning `cmd.exe`. - Typically, this is not common behavior and not default with winword.exe. Winword.exe - will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` - (version will vary). Cmd.exe spawning from winword.exe is common for a spearphishing - attachment and is actively used. Albeit, the command-line will indicate what is - being executed. During triage, review parallel processes and identify any files - that may have been written. It is possible that COM is utilized to trampoline the - child process to `explorer.exe` or `wmiprvse.exe`. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: winword.exe - selection2: - OriginalFileName: Cmd.Exe - selection3: - Image|endswith: cmd.exe - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited, but if any are present, - filter as needed. -references: -- https://app.any.run/tasks/73af0064-a785-4c0a-ab0d-cde593fe16ef/ -tags: - analytic_story: - - Spearphishing Attachments - - DarkCrystal RAT - asset_type: Endpoint - confidence: 100 - impact: 70 - message: '$parent_process_name$ on $dest$ by $user$ launched command: $process_name$ - which is very common in spearphishing attacks.' - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - - name: process_name - type: Process - role: - - Target - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 70 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/winword_spawning_powershell.yml b/dev/endpoint/winword_spawning_powershell.yml deleted file mode 100644 index 2abaf88ed2..0000000000 --- a/dev/endpoint/winword_spawning_powershell.yml +++ /dev/null @@ -1,82 +0,0 @@ -name: Winword Spawning PowerShell -id: b2c950b8-9be2-11eb-8658-acde48001122 -version: 2 -date: '2021-04-12' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following detection identifies Microsoft Word spawning PowerShell. - Typically, this is not common behavior and not default with winword.exe. Winword.exe - will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` - (version will vary). PowerShell spawning from winword.exe is common for a spearphishing - attachment and is actively used. Albeit, the command executed will most likely be - encoded and captured via another detection. During triage, review parallel processes - and identify any files that may have been written. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: winword.exe - selection2: - OriginalFileName: pwsh.dll - selection3: - Image|endswith: - - pwsh.exe - - sqlps.exe - - sqltoolsps.exe - - powershell.exe - - powershell_ise.exe - selection4: - OriginalFileName: PowerShell.EXE - selection5: - OriginalFileName: powershell_ise.EXE - condition: selection1 and selection2 and selection3 and selection4 and selection5 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited, but if any are present, - filter as needed. -references: -- https://redcanary.com/threat-detection-report/techniques/powershell/ -- https://attack.mitre.org/techniques/T1566/001/ -- https://app.any.run/tasks/b79fa381-f35c-4b3e-8d02-507e7ee7342f/ -- https://app.any.run/tasks/181ac90b-0898-4631-8701-b778a30610ad/ -tags: - analytic_story: - - Spearphishing Attachments - - DarkCrystal RAT - asset_type: Endpoint - confidence: 100 - impact: 70 - message: '$parent_process_name$ on $dest$ by $user$ launched the following powershell - process: $process_name$ which is very common in spearphishing attacks' - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - - name: process_name - type: Process - role: - - Target - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 70 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/winword_spawning_windows_script_host.yml b/dev/endpoint/winword_spawning_windows_script_host.yml deleted file mode 100644 index 034cfc6932..0000000000 --- a/dev/endpoint/winword_spawning_windows_script_host.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Winword Spawning Windows Script Host -id: 637e1b5c-9be1-11eb-9c32-acde48001122 -version: 1 -date: '2021-04-12' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following detection identifies Microsoft Winword.exe spawning Windows - Script Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior - and not default with Winword.exe. Winword.exe will generally be found in the following - path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). `cscript.exe` - or `wscript.exe` default location is `c:\windows\system32\` or c:windows\syswow64\`. - `cscript.exe` or `wscript.exe` spawning from Winword.exe is common for a spearphishing - attachment and is actively used. Albeit, the command-line executed will most likely - be obfuscated and captured via another detection. During triage, review parallel - processes and identify any files that may have been written. Review the reputation - of the remote destination and block accordingly. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - cscript.exe - - wscript.exe - ParentImage: winword.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: There will be limited false positives and it will be different - for every environment. Tune by child process or command-line as needed. -references: -- https://attack.mitre.org/techniques/T1566/001/ -tags: - analytic_story: - - Spearphishing Attachments - asset_type: Endpoint - confidence: 100 - impact: 70 - message: User $user$ on $dest$ spawned Windows Script Host from Winword.exe - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - - name: process_name - type: Process - role: - - Target - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 70 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_wsh.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/wmic_group_discovery.yml b/dev/endpoint/wmic_group_discovery.yml deleted file mode 100644 index 088e595d4b..0000000000 --- a/dev/endpoint/wmic_group_discovery.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Wmic Group Discovery -id: 83317b08-155b-11ec-8e00-acde48001122 -version: 1 -date: '2021-09-14' -author: Michael Haag, Splunk -status: production -type: Hunting -description: 'The following hunting analytic identifies the use of `wmic.exe` enumerating - local groups on the endpoint. - - Typically, by itself, is not malicious but may raise suspicion based on time of - day, endpoint and username. - - During triage, review parallel processes and identify any further suspicious behavior.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*group get name*' - Image|endswith: wmic.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1069/001/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Local group discovery on $dest$ by $user$. - mitre_attack_id: - - T1069 - - T1069.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/wmic_noninteractive_app_uninstallation.yml b/dev/endpoint/wmic_noninteractive_app_uninstallation.yml deleted file mode 100644 index ca4f52c35e..0000000000 --- a/dev/endpoint/wmic_noninteractive_app_uninstallation.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Wmic NonInteractive App Uninstallation -id: bff0e7a0-317f-11ec-ab4e-acde48001122 -version: 2 -date: '2022-07-19' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: This analytic indentifies WMIC command-line attempting to uninstall application - non-interactively. This technique was seen in IcedID to uninstall AV products on - the compromised host to evade detection. This Hunting query maybe a good indicator - that some process tries to uninstall application using wmic which is not a common - behavior. This approach may seen in some script or third part appication to uninstall - their application but it is a good thing to check what it uninstall and why. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '* product *' - Image|endswith: wmic.exe - selection2: - CommandLine: '*where name*' - selection3: - CommandLine: '*call uninstall*' - selection4: - CommandLine: '*/nointeractive*' - condition: selection1 and selection2 and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Third party application may use this approach to uninstall - applications. -references: -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ -tags: - analytic_story: - - IcedID - - Azorult - asset_type: Endpoint - confidence: 50 - impact: 50 - message: Wmic $process_name$ with command-line $process$ on $dest$ attempting to - uninstall software. - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - - name: process_name - type: Process - role: - - Target - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon2.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/wmic_xsl_execution_via_url.yml b/dev/endpoint/wmic_xsl_execution_via_url.yml deleted file mode 100644 index b8bcedbe15..0000000000 --- a/dev/endpoint/wmic_xsl_execution_via_url.yml +++ /dev/null @@ -1,79 +0,0 @@ -name: WMIC XSL Execution via URL -id: 787e9dd0-4328-11ec-a029-acde48001122 -version: 1 -date: '2021-11-11' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible - Stylesheet Language) script. This originally was identified by Casey Smith, dubbed - Squiblytwo, as an application control bypass. Many adversaries will utilize this - technique to invoke JScript or VBScript within an XSL file. This technique can also - execute local/remote scripts and, similar to its Regsvr32 "Squiblydoo" counterpart, - leverages a trusted, built-in Windows tool. Adversaries may abuse any alias in Windows - Management Instrumentation provided they utilize the /FORMAT switch. Upon identifying - a suspicious execution, review for confirmed network connnection and script download. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: wmic.exe - selection2: - Image|endswith: wmic.exe - selection3: - CommandLine: - - '*http://*' - - '*https://*' - selection4: - CommandLine: '*/format:*' - condition: (selection1 or selection2) and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives are limited as legitimate applications typically - do not download files or xsl using WMIC. Filter as needed. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md -- https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md#atomic-test-4---wmic-bypass-using-remote-xsl-file -tags: - analytic_story: - - Suspicious WMI Use - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ utilizing wmic to download a remote XSL script. - mitre_attack_id: - - T1220 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1220/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/wmiprsve_lolbas_execution_process_spawn.yml b/dev/endpoint/wmiprsve_lolbas_execution_process_spawn.yml deleted file mode 100644 index 7a45818116..0000000000 --- a/dev/endpoint/wmiprsve_lolbas_execution_process_spawn.yml +++ /dev/null @@ -1,111 +0,0 @@ -name: Wmiprsve LOLBAS Execution Process Spawn -id: 95a455f0-4c04-11ec-b8ac-3e22fbd008af -version: 1 -date: '2021-11-22' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution - process. When adversaries execute code on remote endpoints abusing Windows Management - Instrumentation (WMI), the executed command is spawned as a child process of `wmiprvse.exe`. - The LOLBAS project documents Windows native binaries that can be abused by threat - actors to perform tasks like executing malicious code. Looking for child processes - of wmiprvse.exe that are part of the LOLBAS project can help defenders identify - lateral movement activity. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - Regsvcs.exe - - Ftp.exe - - OfflineScannerShell.exe - - Rasautou.exe - - Schtasks.exe - - Xwizard.exe - - Dllhost.exe - - Pnputil.exe - - Atbroker.exe - - Pcwrun.exe - - Ttdinject.exe - - Mshta.exe - - Bitsadmin.exe - - Certoc.exe - - Ieexec.exe - - Microsoft.Workflow.Compiler.exe - - Runscripthelper.exe - - Forfiles.exe - - Msbuild.exe - - Register-cimprovider.exe - - Tttracer.exe - - Ie4uinit.exe - - Bash.exe - - Hh.exe - - SettingSyncHost.exe - - Cmstp.exe - - Mmc.exe - - Stordiag.exe - - Scriptrunner.exe - - Odbcconf.exe - - Extexport.exe - - Msdt.exe - - WorkFolders.exe - - Diskshadow.exe - - Mavinject.exe - - Regasm.exe - - Gpscript.exe - - Rundll32.exe - - Regsvr32.exe - - Msiexec.exe - - Wuauclt.exe - - Presentationhost.exe - - Wmic.exe - - Runonce.exe - - Syncappvpublishingserver.exe - - Verclsid.exe - - Infdefaultinstall.exe - - Explorer.exe - - Installutil.exe - - Netsh.exe - - Wab.exe - - Dnscmd.exe - - At.exe - - Pcalua.exe - - Msconfig.exe - ParentImage: wmiprvse.exe - condition: (selection1) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -known_false_positives: Legitimate applications may trigger this behavior, filter as - needed. -references: -- https://attack.mitre.org/techniques/T1047/ -- https://www.ired.team/offensive-security/lateral-movement/t1047-wmi-for-lateral-movement -- https://lolbas-project.github.io/ -tags: - analytic_story: - - Active Directory Lateral Movement - asset_type: Endpoint - confidence: 60 - impact: 90 - message: Wmiprsve.exe spawned a LOLBAS process on $dest$. - mitre_attack_id: - - T1047 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 54 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement_lolbas/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/wscript_or_cscript_suspicious_child_process.yml b/dev/endpoint/wscript_or_cscript_suspicious_child_process.yml deleted file mode 100644 index 8657786e76..0000000000 --- a/dev/endpoint/wscript_or_cscript_suspicious_child_process.yml +++ /dev/null @@ -1,76 +0,0 @@ -name: Wscript Or Cscript Suspicious Child Process -id: 1f35e1da-267b-11ec-90a9-acde48001122 -version: 1 -date: '2021-10-06' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic identifies a suspicious spawned process by WScript or CScript - process. This technique was a common technique used by adversaries and malware to - execute different LOLBIN, other scripts like PowerShell or spawn a suspended process - to inject its code as a defense evasion. This TTP may detect some normal script - that using several application tool that are in the list of the child process it - detects but a good pivot and indicator that a script is may execute suspicious code. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - regsvr32.exe - - rundll32.exe - - winhlp32.exe - - certutil.exe - - msbuild.exe - - cmd.exe - - powershell* - - wmic.exe - - mshta.exe - ParentImage: - - cscript.exe - - wscript.exe - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrators may create vbs or js script that use several - tool as part of its execution. Filter as needed. -references: -- https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -tags: - analytic_story: - - FIN7 - - Remcos - - Unusual Processes - - WhisperGate - asset_type: Endpoint - confidence: 70 - impact: 70 - message: wscript or cscript parent process spawned $process_name$ in $dest$ - mitre_attack_id: - - T1055 - - T1543 - - T1134.004 - - T1134 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml b/dev/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml deleted file mode 100644 index 81a3fc51d2..0000000000 --- a/dev/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml +++ /dev/null @@ -1,112 +0,0 @@ -name: Wsmprovhost LOLBAS Execution Process Spawn -id: 2eed004c-4c0d-11ec-93e8-3e22fbd008af -version: 1 -date: '2021-11-22' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: The following analytic identifies `Wsmprovhost.exe` spawning a LOLBAS - execution process. When adversaries execute code on remote endpoints abusing the - Windows Remote Management (WinRm) protocol, the executed command is spawned as a - child processs of `Wsmprovhost.exe`. The LOLBAS project documents Windows native - binaries that can be abused by threat actors to perform tasks like executing malicious - code. Looking for child processes of Wsmprovhost.exe that are part of the LOLBAS - project can help defenders identify lateral movement activity. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - Regsvcs.exe - - Ftp.exe - - OfflineScannerShell.exe - - Rasautou.exe - - Schtasks.exe - - Xwizard.exe - - Dllhost.exe - - Pnputil.exe - - Atbroker.exe - - Pcwrun.exe - - Ttdinject.exe - - Mshta.exe - - Bitsadmin.exe - - Certoc.exe - - Ieexec.exe - - Microsoft.Workflow.Compiler.exe - - Runscripthelper.exe - - Forfiles.exe - - Msbuild.exe - - Register-cimprovider.exe - - Tttracer.exe - - Ie4uinit.exe - - Bash.exe - - Hh.exe - - SettingSyncHost.exe - - Cmstp.exe - - Mmc.exe - - Stordiag.exe - - Scriptrunner.exe - - Odbcconf.exe - - Extexport.exe - - Msdt.exe - - WorkFolders.exe - - Diskshadow.exe - - Mavinject.exe - - Regasm.exe - - Gpscript.exe - - Rundll32.exe - - Regsvr32.exe - - Msiexec.exe - - Wuauclt.exe - - Presentationhost.exe - - Wmic.exe - - Runonce.exe - - Syncappvpublishingserver.exe - - Verclsid.exe - - Infdefaultinstall.exe - - Explorer.exe - - Installutil.exe - - Netsh.exe - - Wab.exe - - Dnscmd.exe - - At.exe - - Pcalua.exe - - Msconfig.exe - ParentImage: wsmprovhost.exe - condition: (selection1) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -known_false_positives: Legitimate applications may trigger this behavior, filter as - needed. -references: -- https://attack.mitre.org/techniques/T1021/006/ -- https://lolbas-project.github.io/ -- https://pentestlab.blog/2018/05/15/lateral-movement-winrm/ -tags: - analytic_story: - - Active Directory Lateral Movement - asset_type: Endpoint - confidence: 60 - impact: 90 - message: Wsmprovhost.exe spawned a LOLBAS process on $dest$. - mitre_attack_id: - - T1021 - - T1021.006 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 54 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_lolbas/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/wsreset_uac_bypass.yml b/dev/endpoint/wsreset_uac_bypass.yml deleted file mode 100644 index 1d03e9a4d9..0000000000 --- a/dev/endpoint/wsreset_uac_bypass.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: WSReset UAC Bypass -id: 8b5901bc-da63-11eb-be43-acde48001122 -version: 2 -date: '2020-01-28' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious modification of registry related - to UAC bypass. This technique is to modify the registry in this detection, create - a registry value with the path of the payload and run WSreset.exe to bypass User - account Control. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: - - DelegateExecute - - (Default) - TargetObject: '*\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command*' - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: unknown -references: -- https://github.com/hfiref0x/UACME -- https://blog.morphisec.com/trickbot-uses-a-new-windows-10-uac-bypass -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Living Off The Land - - Windows Registry Abuse - asset_type: Endpoint - confidence: 90 - impact: 70 - message: Suspicious modification of registry $registry_path$ with possible payload - path $registry_value_name$ in $dest$ - mitre_attack_id: - - T1548.002 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/xsl_script_execution_with_wmic.yml b/dev/endpoint/xsl_script_execution_with_wmic.yml deleted file mode 100644 index bfb7c5b194..0000000000 --- a/dev/endpoint/xsl_script_execution_with_wmic.yml +++ /dev/null @@ -1,76 +0,0 @@ -name: XSL Script Execution With WMIC -id: 004e32e2-146d-11ec-a83f-acde48001122 -version: 1 -date: '2021-09-13' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious wmic.exe process or renamed wmic - process to execute malicious xsl file. This technique was seen in FIN7 to execute - its malicous jscript using the .xsl as the loader with the help of wmic.exe process. - This TTP is really a good indicator for you to hunt further for FIN7 or other attacker - that known to used this technique. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: wmic.exe - selection2: - Image|endswith: wmic.exe - selection3: - CommandLine: '*os get*' - selection4: - CommandLine: '*/format:*' - selection5: - CommandLine: '*.xsl*' - condition: (selection1 or selection2) and selection3 and selection4 and selection5 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: unknown -references: -- https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation -- https://attack.mitre.org/groups/G0046/ -- https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md#atomic-test-3---wmic-bypass-using-local-xsl-file -tags: - analytic_story: - - FIN7 - - Suspicious WMI Use - asset_type: Endpoint - confidence: 70 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ utilizing wmic to load a XSL script. - mitre_attack_id: - - T1220 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev_ssa/endpoint/ssa___anomalous_usage_of_archive_tools.yml b/dev_ssa/endpoint/ssa___anomalous_usage_of_archive_tools.yml deleted file mode 100644 index 36b8814c2f..0000000000 --- a/dev_ssa/endpoint/ssa___anomalous_usage_of_archive_tools.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Anomalous usage of Archive Tools -id: 63614a58-10e2-4c6c-ae81-ea1113681439 -version: 4 -date: '2021-11-22' -author: Patrick Bareiss, Splunk -status: production -type: Anomaly -description: The following detection identifies the usage of archive tools from the - command line. -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: WinRAR.exe - selection2: - process.file.name|startswith: 7z - selection3: - process.file.name|startswith: winzip - selection4: - actor.process.file.name|endswith: - - powershell.exe - - cmd.exe - condition: (selection1 or selection2 or selection3) and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: False positives can be ligitmate usage of archive tools from - the command line. -references: -- https://attack.mitre.org/techniques/T1560/001/ -tags: - analytic_story: - - Cobalt Strike - - NOBELIUM Group - - Insider Threat - asset_type: Endpoint - confidence: 60 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading - of 7zip. - mitre_attack_id: - - T1560.001 - - T1560 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 42 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_tools/windows-security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___attacker_tools_on_endpoint.yml b/dev_ssa/endpoint/ssa___attacker_tools_on_endpoint.yml deleted file mode 100644 index f7153a0c0a..0000000000 --- a/dev_ssa/endpoint/ssa___attacker_tools_on_endpoint.yml +++ /dev/null @@ -1,93 +0,0 @@ -name: Attacker Tools On Endpoint -id: 241b1159-cf78-4201-8fad-1c21c3c96213 -version: 1 -date: '2024-03-19' -author: Patrick Bareiss, Splunk -status: validation -type: TTP -description: The following analytic detects the use of tools that are commonly exploited by cybercriminals since these tools are usually associated with malicious activities - such as unauthorized access, network scanning, or data exfiltration and pose a significant threat to an organization's security infrastructure. - It also provides enhanced visibility into potential security threats and helps to proactively detect and respond to mitigate the risks associated with cybercriminal - activities. This detection is made by examining the process activity on the host, specifically focusing on processes that are known to be associated with attacker - tool names. This detection is important because it acts as an early warning system for potential security incidents that allows you to respond to security - incidents promptly. False positives might occur due to legitimate administrative activities that can resemble malicious actions. - You must develop a comprehensive understanding of typical endpoint activities and behaviors within the organization to accurately interpret and - respond to the alerts generated by this analytic. This ensures a proper balance between precision and minimizing false positives. -data_source: -- Windows Security 4688 -search: - selection: - process.cmd_line|contains: - - ADRecon - - ADCollector - - nmap - - PingCastle - - SharpHound - - ACLight - - ADACLScan - - Liza - - LAPSToolkit - - Rubeus - - PassTheCert - - Responder - - Inveigh - - hydra - - mimikatz - - SharpKatz - - nanodump - - PowerSploit - - PowerSharpPack - - PrivescCheck - - Seatbelt - - KrbRelayUp - - SharpImpersonation - - Tokenvator - - bloodyAD - - Nimcrypt - - ProtectMyTooling - - Invoke-Obfuscation - - chameleon - - Covenant - condition: selection -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: Some administrator activity can be potentially triggered, please - add those users to the filter macro. -references: -- https://github.com/Jean-Francois-C/Windows-Penetration-Testing -tags: - analytic_story: - - Monitor for Unauthorized Software - - XMRig - - SamSam Ransomware - - Unusual Processes - - CISA AA22-264A - asset_type: Endpoint - confidence: 80 - impact: 80 - message: An attacker tool $process_name$,listed in attacker_tools.csv is executed - on host $dest$ by User $user$. This process $process_name$ is known to do- $description$ - mitre_attack_id: - - T1036.005 - - T1036 - - T1003 - - T1595 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1595/attacker_scan_tools/windows-security.log - source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog diff --git a/dev_ssa/endpoint/ssa___attempt_to_delete_services.yml b/dev_ssa/endpoint/ssa___attempt_to_delete_services.yml deleted file mode 100644 index 7256d228be..0000000000 --- a/dev_ssa/endpoint/ssa___attempt_to_delete_services.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Attempt To Delete Services -id: a0c8c292-d01a-11eb-aa18-acde48001122 -version: 6 -date: '2021-11-24' -author: Teoderick Contreras, splunk -status: production -type: TTP -description: The following analytic identifies Windows Service Control, `sc.exe`, - attempting to delete a service. This is typically identified in parallel with other - instances of service enumeration of attempts to stop a service and then delete it. - Adversaries utilize this technique to terminate security services or other related - services to continue there objective and evade detections. -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: sc.exe - process.cmd_line|contains: delete - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: It is possible administrative scripts may start/stop/delete - services. Filter as needed. -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md -tags: - analytic_story: - - XMRig - - Ransomware - asset_type: Endpoint - confidence: 60 - impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a service. - mitre_attack_id: - - T1489 - - T1543 - - T1543.003 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 36 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_del.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___attempt_to_disable_services.yml b/dev_ssa/endpoint/ssa___attempt_to_disable_services.yml deleted file mode 100644 index f5daab896d..0000000000 --- a/dev_ssa/endpoint/ssa___attempt_to_disable_services.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Attempt To Disable Services -id: afb31de4-d023-11eb-98d5-acde48001122 -version: 6 -date: '2021-11-24' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies Windows Service Control, `sc.exe`, - attempting to disable a service. This is typically identified in parallel with other - instances of service enumeration of attempts to stop a service and then disable - it. Adversaries utilize this technique to terminate security services or other related - services to continue there objective and evade detections. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|contains: config - selection2: - process.cmd_line|contains: disabled - selection3: - process.file.name: sc.exe - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: It is possible administrative scripts may start/stop/delete - services. Filter as needed. -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service -tags: - analytic_story: - - XMRig - - Ransomware - asset_type: Endpoint - confidence: 60 - impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable a service. - mitre_attack_id: - - T1489 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 36 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_disable.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml deleted file mode 100644 index fc5a3fe3b1..0000000000 --- a/dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Attempted Credential Dump From Registry via Reg exe -id: 14038953-e5f2-4daf-acff-5452062baf03 -version: 7 -date: '2021-11-29' -author: Jose Hernandez, Splunk -status: production -type: TTP -description: The following analytic identifies the use of `reg.exe` attempting to - export Windows registry keys that contain hashed credentials. Adversaries will utilize - this technique to capture and perform offline password cracking. -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: - - reg.exe - - cmd.exe - selection2: - process.cmd_line|re: - - HKEY_LOCAL_MACHINE\\System - - HKEY_LOCAL_MACHINE\\SAM - - HKEY_LOCAL_MACHINE\\Security - - HKLM\\System - - HKLM\\SAM - - HKLM\\Security - selection3: - process.cmd_line|re: save - condition: selection1 and (selection2) and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: None identified. -references: -- https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets -tags: - analytic_story: - - Credential Dumping - asset_type: Endpoint - confidence: 90 - impact: 70 - message: An attempt to save registry keys storing credentials has been performed - on - mitre_attack_id: - - T1003 - - T1003.002 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Actions on Objectives - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___bcdedit_failure_recovery_modification.yml b/dev_ssa/endpoint/ssa___bcdedit_failure_recovery_modification.yml deleted file mode 100644 index 751da8b3bb..0000000000 --- a/dev_ssa/endpoint/ssa___bcdedit_failure_recovery_modification.yml +++ /dev/null @@ -1,52 +0,0 @@ -name: BCDEdit Failure Recovery Modification -id: 76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13 -version: 4 -date: '2021-12-07' -author: Michael Haag, Splunk -status: production -type: TTP -description: This search looks for flags passed to bcdedit.exe modifications to the - built-in Windows error recovery boot configurations. This is typically used by ransomware - to prevent recovery. -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: bcdedit.exe - selection2: - process.cmd_line|contains: 'no' - selection3: - process.cmd_line|contains: recoveryenabled - condition: selection1 and (selection2 and selection3) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint_Processess` datamodel. -known_false_positives: Administrators may modify the boot configuration. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair -tags: - analytic_story: - - Ryuk Ransomware - - Ransomware - - Information Sabotage - asset_type: Endpoint - confidence: 80 - impact: 100 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting disable the ability - to recover the endpoint. - mitre_attack_id: - - T1490 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Actions on Objectives - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-security_bcdedit_wbadmin.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml b/dev_ssa/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml deleted file mode 100644 index 2a07169832..0000000000 --- a/dev_ssa/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml +++ /dev/null @@ -1,50 +0,0 @@ -name: Clear Unallocated Sector Using Cipher App -id: 8f907d90-6173-11ec-9c23-acde48001122 -version: 4 -date: '2021-12-20' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: this search is to detect execution of `cipher.exe` to clear the unallocated - sectors of a specific disk. This technique was seen in some ransomware to make it - impossible to forensically recover deleted files. -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: cipher.exe - process.cmd_line|contains: '/W:' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: administrator may execute this app to manage disk -references: -- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/ -- https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf -tags: - analytic_story: - - Ransomware - - Information Sabotage - asset_type: Endpoint - confidence: 100 - impact: 90 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors - of a specific disk. - mitre_attack_id: - - T1070.004 - - T1070 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.004/cipher/security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___create_local_admin_accounts_using_net_exe.yml b/dev_ssa/endpoint/ssa___create_local_admin_accounts_using_net_exe.yml deleted file mode 100644 index 156e76d606..0000000000 --- a/dev_ssa/endpoint/ssa___create_local_admin_accounts_using_net_exe.yml +++ /dev/null @@ -1,74 +0,0 @@ -name: Create Local Admin Accounts Using Net Exe -id: 890f0937-5a83-48fb-b793-68f792ded5db -version: 3 -date: '2023-10-23' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic detects the creation of local administrator accounts using the net.exe command - to mitigate the risks associated with unauthorized access and prevent further damage to the environment by responding - to potential threats earlier and taking appropriate actions to protect the organization's systems and data. - This detection is made by a Splunk query to search for processes with the name net.exe or net1.exe that include the "/add" - parameter and have specific keywords related to administrator accounts in their process name. - This detection is important because the creation of unauthorized local administrator accounts might indicate that an attacker - has successfully created a new administrator account and is trying to gain persistent access to a system or escalate their - privileges for data theft, or other malicious activities. False positives might occur since there might be legitimate uses of the net.exe - command and the creation of administrator accounts in certain circumstances. - You must consider the context of the activity and other indicators of compromise before taking any action. For next steps, - review the details of the identified process, including the user, parent process, and parent process name. - Examine any relevant on-disk artifacts and look for concurrent processes to determine the source of the attack. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|contains: localgroup - selection2: - process.cmd_line|contains: /add - selection3: - process.cmd_line|contains: - - administrators - - administratoren - - administrateurs - - administrador - - amministratori - - administratorer - selection4: - process.file.name: - - net.exe - - net1.exe - condition: selection1 and selection2 and selection3 and (selection4) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed net.exe may be used. -known_false_positives: System administrators or scripts may add user accounts via - this technique. Filter as needed. -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -tags: - analytic_story: - - XMRig - - Ransomware - asset_type: Endpoint - confidence: 60 - impact: 50 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators - group. - mitre_attack_id: - - T1136.001 - - T1136 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/net_create_user/net_user_security.log - source: XmlWinEventLog:Security - diff --git a/dev_ssa/endpoint/ssa___create_local_user_accounts_using_net_exe.yml b/dev_ssa/endpoint/ssa___create_local_user_accounts_using_net_exe.yml deleted file mode 100644 index 17577c02ae..0000000000 --- a/dev_ssa/endpoint/ssa___create_local_user_accounts_using_net_exe.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Create Local User Accounts Using Net Exe -id: 3e66edb4-b4dc-4b65-b57f-779a88d7d1d9 -version: 6 -date: '2023-10-23' -author: Teoderick Contreras, Mauricio Velazco, Splunk -status: production -type: Anomaly -description: The following analytic detects the creation of local administrator accounts using the net.exe command - to mitigate the risks associated with unauthorized access and prevent further damage to the environment by responding - to potential threats earlier and taking appropriate actions to protect the organization's systems and data. - This detection is made by a Splunk query to search for processes with the name net.exe or net1.exe that include the "/add" - parameter in their process name. - This detection is important because the creation of unauthorized local user accounts might indicate that an attacker - has successfully created a new user account and is trying to gain persistent access to a system or escalate their - privileges for data theft, or other malicious activities. False positives might occur since there might be legitimate uses of the net.exe - command and the creation of user accounts in certain circumstances. - You must consider the context of the activity and other indicators of compromise before taking any action. For next steps, - review the details of the identified process, including the user, parent process, and parent process name. - Examine any relevant on-disk artifacts and look for concurrent processes to determine the source of the attack. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|contains: user - selection2: - process.cmd_line|contains: /add - selection3: - process.file.name: - - net.exe - - net1.exe - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed net.exe may be used. -known_false_positives: System administrators or scripts may add user accounts via - this technique. Filter as needed. -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -tags: - analytic_story: - - XMRig - - Ransomware - asset_type: Endpoint - confidence: 30 - impact: 30 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to add a user to the local - group. - mitre_attack_id: - - T1136.001 - - T1136 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/net_create_user/net_user_security.log - source: XmlWinEventLog:Security - diff --git a/dev_ssa/endpoint/ssa___delete_a_net_user.yml b/dev_ssa/endpoint/ssa___delete_a_net_user.yml deleted file mode 100644 index 66276f42f7..0000000000 --- a/dev_ssa/endpoint/ssa___delete_a_net_user.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Delete A Net User -id: 8776d79c-d26e-11eb-9a56-acde48001122 -version: 8 -date: '2022-03-17' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic will detect a suspicious net.exe/net1.exe command-line - to delete a user on a system. This technique may be use by an administrator for - legitimate purposes, however this behavior has been used in the wild to impair some - user or deleting adversaries tracks created during its lateral movement additional - systems. During triage, review parallel processes for additional behavior. Identify - any other user accounts created before or after. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|contains: user - selection2: - process.cmd_line|contains: /delete - selection3: - process.file.name: - - net.exe - - net1.exe - condition: selection1 and selection2 and (selection3) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed net.exe may be used. -known_false_positives: System administrators or scripts may delete user accounts via - this technique. Filter as needed. -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -tags: - analytic_story: - - XMRig - - Ransomware - asset_type: Endpoint - confidence: 70 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a user - account. - mitre_attack_id: - - T1531 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_del.log - source: WinEventLog:Security - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/atomic_red_team/security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___deleting_shadow_copies.yml b/dev_ssa/endpoint/ssa___deleting_shadow_copies.yml deleted file mode 100644 index ff25aa74e1..0000000000 --- a/dev_ssa/endpoint/ssa___deleting_shadow_copies.yml +++ /dev/null @@ -1,48 +0,0 @@ -name: Deleting Shadow Copies -id: 19c85f5e-24a5-4355-a430-db9a58d1dc15 -date: '2023-10-03' -version: 5 -author: Bhavin Patel, Splunk -status: production -type: TTP -description: The vssadmin.exe utility is used to interact with the Volume Shadow Copy Service. Wmic is an interface to the Windows Management Instrumentation. This search looks for either of these tools being used to delete shadow copies. -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: - - vssadmin.exe - - wmic.exe - selection2: - process.cmd_line|contains: delete - selection3: - process.cmd_line|contains: shadow - condition: selection1 and selection2 and selection3 -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. -known_false_positives: System administrators may resize the shadowstorage for valid purposes. Filter as needed. -references: -- https://atomicredteam.io/impact/T1490/ -- https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html -tags: - analytic_story: - - Clop Ransomware - - Ransomware - asset_type: Endpoint - confidence: 80 - impact: 80 - message: An instance of shadow copy was deleted was deleted using command line - $process.cmd_line$ with process name `vssadmin.exe` or `wmic.exe` on host machine - $device.hostname$ by user $actor.user.name$. - mitre_attack_id: - - T1490 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/4688_xml_windows_security_delete_shadow.log - source: XmlWinEventLog:Security \ No newline at end of file diff --git a/dev_ssa/endpoint/ssa___deny_permission_using_cacls_utility.yml b/dev_ssa/endpoint/ssa___deny_permission_using_cacls_utility.yml deleted file mode 100644 index 3b194160c6..0000000000 --- a/dev_ssa/endpoint/ssa___deny_permission_using_cacls_utility.yml +++ /dev/null @@ -1,53 +0,0 @@ -name: Deny Permission using Cacls Utility -id: b76eae28-cd25-11eb-9c92-acde48001122 -version: 7 -date: '2021-11-29' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies the use of `cacls.exe`, `icacls.exe` - or `xcacls.exe` placing the deny permission on a file or directory. Adversaries - perform this behavior to prevent responders from reviewing or gaining access to - adversary files on disk. -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: - - icacls.exe - - xcacls.exe - - cacls.exe - process.cmd_line|re: deny - condition: (selection1) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. -known_false_positives: System administrators may use cacls utilities but this is not - a common practice. Filter as needed. -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -tags: - analytic_story: - - XMRig - - Information Sabotage - asset_type: Endpoint - confidence: 70 - impact: 50 - message: A cacls process $process_name$ with commandline $process$ try to deny a - permission of a file or directory in host $dest_device_id$ - mitre_attack_id: - - T1222 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___detect_powershell_applications_spawning_cmd_exe.yml b/dev_ssa/endpoint/ssa___detect_powershell_applications_spawning_cmd_exe.yml deleted file mode 100644 index 2ad2700925..0000000000 --- a/dev_ssa/endpoint/ssa___detect_powershell_applications_spawning_cmd_exe.yml +++ /dev/null @@ -1,52 +0,0 @@ -name: Detect PowerShell Applications Spawning cmd exe -id: d20a18cb-fd70-4ffa-a844-25126e0b0d94 -version: 3 -date: '2023-12-11' -author: Lou Stella, Splunk -status: production -type: Anomaly -description: The following analytic identifies parent processes that are powershell, spawning cmd.exe. By its very nature, - many applications spawn cmd.exe natively or built into macros. Much of this will - need to be tuned to further enhance the risk. -data_source: -- Windows Security 4688 -search: - selection1: - actor.process.file.name: - - powershell.exe - - pwsh.exe - selection2: - process.file.name: cmd.exe - condition: selection1 and selection2 -how_to_implement: In order to successfully implement this analytic, you will need - endpoint process data from a EDR product or Sysmon. This search has been modified - to process raw sysmon data from attack_range's nxlogs on DSP. -known_false_positives: There are circumstances where an application may legitimately - execute and interact with the Windows command-line interface. -references: -- https://attack.mitre.org/techniques/T1059/ -tags: - analytic_story: - - Suspicious Command-Line Executions - - Insider Threat - asset_type: Endpoint - confidence: 50 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event - that warrants investigating. - mitre_attack_id: - - T1059 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-security.log - source: WinEventLog:Security \ No newline at end of file diff --git a/dev_ssa/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/dev_ssa/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml deleted file mode 100644 index b9e55d2344..0000000000 --- a/dev_ssa/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Detect Prohibited Applications Spawning cmd exe -id: c10a18cb-fd80-4ffa-a844-25026e0a0c94 -version: 6 -date: '2022-03-01' -author: Ignacio Bermudez Corrales, Splunk -status: deprecated -type: Anomaly -description: The following analytic identifies parent processes, browsers, Windows - terminal applications, Office Products and Java spawning cmd.exe. By its very nature, - many applications spawn cmd.exe natively or built into macros. Much of this will - need to be tuned to further enhance the risk. -data_source: -- Windows Security 4688 -search: - selection1: - actor.process.file.name: - - winword.exe - - excel.exe - - outlook.exe - - acrobat.exe - - acrord32.exe - - iexplore.exe - - opera.exe - - firefox.exe - - powershell.exe - selection2: - actor.process.file.name: java.exe - selection3: - actor.process.file.name|re: patch1-Hotfix1a - selection4: - actor.process.file.name: chrome.exe - selection5: - process.cmd_line: chrome-extension - selection6: - process.file.name: cmd.exe - condition: ((selection1) or (selection2 and not selection3) or (selection4 and not selection5)) and selection6 -how_to_implement: In order to successfully implement this analytic, you will need - endpoint process data from a EDR product or Sysmon. This search has been modified - to process raw sysmon data from attack_range's nxlogs on DSP. -known_false_positives: There are circumstances where an application may legitimately - execute and interact with the Windows command-line interface. -references: -- https://attack.mitre.org/techniques/T1059/ -tags: - analytic_story: - - Suspicious Command-Line Executions - - Insider Threat - asset_type: Endpoint - confidence: 50 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event - that warrants investigating. - mitre_attack_id: - - T1059 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___detect_prohibited_browsers_spawning_cmd_exe.yml b/dev_ssa/endpoint/ssa___detect_prohibited_browsers_spawning_cmd_exe.yml deleted file mode 100644 index 0174d287ad..0000000000 --- a/dev_ssa/endpoint/ssa___detect_prohibited_browsers_spawning_cmd_exe.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Detect Prohibited Browsers Spawning cmd exe -id: c10a18cb-fa70-4dfa-a944-25026e1b0c94 -version: 8 -date: '2023-12-11' -author: Lou Stella, Splunk -status: production -type: Anomaly -description: The following analytic identifies parent processes that are browsers, spawning cmd.exe. By its very nature, - many applications spawn cmd.exe natively or built into macros. Much of this will - need to be tuned to further enhance the risk. -data_source: -- Windows Security 4688 -search: - selection1: - actor.process.file.name: - - iexplore.exe - - opera.exe - - firefox.exe - selection2: - actor.process.file.name: chrome.exe - selection3: - process.cmd_line: chrome-extension - selection4: - process.file.name: cmd.exe - condition: ((selection1) or (selection2 and not selection3)) and selection4 -how_to_implement: In order to successfully implement this analytic, you will need - endpoint process data from a EDR product or Sysmon. This search has been modified - to process raw sysmon data from attack_range's nxlogs on DSP. -known_false_positives: There are circumstances where an application may legitimately - execute and interact with the Windows command-line interface. -references: -- https://attack.mitre.org/techniques/T1059/ -tags: - analytic_story: - - Suspicious Command-Line Executions - - Insider Threat - asset_type: Endpoint - confidence: 50 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event - that warrants investigating. - mitre_attack_id: - - T1059 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/ssa_validation/browsers/windows-security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___detect_prohibited_office_applications_spawning_cmd_exe.yml b/dev_ssa/endpoint/ssa___detect_prohibited_office_applications_spawning_cmd_exe.yml deleted file mode 100644 index 415548c97a..0000000000 --- a/dev_ssa/endpoint/ssa___detect_prohibited_office_applications_spawning_cmd_exe.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Detect Prohibited Office Applications Spawning cmd exe -id: c10a18cb-fd70-44fb-a8f4-25026a0b0c94 -version: 3 -date: '2023-12-11' -author: Lou Stella, Splunk -status: production -type: Anomaly -description: The following analytic identifies parent processes that are office/productivity applications, spawning cmd.exe. By its very nature, - many applications spawn cmd.exe natively or built into macros. Much of this will - need to be tuned to further enhance the risk. -data_source: -- Windows Security 4688 -search: - selection1: - actor.process.file.name: - - winword.exe - - excel.exe - - outlook.exe - - powerpnt.exe - - acrobat.exe - - acrord32.exe - selection2: - process.file.name: cmd.exe - condition: selection1 and selection2 -how_to_implement: In order to successfully implement this analytic, you will need - endpoint process data from a EDR product or Sysmon. This search has been modified - to process raw sysmon data from attack_range's nxlogs on DSP. -known_false_positives: There are circumstances where an application may legitimately - execute and interact with the Windows command-line interface. -references: -- https://attack.mitre.org/techniques/T1059/ -tags: - analytic_story: - - Suspicious Command-Line Executions - - Insider Threat - asset_type: Endpoint - confidence: 50 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event - that warrants investigating. - mitre_attack_id: - - T1059 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/ssa_validation/office/windows-security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___detect_rclone_command_line_usage.yml b/dev_ssa/endpoint/ssa___detect_rclone_command_line_usage.yml deleted file mode 100644 index 4d063a5c95..0000000000 --- a/dev_ssa/endpoint/ssa___detect_rclone_command_line_usage.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Detect RClone Command-Line Usage -id: e8b74268-5454-11ec-a799-acde48001122 -version: 4 -date: '2021-12-03' -author: Michael Haag, Splunk -status: production -type: TTP -description: This analytic identifies commonly used command-line arguments used by - `rclone.exe` to initiate a file transfer. Some arguments were negated as they are - specific to the configuration used by adversaries. In particular, an adversary may - list the files or directories of the remote file share using `ls` or `lsd`, which - is not indicative of malicious behavior. During triage, at this stage of a ransomware - event, exfiltration is about to occur or has already. Isolate the endpoint and continue - investigating by review file modifications and parallel processes. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|contains: - - --multi-thread-streams - - --transfers - - --auto-confirm - - --ignore-existing - - --no-check-certificate - - --progress - - --config - - ftp - - pcloud - - mega - - copy - process.file.name: rclone.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint_Processess` datamodel. -known_false_positives: False positives should be limited as this is restricted to - the Rclone process name. Filter or tune the analytic as needed. -references: -- https://redcanary.com/blog/rclone-mega-extortion/ -- https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations -- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ -- https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/ -tags: - analytic_story: - - DarkSide Ransomware - - Ransomware - - Insider Threat - asset_type: Endpoint - confidence: 70 - impact: 50 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting to connect to a - remote cloud service to move files or folders. - mitre_attack_id: - - T1020 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___disable_net_user_account.yml b/dev_ssa/endpoint/ssa___disable_net_user_account.yml deleted file mode 100644 index 95b9d37ba8..0000000000 --- a/dev_ssa/endpoint/ssa___disable_net_user_account.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Disable Net User Account -id: ba858b08-d26c-11eb-af9b-acde48001122 -version: 7 -date: '2021-11-30' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic will identify a suspicious command-line that disables a - user account using the native `net.exe` or `net1.exe` utility to Windows. This technique - may used by the adversaries to interrupt availability of accounts and continue the - impact against the organization. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|contains: user - selection2: - process.cmd_line|contains: /active:no - selection3: - process.file.name: - - net.exe - - net1.exe - condition: selection1 and selection2 and (selection3) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be - used. -known_false_positives: System administrators or automated scripts may disable an account - but not a common practice. Filter as needed. -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -tags: - analytic_story: - - XMRig - - Ransomware - asset_type: Endpoint - confidence: 70 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable accounts. - mitre_attack_id: - - T1489 - - T1078 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_dis.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml b/dev_ssa/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml deleted file mode 100644 index 4e03035459..0000000000 --- a/dev_ssa/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: DNS Exfiltration Using Nslookup App -id: 2452e632-9e0d-11eb-34ba-acde48001122 -version: 4 -date: '2021-12-07' -author: Michael Haag, Splunk -status: production -type: TTP -description: This search is to detect potential DNS exfiltration using nslookup application. - This technique are seen in couple of malware and APT group to exfiltrated collected - data in a infected machine or infected network. This detection is looking for unique - use of nslookup where it tries to use specific record type, TXT, A, AAAA, that are - commonly used by attacker and also the retry parameter which is designed to query - C2 DNS multiple tries. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|contains: - - -retry= - - -type= - - -q= - - -qt= - - -querytype= - process.file.name: nslookup.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint_Processess` datamodel. -known_false_positives: It is possible for some legitimate administrative utilities - to use similar process parameters. Filter as needed. -references: -- https://www.mandiant.com/resources/fin7-spear-phishing-campaign-targets-personnel-involved-sec-filings -- https://www.varonis.com/blog/dns-tunneling -- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ -tags: - analytic_story: - - Suspicious DNS Traffic - - Dynamic DNS - - Data Exfiltration - - Command And Control - asset_type: Endpoint - confidence: 80 - impact: 90 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ performing activity related - to DNS exfiltration. - mitre_attack_id: - - T1048 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 72 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___executable_file_written_in_administrative_smb_share.yml b/dev_ssa/endpoint/ssa___executable_file_written_in_administrative_smb_share.yml deleted file mode 100644 index a13ed29671..0000000000 --- a/dev_ssa/endpoint/ssa___executable_file_written_in_administrative_smb_share.yml +++ /dev/null @@ -1,74 +0,0 @@ -name: Executable File Written in Administrative SMB Share -id: d3bba9cb-c066-4e49-a81e-29eeb8e8506b -version: 1 -date: "2024-05-28" -author: Teoderick Contreras, Mauricio Velazco, Splunk -status: production -type: TTP -description: - The following analytic identifies executable files (.exe or .dll) being - written to Windows administrative SMB shares (Admin$, IPC$, C$). This represents - suspicious behavior as its commonly used by tools like PsExec/PaExec and others - to stage service binaries before creating and starting a Windows service on remote - endpoints. Red Teams and adversaries alike may abuse administrative shares for lateral - movement and remote code execution. The Trickbot malware family also implements - this behavior to try to infect other machines in the infected network. -data_source: - - Windows Event Log Security 5145 -search: - selection1: - file.path|endswith: - - .exe - - .dll - file.type: File - share: - - \\\\*\\C$ - - \\\\*\\IPC$ - - \\\\*\\admin$ - access_mask: 2 - condition: selection1 -how_to_implement: - To successfully implement this search, you need to be ingesting - Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also - required. Also enable the object Audit access success/failure in your group policy. -known_false_positives: - System Administrators may use looks like PsExec for troubleshooting - or administrations tasks. However, this will typically come only from certain users - and certain systems that can be added to an allow list. -references: - - https://attack.mitre.org/techniques/T1021/002/ - - https://www.rapid7.com/blog/post/2013/03/09/psexec-demystified/ - - https://labs.vipre.com/trickbot-and-its-modules/ - - https://whitehat.eu/incident-response-case-study-featuring-ryuk-and-trickbot-part-2/ - - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ -tags: - analytic_story: - - Active Directory Lateral Movement - - Prestige Ransomware - - Graceful Wipe Out Attack - - Industroyer2 - - IcedID - - Data Destruction - - Hermetic Wiper - - Trickbot - asset_type: Endpoint - confidence: 100 - impact: 70 - message: - $src_user$ dropped or created an executable file in known sensitive SMB share. Share - name=$ShareName$, Target name=$RelativeTargetName$, and Access mask=$AccessMask$ - mitre_attack_id: - - T1021 - - T1021.002 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - risk_score: 70 - security_domain: endpoint -tests: - - name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/exe_smbshare/windows-xml.log - source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog diff --git a/dev_ssa/endpoint/ssa___fsutil_zeroing_file.yml b/dev_ssa/endpoint/ssa___fsutil_zeroing_file.yml deleted file mode 100644 index 71a0b92679..0000000000 --- a/dev_ssa/endpoint/ssa___fsutil_zeroing_file.yml +++ /dev/null @@ -1,52 +0,0 @@ -name: Fsutil Zeroing File -id: f792cdc9-43ee-4429-a3c0-ffce4fed1a85 -version: 4 -date: '2021-12-07' -author: Michael Haag, Splunk -status: production -type: TTP -description: This search is to detect a suspicious fsutil process to zeroing a target - file. This technique was seen in lockbit ransomware where it tries to zero out its - malware path as part of its defense evasion after encrypting the compromised host. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|contains: setzerodata - process.file.name: fsutil.exe - condition: (selection1) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed net.exe may be used. -known_false_positives: System administrators or scripts may delete user accounts via - this technique. Filter as needed. -references: -- https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/ -- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file -tags: - analytic_story: - - Ransomware - - Insider Threat - - Information Sabotage - asset_type: Endpoint - confidence: 90 - impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ atempting to perform file - deletion. - mitre_attack_id: - - T1070 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 54 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___grant_permission_using_cacls_utility.yml b/dev_ssa/endpoint/ssa___grant_permission_using_cacls_utility.yml deleted file mode 100644 index cf8df819c3..0000000000 --- a/dev_ssa/endpoint/ssa___grant_permission_using_cacls_utility.yml +++ /dev/null @@ -1,53 +0,0 @@ -name: Grant Permission Using Cacls Utility -id: c6da561a-cd29-11eb-ae65-acde48001122 -version: 7 -date: '2021-11-30' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies the use of `cacls.exe`, `icacls.exe` - or `xcacls.exe` placing the grant permission on a file or directory. Adversaries - perform this behavior to allow components of their files to run, however it allows - responders to review or gaining access to adversary files on disk. -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: - - icacls.exe - - xcacls.exe - - cacls.exe - process.cmd_line|re: grant - condition: (selection1) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. -known_false_positives: System administrators may use cacls utilities but this is not - a common practice. Filter as needed. -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -tags: - analytic_story: - - XMRig - - Insider Threat - asset_type: Endpoint - confidence: 70 - impact: 50 - message: A cacls process $process_name$ with commandline $process$ try to grant - user a permission to a file or directory in host $dest_device_id$ - mitre_attack_id: - - T1222 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml b/dev_ssa/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml deleted file mode 100644 index 0b15b31f47..0000000000 --- a/dev_ssa/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ /dev/null @@ -1,53 +0,0 @@ -name: Hiding Files And Directories With Attrib exe -id: 028e4406-6176-11ec-aec2-acde48001122 -version: 4 -date: '2021-12-20' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: Attackers leverage an existing Windows binary, attrib.exe, to mark specific - as hidden by using specific flags so that the victim does not see the file. The - search looks for specific command-line arguments to detect the use of attrib.exe - to hide files. -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: attrib.exe - process.cmd_line|re: '' - condition: selection1 -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. -known_false_positives: 'Some applications and users may legitimately use attrib.exe - to interact with the files. ' -references: -- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/attrib -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Persistence Techniques - - Information Sabotage - - Insider Threat - asset_type: Endpoint - confidence: 90 - impact: 80 - message: Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is detected. - mitre_attack_id: - - T1222.001 - - T1222 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 72 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/attrib_hidden/security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___impacket_lateral_movement_smbexec_commandline_parameters.yml b/dev_ssa/endpoint/ssa___impacket_lateral_movement_smbexec_commandline_parameters.yml deleted file mode 100644 index 4388e8e700..0000000000 --- a/dev_ssa/endpoint/ssa___impacket_lateral_movement_smbexec_commandline_parameters.yml +++ /dev/null @@ -1,85 +0,0 @@ -name: Impacket Lateral Movement smbexec CommandLine Parameters -id: c1238942-2715-41ee-b371-0475da48029c -version: 1 -date: '2024-01-01' -author: Michael Haag, Splunk -status: production -type: TTP -data_source: -- Windows Security 4688 -description: This analytic focuses on identifying suspicious command-line parameters - commonly associated with the use of Impacket wmiexec.py. Impacket is a set of Python - classes designed for working with Microsoft network protocols, and it includes several - scripts like wmiexec.py, smbexec.py, dcomexec.py, and atexec.py that enable command - execution on remote endpoints. These scripts typically utilize administrative shares - and hardcoded parameters, which can serve as signatures to detect their usage. Both - Red Teams and adversaries may employ Impacket tools for lateral movement and remote - code execution purposes. By monitoring for these specific command-line indicators, - the analytic aims to detect potentially malicious activities related to Impacket - tool usage. -search: - selection1: - process.file.name: cmd.exe - process.cmd_line|contains: "cmd.exe /Q /c" - selection2: - process.cmd_line|contains: echo cd - selection3: - process.cmd_line|contains: __output - process.cmd_line|re: C:\\Windows\\[a-zA-Z]{1,8}\.bat - condition: selection1 and selection2 and selection3 -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: Although uncommon, Administrators may leverage Impackets tools - to start a process on remote systems for system administration or automation use - cases. -references: -- https://attack.mitre.org/techniques/T1021/002/ -- https://attack.mitre.org/techniques/T1021/003/ -- https://attack.mitre.org/techniques/T1047/ -- https://attack.mitre.org/techniques/T1053/ -- https://attack.mitre.org/techniques/T1053/005/ -- https://github.com/SecureAuthCorp/impacket -- https://vk9-sec.com/impacket-remote-code-execution-rce-on-windows-from-linux/ -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ -tags: - analytic_story: - - Active Directory Lateral Movement - - CISA AA22-277A - - WhisperGate - - Prestige Ransomware - - Volt Typhoon - - Graceful Wipe Out Attack - - Industroyer2 - - Data Destruction - asset_type: Endpoint - atomic_guid: [] - confidence: 70 - impact: 90 - message: Suspicious command-line parameters on $dest_device_id$ may represent lateral movement - using smbexec. - mitre_attack_id: - - T1021 - - T1021.002 - - T1021.003 - - T1047 - - T1543.003 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.002/impacket_smbexec/windows_security_xml.log - source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog diff --git a/dev_ssa/endpoint/ssa___impacket_lateral_movement_wmiexec_commandline_parameters.yml b/dev_ssa/endpoint/ssa___impacket_lateral_movement_wmiexec_commandline_parameters.yml deleted file mode 100644 index 7de10a1554..0000000000 --- a/dev_ssa/endpoint/ssa___impacket_lateral_movement_wmiexec_commandline_parameters.yml +++ /dev/null @@ -1,80 +0,0 @@ -name: Impacket Lateral Movement WMIExec Commandline Parameters -id: 9d07ff50-e968-456e-a3d9-c65c38ed0ab0 -version: 1 -date: '2024-02-01' -author: Michael Haag, Splunk -status: production -type: TTP -data_source: -- Windows Security 4688 -description: This analytic looks for the presence of suspicious commandline parameters - typically present when using Impacket tools. Impacket is a collection of python - classes meant to be used with Microsoft network protocols. There are multiple scripts - that leverage impacket libraries like `wmiexec.py`, `smbexec.py`, `dcomexec.py` - and `atexec.py` used to execute commands on remote endpoints. By default, these - scripts leverage administrative shares and hardcoded parameters that can be used - as a signature to detect its use. Red Teams and adversaries alike may leverage Impackets - tools for lateral movement and remote code execution. -search: - selection1: - actor.process.file.name: wmiprvse.exe - process.cmd_line|contains: cmd.exe /Q /c - process.cmd_line|contains: \\127.0.0.1 - process.cmd_line|re: __\d{1,10}\.\d{1,10} - condition: selection1 -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: Although uncommon, Administrators may leverage Impackets tools - to start a process on remote systems for system administration or automation use - cases. -references: -- https://attack.mitre.org/techniques/T1021/002/ -- https://attack.mitre.org/techniques/T1021/003/ -- https://attack.mitre.org/techniques/T1047/ -- https://attack.mitre.org/techniques/T1053/ -- https://attack.mitre.org/techniques/T1053/005/ -- https://github.com/SecureAuthCorp/impacket -- https://vk9-sec.com/impacket-remote-code-execution-rce-on-windows-from-linux/ -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ -tags: - analytic_story: - - Active Directory Lateral Movement - - CISA AA22-277A - - WhisperGate - - Prestige Ransomware - - Volt Typhoon - - Graceful Wipe Out Attack - - Industroyer2 - - Data Destruction - asset_type: Endpoint - atomic_guid: [] - confidence: 70 - impact: 90 - message: Suspicious command-line parameters on $dest_device_id$ may represent lateral movement - using wmiexec. - mitre_attack_id: - - T1021 - - T1021.002 - - T1021.003 - - T1047 - - T1543.003 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.002/impacket_wmiexec/windows_security_xml.log - source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog diff --git a/dev_ssa/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/dev_ssa/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml deleted file mode 100644 index fbd6c361af..0000000000 --- a/dev_ssa/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Modify ACLs Permission Of Files Or Folders -id: 9ae9a48a-cdbe-11eb-875a-acde48001122 -version: 7 -date: '2022-03-17' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic identifies suspicious modification of ACL permission to - a files or folder to make it available to everyone or to a specific user. This technique - may be used by the adversary to evade ACLs or protected files access. This changes - is commonly configured by the file or directory owner with appropriate permission. - This behavior raises suspicion if this command is seen on an endpoint utilized by - an account with no permission to do so. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|re: - - 'S-1-1-0:' - - 'SYSTEM:' - - 'everyone:' - selection2: - process.file.name: - - icacls.exe - - xcacls.exe - - cacls.exe - condition: (selection1) and (selection2) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used. -known_false_positives: System administrators may use this windows utility. filter - is needed. -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -tags: - analytic_story: - - XMRig - asset_type: Endpoint - confidence: 70 - impact: 50 - message: A cacls process $process_name$ with commandline $process$ try to modify - a permission of a file or directory in host $dest_device_id$ - mitre_attack_id: - - T1222 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___office_product_spawning_windows_script_host.yml b/dev_ssa/endpoint/ssa___office_product_spawning_windows_script_host.yml deleted file mode 100644 index 17022ea789..0000000000 --- a/dev_ssa/endpoint/ssa___office_product_spawning_windows_script_host.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Office Product Spawning Windows Script Host -id: 3ea3851a-8736-41a0-bc09-7e4485b48fa6 -version: 5 -date: '2022-10-12' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic will identify a Windows Office Product spawning - WScript.exe or CScript.exe. Tuning may be required based on legitimate application - usage that may spawn scripts from an Office product. -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: - - cscript.exe - - wscript.exe - actor.process.file.name|re: - - visio.exe - - mspub.exe - - powerpnt.exe - - excel.exe - - winword.exe - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: False positives may be present based on macro based approved - documents in the organization. Filtering may be needed. -references: -- https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/ -tags: - analytic_story: - - Spearphishing Attachments - asset_type: Endpoint - confidence: 90 - impact: 70 - message: A Microsoft office parent process $parent_process_name$ has spawned a suspicious - child process $process_name$ on host $dest$. - mitre_attack_id: - - T1566 - - T1566.001 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-security.log - source: XmlWinEventLog - update_timestamp: true diff --git a/dev_ssa/endpoint/ssa___possible_lateral_movement_powershell_spawn.yml b/dev_ssa/endpoint/ssa___possible_lateral_movement_powershell_spawn.yml deleted file mode 100644 index 4e1d98816c..0000000000 --- a/dev_ssa/endpoint/ssa___possible_lateral_movement_powershell_spawn.yml +++ /dev/null @@ -1,87 +0,0 @@ -name: Possible Lateral Movement PowerShell Spawn -id: 22282a2d-dc19-4b88-ac61-6c86ff92904f -version: 1 -date: '2024-02-01' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: 'The following analytic is designed to identify possible lateral movement - attacks that involve the spawning of a PowerShell process as a child or grandchild - process of commonly abused processes. These processes include services.exe, wmiprsve.exe, - svchost.exe, wsmprovhost.exe, and mmc.exe.\ - - Such behavior is indicative of legitimate Windows features such as the Service Control - Manager, Windows Management Instrumentation, Task Scheduler, Windows Remote Management, - and the DCOM protocol being abused to start a process on a remote endpoint. This - behavior is often seen during lateral movement techniques where adversaries or red - teams abuse these services for lateral movement and remote code execution.' -data_source: -- Windows Security 4688 -search: - selection1: - actor.process.file.name: - - wmiprvse.exe - - services.exe - - svchost.exe - - wsmprovhost.exe - - mmc.exe - selection2: - process.file.name: - - powershell.exe - - pwsh.exe - selection3: - process.file.name: cmd.exe - process.cmd_line|contains: - - powershell.exe - - pwsh.exe - condition: selection1 and (selection2 or selection3) -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: Legitimate applications may spawn PowerShell as a child process - of the the identified processes. Filter as needed. -references: -- https://attack.mitre.org/techniques/T1021/003/ -- https://attack.mitre.org/techniques/T1021/006/ -- https://attack.mitre.org/techniques/T1047/ -- https://attack.mitre.org/techniques/T1053/005/ -- https://attack.mitre.org/techniques/T1543/003/ -tags: - analytic_story: - - Active Directory Lateral Movement - - Malicious PowerShell - - Hermetic Wiper - - Data Destruction - - Scheduled Tasks - asset_type: Endpoint - confidence: 50 - impact: 90 - message: A PowerShell process was spawned as a child process of typically abused - processes on $dest_device_id$ - mitre_attack_id: - - T1021 - - T1021.003 - - T1021.006 - - T1047 - - T1053.005 - - T1543.003 - - T1059.001 - - T1218.014 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - risk_score: 45 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement/windows_security_xml.log - source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog diff --git a/dev_ssa/endpoint/ssa___resize_shadowstorage_volume.yml b/dev_ssa/endpoint/ssa___resize_shadowstorage_volume.yml deleted file mode 100644 index e165cd4d15..0000000000 --- a/dev_ssa/endpoint/ssa___resize_shadowstorage_volume.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Resize Shadowstorage Volume -id: dbc30554-d27e-11eb-9e5e-acde48001122 -version: 6 -date: '2021-11-30' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies the resizing of shadowstorage using - vssadmin.exe to avoid the shadow volumes being made again. This technique is typically - found used by adversaries during a ransomware event and a precursor to deleting - the shadowstorage. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|contains: shadowstorage - selection2: - process.cmd_line|contains: resize - selection3: - process.cmd_line|contains: maxsize - selection4: - process.file.name: vssadmin.exe - condition: selection1 and selection2 and selection3 and selection4 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: System administrators may resize the shadowstorage for valid - purposes. Filter as needed. -references: -- https://www.mandiant.com/resources/fin11-email-campaigns-precursor-for-ransomware-data-theft -- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html -tags: - analytic_story: - - Clop Ransomware - - Ransomware - asset_type: Endpoint - confidence: 80 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting to create a shadow - copy to perform offline password cracking. - mitre_attack_id: - - T1489 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/windows-security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___sdelete_application_execution.yml b/dev_ssa/endpoint/ssa___sdelete_application_execution.yml deleted file mode 100644 index 25870dbf78..0000000000 --- a/dev_ssa/endpoint/ssa___sdelete_application_execution.yml +++ /dev/null @@ -1,81 +0,0 @@ -name: Sdelete Application Execution -id: fcc52b9a-4616-11ec-8454-acde48001122 -version: 4 -date: '2021-11-15' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic will detect the execution of sdelete.exe attempting to - delete potentially important files that may related to adversary or insider threats - to destroy evidence or information sabotage. Sdelete is a SysInternals utility meant - to securely delete files on disk. This tool is commonly used to clear tracks and - artifact on the targeted host. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|contains: - - .xls - - .gz - - .tar - - .rar - - .zip - - .7z - - .bmp - - .gif - - .png - - .jpg - - .txt - - .log - - .key - - .pdf - - .rtf - - .ppt - - .xls - - .doc - - -nobanner - - /accepteula - - '-z ' - - '-s ' - - '-q ' - - '-r ' - - '-p ' - - '-f ' - - '-c ' - process.file.name|contains: sdelete - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited, filter as needed. -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md -tags: - analytic_story: - - Information Sabotage - - Insider Threat - asset_type: Endpoint - confidence: 70 - impact: 60 - message: Sdelete process $process_name$ executed on $dest_device_id$ attempting - to permanently delete files by $dest_user_id$. - mitre_attack_id: - - T1485 - - T1070.004 - - T1070 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 42 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___serviceprincipalnames_discovery_with_powershell.yml b/dev_ssa/endpoint/ssa___serviceprincipalnames_discovery_with_powershell.yml deleted file mode 100644 index c44ef3cd29..0000000000 --- a/dev_ssa/endpoint/ssa___serviceprincipalnames_discovery_with_powershell.yml +++ /dev/null @@ -1,74 +0,0 @@ -name: ServicePrincipalNames Discovery with PowerShell -id: 043f07a0-7fd8-40e2-b526-80406fb59abb -version: 2 -date: '2024-02-01' -author: Michael Haag, Splunk -status: production -type: TTP -description: 'The following analytic identifies `powershell.exe` usage, using Script - Block Logging EventCode 4104, related to querying the domain for Service Principle - Names. typically, this is a precursor activity related to kerberoasting or the silver - ticket attack. \ - - What is a ServicePrincipleName? \ - - A service principal name (SPN) is a unique identifier of a service instance. SPNs - are used by Kerberos authentication to associate a service instance with a service - logon account. This allows a client application to request that the service authenticate - an account even if the client does not have the account name.\ - - The following analytic identifies the use of KerberosRequestorSecurityToken class - within the script block. Using .NET System.IdentityModel.Tokens.KerberosRequestorSecurityToken - class in PowerShell is the equivelant of using setspn.exe. \ - - During triage, review parallel processes for further suspicious activity.' -data_source: -- Powershell 4104 -search: - selection: - process.cmd_line|re: KerberosRequestorSecurityToken - condition: selection -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: False positives should be limited, however filter as needed. -references: -- https://docs.microsoft.com/en-us/windows/win32/ad/service-principal-names -- https://docs.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8 -- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting -- https://strontic.github.io/xcyclopedia/library/setspn.exe-5C184D581524245DAD7A0A02B51FD2C2.html -- https://attack.mitre.org/techniques/T1558/003/ -- https://social.technet.microsoft.com/wiki/contents/articles/717.service-principal-names-spn-setspn-syntax.aspx -- https://web.archive.org/web/20220212163642/https://www.harmj0y.net/blog/powershell/kerberoasting-without-mimikatz/ -- https://blog.zsec.uk/paving-2-da-wholeset/ -- https://msitpros.com/?p=3113 -- https://adsecurity.org/?p=3466 -- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 -- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf -- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ -tags: - analytic_story: - - Active Directory Discovery - - Active Directory Kerberos Attacks - - Malicious PowerShell - - Active Directory Privilege Escalation - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of attempting to identify service principle detected on $dest$ - names. - mitre_attack_id: - - T1558.003 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog diff --git a/dev_ssa/endpoint/ssa___services_lolbas_execution_process_spawn.yml b/dev_ssa/endpoint/ssa___services_lolbas_execution_process_spawn.yml deleted file mode 100644 index 6f08db162a..0000000000 --- a/dev_ssa/endpoint/ssa___services_lolbas_execution_process_spawn.yml +++ /dev/null @@ -1,101 +0,0 @@ -name: Services lolbas Execution Process Spawn -id: 0d85fde3-0de9-4eec-b386-6a8ba70f3935 -version: 5 -date: '2023-10-02' -author: Bhavin Patel, Splunk -status: validation -type: Anomaly -description: The following analytic identifies services.exe spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the Service Control Manager and creating a remote malicious service, the executed command is spawned as a child process of services.exe. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of services.exe that are part of the LOLBAS project can help defenders identify lateral movement activity. -data_source: -- Windows Security 4688 -search: - selection1: - actor.process.file.name: services.exe - selection2: - process.file.name: - - at.exe - - atbroker.exe - - bash.exe - - bitsadmin.exe - - certoc.exe - - cmd.exe - - cmstp.exe - - dllhost.exe - - dnscmd.exe - - extexport.exe - - explorer.exe - - forfiles.exe - - ftp.exe - - gpscript.exe - - hh.exe - - ie4uinit.exe - - ieexec.exe - - infdefaultinstall.exe - - installutil.exe - - lucallbackproxy.exe - - mavinject.exe - - microsoft.workflow.compiler.exe - - mmc.exe - - msbuild.exe - - msconfig.exe - - msdt.exe - - mshta.exe - - msiexec.exe - - netsh.exe - - odbcconf.exe - - offlinescannershell.exe - - pcwrun.exe - - pcalua.exe - - pnputil.exe - - presentationhost.exe - - rasautou.exe - - regasm.exe - - regsvcs.exe - - regsvr32.exe - - register-cimprovider.exe - - rundll32.exe - - runonce.exe - - runscripthelper.exe - - schtasks.exe - - scriptrunner.exe - - settingsynchost.exe - - stordiag.exe - - syncappvpublishingserver.exe - - ttdinject.exe - - tttracer.exe - - verclsid.exe - - wab.exe - - wmic.exe - - wuauclt.exe - - xwizard.exe - condition: (selection1 and selection2) -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the Processes node of the Endpoint data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: There are circumstances where the services application may legitimately execute and spawn a windows native binary to do an activity that is benign. -references: -- https://attack.mitre.org/techniques/T1543/003/ -- https://pentestlab.blog/2020/07/21/lateral-movement-services -tags: - analytic_story: - - Suspicious Command-Line Executions - - Insider Threat - asset_type: Endpoint - confidence: 50 - impact: 70 - message: An instance of services.exe spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event - that warrants investigating. - mitre_attack_id: - - T1543.003 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/services_lolbas_execution/4688_xml_windows_security.log - source: XmlWinEventLog:Security \ No newline at end of file diff --git a/dev_ssa/endpoint/ssa___system_process_running_from_unexpected_location.yml b/dev_ssa/endpoint/ssa___system_process_running_from_unexpected_location.yml deleted file mode 100644 index 6de844e46c..0000000000 --- a/dev_ssa/endpoint/ssa___system_process_running_from_unexpected_location.yml +++ /dev/null @@ -1,610 +0,0 @@ -name: System Process Running from Unexpected Location -id: 28179107-099a-464a-94d3-08301e6c055f -version: 8 -date: '2022-03-24' -author: Jose Hernadnez, Ignacio Bermudez Corrales, Splunk -status: production -type: Anomaly -description: An attacker tries might try to use different version of a system command - without overriding original, or they might try to avoid some detection running the - process from a different folder. This detection checks that a list of system processes - run inside C:\\Windows\System32 or C:\\Windows\SysWOW64 The list of system processes - has been extracted from https://github.com/splunk/security_content/blob/develop/lookups/is_windows_system_file.csv - and the original detection https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: - - xwizard.exe - - xpsrchvw.exe - - xcopy.exe - - wusa.exe - - wuauclt.exe - - wuapp.exe - - wuapihost.exe - - wsqmcons.exe - - wsmprovhost.exe - - wscript.exe - - write.exe - - wpr.exe - - wpnpinst.exe - - wowreg32.exe - - wlrmdr.exe - - wlanext.exe - - wksprt.exe - - wkspbroker.exe - - wisptis.exe - - winver.exe - - winrshost.exe - - winrs.exe - - winresume.exe - - winlogon.exe - - winload.exe - - wininit.exe - - wimserv.exe - - wifitask.exe - - wiawow64.exe - - wiaacmgr.exe - - whoami.exe - - where.exe - - wextract.exe - - wevtutil.exe - - wermgr.exe - - wecutil.exe - - wbengine.exe - - wbadmin.exe - - waitfor.exe - - w32tm.exe - - vssadmin.exe - - vmicsvc.exe - - verifiergui.exe - - verifier.exe - - verclsid.exe - - vdsldr.exe - - vds.exe - - userinit.exe - - upnpcont.exe - - unregmp2.exe - - unlodctr.exe - - ucsvc.exe - - tzutil.exe - - tzsync.exe - - typeperf.exe - - tskill.exe - - tsdiscon.exe - - tscon.exe - - tracerpt.exe - - tpmvscmgrsvr.exe - - tpmvscmgr.exe - - timeout.exe - - tcmsetup.exe - - taskmgr.exe - - tasklist.exe - - taskkill.exe - - taskhostw.exe - - taskhost.exe - - taskeng.exe - - takeown.exe - - tabcal.exe - - systray.exe - - systemreset.exe - - systeminfo.exe - - syskey.exe - - sxstrace.exe - - svchost.exe - - subst.exe - - srdelayed.exe - - spreview.exe - - sppsvc.exe - - spoolsv.exe - - spinstall.exe - - sort.exe - - snmptrap.exe - - smss.exe - - slui.exe - - sihost.exe - - sigverif.exe - - shutdown.exe - - shrpubw.exe - - shadow.exe - - setx.exe - - setupugc.exe - - setupcl.exe - - setspn.exe - - sethc.exe - - sessionmsg.exe - - services.exe - - secinit.exe - - sdiagnhost.exe - - sdclt.exe - - sdchange.exe - - sdbinst.exe - - schtasks.exe - - sc.exe - - sbunattend.exe - - rwinsta.exe - - runonce.exe - - rundll32.exe - - runas.exe - - rstrui.exe - - rrinstaller.exe - - rmttpmvscmgrsvr.exe - - resmon.exe - - reset.exe - - replace.exe - - repair-bde.exe - - relog.exe - - rekeywiz.exe - - regsvr32.exe - - regini.exe - - regedt32.exe - - reg.exe - - recover.exe - - recdisc.exe - - rdrleakdiag.exe - - rdpinput.exe - - rdpclip.exe - - rasphone.exe - - raserver.exe - - rasdial.exe - - rasautou.exe - - qwinsta.exe - - quser.exe - - query.exe - - qprocess.exe - - qappsrv.exe - - pwlauncher.exe - - psr.exe - - provtool.exe - - proquota.exe - - printui.exe - - printfilterpipelinesvc.exe - - print.exe - - prevhost.exe - - powercfg.exe - - poqexec.exe - - plasrv.exe - - phoneactivate.exe - - perfmon.exe - - pcwrun.exe - - pcawrk.exe - - pcaui.exe - - pcalua.exe - - p2phost.exe - - osk.exe - - openfiles.exe - - omadmprc.exe - - omadmclient.exe - - odbcconf.exe - - odbcad32.exe - - ocsetup.exe - - ntprint.exe - - ntoskrnl.exe - - nslookup.exe - - notepad.exe - - nltest.exe - - newdev.exe - - netsh.exe - - netiougc.exe - - netcfg.exe - - netbtugc.exe - - net1.exe - - net.exe - - ndadmin.exe - - nbtstat.exe - - mtstocom.exe - - mstsc.exe - - msra.exe - - mspaint.exe - - msinfo32.exe - - msiexec.exe - - mshta.exe - - msg.exe - - msfeedssync.exe - - msdtc.exe - - msdt.exe - - msconfig.exe - - mpnotify.exe - - mountvol.exe - - mobsync.exe - - mmc.exe - - mfpmp.exe - - mctadmin.exe - - mcbuilder.exe - - mblctr.exe - - manage-bde.exe - - makecab.exe - - lsm.exe - - lsass.exe - - lpremove.exe - - lpksetup.exe - - lpkinstall.exe - - logoff.exe - - logman.exe - - logagent.exe - - lodctr.exe - - licensingdiag.exe - - label.exe - - ktmutil.exe - - ksetup.exe - - klist.exe - - isoburn.exe - - iscsicpl.exe - - iscsicli.exe - - irftp.exe - - ipconfig.exe - - immersivetpmvscmgrsvr.exe - - iexpress.exe - - ieetwcollector.exe - - ieunatt.exe - - ie4uinit.exe - - icsunattend.exe - - icardagt.exe - - icacls.exe - - hwrreg.exe - - hwrcomp.exe - - help.exe - - hdwwiz.exe - - grpconv.exe - - gpupdate.exe - - gpscript.exe - - gpresult.exe - - getmac.exe - - fveprompt.exe - - fvenotify.exe - - ftp.exe - - fsutil.exe - - fsquirt.exe - - fsavailux.exe - - forfiles.exe - - fontview.exe - - fontdrvhost.exe - - fodhelper.exe - - fltmc.exe - - fixmapi.exe - - finger.exe - - findstr.exe - - find.exe - - fhmanagew.exe - - fc.exe - - extrac32.exe - - expand.exe - - eventvwr.exe - - eventcreate.exe - - eudcedit.exe - - esentutl.exe - - embeddedapplauncher.exe - - efsui.exe - - easinvoker.exe - - dxdiag.exe - - dwm.exe - - dvdupgrd.exe - - dvdplay.exe - - dstokenclean.exe - - dsregcmd.exe - - drvinst.exe - - drvcfg.exe - - driverquery.exe - - dpnsvr.exe - - dpapimig.exe - - doskey.exe - - dnscacheugc.exe - - dmclient.exe - - dmcfghost.exe - - dmcertinst.exe - - dllhst3g.exe - - dllhost.exe - - djoin.exe - - dispdiag.exe - - diskraid.exe - - diskperf.exe - - diskpart.exe - - dinotify.exe - - diantz.exe - - dialer.exe - - dfrgui.exe - - ddodiag.exe - - dcomcnfg.exe - - dccw.exe - - dashost.exe - - cttunesvr.exe - - cttune.exe - - ctfmon.exe - - csrss.exe - - cscript.exe - - credwiz.exe - - convert.exe - - control.exe - - consent.exe - - conhost.exe - - compact.exe - - comp.exe - - colorcpl.exe - - cofire.exe - - cmstp.exe - - cmmon32.exe - - cmdl32.exe - - cmdkey.exe - - cmd.exe - - clip.exe - - cliconfg.exe - - cleanmgr.exe - - cipher.exe - - choice.exe - - chkntfs.exe - - chkdsk.exe - - chgusr.exe - - chgport.exe - - chglogon.exe - - charmap.exe - - changepk.exe - - change.exe - - certutil.exe - - certreq.exe - - cdpreference.exe - - calc.exe - - cacls.exe - - bthudtask.exe - - browser_broker.exe - - bridgeunattend.exe - - bootsect.exe - - bootim.exe - - bootcfg.exe - - bitsadmin.exe - - bdeunlock.exe - - bdechangepin.exe - - bcdedit.exe - - bcdboot.exe - - bcastdvr.exe - - backgroundtaskhost.exe - - baaupdate.exe - - autofmt.exe - - autoconv.exe - - autochk.exe - - auditpol.exe - - audiodg.exe - - attrib.exe - - at.exe - - appidpolicyconverter.exe - - appidcertstorecheck.exe - - alg.exe - - aitstatic.exe - - aitagent.exe - - acu.exe - - wpcmon.exe - - workfolders.exe - - windowsupdateelevatedinstaller.exe - - windowsanytimeupgradeui.exe - - windowsanytimeupgraderesults.exe - - windowsanytimeupgrade.exe - - windowsactiondialog.exe - - windows.media.backgroundplayback.exe - - winsat.exe - - werfaultsecure.exe - - werfault.exe - - webcache.exe - - wallpaperhost.exe - - wwahost.exe - - wudfhost.exe - - wsreset.exe - - wsmanhttpconfig.exe - - wscollect.exe - - wpdshextautoplay.exe - - wmpdmc.exe - - wfs.exe - - vaultsysui.exe - - vaultcmd.exe - - vssvc.exe - - utilman.exe - - usoclient.exe - - useraccountcontrolsettings.exe - - useraccountbroker.exe - - upgraderesultsui.exe - - ui0detect.exe - - tswpfwrp.exe - - tpminit.exe - - tokenbrokercookies.exe - - thumbnailextractionhost.exe - - taskmgr.exe - - tapiunattend.exe - - tswbprxy.exe - - tstheme.exe - - tracert.exe - - tcpsvcs.exe - - systemsettingsremovedevice.exe - - systemsettingsbroker.exe - - systemsettingsadminflows.exe - - systempropertiesremote.exe - - systempropertiesprotection.exe - - systempropertiesperformance.exe - - systempropertieshardware.exe - - systempropertiesdataexecutionprevention.exe - - systempropertiescomputername.exe - - systempropertiesadvanced.exe - - sysreseterr.exe - - synchost.exe - - stikynot.exe - - srtasks.exe - - sppextcomobj.exe - - spaceagent.exe - - soundrecorder.exe - - snippingtool.exe - - sndvol.exe - - smartscreensettings.exe - - slidetoshutdown.exe - - settingsynchost.exe - - setieinstalleddate.exe - - sensordataservice.exe - - secedit.exe - - searchprotocolhost.exe - - searchindexer.exe - - searchfilterhost.exe - - sihclient.exe - - runtimebroker.exe - - runlegacycplelevated.exe - - rpcping.exe - - rmclient.exe - - remoteposworker.exe - - relpost.exe - - registeriepkeys.exe - - register-cimprovider.exe - - recoverydrive.exe - - reagentc.exe - - rdpsauachelper.exe - - rdpsaproxy.exe - - rdpsa.exe - - route.exe - - rmactivate_ssp_isv.exe - - rmactivate_ssp.exe - - rmactivate_isv.exe - - rmactivate.exe - - rdspnf.exe - - proximityuxhost.exe - - printisolationhost.exe - - printdialoghost3d.exe - - printdialoghost.exe - - printbrmui.exe - - presentationsettings.exe - - presentationhost.exe - - pnputil.exe - - pnpunattend.exe - - pkgmgr.exe - - pickerhost.exe - - passwordonwakesettingflyout.exe - - ping.exe - - pathping.exe - - optionalfeatures.exe - - openwith.exe - - networkuxbroker.exe - - netplwiz.exe - - netproj.exe - - netevtfwdr.exe - - netcfgnotifyobjecthost.exe - - narrator.exe - - netstat.exe - - napstat.exe - - musnotificationux.exe - - musnotification.exe - - multidigimon.exe - - muiunattend.exe - - msspellcheckinghost.exe - - mpsigstub.exe - - migautoplay.exe - - mdsched.exe - - mdres.exe - - mbaeparsertask.exe - - magnify.exe - - mschedexe.exe - - mrt.exe - - mrinfo.exe - - mdmappinstaller.exe - - mdmagent.exe - - mdeserver.exe - - lsaiso.exe - - logonui.exe - - lockscreencontentserver.exe - - lockapphost.exe - - locator.exe - - locationnotifications.exe - - locationnotificationwindows.exe - - licensingui.exe - - licensemanagershellext.exe - - legacynetuxhost.exe - - launchwinapp.exe - - launchtm.exe - - languagecomponentsinstallercomhandler.exe - - installagent.exe - - infdefaultinstall.exe - - icsentitlementhost.exe - - hostname.exe - - gettingstarted.exe - - genvalobj.exe - - gamepanel.exe - - fondue.exe - - filehistory.exe - - fxsunatd.exe - - fxssvc.exe - - fxscover.exe - - ehstorauthn.exe - - easeofaccessdialog.exe - - easpoliciesbrokerhost.exe - - eap3host.exe - - eosnotify.exe - - edpcleanup.exe - - dxpserver.exe - - dsmusertask.exe - - dpiscaling.exe - - dmomacpmo.exe - - dmnotificationbroker.exe - - displayswitch.exe - - dism.exe - - disksnapshot.exe - - deviceproperties.exe - - devicepairingwizard.exe - - deviceenroller.exe - - deviceeject.exe - - devicedisplayobjectprovider.exe - - defrag.exe - - dataexchangehost.exe - - dwwin.exe - - dfdwiz.exe - - credentialuibroker.exe - - computerdefaults.exe - - compattelrunner.exe - - compmgmtlauncher.exe - - cloudstoragewizard.exe - - cloudnotifications.exe - - cloudexperiencehostbroker.exe - - clipup.exe - - checknetisolation.exe - - certenrollctrl.exe - - castsrv.exe - - camerasettingsuihost.exe - - bytecodegenerator.exe - - bitlockerwizardelev.exe - - bitlockerwizard.exe - - bitlockerdeviceencryption.exe - - bdeunlockwizard.exe - - bdeuisrv.exe - - bdehdcfg.exe - - backgroundtransferhost.exe - - axinstui.exe - - autoworkplace.exe - - authhost.exe - - atbroker.exe - - applicationframehost.exe - - adaptertroubleshooter.exe - - arp.exe - selection2: - process.file.path|re: \\windows\\syswow64 - selection3: - process.file.path|re: \\windows\\system32 - condition: selection1 and not selection2 and not selection3 -how_to_implement: Collect endpoint data such as sysmon or 4688 events. -known_false_positives: None -references: [] -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Masquerading - Rename System Utilities - asset_type: Endpoint - confidence: 80 - impact: 70 - message: A system process $process_name$ with commandline $process$ spawn in non-default - folder path in host $dest_device_id$ - mitre_attack_id: - - T1036 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Actions on Objectives - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/windows-security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___wbadmin_delete_system_backups.yml b/dev_ssa/endpoint/ssa___wbadmin_delete_system_backups.yml deleted file mode 100644 index 5216a36009..0000000000 --- a/dev_ssa/endpoint/ssa___wbadmin_delete_system_backups.yml +++ /dev/null @@ -1,55 +0,0 @@ -name: WBAdmin Delete System Backups -id: 71efbf52-4dbb-4c00-a520-306aa546cbb7 -version: 4 -date: '2021-12-07' -author: Michael Haag, Splunk -status: production -type: TTP -description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator - Tool) that delete backup files. This is typically used by ransomware to prevent - recovery. -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: wbadmin.exe - selection2: - process.cmd_line|contains: - - systemstatebackup - - catalog - - delete - condition: selection1 and selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint_Processess` datamodel. -known_false_positives: Administrators may modify the boot configuration. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md -- https://thedfirreport.com/2020/10/08/ryuks-return/ -- https://attack.mitre.org/techniques/T1490/ -- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin -tags: - analytic_story: - - Ryuk Ransomware - - Ransomware - asset_type: Endpoint - confidence: 50 - impact: 30 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete system - backups. - mitre_attack_id: - - T1490 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-security_bcdedit_wbadmin.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/dev_ssa/endpoint/ssa___wevtutil_usage_to_clear_logs.yml deleted file mode 100644 index 062ebffae7..0000000000 --- a/dev_ssa/endpoint/ssa___wevtutil_usage_to_clear_logs.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: WevtUtil Usage To Clear Logs -id: 5438113c-cdd9-11eb-93b8-acde48001122 -version: 5 -date: '2021-06-15' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The wevtutil.exe application is the windows event log utility. This searches - for wevtutil.exe with parameters for clearing the application, security, setup, - powershell, sysmon, or system event logs. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|re: - - powershell - - setup - - application - - sysmon - - system - - security - process.cmd_line|contains: ' cl ' - process.file.name: wevtutil.exe - condition: (selection1) -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. -known_false_positives: The wevtutil.exe application is a legitimate Windows event - log utility. Administrators may use it to manage Windows event logs. -references: -- https://www.splunk.com/en_us/blog/security/detecting-clop-ransomware.html -tags: - analytic_story: - - Windows Log Manipulation - - Ransomware - - Clop Ransomware - - Insider Threat - - CISA AA22-264A - asset_type: Endpoint - confidence: 90 - impact: 70 - message: A wevtutil process $process_name$ with commandline $process$ to clear event - logs in host $dest_device_id$ - mitre_attack_id: - - T1070 - - T1070.001 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___wevtutil_usage_to_disable_logs.yml b/dev_ssa/endpoint/ssa___wevtutil_usage_to_disable_logs.yml deleted file mode 100644 index 67f8526544..0000000000 --- a/dev_ssa/endpoint/ssa___wevtutil_usage_to_disable_logs.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Wevtutil Usage To Disable Logs -id: a4bdc944-cdd9-11eb-ac97-acde48001122 -version: 5 -date: '2021-06-15' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect execution of wevtutil.exe to disable logs. This - technique was seen in several ransomware to disable the event logs to evade alerts - and detections in compromised host. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|contains: /e:false - selection2: - process.cmd_line|contains: ' sl ' - selection3: - process.file.name: wevtutil.exe - condition: selection1 and selection2 and selection3 -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. -known_false_positives: network operator may disable audit event logs for debugging - purposes. -references: -- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/ -tags: - analytic_story: - - Windows Log Manipulation - - Ransomware - - Insider Threat - - Information Sabotage - asset_type: Endpoint - confidence: 90 - impact: 70 - message: A wevtutil process $process_name$ with commandline $process$ to disable - event logs in host $dest_device_id$ - mitre_attack_id: - - T1070 - - T1070.001 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___windows_bits_job_persistence.yml b/dev_ssa/endpoint/ssa___windows_bits_job_persistence.yml deleted file mode 100644 index 05d8d85dd7..0000000000 --- a/dev_ssa/endpoint/ssa___windows_bits_job_persistence.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Windows Bits Job Persistence -id: 1e25e97a-8ea4-11ec-9767-acde48001122 -version: 4 -date: '2022-02-15' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following query identifies Microsoft Background Intelligent Transfer - Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint. - The query identifies the parameters used to create, resume or add a file to a BITS - job. Typically seen combined in a oneliner or ran in sequence. If identified, review - the BITS job created and capture any files written to disk. It is possible for BITS - to be used to upload files and this may require further network data analysis to - identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|contains: - - resume - - setcustomheaders - - setminretrydelay - - setnotifycmdline - - setnotifyflags - - addfile - - create - process.file.name: bitsadmin.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives will be present. Typically, applications - will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments - (legitimate applications) or parent process. -references: -- https://attack.mitre.org/techniques/T1197/ -- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute -- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ -tags: - analytic_story: - - BITS Jobs - - Living Off The Land - asset_type: Endpoint - confidence: 80 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $dest_user_id$ attempting to persist using BITS. - mitre_attack_id: - - T1197 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___windows_bitsadmin_download_file.yml b/dev_ssa/endpoint/ssa___windows_bitsadmin_download_file.yml deleted file mode 100644 index e824161db4..0000000000 --- a/dev_ssa/endpoint/ssa___windows_bitsadmin_download_file.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Windows Bitsadmin Download File -id: d76e8188-8f5a-11ec-ace4-acde48001122 -version: 4 -date: '2022-02-16' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following query identifies Microsoft Background Intelligent Transfer - Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote - object. In addition, look for `download` or `upload` on the command-line, the switches - are not required to perform a transfer. Capture any files downloaded. Review the - reputation of the IP or domain used. Typically once executed, a follow on command - will be used to execute the dropped file. Note that the network connection or file - modification events related will not spawn or create from `bitsadmin.exe`, but the - artifacts will appear in a parallel process of `svchost.exe` with a command-line - similar to `svchost.exe -k netsvcs -s BITS`. It's important to review all parallel - and child processes to capture any behaviors and artifacts. In some suspicious and - malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose` - to list out the jobs during investigation. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|contains: transfer - process.file.name: bitsadmin.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives, however it may be required to filter - based on parent process name or network connection. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download -- https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md -- https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool -- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ -tags: - analytic_story: - - Ingress Tool Transfer - - BITS Jobs - - DarkSide Ransomware - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $dest_user_id$ attempting to download a file. - mitre_attack_id: - - T1197 - - T1105 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___windows_certutil_decode_file.yml b/dev_ssa/endpoint/ssa___windows_certutil_decode_file.yml deleted file mode 100644 index 87df1c36d0..0000000000 --- a/dev_ssa/endpoint/ssa___windows_certutil_decode_file.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Windows CertUtil Decode File -id: b06983f4-8f72-11ec-ab50-acde48001122 -version: 4 -date: '2022-02-16' -author: Michael Haag, Splunk -status: production -type: TTP -description: CertUtil.exe may be used to `encode` and `decode` a file, including PE - and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----` - and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded - file that was downloaded. Once decoded, it will be loaded by a parallel process. - Note that there are two additional command switches that may be used - `encodehex` - and `decodehex`. Similarly, the file will be encoded in HEX and later decoded for - further execution. During triage, identify the source of the file being decoded. - Review its contents or execution behavior for further analysis. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|contains: decode - process.file.name: certutil.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Typically seen used to `encode` files, but it is possible to - see legitimate use of `decode`. Filter based on parent-child relationship, file - paths, endpoint or user. -references: -- https://attack.mitre.org/techniques/T1140/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1140/T1140.md -- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil -- https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/ -tags: - analytic_story: - - Deobfuscate-Decode Files or Information - - Living Off The Land - - Forest Blizzard - asset_type: Endpoint - confidence: 80 - impact: 50 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting to decode a file - on disk. - mitre_attack_id: - - T1140 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 40 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/atomic_red_team/encode-windows-security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___windows_certutil_urlcache_download.yml b/dev_ssa/endpoint/ssa___windows_certutil_urlcache_download.yml deleted file mode 100644 index d5ccf9ed0d..0000000000 --- a/dev_ssa/endpoint/ssa___windows_certutil_urlcache_download.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Windows CertUtil URLCache Download -id: 8cb1ad38-8f6d-11ec-87a3-acde48001122 -version: 4 -date: '2022-02-16' -author: Michael Haag, Splunk -status: production -type: TTP -description: Certutil.exe may download a file from a remote destination using `-urlcache`. - This behavior does require a URL to be passed on the command-line. In addition, - `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will - be used. It is not entirely common for `certutil.exe` to contact public IP space. - However, it is uncommon for `certutil.exe` to write files to world writeable paths. - - During triage, capture any files on disk and review. Review the reputation of the - remote IP or domain in question. -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: certutil.exe - selection2: - process.cmd_line|contains: split - selection3: - process.cmd_line|contains: urlcache - selection4: - process.cmd_line|contains: urlcache - condition: selection1 and selection2 and selection3 or selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Limited false positives in most environments, however tune - as needed based on parent-child relationship or network connection. -references: -- https://attack.mitre.org/techniques/T1105/ -- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats -- https://web.archive.org/web/20210921110637/https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html -tags: - analytic_story: - - Ingress Tool Transfer - - DarkSide Ransomware - - Living Off The Land - - Forest Blizzard - asset_type: Endpoint - confidence: 100 - impact: 90 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file. - mitre_attack_id: - - T1105 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___windows_certutil_verifyctl_download.yml b/dev_ssa/endpoint/ssa___windows_certutil_verifyctl_download.yml deleted file mode 100644 index 17adb214d2..0000000000 --- a/dev_ssa/endpoint/ssa___windows_certutil_verifyctl_download.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Windows CertUtil VerifyCtl Download -id: 9ac29c40-8f6b-11ec-b19a-acde48001122 -version: 4 -date: '2022-02-16' -author: Michael Haag, Splunk -status: production -type: TTP -description: 'Certutil.exe may download a file from a remote destination using `-VerifyCtl`. - This behavior does require a URL to be passed on the command-line. In addition, - `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will - be used. It is not entirely common for `certutil.exe` to contact public IP space. - \ During triage, capture any files on disk and review. Review the reputation of - the remote IP or domain in question. Using `-VerifyCtl`, the file will either be - written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\`. ' -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: certutil.exe - selection2: - process.cmd_line|contains: split - selection3: - process.cmd_line|contains: verifyctl - selection4: - process.cmd_line|contains: verifyctl - condition: selection1 and selection2 and selection3 or selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Limited false positives in most environments, however tune - as needed based on parent-child relationship or network connection. -references: -- https://attack.mitre.org/techniques/T1105/ -- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/ -- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl -- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats -tags: - analytic_story: - - Ingress Tool Transfer - - DarkSide Ransomware - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 90 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file. - mitre_attack_id: - - T1105 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml b/dev_ssa/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml deleted file mode 100644 index 67e346a241..0000000000 --- a/dev_ssa/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Windows COM Hijacking InprocServer32 Modification -id: 0ae05a0f-bc84-456b-822a-a5b9c081c7ca -version: 4 -date: '2022-10-12' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the use of reg.exe performing an add - to the InProcServer32, which may be related to COM hijacking. Adversaries can use - the COM system to insert malicious code that can be executed in place of legitimate - software through hijacking the COM references and relationships as a means for persistence. - Hijacking a COM object requires a change in the Registry to replace a reference - to a legitimate system component which may cause that component to not work when - executed. When that system component is executed through normal system operation - the adversary's code will be executed instead. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|re: inprocserver32 - process.file.name: reg.exe - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: False positives may be present and some filtering may be required. -references: -- https://attack.mitre.org/techniques/T1546/015/ -- https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.015/T1546.015.md -tags: - analytic_story: - - Living Off The Land - asset_type: Endpoint - confidence: 80 - impact: 80 - message: An instance of $parent_process_name$ has spawned $process_name$ attempting - to modify InProcServer32 within the registry on $dest_device_id$ by $dest_user_id$. - mitre_attack_id: - - T1546.015 - - T1546 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/atomic_red_team/windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog - update_timestamp: true diff --git a/dev_ssa/endpoint/ssa___windows_curl_upload_to_remote_destination.yml b/dev_ssa/endpoint/ssa___windows_curl_upload_to_remote_destination.yml deleted file mode 100644 index 65cd8b6877..0000000000 --- a/dev_ssa/endpoint/ssa___windows_curl_upload_to_remote_destination.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Windows Curl Upload to Remote Destination -id: cc8d046a-543b-11ec-b864-acde48001122 -version: 4 -date: '2021-12-03' -author: Michael Haag, Splunk -status: production -type: TTP -description: 'The following analytic identifies the use of Windows Curl.exe uploading - a file to a remote destination. - - `-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination. - - - `-d` or `--data` POST is the HTTP method that was invented to send data to a receiving - web application, and it is, for example, how most common HTML forms on the web work. - - - HTTP multipart formposts are done with `-F`, but this appears to not be compatible - with the Windows version of Curl. Will update if identified adversary tradecraft. - - - Adversaries may use one of the three methods based on the remote destination and - what they are attempting to upload (zip vs txt). During triage, review parallel - processes for further behavior. In addition, identify if the upload was successful - in network logs. If a file was uploaded, isolate the endpoint and review.' -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|contains: - - '-F ' - - '--data ' - - '-d ' - - '--upload-file ' - - '-T ' - process.file.name|re: curl.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint_Processess` datamodel. -known_false_positives: False positives may be limited to source control applications - and may be required to be filtered out. -references: -- https://everything.curl.dev/usingcurl/uploads -- https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409 -- https://twitter.com/d1r4c/status/1279042657508081664?s=20 -tags: - analytic_story: - - Ingress Tool Transfer - - Insider Threat - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ uploading a file to a remote - destination. - mitre_attack_id: - - T1105 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___windows_default_group_policy_object_modified_with_gpme.yml b/dev_ssa/endpoint/ssa___windows_default_group_policy_object_modified_with_gpme.yml deleted file mode 100644 index 34ae937341..0000000000 --- a/dev_ssa/endpoint/ssa___windows_default_group_policy_object_modified_with_gpme.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Windows Default Group Policy Object Modified with GPME -id: bcb55c13-067b-4648-98f3-627010f72520 -version: 5 -date: '2023-05-02' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: The following analytic identifies the potential edition of a default Group Policy Object. A fresh installation of an Active Directory network will typically contain - two default group policy objects `Default Domain Controllers Policy` and `Default Domain Policy`. The default domain controllers policy is used to enforce and set policies to all the domain controllers within the domain environment. - The default domain policy is linked to all users and computers by default. An adversary who has obtained privileged access to an Active Directory network may modify the default group - policy objects to obtain further access, deploy persistence or execute malware across a large number of hosts. Security teams should monitor the edition of the default GPOs. -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: - - mmc.exe - process.cmd_line|contains: gpme.msc - selection2: - process.cmd_line|contains: 31B2F340-016D-11D2-945F-00C04FB984F9 - selection3: - process.cmd_line|contains: 6AC1786C-016F-11D2-945F-00C04fB984F9 - condition: selection1 or selection2 or selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: The default Group Policy Objects within an AD network may be legitimately updated for administrative operations, filter as needed. -references: -- https://attack.mitre.org/techniques/T1484/ -- https://attack.mitre.org/techniques/T1484/001 -- https://www.trustedsec.com/blog/weaponizing-group-policy-objects-access/ -- https://adsecurity.org/?p=2716 -- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn265969(v=ws.11) -tags: - analytic_story: - - Active Directory Privilege Escalation - asset_type: Endpoint - confidence: 50 - impact: 100 - message: A default group policy object was opened with Group Policy Manage Editor on $dest$ - mitre_attack_id: - - T1484 - - T1484.001 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Behavioral Analytics - required_fields: - - process_name - - _time - - dest_device_id - - dest_user_id - - process - risk_score: 50 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/default_domain_policy_modified/security-4688.log - source: XmlWinEventLog diff --git a/dev_ssa/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml b/dev_ssa/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml deleted file mode 100644 index a3d29701f3..0000000000 --- a/dev_ssa/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml +++ /dev/null @@ -1,50 +0,0 @@ -name: Windows Defender Tools in Non Standard Path -id: c205bd2e-cd5b-4224-8510-578a2a1f83d7 -version: 4 -date: '2022-07-18' -author: Lou Stella, Splunk -status: production -type: Anomaly -description: The following analytic identifies usage of the MPCmdRun utility that - can be abused by adversaries by moving it to a new directory. -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name|re: mpcmdrun.exe - selection2: - process.file.path|re: \\windows defender - selection3: - process.file.path|re: \\microsoft\\windows defender\\platform - condition: selection1 and not selection2 and not selection3 -how_to_implement: Collect endpoint data such as sysmon or 4688 events. -known_false_positives: False positives may be present and filtering may be required. -references: -- https://attack.mitre.org/techniques/T1036/003/ -- https://lolbas-project.github.io/lolbas/Binaries/MpCmdRun/ -tags: - analytic_story: - - Living Off The Land - asset_type: Endpoint - confidence: 80 - impact: 70 - message: Process $process_name$ with commandline $process$ spawn in non-default - folder path on host $dest_device_id$ - mitre_attack_id: - - T1036 - - T1036.003 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Actions on Objectives - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/mpcmdrun/windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog - update_timestamp: true diff --git a/dev_ssa/endpoint/ssa___windows_diskshadow_proxy_execution.yml b/dev_ssa/endpoint/ssa___windows_diskshadow_proxy_execution.yml deleted file mode 100644 index b2b072d049..0000000000 --- a/dev_ssa/endpoint/ssa___windows_diskshadow_proxy_execution.yml +++ /dev/null @@ -1,52 +0,0 @@ -name: Windows Diskshadow Proxy Execution -id: aa502688-9037-11ec-842d-acde48001122 -version: 4 -date: '2022-02-17' -author: Lou Stella, Splunk -status: production -type: Anomaly -description: DiskShadow.exe is a Microsoft Signed binary present on Windows Server. - It has a scripting mode intended for complex scripted backup operations. This feature - also allows for execution of arbitrary unsigned code. This analytic looks for the - usage of the scripting mode flags in executions of DiskShadow. During triage, compare - to known backup behavior in your environment and then review the scripts called - by diskshadow. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|contains: - - /s - - -S - process.file.name: diskshadow.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on processes that include the name of the process responsible for the changes from - your endpoints into the `Endpoint_Processess` datamodel. -known_false_positives: Administrators using the DiskShadow tool in their infrastructure - as a main backup tool with scripts will cause false positives -references: -- https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/ -tags: - analytic_story: - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting to run a script. - mitre_attack_id: - - T1218 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/diskshadow/windows-security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml b/dev_ssa/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml deleted file mode 100644 index 8d75b009ad..0000000000 --- a/dev_ssa/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml +++ /dev/null @@ -1,110 +0,0 @@ -name: Windows DotNet Binary in Non Standard Path -id: 21179107-099a-324a-94d3-08301e6c065f -version: 4 -date: '2022-03-17' -author: Michael Haag, Splunk -status: production -type: Anomaly -description: The following analytic identifies native .net binaries within the Windows - operating system that may be abused by adversaries by moving it to a new directory. - The analytic identifies the .net binary by using a list. If one or the other matches - an alert will be generated. Adversaries abuse these binaries as they are native - to Windows and native DotNet. Note that not all SDK (post install of Windows) are - captured in the list. Lookup - https://github.com/splunk/security_content/blob/develop/lookups/is_net_windows_file.csv. -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name|re: - - MSBuild.exe - - comsvcconfig.exe - - dfsradmin.exe - - dfsvc.exe - - microsoft.workflow.compiler.exe - - smsvchost.exe - - wsatconfig.exe - - addinprocess.exe - - addinprocess32.exe - - addinutil.exe - - aspnet_compiler.exe - - aspnet_regbrowsers.exe - - aspnet_regsql.exe - - caspol.exe - - datasvcutil.exe - - edmgen.exe - - installutil.exe - - jsc.exe - - ngentask.exe - - regasm.exe - - regsvcs.exe - - sdnbr.exe - - acu.exe - - appvstreamingux.exe - - dsac.exe - - lbfoadmin.exe - - microsoft.uev.synccontroller.exe - - mtedit.exe - - scriptrunner.exe - - servermanager.exe - - stordiag.exe - - tzsync.exe - - uevagentpolicygenerator.exe - - uevappmonitor.exe - - uevtemplatebaselinegenerator.exe - - uevtemplateconfigitemgenerator.exe - - powershell_ise.exe - - iediagcmd.exe - - xbox.tcui.exe - - microsoft.activedirectory.webservices.exe - - iisual.exe - - filehistory.exe - - secureassessmentbrowser.exe - selection2: - process.file.path|re: - - \\windows\\system32 - - \\windows\\syswow64 - - \\windows\\adws - - \\windows\\networkcontroller - - \\windows\\systemapps - - \\winsxs - - \\microsoft.net - condition: selection1 and not selection2 -how_to_implement: Collect endpoint data such as sysmon or 4688 events. -known_false_positives: False positives may be present and filtering may be required. - Certain utilities will run from non-standard paths based on the third-party application - in use. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml -- https://attack.mitre.org/techniques/T1036/003/ -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md -tags: - analytic_story: - - Masquerading - Rename System Utilities - - Unusual Processes - - Ransomware - - Signed Binary Proxy Execution InstallUtil - - WhisperGate - asset_type: Endpoint - confidence: 70 - impact: 70 - message: A system process $process_name$ with commandline $process$ spawn in non-default - folder path on host $dest_device_id$ - mitre_attack_id: - - T1036 - - T1036.003 - - T1218 - - T1218.004 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Actions on Objectives - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___windows_exchange_powershell_module_usage.yml b/dev_ssa/endpoint/ssa___windows_exchange_powershell_module_usage.yml deleted file mode 100644 index 8d6a86c66f..0000000000 --- a/dev_ssa/endpoint/ssa___windows_exchange_powershell_module_usage.yml +++ /dev/null @@ -1,80 +0,0 @@ -name: Windows Exchange PowerShell Module Usage -id: 1118bc65-b0c7-4589-bc2f-ad6802fd0909 -version: 4 -date: '2022-10-12' -author: Michael Haag, Splunk -status: production -type: TTP -description: 'The following analytic identifies the usage of Exchange PowerShell modules - that were recently used for a proof of concept related to ProxyShell. Currently, - there is no active data shared or data we could re-produce relate to this part of - the ProxyShell chain of exploits. - - Inherently, the usage of the modules is not malicious, but reviewing parallel processes, - and user, of the session will assist with determining the intent. - - Module - New-MailboxExportRequest will begin the process of exporting contents of - a primary mailbox or archive to a .pst file. - - Module - New-managementroleassignment can assign a management role to a management - role group, management role assignment policy, user, or universal security group - (USG). - - Module - New-MailboxSearch cmdlet to create a mailbox search and either get an estimate - of search results, place search results on In-Place Hold or copy them to a Discovery - mailbox. You can also place all contents in a mailbox on hold by not specifying - a search query, which accomplishes similar results as Litigation Hold. \ Module - - Get-Recipient cmdlet to view existing recipient objects in your organization. - This cmdlet returns all mail-enabled objects (for example, mailboxes, mail users, - mail contacts, and distribution groups).' -data_source: -- Powershell 4104 -search: - selection1: - process.cmd_line|re: - - get-recipient - - new-mailboxsearch - - new-managementroleassignment - - new-mailboxexportrequest - condition: (selection1) -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. - This will only work with Multiline event logs, not XML. -known_false_positives: Administrators or power users may use this PowerShell commandlet -references: -- https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps -- https://docs.microsoft.com/en-us/powershell/module/exchange/new-managementroleassignment?view=exchange-ps -- https://blog.orange.tw/2021/08/proxyshell-a-new-attack-surface-on-ms-exchange-part-3.html -- https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell -- https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/ -- https://www.cisa.gov/uscert/ncas/alerts/aa22-264a -- https://learn.microsoft.com/en-us/powershell/module/exchange/new-mailboxsearch?view=exchange-ps -- https://learn.microsoft.com/en-us/powershell/module/exchange/get-recipient?view=exchange-ps -- https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/ -tags: - analytic_story: - - ProxyShell - - CISA AA22-264A - asset_type: Endpoint - confidence: 80 - impact: 40 - message: Exchange enumeration using PowerShell on $dest_device_id$. - mitre_attack_id: - - T1059 - - T1059.001 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Actions on Objectives - risk_score: 32 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/exchange/windows-powershell.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog - update_timestamp: true diff --git a/dev_ssa/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/dev_ssa/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml deleted file mode 100644 index fa51f45648..0000000000 --- a/dev_ssa/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Windows Execute Arbitrary Commands with MSDT -id: f253f9c2-10f0-4cc8-b469-f505ba8c2038 -version: 4 -date: '2022-09-15' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies a recently disclosed arbitraty command - execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample - identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve - a remote payload. During triage, review file modifications for html. Identify parallel - process execution that may be related, including an Office Product. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|contains: - - ms-msdt:/id - - ms-msdt:-id - - ms-msdt:/id - - 'ms-msdt:' - - msdt - process.file.name: msdt.exe - selection2: - process.cmd_line|re: - - .xml - - it_rebrowseforfile= - - it_browseforfile= - selection3: - process.cmd_line|re: pcwdiagnostic - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: False positives may be present, filter as needed. Added .xml - to potentially capture any answer file usage. Remove as needed. -references: -- https://isc.sans.edu/diary/rss/28694 -- https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e -- https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A -- https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ -- https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection -- https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html -tags: - analytic_story: - - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190 - asset_type: Endpoint - confidence: 100 - cve: - - CVE-2022-30190 - impact: 100 - message: $process_name$ on $dest_device_id$ under user $dest_user_id$ possibly indicative - of indirect command execution. - mitre_attack_id: - - T1218 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 100 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt-windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog - update_timestamp: true diff --git a/dev_ssa/endpoint/ssa___windows_file_share_discovery_with_powerview.yml b/dev_ssa/endpoint/ssa___windows_file_share_discovery_with_powerview.yml deleted file mode 100644 index d83d297b2d..0000000000 --- a/dev_ssa/endpoint/ssa___windows_file_share_discovery_with_powerview.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Windows File Share Discovery With Powerview -id: ec4f671e-c736-4f78-a4c0-8fe809e952e5 -version: 4 -date: '2023-05-02' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: The following analytic identifies the use of the Invoke-ShareFinder PowerShell commandlet part of PowerView. This module obtains the list of all - active domain computers and lists the active shares on each computer. Network file shares in Active Directory environments may contain sensitive information - like backups, scripts, credentials, etc. Adversaries who have obtained a foothold in an AD network may leverage PowerView to identify secrets and leverage them - for Privilege Escalation or Lateral Movement. -data_source: -- Powershell 4104 -search: - selection1: - process.cmd_line|re: 'invoke-sharefinder' - condition: selection1 -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: Unknown -references: -- https://github.com/PowerShellEmpire/PowerTools/blob/master/PowerView/powerview.ps1 -- https://thedfirreport.com/2023/01/23/sharefinder-how-threat-actors-discover-file-shares/ -- https://attack.mitre.org/techniques/T1135/ -tags: - analytic_story: - - Active Directory Privilege Escalation - asset_type: Endpoint - confidence: 80 - impact: 60 - message: Invoke-ShareFinder commandlet was executed on $Computer$ - mitre_attack_id: - - T1552 - - T1552.006 - observable: - - name: Computer - type: Hostname - role: - - Victim - - name: UserID - type: User - role: - - Victim - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - EventCode - - ScriptBlockText - - Opcode - - Computer - - UserID - kill_chain_phases: - - Exploitation - risk_score: 48 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/powerview_sharefinder/windows-powershell.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog - update_timestamp: true diff --git a/dev_ssa/endpoint/ssa___windows_findstr_gpp_discovery.yml b/dev_ssa/endpoint/ssa___windows_findstr_gpp_discovery.yml deleted file mode 100644 index 34e956cd30..0000000000 --- a/dev_ssa/endpoint/ssa___windows_findstr_gpp_discovery.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Windows Findstr GPP Discovery -id: 73ed0f19-080e-4917-b7c6-56e1760a50d4 -version: 4 -date: '2023-05-02' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: The following analytic identifies the use of the findstr command employed to search for unsecured credentials Group Policy Preferences (GPP). - GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts. - These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public). - While Microsoft released a patch that impedes Administrators to create unsecure credentials, existing Group Policy Preferences files with passwords are not removed from SYSVOL. -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: - - findstr.exe - process.cmd_line|contains: sysvol - process.cmd_line|contains: cpassword - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrators may leverage findstr to find passwords in GPO to validate exposure. Filter as needed. -references: -- https://attack.mitre.org/techniques/T1552/006/ -- https://pentestlab.blog/2017/03/20/group-policy-preferences/ -- https://adsecurity.org/?p=2288 -- https://www.hackingarticles.in/credential-dumping-group-policy-preferences-gpp/ -- https://support.microsoft.com/en-us/topic/ms14-025-vulnerability-in-group-policy-preferences-could-allow-elevation-of-privilege-may-13-2014-60734e15-af79-26ca-ea53-8cd617073c30 -tags: - analytic_story: - - Active Directory Privilege Escalation - asset_type: Endpoint - confidence: 80 - impact: 70 - message: Findstr was executed to discover GPP credentials on $dest$ - mitre_attack_id: - - T1552 - - T1552.006 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Behavioral Analytics - required_fields: - - process_name - - _time - - dest_device_id - - dest_user_id - - process - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.006/findstr_gpp_discovery/windows-4688.log - source: XmlWinEventLog \ No newline at end of file diff --git a/dev_ssa/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml b/dev_ssa/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml deleted file mode 100644 index 62372230f4..0000000000 --- a/dev_ssa/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Windows Ingress Tool Transfer Using Explorer -id: 695bfad6-9662-4f9e-a576-bf02a951aa60 -version: 4 -date: '2022-09-13' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the Windows Explorer process with a - URL within the command-line. Explorer.exe is known Windows process that handles - start menu, taskbar, desktop and file manager. Many adversaries abuse this process, - like DCRat malware, where it attempts to open the URL with the default browser application - on the target host by putting the URL as a parameter on explorer.exe process. This - anomaly detection might be a good pivot to check which user and how this process - was executed, what is the parent process and what is the URL link. This technique - is not commonly used to open an URL. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|contains: - - https:// - - http:// - process.file.name: explorer.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints. -known_false_positives: False positives may be present based on legitimate applications - or third party utilities. Filter out any additional parent process names. -references: -- https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor -tags: - analytic_story: - - DarkCrystal RAT - asset_type: Endpoint - confidence: 50 - impact: 50 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote - destination to download an additional payload. - mitre_attack_id: - - T1105 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105_explorer-windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog - update_timestamp: true diff --git a/dev_ssa/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml b/dev_ssa/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml deleted file mode 100644 index 319759e7da..0000000000 --- a/dev_ssa/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml +++ /dev/null @@ -1,76 +0,0 @@ -name: Windows Lateral Tool Transfer RemCom -id: 25c6b8ba-2a61-41ad-b80c-8e97cf501920 -version: 4 -date: '2022-02-23' -author: Michael Haag, Splunk -status: experimental -type: TTP -description: This analytic identifies the use of RemCom.exe - The open source psexec. This utility provides the ability to move laterally and run scripts or commands remotely. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|contains: - - '/user:' - - '/pwd:' - - '\\' - process.file.name: remcom.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: It is possible legitimate applications may perform this behavior - and will need to be filtered. -references: - - https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ - - https://github.com/kavika13/RemCom -tags: - analytic_story: - - Active Directory Lateral Movement - - Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to move laterally. - mitre_attack_id: - - T1570 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - kill_chain_phases: - - Exploitation - risk_score: 40 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1570/remcom/4688_remcom_windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog - update_timestamp: true \ No newline at end of file diff --git a/dev_ssa/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml b/dev_ssa/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml deleted file mode 100644 index b61614b068..0000000000 --- a/dev_ssa/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml +++ /dev/null @@ -1,143 +0,0 @@ -name: Windows LOLBin Binary in Non Standard Path -id: 25689101-012a-324a-94d3-08301e6c065a -version: 8 -date: '2022-08-31' -author: Michael Haag, Splunk -status: production -type: Anomaly -description: The following analytic identifies native living off the land binaries - within the Windows operating system that may be abused by adversaries by moving - it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io - site, and excluded common process names (cmd.exe, explorer.exe, csc.exe, hh.exe, - regedit.exe) and DotNet binaries. It also does not include the category of OtherMSBinaries. -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: - - bitsadmin.exe - - certoc.exe - - certreq.exe - - certutil.exe - - cmdkey.exe - - cmdl32.exe - - cmstp.exe - - configsecuritypolicy.exe - - control.exe - - cscript.exe - - datasvcutil.exe - - desktopimgdownldr.exe - - dfsvc.exe - - diantz.exe - - diskshadow.exe - - dllhost.exe - - dnscmd.exe - - esentutl.exe - - eventvwr.exe - - expand.exe - - extexport.exe - - extrac32.exe - - findstr.exe - - finger.exe - - fltmc.exe - - forfiles.exe - - ftp.exe - - gfxdownloadwrapper.exe - - gpscript.exe - - imewdbld.exe - - ie4uinit.exe - - ieexec.exe - - ilasm.exe - - infdefaultinstall.exe - - makecab.exe - - mavinject.exe - - microsoft.workflow.compiler.exe - - mmc.exe - - msconfig.exe - - msdt.exe - - mshta.exe - - msiexec.exe - - netsh.exe - - odbcconf.exe - - offlinescannershell.exe - - pcalua.exe - - pcwrun.exe - - pktmon.exe - - pnputil.exe - - presentationhost.exe - - print.exe - - printbrm.exe - - psr.exe - - rasautou.exe - - reg.exe - - regini.exe - - register-cimprovider.exe - - regsvr32.exe - - replace.exe - - rpcping.exe - - rundll32.exe - - runonce.exe - - runscripthelper.exe - - sc.exe - - schtasks.exe - - scriptrunner.exe - - settingsynchost.exe - - syncappvpublishingserver.exe - - ttdinject.exe - - tttracer.exe - - vbc.exe - - verclsid.exe - - wab.exe - - wlrmdr.exe - - wmic.exe - - workfolders.exe - - wscript.exe - - wsreset.exe - - wuauclt.exe - - xwizard.exe - selection2: - process.file.path|re: - - (?i)\\windows\\system32 - - (?i)\\windows\\syswow64 - - (?i)\\windows\\networkcontrolle - - (?i)\\windows\\systemapps - - (?i)\\winsxs - - (?i)\\microsoft.net - condition: selection1 and not selection2 -how_to_implement: Collect endpoint data such as sysmon or 4688 events. -known_false_positives: False positives may be present and filtering may be required. - Certain utilities will run from non-standard paths based on the third-party application - in use. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml -- https://attack.mitre.org/techniques/T1036/003/ -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md -tags: - analytic_story: - - Unusual Processes - - Ransomware - - WhisperGate - asset_type: Endpoint - confidence: 70 - impact: 70 - message: A system process $process_name$ with commandline $process$ spawn in non-default - folder path on host $dest_device_id$ - mitre_attack_id: - - T1036 - - T1036.003 - - T1218 - - T1218.004 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Actions on Objectives - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___windows_mshta_child_process.yml b/dev_ssa/endpoint/ssa___windows_mshta_child_process.yml deleted file mode 100644 index cd43952a16..0000000000 --- a/dev_ssa/endpoint/ssa___windows_mshta_child_process.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Windows MSHTA Child Process -id: f63f7e9c-9526-11ec-9fc7-acde48001122 -version: 6 -date: '2022-02-23' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies child processes spawning from "mshta.exe". - The search will return the first time and last time these command-line arguments - were used for these executions, as well as the target system, the user, parent process - "mshta.exe" and its child process. -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: - - wscript.exe - - cscript.exe - - searchprotocolhost.exe - - microsoft.workflow.compiler.exe - - msbuild.exe - - colorcpl.exe - - scrcons.exe - - cmd.exe - - powershell.exe - actor.process.file.name|endswith: mshta.exe - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Although unlikely, some legitimate applications may exhibit - this behavior, triggering a false positive. -references: -- https://github.com/redcanaryco/AtomicTestHarnesses -- https://redcanary.com/blog/introducing-atomictestharnesses/ -tags: - analytic_story: - - Suspicious MSHTA Activity - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote - destination to download an additional payload. - mitre_attack_id: - - T1218.005 - - T1218 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___windows_mshta_command_line_url.yml b/dev_ssa/endpoint/ssa___windows_mshta_command_line_url.yml deleted file mode 100644 index 3c38fc351e..0000000000 --- a/dev_ssa/endpoint/ssa___windows_mshta_command_line_url.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Windows MSHTA Command-Line URL -id: 9b35c538-94ef-11ec-9439-acde48001122 -version: 4 -date: '2022-02-23' -author: Michael Haag, Splunk -status: production -type: TTP -description: This analytic identifies when Microsoft HTML Application Host (mshta.exe) - utility is used to make remote http connections. Adversaries may use mshta.exe to - proxy the download and execution of remote .hta files. The analytic identifies command - line arguments of http and https being used. This technique is commonly used by - malicious software to bypass preventative controls. The search will return the first - time and last time these command-line arguments were used for these executions, - as well as the target system, the user, process "rundll32.exe" and its parent process. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|contains: - - https:// - - http:// - process.file.name: mshta.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: It is possible legitimate applications may perform this behavior - and will need to be filtered. -references: -- https://github.com/redcanaryco/AtomicTestHarnesses -- https://redcanary.com/blog/introducing-atomictestharnesses/ -- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing -tags: - analytic_story: - - Suspicious MSHTA Activity - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote - destination to download an additional payload. - mitre_attack_id: - - T1218.005 - - T1218 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___windows_mshta_inline_hta_execution.yml b/dev_ssa/endpoint/ssa___windows_mshta_inline_hta_execution.yml deleted file mode 100644 index 83ed489cf5..0000000000 --- a/dev_ssa/endpoint/ssa___windows_mshta_inline_hta_execution.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Windows MSHTA Inline HTA Execution -id: 24962154-9524-11ec-9333-acde48001122 -version: 4 -date: '2022-02-23' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies "mshta.exe" execution with inline protocol - handlers. "JavaScript", "VBScript", and "About" are the only supported options when - invoking HTA content directly on the command-line. The search will return the first - time and last time these command-line arguments were used for these executions, - as well as the target system, the user, process "mshta.exe" and its parent process. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|contains: - - about - - javascript - - vbscript - process.file.name: mshta.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Although unlikely, some legitimate applications may exhibit - this behavior, triggering a false positive. -references: -- https://github.com/redcanaryco/AtomicTestHarnesses -- https://redcanary.com/blog/introducing-atomictestharnesses/ -- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing -tags: - analytic_story: - - Suspicious MSHTA Activity - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ executing with inline HTA, - indicative of defense evasion. - mitre_attack_id: - - T1218.005 - - T1218 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___windows_odbcconf_load_response_file.yml b/dev_ssa/endpoint/ssa___windows_odbcconf_load_response_file.yml deleted file mode 100644 index 16702f47da..0000000000 --- a/dev_ssa/endpoint/ssa___windows_odbcconf_load_response_file.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Windows Odbcconf Load Response File -id: 7b6c3fac-0c37-4efc-a85e-de88f42b6763 -version: 4 -date: '2022-09-15' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the odbcconf.exe, Windows Open Database - Connectivity utility, loading up a resource file. The file extension is arbitrary - and may be named anything. The resource file itself may have different commands - supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands. - During triage, review file modifications and parallel processes. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|contains: - - '/f ' - - '-f ' - process.file.name: odbcconf.exe - selection2: - process.cmd_line|contains: .rsp - condition: (selection1) and selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: False positives may be present and filtering may need to occur - based on legitimate application usage. Filter as needed. -references: -- https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html -- https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw -tags: - analytic_story: - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 60 - message: $process_name$ has been identified on $dest_device_id$ under user $dest_user_id$ - attempting to circumvent controls. - mitre_attack_id: - - T1218.008 - - T1218 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 42 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/odbcconf-windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog - update_timestamp: true diff --git a/dev_ssa/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml b/dev_ssa/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml deleted file mode 100644 index 987c572de7..0000000000 --- a/dev_ssa/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Windows OS Credential Dumping with Ntdsutil Export NTDS -id: dad9ddec-a72a-47be-87b6-a0f7ba98ed6e -version: 4 -date: '2022-08-31' -author: Michael Haag, Splunk -status: production -type: TTP -description: 'Monitor for signs that Ntdsutil is being used to Extract Active Directory - database - NTDS.dit, typically used for offline password cracking. It may be used - in normal circumstances with no command line arguments or shorthand variations of - more common arguments. Ntdsutil.exe is typically seen run on a Windows Server. Typical - command used to dump ntds.dit - - ntdsutil "ac i ntds" "ifm" "create full C:\Temp" q q - - This technique uses "Install from Media" (IFM), which will extract a copy of the - Active Directory database. A successful export of the Active Directory database - will yield a file modification named ntds.dit to the destination.' -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: ntdsutil.exe - selection2: - process.cmd_line|contains: create - selection3: - process.cmd_line|contains: ntds - condition: selection1 and (selection2 and selection3) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Highly possible Server Administrators will troubleshoot with - ntdsutil.exe, generating false positives. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.003/T1003.003.md#atomic-test-3---dump-active-directory-database-with-ntdsutil -- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753343(v=ws.11) -- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf -- https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html -- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ -tags: - analytic_story: - - Credential Dumping - - HAFNIUM Group - - Living Off The Land - - Volt Typhoon - asset_type: Endpoint - confidence: 50 - impact: 100 - message: Active Directory NTDS export on $dest_device_id$ using $process_name$ by - $dest_user_id$. - mitre_attack_id: - - T1003.003 - - T1003 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 50 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/4688_windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog - update_timestamp: true diff --git a/dev_ssa/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml b/dev_ssa/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml deleted file mode 100644 index f6a83e5d51..0000000000 --- a/dev_ssa/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Windows OS Credential Dumping with Procdump -id: e102e297-dbe6-4a19-b319-5c08f4c19a06 -version: 5 -date: '2022-08-31' -author: Michael Haag, Splunk -status: production -type: TTP -description: 'Detect procdump.exe dumping the lsass process. This query looks for - both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump - file with all process memory. Both are highly suspect and should be reviewed. This - query does not monitor for the internal name (original_file_name=procdump) of the - PE or look for procdump64.exe. Modify the query as needed. - - During triage, confirm this is procdump.exe executing. If it is the first time a - Sysinternals utility has been ran, it is possible there will be a -accepteula on - the command line. Review other endpoint data sources for cross process (injection) - into lsass.exe.' -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|contains: - - '-ma ' - - '-mm ' - process.file.name: - - procdump64.exe - - procdump.exe - selection2: - process.cmd_line|contains: lsass - condition: (selection1) and selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: None identified. -references: -- https://attack.mitre.org/techniques/T1003/001/ -- https://docs.microsoft.com/en-us/sysinternals/downloads/procdump -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump -- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ -tags: - analytic_story: - - Credential Dumping - - HAFNIUM Group - asset_type: Endpoint - confidence: 100 - impact: 80 - message: Procdump was utilized to dump lsass on $dest_device_id$ by $dest_user_id$. - mitre_attack_id: - - T1003.001 - - T1003 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/procdump_windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog - update_timestamp: true diff --git a/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml deleted file mode 100644 index 0012d4cfa5..0000000000 --- a/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Windows Powershell Connect to Internet With Hidden Window -id: 477e068e-8b6d-11ec-b6c1-81af21670352 -version: 6 -date: '2022-02-11' -author: Jose Hernandez, David Dorsey, Michael Haag Splunk -status: production -type: Anomaly -description: The following hunting analytic identifies PowerShell commands utilizing - the WindowStyle parameter to hide the window on the compromised endpoint. This combination - of command-line options is suspicious because it is overriding the default PowerShell - execution policy, attempts to hide its activity from the user, and connects to the - Internet. Removed in this version of the query is New-Object. The analytic identifies - all variations of WindowStyle, as PowerShell allows the ability to shorten the parameter. - For example w, win, windowsty and so forth. In addition, through our research it - was identified that PowerShell will interpret different command switch types beyond - the hyphen. We have added endash, emdash, horizontal bar, and forward slash. -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: - - powershell_ise.exe - - powershell.exe - - sqltoolsps.exe - - sqlps.exe - - pwsh.exe - selection2: - process.cmd_line|re: '[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+h(i*d*d*e*n*)\s+' - condition: selection1 and selection2 -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. -known_false_positives: Legitimate process can have this combination of command-line - options, but it's not common. -references: -- https://regexr.com/663rr -- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/Windows/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1 -- https://ss64.com/ps/powershell.html -- https://twitter.com/M_haggis/status/1440758396534214658?s=20 -- https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/ -tags: - analytic_story: - - Malicious PowerShell - - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns - - HAFNIUM Group - - Log4Shell CVE-2021-44228 - asset_type: Endpoint - confidence: 70 - impact: 50 - message: PowerShell processes $process$ started with parameters to modify the execution - policy of the run, run in a hidden window, and connect to the Internet on host - $dest$ executed by user $user$. - mitre_attack_id: - - T1020 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/hidden_powershell/hidden_windows-security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml b/dev_ssa/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml deleted file mode 100644 index 392b9f857f..0000000000 --- a/dev_ssa/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser -id: d57b4d91-fc91-4482-a325-47693cced1eb -version: 4 -date: '2022-11-14' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - to identify the execution of the `Get-ADUser` commandlet with specific parameters. - `Get-ADUser` is part of the Active Directory PowerShell module used to manage Windows - Active Directory networks. As the name suggests, `Get-ADUser` is used to query for - domain users. With the appropiate parameters, Get-ADUser allows adversaries to discover - domain accounts with Kerberos Pre Authentication disabled.\ Red Teams and adversaries - alike use may abuse Get-ADUSer to enumerate these accounts and attempt to crack - their passwords offline. -data_source: -- Powershell 4104 -search: - selection1: - process.cmd_line|contains: '4194304' - selection2: - process.cmd_line|re: get-aduser - condition: selection1 and selection2 -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: Administrators or power users may use search for accounts with - Kerberos Pre Authentication disabled for legitimate purposes. -references: -- https://attack.mitre.org/techniques/T1558/004/ -- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html -- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/ -tags: - analytic_story: - - Active Directory Kerberos Attacks - asset_type: Endpoint - confidence: 90 - impact: 60 - message: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser from $dest_device_id$ - mitre_attack_id: - - T1558 - - T1558.004 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 54 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/windows-powershell.log - source: WinEventLog - sourcetype: WinEventLog - update_timestamp: true diff --git a/dev_ssa/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/dev_ssa/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml deleted file mode 100644 index 48e238b891..0000000000 --- a/dev_ssa/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView -id: dc3f2af7-ca69-47ce-a122-9f9787e19417 -version: 4 -date: '2022-11-14' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - to identify the execution of the `Get-DomainUser` commandlet with specific parameters. - `Get-DomainUser` is part of PowerView, a PowerShell tool used to perform enumeration - on Windows Active Directory networks. As the name suggests, `Get-DomainUser` is - used to identify domain users and combining it with `-PreauthNotRequired` allows - adversaries to discover domain accounts with Kerberos Pre Authentication disabled. - - Red Teams and adversaries alike use may leverage PowerView to enumerate these accounts - and attempt to crack their passwords offline. -data_source: -- Powershell 4104 -search: - selection1: - process.cmd_line|re: preauthnotrequired - selection2: - process.cmd_line|re: get-domainuser - condition: selection1 and selection2 -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: Administrators or power users may use PowerView for troubleshooting -references: -- https://attack.mitre.org/techniques/T1558/004/ -- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html -- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/ -tags: - analytic_story: - - Active Directory Kerberos Attacks - asset_type: endpoint - confidence: 90 - impact: 60 - message: Disabled Kerberos Pre-Authentication Discovery With PowerView from $dest_device_id$ - mitre_attack_id: - - T1558 - - T1558.004 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 54 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdomainuser.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog - update_timestamp: true diff --git a/dev_ssa/endpoint/ssa___windows_powershell_downloadfile.yml b/dev_ssa/endpoint/ssa___windows_powershell_downloadfile.yml deleted file mode 100644 index abe97e3bfd..0000000000 --- a/dev_ssa/endpoint/ssa___windows_powershell_downloadfile.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Windows Powershell DownloadFile -id: 46440222-81d5-44b1-a376-19dcd70d1b08 -version: 5 -date: '2022-02-11' -author: Jose Hernandez, Michael Haag, Splunk -status: production -type: Anomaly -description: The following analytic identifies the use of PowerShell downloading a - file using `DownloadFile` method. This particular method is utilized in many different - PowerShell frameworks to download files and output to disk. Identify the source - (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell - transaction logs are available, review for further details of the implant. -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: - - powershell_ise.exe - - powershell.exe - - sqltoolsps.exe - - sqlps.exe - - pwsh.exe - - pwsh.exe - selection2: - process.cmd_line|re: downloadfile - condition: selection1 and selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present and filtering will need to occur - by parent process or command line argument. It may be required to modify this query - to an EDR product for more granular coverage. -references: -- https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0 -- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md -tags: - analytic_story: - - Malicious PowerShell - - Ingress Tool Transfer - - Log4Shell CVE-2021-44228 - asset_type: Endpoint - confidence: 70 - impact: 50 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile - within PowerShell. - mitre_attack_id: - - T1020 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/downloadfile_windows-security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___windows_powershell_downloadstring.yml b/dev_ssa/endpoint/ssa___windows_powershell_downloadstring.yml deleted file mode 100644 index 49f769cd80..0000000000 --- a/dev_ssa/endpoint/ssa___windows_powershell_downloadstring.yml +++ /dev/null @@ -1,75 +0,0 @@ -name: Windows Powershell DownloadString -id: e4a2cc58-59d4-480a-8992-9dfb95a4bacd -version: 1 -date: '2024-03-19' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the use of PowerShell downloading a - file using `DownloadString` method. This particular method is utilized in many different - PowerShell frameworks to download files and output to disk. Identify the source - (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell - transaction logs are available, review for further details of the implant. -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: - - powershell_ise.exe - - powershell.exe - - sqltoolsps.exe - - sqlps.exe - - pwsh.exe - - pwsh.exe - selection2: - process.cmd_line|re: DownloadString - condition: selection1 and selection2 -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: False positives may be present and filtering will need to occur - by parent process or command line argument. It may be required to modify this query - to an EDR product for more granular coverage. -references: -- https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-5.0 -- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md -- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ -tags: - analytic_story: - - Winter Vivern - - Ingress Tool Transfer - - Hermetic Wiper - - Malicious PowerShell - - HAFNIUM Group - - Data Destruction - - IcedID - - SysAid On-Prem Software CVE-2023-47246 Vulnerability - asset_type: Endpoint - confidence: 70 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadString - within PowerShell. - mitre_attack_id: - - T1059 - - T1059.001 - - T1105 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-security-2.log - source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog diff --git a/dev_ssa/endpoint/ssa___windows_powershell_execution_policy_bypass.yml b/dev_ssa/endpoint/ssa___windows_powershell_execution_policy_bypass.yml deleted file mode 100644 index df5ed8ec94..0000000000 --- a/dev_ssa/endpoint/ssa___windows_powershell_execution_policy_bypass.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Windows Powershell Execution Policy Bypass -id: 1d20daaa-f99e-4770-a25c-e84e8cd32825 -version: 1 -date: '2024-03-19' -author: Patrick Bareiss, Splunk -status: validation -type: TTP -description: The following analytic detects the initiation of PowerShell processes with parameters specifically designed to bypass the local script execution policy. - It identifies this behavior by searching for commandline arguments that are commonly used in malicious activities to circumvent the built-in security mechanisms - of PowerShell. This detection is crucial for a Security Operations Center (SOC) as bypassing the execution policy can allow attackers to execute arbitrary scripts, - leading to unauthorized actions, data exfiltration, or further system compromise. The impact of such an attack can be significant, potentially resulting in the - loss of sensitive information or control over critical systems. -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: - - powershell_ise.exe - - powershell.exe - - sqltoolsps.exe - - sqlps.exe - - pwsh.exe - - pwsh.exe - selection2: - process.cmd_line|re: Bypass - condition: selection1 and selection2 -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: There may be legitimate reasons to bypass the PowerShell execution - policy. The PowerShell script being run with this parameter should be validated - to ensure that it is legitimate. -references: -- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ -tags: - analytic_story: - - DHS Report TA18-074A - - HAFNIUM Group - - DarkCrystal RAT - - AsyncRAT - - Volt Typhoon - asset_type: Endpoint - confidence: 60 - impact: 70 - message: PowerShell local execution policy bypass attempt on $dest$ - mitre_attack_id: - - T1059 - - T1059.001 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - risk_score: 42 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/encoded_powershell/windows-security.log - source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog diff --git a/dev_ssa/endpoint/ssa___windows_powershell_export_certificate.yml b/dev_ssa/endpoint/ssa___windows_powershell_export_certificate.yml deleted file mode 100644 index 9c5844b698..0000000000 --- a/dev_ssa/endpoint/ssa___windows_powershell_export_certificate.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Windows PowerShell Export Certificate -id: 0bf87e10-4d7d-4c63-9721-c7b3f6e6e944 -version: 3 -date: '2023-05-01' -author: Michael Haag, Splunk -status: experimental -type: Anomaly -description: The following analytic identifies the PowerShell Cmdlet export-certificate - utilizing Script Block Logging. This particular behavior is related to an adversary - attempting to steal certificates local to the Windows endpoint within the Certificate - Store. -data_source: -- Powershell 4104 -search: - selection1: - process.cmd_line|re: 'export-certificate' - condition: (selection1) -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: It is possible administrators or scripts may run these commands, - filtering may be required. -references: -- https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj -- https://learn.microsoft.com/en-us/powershell/module/pki/export-certificate?view=windowsserver2022-ps -tags: - analytic_story: - - Windows Certificate Services - asset_type: Endpoint - confidence: 60 - impact: 60 - message: A PowerShell Cmdlet related to exporting a Certificate was ran on $dest_device_id$, - attempting to export a certificate. - mitre_attack_id: - - T1552.004 - - T1552 - - T1649 - observable: - - name: dest_device_id - type: Hostname - role: - - Victim - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process - kill_chain_phases: - - Exploitation - risk_score: 36 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_certificate.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog - update_timestamp: true diff --git a/dev_ssa/endpoint/ssa___windows_powershell_export_pfxcertificate.yml b/dev_ssa/endpoint/ssa___windows_powershell_export_pfxcertificate.yml deleted file mode 100644 index 1dde6e131b..0000000000 --- a/dev_ssa/endpoint/ssa___windows_powershell_export_pfxcertificate.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Windows PowerShell Export PFXCertificate -id: 0c93bb7a-df21-477e-a623-b0c37c1c6661 -version: 3 -date: '2023-05-18' -author: Michael Haag, Splunk -status: experimental -type: Anomaly -description: The following analytic identifies the PowerShell Cmdlet export-pfxcertificate - utilizing Script Block Logging. This particular behavior is related to an adversary - attempting to steal certificates local to the Windows endpoint within the Certificate - Store. -data_source: -- Powershell 4104 -search: - selection1: - process.cmd_line|re: 'export-pfxcertificate' - condition: (selection1) -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: It is possible administrators or scripts may run these commands, - filtering may be required. -references: -- https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj -- https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps -tags: - analytic_story: - - Windows Certificate Services - asset_type: Endpoint - confidence: 60 - impact: 60 - message: A PowerShell Cmdlet related to exporting a Certificate was ran on $dest_device_id$, - attempting to export a pfxcertificate. - mitre_attack_id: - - T1552.004 - - T1552 - - T1649 - observable: - - name: dest_device_id - type: Hostname - role: - - Victim - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process - kill_chain_phases: - - Exploitation - risk_score: 36 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_pfx-windows-powershell.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog - update_timestamp: true diff --git a/dev_ssa/endpoint/ssa___windows_powershell_start_bitstransfer.yml b/dev_ssa/endpoint/ssa___windows_powershell_start_bitstransfer.yml deleted file mode 100644 index db5d53cb9a..0000000000 --- a/dev_ssa/endpoint/ssa___windows_powershell_start_bitstransfer.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Windows PowerShell Start-BitsTransfer -id: 0bafd086-8f61-11ec-996e-acde48001122 -version: 5 -date: '2022-02-16' -author: Michael Haag, Splunk -status: production -type: TTP -description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar - functionality is present. This technique variation is not as commonly used by adversaries, - but has been abused in the past. Lesser known uses include the ability to set the - `-TransferType` to `Upload` for exfiltration of files. In an instance where `Upload` - is used, it is highly possible files will be archived. During triage, review parallel - processes and process lineage. Capture any files on disk and review. For the remote - domain or IP, what is the reputation? -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: - - powershell_ise.exe - - powershell.exe - - sqltoolsps.exe - - sqlps.exe - - pwsh.exe - - pwsh.exe - selection2: - process.cmd_line|re: start-bitstransfer - condition: selection1 and selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint_Processess` datamodel. -known_false_positives: Limited false positives. It is possible administrators will - utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent - process or command-line arguments. -references: -- https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281 -- https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs -tags: - analytic_story: - - BITS Jobs - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $dest_user_id$ attempting to download a file. - mitre_attack_id: - - T1197 - - T1105 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/T1197_windows-security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___windows_powersploit_gpp_discovery.yml b/dev_ssa/endpoint/ssa___windows_powersploit_gpp_discovery.yml deleted file mode 100644 index 5f4d575741..0000000000 --- a/dev_ssa/endpoint/ssa___windows_powersploit_gpp_discovery.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Windows PowerSploit GPP Discovery -id: fdef746e-71fb-41ce-8ab2-b4a5a6b50ca2 -version: 4 -date: '2023-05-02' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: The following analytic identifies the use of the Get-GPPPassword PowerShell commandlet employed to search for unsecured credentials Group Policy Preferences (GPP). - GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts. - These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public). - While Microsoft released a patch that impedes Administrators to create unsecure credentials, existing Group Policy Preferences files with passwords are not removed from SYSVOL. -data_source: -- Powershell 4104 -search: - selection1: - process.cmd_line|re: 'get-gpppassword' - condition: selection1 -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: Unknown -references: -- https://attack.mitre.org/techniques/T1552/006/ -- https://pentestlab.blog/2017/03/20/group-policy-preferences/ -- https://adsecurity.org/?p=2288 -- https://www.hackingarticles.in/credential-dumping-group-policy-preferences-gpp/ -- https://adsecurity.org/?p=2288 -- https://support.microsoft.com/en-us/topic/ms14-025-vulnerability-in-group-policy-preferences-could-allow-elevation-of-privilege-may-13-2014-60734e15-af79-26ca-ea53-8cd617073c30 -tags: - analytic_story: - - Active Directory Privilege Escalation - asset_type: Endpoint - confidence: 80 - impact: 70 - message: Commandlets leveraged to discover GPP credentials were executed on $Computer$ - mitre_attack_id: - - T1552 - - T1552.006 - observable: - - name: Computer - type: Hostname - role: - - Victim - - name: UserID - type: User - role: - - Victim - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - EventCode - - ScriptBlockText - - Opcode - - Computer - - UserID - kill_chain_phases: - - Exploitation - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.006/powershell_gpp_discovery/win-powershell.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog - update_timestamp: true diff --git a/dev_ssa/endpoint/ssa___windows_rasautou_dll_execution.yml b/dev_ssa/endpoint/ssa___windows_rasautou_dll_execution.yml deleted file mode 100644 index 392b103505..0000000000 --- a/dev_ssa/endpoint/ssa___windows_rasautou_dll_execution.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Windows Rasautou DLL Execution -id: 6f42b8ce-1e15-11ec-ad5a-acde48001122 -version: 4 -date: '2022-02-15' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the Windows Windows Remote Auto Dialer, - rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary - shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review - parent and child process behavior including file and image loads. -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: rasautou.exe - selection2: - process.cmd_line|re: '-p ' - selection3: - process.cmd_line|re: '-d ' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives will be limited to applications that require - Rasautou.exe to load a DLL from disk. Filter as needed. -references: -- https://github.com/mandiant/DueDLLigence -- https://github.com/MHaggis/notes/blob/master/utilities/Invoke-SPLDLLigence.ps1 -- https://gist.github.com/NickTyrer/c6043e4b302d5424f701f15baf136513 -- https://www.mandiant.com/resources/staying-hidden-on-the-endpoint-evading-detection-with-shellcode -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ attempting to load a DLL in a suspicious manner. - mitre_attack_id: - - T1055.001 - - T1218 - - T1055 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___windows_remote_create_service.yml b/dev_ssa/endpoint/ssa___windows_remote_create_service.yml deleted file mode 100644 index 85c0915c9a..0000000000 --- a/dev_ssa/endpoint/ssa___windows_remote_create_service.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Windows Remote Create Service -id: 0259ff91-a6f3-4af1-af83-6360eff7fd80 -version: 4 -date: '2023-05-18' -author: Michael Haag, Splunk -status: experimental -type: TTP -description: 'This analytic identifies an endpoint that remotely connects to another endpoint to create a new service using sc.exe. On the remote endpoint, the new service will be created and this action will trigger the creation of EventCode 7045 along with all the resulting service information.' -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|re: - - 'create' - - '\\\\' - process.file.name: sc.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: Note that false positives may occur, and filtering may be necessary, especially when it comes to remote service creation by administrators or software management utilities. -references: - - https://attack.mitre.org/techniques/T1543/003/ -tags: - analytic_story: - - Active Directory Lateral Movement - asset_type: Endpoint - confidence: 50 - impact: 50 - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to create a remote service. - mitre_attack_id: - - T1543 - - T1543.003 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - kill_chain_phases: - - Exploitation - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/atomic_red_team/4688-remote-service-create-windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog - update_timestamp: true diff --git a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml b/dev_ssa/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml deleted file mode 100644 index fb35d0c435..0000000000 --- a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Windows Rename System Utilities Acccheckconsole exe LOLBAS in Non Standard Path -id: c842931e-661f-42bc-a4df-0460d93cfb69 -version: 5 -date: '2024-04-03' -author: Splunk Threat Research Bot, Lou Stella, Splunk -status: production -type: Anomaly -description: The following analytic identifies AccCheckConsole.exe which is a native - living off the land binary or script (LOLBAS) within the Windows operating system - that may be abused by adversaries by moving it to a new directory. The list of binaries - was derived from the https://lolbas-project.github.io site. The specific default filepath for AccCheckConsole.exe is within "C:\Program Files (x86)\Windows Kits\10\bin\10.0.22000.0\". -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: acccheckconsole.exe - selection2: - process.file.path|re: \\program files \(x86\)\\windows kits\\10\\bin\\10.0.22000.0\\(x86|x64|arm|arm64)\\accchecker\\ - condition: selection1 and not selection2 -how_to_implement: To successfully implement this search, you must be ingesting logs - with the process name, command-line arguments, and parent processes from your endpoints. - Collect endpoint data such as Sysmon or Windows Events 4688. -known_false_positives: False positives may be present and filtering may be required. - Certain utilities will run from non-standard paths based on the third-party application - in use. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml -- https://attack.mitre.org/techniques/T1036/003/ -- https://lolbas-project.github.io/lolbas/OtherMSBinaries/AccCheckConsole/ -tags: - analytic_story: - - Unusual Processes - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 20 - message: A system process $process_name$ with path $process_path$ spawn in non-default - folder path on host $dest_device_id$ - mitre_attack_id: - - T1036 - - T1036.003 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Actions on Objectives - risk_score: 14 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml b/dev_ssa/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml deleted file mode 100644 index 23e336ac9b..0000000000 --- a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Windows Rename System Utilities Adplus exe LOLBAS in Non Standard Path -id: ecaaf956-c516-4980-b08e-8c01c19614ca -version: 5 -date: '2022-04-03' -author: Splunk Threat Research Bot, Lou Stella, Splunk -status: production -type: Anomaly -description: The following analytic identifies adplus.exe which is a native living - off the land binary or script (LOLBAS) within the Windows operating system that - may be abused by adversaries by moving it to a new directory. The list of binaries - was derived from the https://lolbas-project.github.io site. The specific default filepath for adplus.exe is within "C:\Program Files (x86)\Windows Kits\10\Debuggers". -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: adplus.exe - selection2: - process.file.path|re: \\program files \(x86\)\\windows kits\\10\\debuggers\\(x86|x64|arm|arm64)\\ - condition: selection1 and not selection2 -how_to_implement: To successfully implement this search, you must be ingesting logs - with the process name, command-line arguments, and parent processes from your endpoints. - Collect endpoint data such as Sysmon or Windows Events 4688. -known_false_positives: False positives may be present and filtering may be required. - Certain utilities will run from non-standard paths based on the third-party application - in use. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml -- https://attack.mitre.org/techniques/T1036/003/ -- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Adplus/ -tags: - analytic_story: - - Unusual Processes - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 20 - message: A system process $process_name$ with path $process_path$ spawn in non-default - folder path on host $dest_device_id$ - mitre_attack_id: - - T1036 - - T1036.003 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Actions on Objectives - risk_score: 14 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml b/dev_ssa/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml deleted file mode 100644 index f4e73cd35e..0000000000 --- a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Windows Rename System Utilities Advpack dll LOLBAS in Non Standard Path -id: 3284e4f4-67f7-49b6-ad5e-a8fcead2eef8 -version: 5 -date: '2024-04-03' -author: Splunk Threat Research Bot, Lou Stella, Splunk -status: production -type: Anomaly -description: The following analytic identifies Advpack.dll which is a native living - off the land binary or script (LOLBAS) within the Windows operating system that - may be abused by adversaries by moving it to a new directory. The list of binaries - was derived from the https://lolbas-project.github.io site. The specific default filepath for advpack.dll is within either "C:\Windows\System32" or "C:\Windows\SysWOW64". -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: advpack.dll - selection2: - process.file.path|re: \\windows\\(syswow64|system32)\\ - condition: selection1 and not selection2 -how_to_implement: To successfully implement this search, you must be ingesting logs - with the process name, command-line arguments, and parent processes from your endpoints. - Collect endpoint data such as Sysmon or Windows Events 4688. -known_false_positives: False positives may be present and filtering may be required. - Certain utilities will run from non-standard paths based on the third-party application - in use. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml -- https://attack.mitre.org/techniques/T1036/003/ -- https://lolbas-project.github.io/lolbas/Libraries/Advpack/ -tags: - analytic_story: - - Unusual Processes - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 20 - message: A system process $process_name$ with path $process_path$ spawn in non-default - folder path on host $dest_device_id$ - mitre_attack_id: - - T1036 - - T1036.003 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Actions on Objectives - risk_score: 14 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml b/dev_ssa/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml deleted file mode 100644 index 239c91274d..0000000000 --- a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Windows Rename System Utilities Agentexecutor exe LOLBAS in Non Standard Path -id: e124f71f-11bc-47e4-9931-6046d256005d -version: 5 -date: '2024-04-03' -author: Splunk Threat Research Bot, Lou Stella, Splunk -status: production -type: Anomaly -description: The following analytic identifies AgentExecutor.exe which is a native - living off the land binary or script (LOLBAS) within the Windows operating system - that may be abused by adversaries by moving it to a new directory. The list of binaries - was derived from the https://lolbas-project.github.io site. The specific default filepath for AgentExecutor.exe should be "C:\Program Files (x86)\Microsoft Intune Management Extension". -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: agentexecutor.exe - selection2: - process.file.path|re: \\program files (x86)\\microsoft intune management extension\\ - condition: selection1 and not selection2 -how_to_implement: To successfully implement this search, you must be ingesting logs - with the process name, command-line arguments, and parent processes from your endpoints. - Collect endpoint data such as Sysmon or Windows Events 4688. -known_false_positives: False positives may be present and filtering may be required. - Certain utilities will run from non-standard paths based on the third-party application - in use. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml -- https://attack.mitre.org/techniques/T1036/003/ -- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Agentexecutor/ -tags: - analytic_story: - - Unusual Processes - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 20 - message: A system process $process_name$ with path $process_path$ spawn in non-default - folder path on host $dest_device_id$ - mitre_attack_id: - - T1036 - - T1036.003 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Actions on Objectives - risk_score: 14 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml b/dev_ssa/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml deleted file mode 100644 index 076cf42306..0000000000 --- a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Windows Rename System Utilities Appinstaller exe LOLBAS in Non Standard Path -id: 057c06c7-ef31-4749-b5c9-199152e53a06 -version: 5 -date: '2024-04-03' -author: Splunk Threat Research Bot, Lou Stella, Splunk -status: production -type: Anomaly -description: The following analytic identifies AppInstaller.exe which is a native - living off the land binary or script (LOLBAS) within the Windows operating system - that may be abused by adversaries by moving it to a new directory. The list of binaries - was derived from the https://lolbas-project.github.io site. The specific default filepath for AppInstaller.exe should be in "C:\Program Files\WindowsApps\". -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: appinstaller.exe - selection2: - process.file.path|re: \\program files\\windowsapps\\microsoft.desktopappinstaller_ - condition: selection1 and not selection2 -how_to_implement: To successfully implement this search, you must be ingesting logs - with the process name, command-line arguments, and parent processes from your endpoints. - Collect endpoint data such as Sysmon or Windows Events 4688. -known_false_positives: False positives may be present and filtering may be required. - Certain utilities will run from non-standard paths based on the third-party application - in use. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml -- https://attack.mitre.org/techniques/T1036/003/ -- https://lolbas-project.github.io/lolbas/Binaries/AppInstaller/ -tags: - analytic_story: - - Unusual Processes - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 20 - message: A system process $process_name$ with path $process_path$ spawn in non-default - folder path on host $dest_device_id$ - mitre_attack_id: - - T1036 - - T1036.003 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Actions on Objectives - risk_score: 14 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml b/dev_ssa/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml deleted file mode 100644 index 9649c6202d..0000000000 --- a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard Path -id: 93862a89-abe0-4094-909a-08ec390aa5e3 -version: 5 -date: '2024-04-03' -author: Splunk Threat Research Bot, Lou Stella, Splunk -status: production -type: Anomaly -description: The following analytic identifies Appvlp.exe which is a native living - off the land binary or script (LOLBAS) within the Windows operating system that - may be abused by adversaries by moving it to a new directory. The list of binaries - was derived from the https://lolbas-project.github.io site. The specific default filepath for Appvlp.exe should be "C:\Program Files\Microsoft Office\root\client". -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: appvlp.exe - selection2: - process.file.path|re: \\program files(| \(x86\))\\microsoft office\\root\\client - condition: selection1 and not selection2 -how_to_implement: To successfully implement this search, you must be ingesting logs - with the process name, command-line arguments, and parent processes from your endpoints. - Collect endpoint data such as Sysmon or Windows Events 4688. -known_false_positives: False positives may be present and filtering may be required. - Certain utilities will run from non-standard paths based on the third-party application - in use. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml -- https://attack.mitre.org/techniques/T1036/003/ -- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Appvlp/ -tags: - analytic_story: - - Unusual Processes - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 20 - message: A system process $process_name$ with path $process_path$ spawn in non-default - folder path on host $dest_device_id$ - mitre_attack_id: - - T1036 - - T1036.003 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Actions on Objectives - risk_score: 14 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml b/dev_ssa/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml deleted file mode 100644 index 2e78c3b0ca..0000000000 --- a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Windows Rename System Utilities Aspnet compiler exe LOLBAS in Non Standard Path -id: d75cc561-3828-4d0a-92c4-0eb93bfe0929 -version: 5 -date: '2024-04-03' -author: Splunk Threat Research Bot, Lou Stella, Splunk -status: production -type: Anomaly -description: The following analytic identifies Aspnet_Compiler.exe which is a native - living off the land binary or script (LOLBAS) within the Windows operating system - that may be abused by adversaries by moving it to a new directory. The list of binaries - was derived from the https://lolbas-project.github.io site. The specific default filepath for the Aspnet_compiler.exe should be in "C:\Windows\Microsoft.NET\Framework\". -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: aspnet_compiler.exe - selection2: - process.file.path|re: \\windows\\microsoft.net\\(framework|framework64)\\v[0-9]+\.[0-9]+\.[0-9]+\\ - condition: selection1 and not selection2 -how_to_implement: To successfully implement this search, you must be ingesting logs - with the process name, command-line arguments, and parent processes from your endpoints. - Collect endpoint data such as Sysmon or Windows Events 4688. -known_false_positives: False positives may be present and filtering may be required. - Certain utilities will run from non-standard paths based on the third-party application - in use. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml -- https://attack.mitre.org/techniques/T1036/003/ -- https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/ -tags: - analytic_story: - - Unusual Processes - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 20 - message: A system process $process_name$ with path $process_path$ spawn in non-default - folder path on host $dest_device_id$ - mitre_attack_id: - - T1036 - - T1036.003 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Actions on Objectives - risk_score: 14 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml b/dev_ssa/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml deleted file mode 100644 index 91efe55505..0000000000 --- a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Windows Rename System Utilities At exe LOLBAS in Non Standard Path -id: 6401d583-0052-4dc5-a713-68b510826d2b -version: 5 -date: '2024-04-03' -author: Splunk Threat Research Bot, Lou Stella, Splunk -status: production -type: Anomaly -description: The following analytic identifies At.exe which is a native living off - the land binary or script (LOLBAS) within the Windows operating system that may - be abused by adversaries by moving it to a new directory. The list of binaries was - derived from the https://lolbas-project.github.io site. The specific default filepath should be either "C:\Windows\System32\" or "C:\Windows\SysWOW64\". -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: at.exe - selection2: - process.file.path|re: \\windows\\(syswow64|system32)\\ - condition: selection1 and not selection2 -how_to_implement: To successfully implement this search, you must be ingesting logs - with the process name, command-line arguments, and parent processes from your endpoints. - Collect endpoint data such as Sysmon or Windows Events 4688. -known_false_positives: False positives may be present and filtering may be required. - Certain utilities will run from non-standard paths based on the third-party application - in use. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml -- https://attack.mitre.org/techniques/T1036/003/ -- https://lolbas-project.github.io/lolbas/Binaries/At/ -tags: - analytic_story: - - Unusual Processes - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 20 - message: A system process $process_name$ with path $process_path$ spawn in non-default - folder path on host $dest_device_id$ - mitre_attack_id: - - T1036 - - T1036.003 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Actions on Objectives - risk_score: 14 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml b/dev_ssa/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml deleted file mode 100644 index 73d9349170..0000000000 --- a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard Path -id: b8da7ea5-8c16-4eff-9787-54ec271159e0 -version: 5 -date: '2024-04-03' -author: Splunk Threat Research Bot, Lou Stella, Splunk -status: production -type: Anomaly -description: The following analytic identifies Atbroker.exe which is a native living - off the land binary or script (LOLBAS) within the Windows operating system that - may be abused by adversaries by moving it to a new directory. The list of binaries - was derived from the https://lolbas-project.github.io site. The specific default filepath should be either "C:\Windows\System32\" or "C:\Windows\SysWOW64\". -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: atbroker.exe - selection2: - process.file.path|re: \\windows\\(syswow64|system32)\\ - condition: selection1 and not selection2 -how_to_implement: To successfully implement this search, you must be ingesting logs - with the process name, command-line arguments, and parent processes from your endpoints. - Collect endpoint data such as Sysmon or Windows Events 4688. -known_false_positives: False positives may be present and filtering may be required. - Certain utilities will run from non-standard paths based on the third-party application - in use. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml -- https://attack.mitre.org/techniques/T1036/003/ -- https://lolbas-project.github.io/lolbas/Binaries/Atbroker/ -tags: - analytic_story: - - Unusual Processes - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 20 - message: A system process $process_name$ with path $process_path$ spawn in non-default - folder path on host $dest_device_id$ - mitre_attack_id: - - T1036 - - T1036.003 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Actions on Objectives - risk_score: 14 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log - source: WinEventLog:Security \ No newline at end of file diff --git a/dev_ssa/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml b/dev_ssa/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml deleted file mode 100644 index 822429444a..0000000000 --- a/dev_ssa/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml +++ /dev/null @@ -1,52 +0,0 @@ -name: Windows Rundll32 Comsvcs Memory Dump -id: 76bb9e35-f314-4c3d-a385-83c72a13ce4e -version: 8 -date: '2022-04-14' -author: Jose Hernandez, Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies memory dumping using comsvcs.dll with - the minidump function with `rundll32.exe`. This technique is common with adversaries - who would like to dump the memory of lsass.exe. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|re: minidump - process.file.name: rundll32.exe - selection2: - process.cmd_line|re: comsvcs.dll - condition: selection1 and selection2 -how_to_implement: You must be ingesting endpoint data that tracks process activity, - including Windows command line logging. You can see how we test this with [Event - Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a) - on the [attack_range](https://github.com/splunk/attack_range/blob/develop/ansible/roles/windows_common/tasks/windows-enable-4688-cmd-line-audit.yml). -known_false_positives: False positives should be limited, filter as needed. -references: -- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-3---dump-lsassexe-memory-using-comsvcsdll -tags: - analytic_story: - - Credential Dumping - - Suspicious Rundll32 Activity - asset_type: Endpoint - confidence: 100 - impact: 40 - message: A dump of a process was attempted using comsvcs.dll with the minidump function - on endpoint $dest_device_id$ by user $dest_device_user$. - mitre_attack_id: - - T1003.003 - - T1003 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Actions on Objectives - risk_score: 40 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___windows_rundll32_inline_hta_execution.yml b/dev_ssa/endpoint/ssa___windows_rundll32_inline_hta_execution.yml deleted file mode 100644 index 390b95cbec..0000000000 --- a/dev_ssa/endpoint/ssa___windows_rundll32_inline_hta_execution.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Windows Rundll32 Inline HTA Execution -id: 0caa1dd6-94f5-11ec-9786-acde48001122 -version: 4 -date: '2022-02-23' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies "rundll32.exe" execution with inline - protocol handlers. "JavaScript", "VBScript", and "About" are the only supported - options when invoking HTA content directly on the command-line. This type of behavior - is commonly observed with fileless malware or application whitelisting bypass techniques. - The search will return the first time and last time these command-line arguments - were used for these executions, as well as the target system, the user, process - "rundll32.exe" and its parent process. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|contains: - - about - - javascript - - vbscript - process.file.name: rundll32.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Although unlikely, some legitimate applications may exhibit - this behavior, triggering a false positive. -references: -- https://github.com/redcanaryco/AtomicTestHarnesses -- https://redcanary.com/blog/introducing-atomictestharnesses/ -- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing -tags: - analytic_story: - - Suspicious MSHTA Activity - - NOBELIUM Group - - Living Off The Land - asset_type: Endpoint - confidence: 80 - impact: 70 - message: Suspicious $process_name$ inline HTA execution on $dest_device_id$. - mitre_attack_id: - - T1218 - - T1218.005 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___windows_screen_capture_via_powershell.yml b/dev_ssa/endpoint/ssa___windows_screen_capture_via_powershell.yml deleted file mode 100644 index 51b8730cec..0000000000 --- a/dev_ssa/endpoint/ssa___windows_screen_capture_via_powershell.yml +++ /dev/null @@ -1,47 +0,0 @@ -name: Windows Screen Capture Via Powershell -id: 678ae7c6-0e63-44db-9881-03202c312f66 -version: 1 -date: '2024-02-01' -author: Teoderick Contreras, Splunk -status: production -type: TTP -data_source: -- Powershell 4104 -description: The following analytic identifies a potential PowerShell script that captures screen images on compromised or targeted hosts. This technique was observed in the Winter-Vivern malware, which attempts to capture desktop screens using a PowerShell script and send the images to its C2 server as part of its exfiltration strategy. This TTP serves as a useful indicator that a PowerShell process may be gathering desktop screenshots from a host system, potentially signaling malicious activity. -search: - selection: - process.cmd_line|re: "[Drawing.Graphics]::FromImage(" - process.cmd_line|re: New-Object Drawing.Bitmap - process.cmd_line|re: .CopyFromScreen - condition: selection -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: unknown -references: -- https://twitter.com/_CERT_UA/status/1620781684257091584 -- https://cert.gov.ua/article/3761104 -tags: - analytic_story: - - Winter Vivern - asset_type: Endpoint - confidence: 70 - context: - - Source:Endpoint - - Stage:Collection - impact: 70 - message: A PowerShell script was identified possibly performing screen captures on $Computer$. - mitre_attack_id: - - T1113 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/dev_ssa/endpoint/ssa___windows_script_host_spawn_msbuild.yml b/dev_ssa/endpoint/ssa___windows_script_host_spawn_msbuild.yml deleted file mode 100644 index 2ce35fe346..0000000000 --- a/dev_ssa/endpoint/ssa___windows_script_host_spawn_msbuild.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Windows Script Host Spawn MSBuild -id: 92886f1c-9b11-11ec-848a-acde48001122 -version: 4 -date: '2022-03-03' -author: Michael Haag, Splunk -status: production -type: TTP -description: This analytic is to detect a suspicious child process of MSBuild spawned - by Windows Script Host - cscript or wscript. This behavior or event are commonly - seen and used by malware or adversaries to execute malicious msbuild process using - malicious script in the compromised host. During triage, review parallel processes - and identify any file modifications. MSBuild may load a script from the same path - without having command-line arguments. -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: MSBuild.exe - actor.process.file.name|re: - - cscript.exe - - wscript.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited as developers do not spawn - MSBuild via a WSH. -references: -- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# -- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/Windows/TestHarnesses/T1127.001_MSBuild/InvokeMSBuild.ps1 -tags: - analytic_story: - - Trusted Developer Utilities Proxy Execution MSBuild - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$. - mitre_attack_id: - - T1127.001 - - T1127 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/msbuild-windows-security.log - source: WinEventLog:Security diff --git a/dev_ssa/endpoint/ssa___windows_service_create_with_tscon.yml b/dev_ssa/endpoint/ssa___windows_service_create_with_tscon.yml deleted file mode 100644 index 8859243845..0000000000 --- a/dev_ssa/endpoint/ssa___windows_service_create_with_tscon.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Windows Service Create with TSCon -id: 6d16f079-0195-4fdc-a97d-7cfacb6b9b4d -version: 4 -date: '2022-02-23' -author: Michael Haag, Splunk -status: experimental -type: TTP -description: 'The following analytic detects potential RDP Hijacking attempts by monitoring a series of actions taken by an attacker to gain unauthorized access to a remote system. The attacker first runs the quser command to query the remote host for disconnected user sessions. Upon identifying a disconnected session, they use the sc.exe command to create a new Windows service with a binary path that launches tscon.exe. By specifying the disconnected session ID and a destination ID, the attacker can transfer the disconnected session to a new RDP session, effectively hijacking the user''s session. This analytic allows security teams to detect and respond to RDP Hijacking attempts, mitigating potential risks and impacts on targeted systems.' -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|re: - - '/dest:rdp-tcp' - process.file.name: sc.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives may arise in the RDP Hijacking analytic when legitimate administrators access remote sessions for maintenance or troubleshooting purposes. These activities might resemble an attacker''s attempt to hijack a disconnected session, leading to false alarms. To mitigate the risk of false positives and improve the overall security posture, organizations can implement Group Policy to automatically disconnect RDP sessions when they are complete. By enforcing this policy, administrators ensure that disconnected sessions are promptly terminated, reducing the window of opportunity for an attacker to hijack a session. Additionally, organizations can also implement access control mechanisms and monitor the behavior of privileged accounts to further enhance security and reduce the chances of false positives in RDP Hijacking detection. -references: - - https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6 - - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1563.002/T1563.002.md -tags: - analytic_story: - - Active Directory Lateral Movement - asset_type: Endpoint - confidence: 50 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to hijack a RDP session. - mitre_attack_id: - - T1563.002 - - T1563 - - T1543.003 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - kill_chain_phases: - - Exploitation - risk_score: 40 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1563.002/rdphijack/4688_tscon_windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog - update_timestamp: true diff --git a/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml deleted file mode 100644 index da2e67eb7e..0000000000 --- a/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Windows System Binary Proxy Execution Compiled HTML File Decompile -id: 11c32b19-05a6-48a8-ab28-18dbd9ec5d50 -version: 4 -date: '2022-09-02' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the decompile parameter with the HTML - Help application, HH.exe. This is a uncommon command to see ran and behavior. Most - recently this was seen in a APT41 campaign where a CHM file was delivered and a - script inside used a technique for running an arbitrary command in a CHM file via - an ActiveX object. This unpacks an HTML help file to a specified path for launching - the next stage. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|contains: -decompile - process.file.name: hh.exe - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: False positives should be limited, filter as needed. -references: -- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/ -- https://redcanary.com/blog/introducing-atomictestharnesses/ -- https://attack.mitre.org/techniques/T1218/001/ -- https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa -tags: - analytic_story: - - Suspicious Compiled HTML Activity - - Living Off The Land - asset_type: Endpoint - confidence: 90 - impact: 100 - message: $process_name$ has been identified using decompile against a CHM on $dest_device_id$ - under user $dest_user_id$. - mitre_attack_id: - - T1218.001 - - T1218 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log - source: XmlWinEventLog - update_timestamp: true diff --git a/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml b/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml deleted file mode 100644 index 86db1e4ea0..0000000000 --- a/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Windows System Binary Proxy Execution Compiled HTML File URL In Command Line -id: 0fec631a-7c9b-4e4c-b28b-93260953e25f -version: 4 -date: '2022-09-02' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled - HTML Help (CHM) file from a remote url. This particular technique will load Windows - script code from a compiled help file. CHM files may contain nearly any file type - embedded, but only execute html/htm. Upon a successful execution, the following - script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, - JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe - upon execution. The "htm" and "html" file extensions were the only extensions observed - to be supported for the execution of Shortcut commands or WSH script code. During - investigation, identify script content origination. Review reputation of remote - IP and domain. Some instances, it is worth decompiling the .chm file to review its - original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|contains: - - https:// - - http:// - process.file.name: hh.exe - condition: (selection1) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Although unlikely, some legitimate applications may retrieve - a CHM remotely, filter as needed. -references: -- https://attack.mitre.org/techniques/T1218/001/ -- https://www.kb.cert.org/vuls/id/851869 -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md -- https://lolbas-project.github.io/lolbas/Binaries/Hh/ -- https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7 -- https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ -tags: - analytic_story: - - Suspicious Compiled HTML Activity - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 90 - message: An instance of $process_name$ was identified on endpoint $dest_device_id$ - by user $dest_user_id$ contacting a remote destination. - mitre_attack_id: - - T1218.001 - - T1218 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/chm-wineventlog-security.log - source: WinEventLog:Security - update_timestamp: true diff --git a/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml b/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml deleted file mode 100644 index 3278956525..0000000000 --- a/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage - Handlers -id: ba0c2450-caea-4086-ac3a-a71e2659754b -version: 4 -date: '2022-09-02' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled - HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique - will load Windows script code from a compiled help file, using InfoTech Storage - Handlers. itss.dll will load upon execution. Three InfoTech Storage handlers are - supported - ms-its, its, mk:@MSITStore. ITSS may be used to launch a specific html/htm - file from within a CHM file. CHM files may contain nearly any file type embedded. - Upon a successful execution, the following script engines may be used for execution - - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may - identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" - and "html" file extensions were the only extensions observed to be supported for - the execution of Shortcut commands or WSH script code. During investigation, identify - script content origination. hh.exe is natively found in C:\Windows\system32 and - C:\Windows\syswow64. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|contains: - - 'mk:@MSITStore:' - - 'its:' - process.file.name: hh.exe - condition: (selection1) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: It is rare to see instances of InfoTech Storage Handlers being - used, but it does happen in some legitimate instances. Filter as needed. -references: -- https://attack.mitre.org/techniques/T1218/001/ -- https://www.kb.cert.org/vuls/id/851869 -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md -- https://lolbas-project.github.io/lolbas/Binaries/Hh/ -- https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7 -- https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ -tags: - analytic_story: - - Suspicious Compiled HTML Activity - - Living Off The Land - asset_type: Endpoint - confidence: 90 - impact: 80 - message: $process_name$ has been identified using Infotech Storage Handlers to load - a specific file within a CHM on $dest_device_id$ under user $dest_user_id$. - mitre_attack_id: - - T1218.001 - - T1218 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 72 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/chm-wineventlog-security.log - source: WinEventLog:Security - update_timestamp: true diff --git a/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml b/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml deleted file mode 100644 index 3b831bbe49..0000000000 --- a/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml +++ /dev/null @@ -1,53 +0,0 @@ -name: Windows System Binary Proxy Execution MSIExec DLLRegisterServer -id: 8d1d5570-722c-49a3-996c-2e2cceef5163 -version: 4 -date: '2022-08-31' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the usage of msiexec.exe using the - /y switch parameter, which grants the ability for msiexec to load DLLRegisterServer. - Upon triage, review parent process and capture any artifacts for further review. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|contains: - - '-y ' - - '/y ' - process.file.name: msiexec.exe - condition: (selection1) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: This analytic will need to be tuned for your environment based - on legitimate usage of msiexec.exe. Filter as needed. -references: -- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md -tags: - analytic_story: - - Windows System Binary Proxy Execution MSIExec - asset_type: Endpoint - confidence: 50 - impact: 70 - message: An instance of spawning $process_name$ was identified on endpoint $dest_device_id$ - by user $dest_user_id$ attempting to register a file. - mitre_attack_id: - - T1218.007 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog - update_timestamp: true diff --git a/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml b/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml deleted file mode 100644 index ded49c1701..0000000000 --- a/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml +++ /dev/null @@ -1,53 +0,0 @@ -name: Windows System Binary Proxy Execution MSIExec Remote Download -id: 92cbbf0f-9a6b-4e9d-8c35-cc9244a4e3d5 -version: 4 -date: '2022-08-31' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies msiexec.exe with http in the command-line. - This procedure will utilize msiexec.exe to download a remote file and load it. During - triage, review parallel processes and capture any artifacts on disk for review. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|contains: - - https:// - - http:// - process.file.name: msiexec.exe - condition: (selection1) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: False positives may be present, filter by destination or parent - process as needed. -references: -- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md -tags: - analytic_story: - - Windows System Binary Proxy Execution MSIExec - asset_type: Endpoint - confidence: 50 - impact: 70 - message: An instance of spawning $process_name$ was identified on endpoint $dest_device_id$ - by user $dest_user_id$ attempting to download a file. - mitre_attack_id: - - T1218.007 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog - update_timestamp: true diff --git a/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml b/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml deleted file mode 100644 index 0efe183b2c..0000000000 --- a/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml +++ /dev/null @@ -1,53 +0,0 @@ -name: Windows System Binary Proxy Execution MSIExec Unregister DLL -id: df76a8d1-92e1-4ec9-b8f7-695b5838703e -version: 4 -date: '2022-08-31' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the usage of msiexec.exe using the - /z switch parameter, which grants the ability for msiexec to unload DLLRegisterServer. - Upon triage, review parent process and capture any artifacts for further review. -data_source: -- Windows Security 4688 -search: - selection1: - process.cmd_line|contains: - - '-z ' - - '/z ' - process.file.name: msiexec.exe - condition: (selection1) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: False positives may be present, filter by destination or parent - process as needed. -references: -- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md -tags: - analytic_story: - - Windows System Binary Proxy Execution MSIExec - asset_type: Endpoint - confidence: 50 - impact: 70 - message: An instance of spawning $process_name$ was identified on endpoint $dest_device_id$ - by user $dest_user_id$ attempting to unregister a DLL. - mitre_attack_id: - - T1218.007 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog - update_timestamp: true diff --git a/dev_ssa/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml b/dev_ssa/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml deleted file mode 100644 index 2710024db7..0000000000 --- a/dev_ssa/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Windows WMIPrvse Spawn MSBuild -id: 76b3b290-9b31-11ec-a934-acde48001122 -version: 4 -date: '2022-03-03' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies wmiprvse.exe spawning msbuild.exe. - This behavior is indicative of a COM object being utilized to spawn msbuild from - wmiprvse.exe. It is common for MSBuild.exe to be spawned from devenv.exe while using - Visual Studio. In this instance, there will be command line arguments and file paths. - In a malicious instance, MSBuild.exe will spawn from non-standard processes and - have no command line arguments. For example, MSBuild.exe spawning from explorer.exe, - powershell.exe is far less common and should be investigated. -data_source: -- Windows Security 4688 -search: - selection1: - process.file.name: MSBuild.exe - actor.process.file.name|re: wmiprvse.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Although unlikely, some legitimate applications may exhibit - this behavior, triggering a false positive. -references: -- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md -tags: - analytic_story: - - Trusted Developer Utilities Proxy Execution MSBuild - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$. - mitre_attack_id: - - T1127 - - T1127.001 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: [] - kill_chain_phases: - - Exploitation - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/msbuild-windows-security.log - source: WinEventLog:Security diff --git a/docs/mitre-map/coverage.json b/docs/mitre-map/coverage.json index d5a3ab5dbb..0a74927670 100644 --- a/docs/mitre-map/coverage.json +++ b/docs/mitre-map/coverage.json @@ -6,13 +6,13 @@ "techniques": [ { "techniqueID": "T1059", - "score": 64, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/detect_risky_spl_using_pretrained_ml_model.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_carry_out_string_command_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_module_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_unix_shell_enable_all_sysrq_functions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/living_off_the_land.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/macos_lolbin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_powershell_remoting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_load_module_in_meterpreter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_writing_dynamicwrapperx.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_with_discord_dns_query.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/vbscript_execution_using_wscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_apache_benchmark_binary.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_identify_protocol_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_msexchange_management_mailbox_cmdlet_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_papercut_ng_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_powershell_cryptography_namespace.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_powershell_import_applocker_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_powershell_remotesigned_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_powershell_scheduletask.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_powershell_wmi_win32_scheduledjob.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_ldap_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/juniper_networks_remote_code_execution_exploit_detection.yml" + "score": 69, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/detect_risky_spl_using_pretrained_ml_model.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_carry_out_string_command_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_module_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_unix_shell_enable_all_sysrq_functions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/living_off_the_land.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/macos_lolbin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_powershell_remoting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_load_module_in_meterpreter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_writing_dynamicwrapperx.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_with_discord_dns_query.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/vbscript_execution_using_wscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_apache_benchmark_binary.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_autoit3_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_asr_audit_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_asr_block_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_asr_rules_stacking.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_identify_protocol_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_msexchange_management_mailbox_cmdlet_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_papercut_ng_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_powershell_cryptography_namespace.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_powershell_import_applocker_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_powershell_remotesigned_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_powershell_scheduletask.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_powershell_wmi_win32_scheduledjob.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_windbg_spawning_autoit3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_ldap_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/juniper_networks_remote_code_execution_exploit_detection.yml" }, { "techniqueID": "T1114", - "score": 8, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/email_files_written_outside_of_the_outlook_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/email_files_written_outside_of_the_outlook_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_mailbox_inbox_folder_shared_with_all_users.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_mailbox_read_access_granted_to_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_pst_export_alert.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_user_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mailsniper_invoke_functions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml" }, { "techniqueID": "T1114.001", @@ -21,13 +21,13 @@ }, { "techniqueID": "T1114.002", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml" + "score": 5, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_mailbox_inbox_folder_shared_with_all_users.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_mailbox_read_access_granted_to_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml" }, { "techniqueID": "T1078", - "score": 55, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_new_api_token_created.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_new_device_enrolled_on_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_phishing_detection_with_fastpass_origin_check.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_risk_threshold_exceeded.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_suspicious_activity_reported.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_threatinsight_login_failure_with_high_unknown_users.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_threatinsight_suspected_passwordspray_attack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_threatinsight_threat_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_user_logins_from_multiple_cities.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_user_enumeration_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/asl_aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_attach_to_role_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_permanent_key_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_role_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_sts_assume_role_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_successful_single_factor_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_successful_powershell_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_successful_single_factor_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_runbook_webhook_created.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_detect_gcploit_framework.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_successful_single_factor_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_computer_account_name_change.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_kerberos_service_ticket_request.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_ticket_granting_ticket_request.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unusual_number_of_computer_service_tickets_requested.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml" + "score": 58, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_new_api_token_created.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_new_device_enrolled_on_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_phishing_detection_with_fastpass_origin_check.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_risk_threshold_exceeded.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_suspicious_activity_reported.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_threatinsight_login_failure_with_high_unknown_users.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_threatinsight_suspected_passwordspray_attack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_threatinsight_threat_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_user_logins_from_multiple_cities.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/pingid_multiple_failed_mfa_requests_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_user_enumeration_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/asl_aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_attach_to_role_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_permanent_key_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_role_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_sts_assume_role_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_successful_single_factor_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multiple_appids_and_useragents_authentication_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_successful_powershell_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_successful_single_factor_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_runbook_webhook_created.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_detect_gcploit_framework.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_successful_single_factor_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_multiple_appids_and_useragents_authentication_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_computer_account_name_change.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_kerberos_service_ticket_request.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_ticket_granting_ticket_request.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unusual_number_of_computer_service_tickets_requested.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml" }, { "techniqueID": "T1078.001", @@ -36,13 +36,13 @@ }, { "techniqueID": "T1110", - "score": 38, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/okta_account_locked_out.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_mfa_exhaustion_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_risk_threshold_exceeded.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_two_or_more_rejected_okta_pushes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_credential_access_failed_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_credential_access_getpassworddata.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_credential_access_rds_password_reset.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_active_directory_high_risk_sign_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_successful_authentication_from_different_ips.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/high_number_of_login_failures_from_a_single_source.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_local_administrator_credential_stuffing.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_disabled_users_failed_auth_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml" + "score": 43, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/okta_account_locked_out.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_mfa_exhaustion_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_risk_threshold_exceeded.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_two_or_more_rejected_okta_pushes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/pingid_multiple_failed_mfa_requests_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_credential_access_failed_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_credential_access_getpassworddata.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_credential_access_rds_password_reset.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_active_directory_high_risk_sign_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multi_source_failed_authentications_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_successful_authentication_from_different_ips.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/high_number_of_login_failures_from_a_single_source.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_authentication_failures_alert.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_high_number_of_failed_authentications_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_multi_source_failed_authentications_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_local_administrator_credential_stuffing.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_disabled_users_failed_auth_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml" }, { "techniqueID": "T1621", - "score": 9, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/asl_aws_multi_factor_authentication_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_multi_factor_authentication_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/pingid_mismatch_auth_source_and_verification_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/pingid_multiple_failed_mfa_requests_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/pingid_new_mfa_method_after_credential_reset.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/pingid_new_mfa_method_registered_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/asl_aws_multi_factor_authentication_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_multi_factor_authentication_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multiple_denied_mfa_requests_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_multiple_failed_mfa_requests_for_user.yml" }, { "techniqueID": "T1550.004", @@ -66,33 +66,43 @@ }, { "techniqueID": "T1110.004", - "score": 9, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/okta_threatinsight_login_failure_with_high_unknown_users.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_local_administrator_credential_stuffing.yml" + "score": 12, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/okta_threatinsight_login_failure_with_high_unknown_users.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multi_source_failed_authentications_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_multi_source_failed_authentications_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_local_administrator_credential_stuffing.yml" }, { "techniqueID": "T1110.003", - "score": 27, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/okta_threatinsight_suspected_passwordspray_attack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_active_directory_high_risk_sign_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_successful_authentication_from_different_ips.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_disabled_users_failed_auth_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml" + "score": 30, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/okta_threatinsight_suspected_passwordspray_attack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_active_directory_high_risk_sign_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multi_source_failed_authentications_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_successful_authentication_from_different_ips.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_multi_source_failed_authentications_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_disabled_users_failed_auth_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml" }, { "techniqueID": "T1083", "score": 3, "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/path_traversal_spl_injection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml" }, + { + "techniqueID": "T1556.006", + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/pingid_mismatch_auth_source_and_verification_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/pingid_new_mfa_method_after_credential_reset.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/pingid_new_mfa_method_registered_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/asl_aws_multi_factor_authentication_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/asl_aws_new_mfa_method_registered_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_multi_factor_authentication_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_new_mfa_method_registered_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_new_mfa_method_registered_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_multi_factor_authentication_disabled.yml" + }, + { + "techniqueID": "T1098.005", + "score": 5, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/pingid_mismatch_auth_source_and_verification_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/pingid_new_mfa_method_after_credential_reset.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/pingid_new_mfa_method_registered_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_new_mfa_method_registered.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_mfa_method_registered.yml" + }, { "techniqueID": "T1087", - "score": 35, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_account_discovery_drilldown_dashboard_disclosure.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ad_abnormal_object_access_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ad_privileged_object_access_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_root_domain_linked_policies_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_special_privileged_logon_on_multiple_hosts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml" + "score": 39, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_account_discovery_drilldown_dashboard_disclosure.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_account_discovery_for_none_disable_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_account_discovery_for_sam_account_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_account_discovery_with_netuser_preauthnotrequire.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ad_abnormal_object_access_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ad_privileged_object_access_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_domain_account_discovery_via_get_netcomputer.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_root_domain_linked_policies_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_special_privileged_logon_on_multiple_hosts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml" }, { "techniqueID": "T1210", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/active_directory_lateral_movement_identified.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/vmware_aria_operations_exploit_attempt.yml" + "score": 7, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_rce_via_user_xslt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/active_directory_lateral_movement_identified.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/vmware_aria_operations_exploit_attempt.yml" }, { "techniqueID": "T1189", - "score": 12, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_list_all_nonstandard_admin_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/persistent_xss_in_rapiddiag_through_user_interface_views.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_persistent_xss_via_url_validation_bypass_w_dashboard.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_reflected_xss_in_the_templates_lists_radio.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_stored_xss_via_data_model_objectname_field.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_xss_in_monitoring_console.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_xss_in_save_table_dialog_header_in_search_page.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_xss_via_view.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml" + "score": 13, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_list_all_nonstandard_admin_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/persistent_xss_in_rapiddiag_through_user_interface_views.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_persistent_xss_via_url_validation_bypass_w_dashboard.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_reflected_xss_in_the_templates_lists_radio.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_stored_xss_via_data_model_objectname_field.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_xss_in_highlighted_json_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_xss_in_monitoring_console.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_xss_in_save_table_dialog_header_in_search_page.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_xss_via_view.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1567", @@ -116,19 +126,29 @@ }, { "techniqueID": "T1548", - "score": 51, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_edit_user_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_uac_remote_restriction.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_apt_get_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_apt_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_awk_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_busybox_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_c89_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_c99_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_common_process_for_elevation_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_composer_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_cpulimit_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_csvtool_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_doas_conf_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_doas_tool_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_docker_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_emacs_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_find_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_gdb_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_gem_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_gnu_awk_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_make_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_mysql_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_node_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_octave_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_openvpn_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_php_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_access_to_sudoers_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_puppet_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_rpm_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_ruby_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_setuid_using_chmod_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_setuid_using_setcap_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_sqlite3_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_sudo_or_su_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_sudoers_tmp_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_visudo_utility_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml" + "score": 54, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_edit_user_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_enterprise_kv_store_incorrect_authorization.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_uac_remote_restriction.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_apt_get_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_apt_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_awk_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_busybox_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_c89_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_c99_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_common_process_for_elevation_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_composer_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_cpulimit_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_csvtool_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_doas_conf_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_doas_tool_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_docker_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_emacs_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_find_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_gdb_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_gem_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_gnu_awk_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_make_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_mysql_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_node_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_octave_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_openvpn_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_php_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_access_to_sudoers_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_puppet_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_rpm_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_ruby_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_setuid_using_chmod_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_setuid_using_setcap_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_sqlite3_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_sudo_or_su_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_sudoers_tmp_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_visudo_utility_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_uac_bypass_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_uac_bypass_suspicious_escalation_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml" }, { "techniqueID": "T1499", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_endpoint_denial_of_service_dos_zip_bomb.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_improperly_formatted_parameter_crashes_splunkd.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_endpoint_denial_of_service_dos_zip_bomb.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_es_dos_investigations_manager_via_investigation_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_es_dos_through_investigation_attachments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_improperly_formatted_parameter_crashes_splunkd.yml" + }, + { + "techniqueID": "T1190", + "score": 59, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_enterprise_windows_deserialization_file_partition.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_rce_via_serialized_session_payload.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_abuse_via_ssrf.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/java_class_file_download_by_java_user_agent.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/java_writing_jsp_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_java_spawning_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/living_off_the_land.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/papercut_ng_suspicious_behavior_debug_log.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_java_spawning_shells.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_moveit_transfer_writing_aspx.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_papercut_ng_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winrm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_ldap_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_zerologon_via_zeek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/access_to_vulnerable_ivanti_connect_secure_bookmark_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/adobe_coldfusion_access_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/adobe_coldfusion_unauthenticated_arbitrary_file_read.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/cisco_ios_xe_implant_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/citrix_adc_and_gateway_unauthorized_data_disclosure.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/citrix_adc_exploitation_cve_2023_3519.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/citrix_sharefile_exploitation_cve_2023_24489.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/confluence_cve_2023_22515_trigger_vulnerability.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/confluence_data_center_and_server_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/confluence_pre_auth_rce_via_ognl_injection_cve_2023_22527.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/detect_f5_tmui_rce_cve_2020_5902.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/exploit_public_facing_application_via_apache_commons_text.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/exploit_public_facing_fortinet_fortinac_cve_2022_39952.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/fortinet_appliance_auth_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/hunting_for_log4shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/ivanti_connect_secure_command_injection_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/ivanti_connect_secure_system_information_access_via_auth_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35078.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35082.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/ivanti_sentry_authentication_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/jenkins_arbitrary_file_read_cve_2024_23897.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/jetbrains_teamcity_rce_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/juniper_networks_remote_code_execution_exploit_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/log4shell_jndi_payload_injection_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/papercut_ng_remote_web_access_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/proxyshell_proxynotshell_behavior_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/spring4shell_payload_url_request.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/sql_injection_with_long_urls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/vmware_aria_operations_exploit_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/vmware_server_side_template_injection_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_jsp_request_via_url.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_remote_shellservlet_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_spring4shell_http_request_class_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_spring_cloud_function_functionrouter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/ws_ftp_remote_code_execution.yml" }, { "techniqueID": "T1027.006", "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_http_response_splitting_via_rest_spl_command.yml" }, + { + "techniqueID": "T1082", + "score": 7, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_information_disclosure_in_splunk_add_on_builder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_kernel_module_enumeration.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_information_discovery_fsutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_post_exploitation_risk_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/detect_attackers_scanning_for_vulnerable_jboss_servers.yml" + }, { "techniqueID": "T1212", "score": 3, @@ -136,8 +156,8 @@ }, { "techniqueID": "T1055", - "score": 27, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/notepad_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_shell_fetch_env_variables.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_process_injection_into_notepad.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_process_injection_of_wermgr_to_known_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_process_injection_remote_thread.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_process_injection_wermgr_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_process_injection_with_public_source_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_process_with_namedpipe_commandline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml" + "score": 28, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/notepad_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_shell_fetch_env_variables.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_process_injection_in_non_service_searchindexer.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_process_injection_into_notepad.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_process_injection_of_wermgr_to_known_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_process_injection_remote_thread.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_process_injection_wermgr_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_process_injection_with_public_source_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_process_with_namedpipe_commandline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml" }, { "techniqueID": "T1001.003", @@ -151,13 +171,8 @@ }, { "techniqueID": "T1134", - "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_rbac_bypass_on_indexing_preview_rest_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/runas_execution_in_commandline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ad_same_domain_sid_history_addition.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ad_sid_history_attribute_modified.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml" - }, - { - "techniqueID": "T1190", - "score": 51, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_rce_via_serialized_session_payload.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_unauthenticated_log_injection_web_service_log.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_abuse_via_ssrf.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/java_class_file_download_by_java_user_agent.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/java_writing_jsp_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_java_spawning_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/living_off_the_land.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/papercut_ng_suspicious_behavior_debug_log.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_java_spawning_shells.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_moveit_transfer_writing_aspx.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_papercut_ng_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winrm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_ldap_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_zerologon_via_zeek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/adobe_coldfusion_access_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/adobe_coldfusion_unauthenticated_arbitrary_file_read.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/cisco_ios_xe_implant_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/citrix_adc_exploitation_cve_2023_3519.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/citrix_sharefile_exploitation_cve_2023_24489.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/confluence_cve_2023_22515_trigger_vulnerability.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/confluence_data_center_and_server_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/detect_f5_tmui_rce_cve_2020_5902.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/exploit_public_facing_application_via_apache_commons_text.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/exploit_public_facing_fortinet_fortinac_cve_2022_39952.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/fortinet_appliance_auth_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/hunting_for_log4shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35078.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35082.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/ivanti_sentry_authentication_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/jetbrains_teamcity_rce_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/juniper_networks_remote_code_execution_exploit_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/log4shell_jndi_payload_injection_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/papercut_ng_remote_web_access_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/proxyshell_proxynotshell_behavior_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/spring4shell_payload_url_request.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/sql_injection_with_long_urls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/vmware_aria_operations_exploit_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/vmware_server_side_template_injection_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_jsp_request_via_url.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_spring4shell_http_request_class_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_spring_cloud_function_functionrouter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/ws_ftp_remote_code_execution.yml" + "score": 11, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_rbac_bypass_on_indexing_preview_rest_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/runas_execution_in_commandline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ad_same_domain_sid_history_addition.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ad_sid_history_attribute_modified.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_parent_pid_spoofing_with_explorer.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml" }, { "techniqueID": "T1202", @@ -166,18 +181,13 @@ }, { "techniqueID": "T1566.001", - "score": 31, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/suspicious_email_attachment_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_iso_lnk_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_office_product_spawning_msdt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_phishing_pdf_file_executes_url_link.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml" + "score": 35, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/suspicious_email_attachment_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_cab_file_on_disk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_asr_audit_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_asr_block_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_asr_rules_stacking.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_iso_lnk_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_office_product_spawning_msdt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_phishing_pdf_file_executes_url_link.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml" }, { "techniqueID": "T1566", - "score": 35, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/suspicious_email_attachment_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gdrive_suspicious_file_sharing.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_calendar_invite.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_iso_lnk_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_office_product_spawning_msdt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_phishing_pdf_file_executes_url_link.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml" - }, - { - "techniqueID": "T1082", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_kernel_module_enumeration.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_information_discovery_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_information_discovery_fsutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_post_exploitation_risk_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/detect_attackers_scanning_for_vulnerable_jboss_servers.yml" + "score": 36, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/suspicious_email_attachment_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_device_code_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gdrive_suspicious_file_sharing.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_calendar_invite.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_iso_lnk_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_office_product_spawning_msdt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_phishing_pdf_file_executes_url_link.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml" }, { "techniqueID": "T1078.004", @@ -186,43 +196,38 @@ }, { "techniqueID": "T1526", - "score": 8, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/amazon_eks_kubernetes_pod_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/asl_aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/kubernetes_scanner_image_pulling.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/kubernetes_azure_scan_fingerprint.yml" + "score": 9, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/amazon_eks_kubernetes_pod_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/asl_aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/kubernetes_scanner_image_pulling.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/kubernetes_suspicious_image_pulling.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/kubernetes_azure_scan_fingerprint.yml" }, { "techniqueID": "T1185", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_concurrent_sessions_from_different_ips.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_concurrent_sessions_from_different_ips.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_concurrent_sessions_from_different_ips.yml" }, { "techniqueID": "T1562.008", - "score": 9, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/asl_aws_defense_evasion_delete_cloudtrail.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/asl_aws_defense_evasion_delete_cloudwatch_log_group.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/asl_aws_defense_evasion_impair_security_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_defense_evasion_delete_cloudtrail.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_defense_evasion_impair_security_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_defense_evasion_putbucketlifecycle.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_defense_evasion_update_cloudtrail.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/asl_aws_defense_evasion_delete_cloudtrail.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/asl_aws_defense_evasion_delete_cloudwatch_log_group.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/asl_aws_defense_evasion_impair_security_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_defense_evasion_delete_cloudtrail.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_defense_evasion_impair_security_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_defense_evasion_putbucketlifecycle.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_defense_evasion_update_cloudtrail.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_advanced_audit_disabled.yml" }, { "techniqueID": "T1562", - "score": 71, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/asl_aws_defense_evasion_delete_cloudtrail.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/asl_aws_defense_evasion_delete_cloudwatch_log_group.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/asl_aws_defense_evasion_impair_security_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_defense_evasion_delete_cloudtrail.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_defense_evasion_impair_security_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_defense_evasion_putbucketlifecycle.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_defense_evasion_update_cloudtrail.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_impair_defenses_process_kill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_iptables_firewall_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_delete_or_modify_system_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_for_service_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_excessive_disabled_services_event.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defenses_disable_hvci.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_powershell_disable_http_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_powershell_import_applocker_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_registry_delete_task_sd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_terminating_lsass_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml" + "score": 97, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/asl_aws_defense_evasion_delete_cloudtrail.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/asl_aws_defense_evasion_delete_cloudwatch_log_group.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/asl_aws_defense_evasion_impair_security_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_defense_evasion_delete_cloudtrail.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_defense_evasion_impair_security_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_defense_evasion_putbucketlifecycle.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_defense_evasion_update_cloudtrail.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_block_user_consent_for_risky_apps_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_advanced_audit_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_block_user_consent_for_risky_apps_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_impair_defenses_process_kill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_iptables_firewall_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_delete_or_modify_system_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_for_service_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_excessive_disabled_services_event.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_change_win_defender_health_check_intervals.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_change_win_defender_quick_scan_interval.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_change_win_defender_throttle_rate.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_change_win_defender_tracing_level.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_configure_app_install_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_define_win_defender_threat_action.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_disable_controlled_folder_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_disable_defender_firewall_and_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_disable_defender_protocol_recognition.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_disable_pua_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_disable_realtime_signature_delivery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_disable_web_evaluation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_disable_win_defender_app_guard.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_disable_win_defender_compute_file_hashes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_disable_win_defender_gen_reports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_disable_win_defender_network_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_disable_win_defender_report_infection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_disable_win_defender_scan_on_update.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_disable_win_defender_signature_retirement.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_overide_win_defender_phishing_filter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_override_smartscreen_prompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_set_win_defender_smart_screen_level_to_warn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defenses_disable_hvci.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_system_firewall_with_notable_process_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_powershell_disable_http_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_powershell_import_applocker_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_registry_delete_task_sd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_terminating_lsass_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml" }, { "techniqueID": "T1098", - "score": 20, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/asl_aws_iam_delete_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_application_administrator_role_assigned.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_pim_role_assigned.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_pim_role_assignment_activated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_privileged_role_assigned.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_service_principal_new_client_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_service_principal_owner_added.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_user_enabled_and_password_reset.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_ssh_key_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ad_dsrm_account_changes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ad_dsrm_password_reset.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ad_serviceprincipalname_added_to_domain_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dnsadmins_new_member_added.yml" + "score": 30, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/asl_aws_iam_delete_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_application_administrator_role_assigned.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_new_mfa_method_registered.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_pim_role_assigned.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_pim_role_assignment_activated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_privileged_role_assigned.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_service_principal_new_client_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_service_principal_owner_added.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_tenant_wide_admin_consent_granted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_user_enabled_and_password_reset.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_application_registration_owner_added.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_applicationimpersonation_role_assigned.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_high_privilege_role_granted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_mailbox_read_access_granted_to_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_mfa_method_registered.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_service_principal_new_client_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_tenant_wide_admin_consent_granted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_ssh_key_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ad_dsrm_account_changes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ad_dsrm_password_reset.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ad_serviceprincipalname_added_to_domain_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dnsadmins_new_member_added.yml" }, { "techniqueID": "T1586", - "score": 28, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/asl_aws_multi_factor_authentication_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_credential_access_failed_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_credential_access_getpassworddata.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_credential_access_rds_password_reset.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_multi_factor_authentication_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_successful_console_authentication_from_multiple_ips.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_successful_single_factor_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_active_directory_high_risk_sign_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_successful_powershell_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_successful_single_factor_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/detect_aws_console_login_by_new_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_multi_factor_authentication_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_successful_single_factor_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml" + "score": 31, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/asl_aws_multi_factor_authentication_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_credential_access_failed_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_credential_access_getpassworddata.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_credential_access_rds_password_reset.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_multi_factor_authentication_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_successful_console_authentication_from_multiple_ips.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_successful_single_factor_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_active_directory_high_risk_sign_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multi_source_failed_authentications_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_successful_powershell_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_successful_single_factor_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/detect_aws_console_login_by_new_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_multi_factor_authentication_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_successful_single_factor_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_multi_source_failed_authentications_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml" }, { "techniqueID": "T1586.003", - "score": 27, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/asl_aws_multi_factor_authentication_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_credential_access_failed_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_credential_access_getpassworddata.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_credential_access_rds_password_reset.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_multi_factor_authentication_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_successful_single_factor_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_active_directory_high_risk_sign_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_successful_powershell_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_successful_single_factor_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/detect_aws_console_login_by_new_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_multi_factor_authentication_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_successful_single_factor_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml" - }, - { - "techniqueID": "T1556.006", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/asl_aws_multi_factor_authentication_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/asl_aws_new_mfa_method_registered_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_multi_factor_authentication_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_new_mfa_method_registered_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_new_mfa_method_registered_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_multi_factor_authentication_disabled.yml" + "score": 30, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/asl_aws_multi_factor_authentication_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_credential_access_failed_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_credential_access_getpassworddata.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_credential_access_rds_password_reset.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_multi_factor_authentication_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_successful_single_factor_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_active_directory_high_risk_sign_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multi_source_failed_authentications_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_successful_powershell_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_successful_single_factor_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/detect_aws_console_login_by_new_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_multi_factor_authentication_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_successful_single_factor_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_multi_source_failed_authentications_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml" }, { "techniqueID": "T1201", @@ -246,8 +251,8 @@ }, { "techniqueID": "T1110.001", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_credential_access_failed_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_credential_access_getpassworddata.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_successful_authentication_from_different_ips.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/high_number_of_login_failures_from_a_single_source.yml" + "score": 7, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_credential_access_failed_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_credential_access_getpassworddata.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_successful_authentication_from_different_ips.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/high_number_of_login_failures_from_a_single_source.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_high_number_of_failed_authentications_for_user.yml" }, { "techniqueID": "T1550", @@ -266,13 +271,13 @@ }, { "techniqueID": "T1204.003", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_upload_unknown_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/correlation_by_repository_and_risk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/correlation_by_user_and_risk.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_upload_unknown_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/risk_rule_for_dev_sec_ops_by_repository.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/correlation_by_repository_and_risk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/correlation_by_user_and_risk.yml" }, { "techniqueID": "T1204", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_upload_unknown_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_lambda_updatefunctioncode.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/correlation_by_repository_and_risk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/correlation_by_user_and_risk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_iso_lnk_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml" + "score": 39, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_upload_unknown_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_lambda_updatefunctioncode.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/kubernetes_anomalous_inbound_network_activity_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/kubernetes_anomalous_inbound_outbound_network_io.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/kubernetes_anomalous_inbound_to_outbound_network_io_ratio.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/kubernetes_anomalous_outbound_network_activity_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/kubernetes_anomalous_traffic_on_network_edge.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/kubernetes_create_or_update_privileged_pod.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/kubernetes_daemonset_deployed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/kubernetes_falco_shell_spawned.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/kubernetes_newly_seen_tcp_edge.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/kubernetes_newly_seen_udp_edge.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/kubernetes_node_port_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/kubernetes_pod_created_in_default_namespace.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/kubernetes_pod_with_host_network_attachment.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/kubernetes_previously_unseen_container_image_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/kubernetes_previously_unseen_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/kubernetes_process_running_from_new_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/kubernetes_process_with_anomalous_resource_utilisation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/kubernetes_process_with_resource_ratio_anomalies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/kubernetes_shell_running_on_worker_node.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/kubernetes_shell_running_on_worker_node_with_cpu_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/kubernetes_unauthorized_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/risk_rule_for_dev_sec_ops_by_repository.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/correlation_by_repository_and_risk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/correlation_by_user_and_risk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/batch_file_write_to_system32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/drop_icedid_license_dat.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/single_letter_process_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_iso_lnk_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml" }, { "techniqueID": "T1119", @@ -306,8 +311,18 @@ }, { "techniqueID": "T1098.003", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_application_administrator_role_assigned.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_global_administrator_role_assigned.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_pim_role_assigned.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_pim_role_assignment_activated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_privileged_role_assigned.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_application_administrator_role_assigned.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_global_administrator_role_assigned.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_pim_role_assigned.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_pim_role_assignment_activated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_privileged_role_assigned.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_tenant_wide_admin_consent_granted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_high_privilege_role_granted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_mailbox_read_access_granted_to_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_tenant_wide_admin_consent_granted.yml" + }, + { + "techniqueID": "T1528", + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_device_code_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_oauth_application_consent_granted_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_user_consent_denied_for_oauth_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_file_permissioned_application_consent_granted_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_mail_permissioned_application_consent_granted_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_user_consent_blocked_for_risky_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_user_consent_denied_for_oauth_application.yml" + }, + { + "techniqueID": "T1566.002", + "score": 5, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_device_code_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_asr_audit_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_asr_block_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_asr_rules_stacking.yml" }, { "techniqueID": "T1484", @@ -326,8 +341,8 @@ }, { "techniqueID": "T1098.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_service_principal_new_client_credentials.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_service_principal_new_client_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_service_principal_new_client_credentials.yml" }, { "techniqueID": "T1554", @@ -379,6 +394,26 @@ "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dns_exfiltration_using_nslookup_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_nslookup_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/multiple_archive_files_http_post_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/prohibited_network_traffic_allowed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/protocol_or_port_mismatch.yml" }, + { + "techniqueID": "T1552.007", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/kubernetes_abuse_of_secret_by_unusual_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_agent.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_group.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_name.yml" + }, + { + "techniqueID": "T1046", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/kubernetes_access_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/kubernetes_scanning_by_unauthenticated_ip_address.yml" + }, + { + "techniqueID": "T1053.007", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/kubernetes_cron_job_creation.yml" + }, + { + "techniqueID": "T1098.002", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_applicationimpersonation_role_assigned.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_suspicious_rights_delegation.yml" + }, { "techniqueID": "T1114.003", "score": 2, @@ -436,8 +471,8 @@ }, { "techniqueID": "T1562.004", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_iptables_firewall_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_delete_or_modify_system_firewall.yml" + "score": 7, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_iptables_firewall_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_delete_or_modify_system_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_system_firewall_with_notable_process_path.yml" }, { "techniqueID": "T1564.001", @@ -456,18 +491,18 @@ }, { "techniqueID": "T1218", - "score": 58, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/lolbas_with_network_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_diskshadow_proxy_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_regsvr32_renamed_binary.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml" + "score": 60, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/lolbas_with_network_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_diskshadow_proxy_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_msiexec_hidewindow_rundll32_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_regsvr32_renamed_binary.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rundll32_apply_user_settings_changes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml" }, { "techniqueID": "T1036", - "score": 16, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rtlo_in_file_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rtlo_in_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_kworker_process_in_writable_process_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_copy_on_system32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml" + "score": 17, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rtlo_in_file_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rtlo_in_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_kworker_process_in_writable_process_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_copy_on_system32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_masquerading_msdtc_process.yml" }, { "techniqueID": "T1218.011", - "score": 16, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml" + "score": 17, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rundll32_apply_user_settings_changes.yml" }, { "techniqueID": "T1204.002", @@ -476,18 +511,18 @@ }, { "techniqueID": "T1560.001", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_archive_collected_data_via_rar.yml" }, { "techniqueID": "T1560", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_certipy_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/7zip_commandline_to_smb_share_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/anomalous_usage_of_7zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_certipy_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_7_zip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_winrar.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_archive_collected_data_via_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_archive_collected_data_via_rar.yml" }, { "techniqueID": "T1087.002", - "score": 26, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ad_abnormal_object_access_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ad_privileged_object_access_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_root_domain_linked_policies_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml" + "score": 27, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ad_abnormal_object_access_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ad_privileged_object_access_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_domain_account_discovery_via_get_netcomputer.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_root_domain_linked_policies_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml" }, { "techniqueID": "T1547.014", @@ -506,8 +541,8 @@ }, { "techniqueID": "T1562.001", - "score": 49, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_impair_defenses_process_kill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_for_service_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_excessive_disabled_services_event.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defenses_disable_hvci.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_powershell_import_applocker_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_terminating_lsass_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml" + "score": 71, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_impair_defenses_process_kill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_for_service_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_excessive_disabled_services_event.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_change_win_defender_health_check_intervals.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_change_win_defender_quick_scan_interval.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_change_win_defender_throttle_rate.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_change_win_defender_tracing_level.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_configure_app_install_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_define_win_defender_threat_action.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_disable_controlled_folder_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_disable_defender_firewall_and_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_disable_defender_protocol_recognition.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_disable_pua_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_disable_realtime_signature_delivery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_disable_web_evaluation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_disable_win_defender_app_guard.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_disable_win_defender_compute_file_hashes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_disable_win_defender_gen_reports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_disable_win_defender_network_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_disable_win_defender_report_infection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_disable_win_defender_scan_on_update.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_disable_win_defender_signature_retirement.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_overide_win_defender_phishing_filter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_override_smartscreen_prompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_set_win_defender_smart_screen_level_to_warn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defenses_disable_hvci.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_powershell_import_applocker_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_terminating_lsass_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml" }, { "techniqueID": "T1021.001", @@ -516,8 +551,8 @@ }, { "techniqueID": "T1021", - "score": 26, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executable_file_written_in_administrative_smb_share.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/impacket_lateral_movement_smbexec_commandline_parameters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mmc_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_services_allow_remote_assistance.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_services_rdp_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/smb_traffic_spike___mltk.yml" + "score": 27, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executable_file_written_in_administrative_smb_share.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/impacket_lateral_movement_smbexec_commandline_parameters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mmc_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_services_add_trustedhost.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_services_allow_remote_assistance.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_services_rdp_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/smb_traffic_spike___mltk.yml" }, { "techniqueID": "T1105", @@ -561,8 +596,8 @@ }, { "techniqueID": "T1033", - "score": 11, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_system_discovery_using_ldap_nslookup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_system_discovery_using_qwinsta.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_system_user_discovery_via_quser.yml" + "score": 12, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_system_discovery_using_ldap_nslookup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_system_discovery_using_qwinsta.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_system_user_discovery_via_quser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_system_user_privilege_discovery.yml" }, { "techniqueID": "T1068", @@ -576,8 +611,8 @@ }, { "techniqueID": "T1070", - "score": 20, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_cron_jobs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_init_daemon_script.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_ssl_certificate.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_indicator_removal_clear_cache.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_indicator_removal_service_file_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdelete_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml" + "score": 21, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_cron_jobs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_init_daemon_script.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_ssl_certificate.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_indicator_removal_clear_cache.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_indicator_removal_service_file_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdelete_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_indicator_removal_via_rmdir.yml" }, { "techniqueID": "T1543", @@ -662,7 +697,7 @@ { "techniqueID": "T1649", "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_certify_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_certipy_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/steal_or_forge_authentication_certificates_behavior_identified.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_export_certificate.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_powershell_export_certificate.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_powershell_export_pfxcertificate.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_steal_authentication_certificates___esc1_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_steal_authentication_certificates_certificate_issued.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_steal_authentication_certificates_certificate_request.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_steal_authentication_certificates_certutil_backup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_steal_authentication_certificates_cs_backup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_steal_authentication_certificates___esc1_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_certify_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_certipy_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/steal_or_forge_authentication_certificates_behavior_identified.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_export_certificate.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_powershell_export_certificate.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_powershell_export_pfxcertificate.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_steal_authentication_certificates___esc1_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_steal_authentication_certificates___esc1_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_steal_authentication_certificates_certificate_issued.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_steal_authentication_certificates_certificate_request.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_steal_authentication_certificates_certutil_backup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_steal_authentication_certificates_cs_backup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml" }, { "techniqueID": "T1078.003", @@ -701,8 +736,8 @@ }, { "techniqueID": "T1574", - "score": 11, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_preload_hijack_library_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/msi_module_loaded_by_non_system_binary.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dll_search_order_hijacking_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dll_side_loading_in_calc.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_masquerading_explorer_as_child_process.yml" + "score": 12, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_preload_hijack_library_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/msi_module_loaded_by_non_system_binary.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dll_search_order_hijacking_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dll_side_loading_in_calc.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_known_graphicalproton_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_masquerading_explorer_as_child_process.yml" }, { "techniqueID": "T1016", @@ -761,18 +796,18 @@ }, { "techniqueID": "T1112", - "score": 49, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_security_logs_using_minint_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_inprocserver32_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_client_registry_install_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_shimcache_flush.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_change_password_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_logoff_button_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_notification_center.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_shutdown_button_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_hide_notification_features_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_auto_minor_updates.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_auto_update_notif.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_default_icon_setting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_disallow_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_longpathsenabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_no_auto_update.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_risk_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_tamper_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_usewuserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_wuserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_wustatusserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml" + "score": 59, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_security_logs_using_minint_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_inprocserver32_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_client_registry_install_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_shimcache_flush.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_asr_registry_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_asr_rule_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_change_password_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_logoff_button_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_notification_center.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_shutdown_button_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_hide_notification_features_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_authenticationleveloverride.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_auto_minor_updates.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_auto_update_notif.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_default_icon_setting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_disable_restricted_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_disablesecuritysettings.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_disallow_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_dontshowui.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_longpathsenabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_no_auto_update.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_nochangingwallpaper.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_proxyenable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_proxyserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_risk_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_tamper_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_usewuserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_wuserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_wustatusserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml" }, { "techniqueID": "T1564", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_alternate_datastream___base64_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_alternate_datastream___executable_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_alternate_datastream___process_execution.yml" }, { "techniqueID": "T1548.002", - "score": 12, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_uac_remote_restriction.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_bypass_uac_via_pkgmgr_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_uac_remote_restriction.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_bypass_uac_via_pkgmgr_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_uac_bypass_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_uac_bypass_suspicious_escalation_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml" }, { "techniqueID": "T1558", @@ -821,8 +856,8 @@ }, { "techniqueID": "T1564.003", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/headless_browser_mockbin_or_mocky_request.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/headless_browser_usage.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/headless_browser_mockbin_or_mocky_request.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/headless_browser_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_conhost_with_headless_argument.yml" }, { "techniqueID": "T1222.001", @@ -841,8 +876,8 @@ }, { "techniqueID": "T1021.006", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml" + "score": 7, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_services_add_trustedhost.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml" }, { "techniqueID": "T1558.003", @@ -1031,8 +1066,8 @@ }, { "techniqueID": "T1574.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msi_module_loaded_by_non_system_binary.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dll_side_loading_in_calc.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_masquerading_explorer_as_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unsigned_dll_side_loading.yml" + "score": 7, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/msi_module_loaded_by_non_system_binary.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dll_side_loading_in_calc.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_known_graphicalproton_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_masquerading_explorer_as_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unsigned_dll_side_loading.yml" }, { "techniqueID": "T1016.001", @@ -1046,8 +1081,8 @@ }, { "techniqueID": "T1555", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_browser_pass_view_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_credentials_from_password_stores_query.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_browser_pass_view_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_credentials_from_password_stores_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_credentials_from_password_stores_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_credentials_from_password_stores_query.yml" }, { "techniqueID": "T1555.003", @@ -1099,11 +1134,6 @@ "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/print_processor_registry_autostart.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_adding_a_printer_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_spawning_rundll32.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml" }, - { - "techniqueID": "T1566.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml" - }, { "techniqueID": "T1559.001", "score": 1, @@ -1181,8 +1211,8 @@ }, { "techniqueID": "T1218.007", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_msiexec_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_msiexec_remote_download.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_msiexec_spawn_discovery_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_msiexec_with_network_connections.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_msiexec_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_msiexec_hidewindow_rundll32_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_msiexec_remote_download.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_msiexec_spawn_discovery_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_msiexec_spawn_windbg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_msiexec_with_network_connections.yml" }, { "techniqueID": "T1218.012", @@ -1224,6 +1254,11 @@ "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_admon_default_group_policy_object_modified.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_admon_group_policy_object_created.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_default_group_policy_object_modified.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_group_policy_object_created.yml" }, + { + "techniqueID": "T1564.004", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_alternate_datastream___base64_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_alternate_datastream___executable_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_alternate_datastream___process_execution.yml" + }, { "techniqueID": "T1071", "score": 9, @@ -1254,6 +1289,11 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_cached_domain_credentials_reg_query.yml" }, + { + "techniqueID": "T1564.006", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_conhost_with_headless_argument.yml" + }, { "techniqueID": "T1012", "score": 8, @@ -1339,6 +1379,11 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_lateral_tool_transfer_remcom.yml" }, + { + "techniqueID": "T1003.004", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_lsa_secrets_nolmhash_registry.yml" + }, { "techniqueID": "T1553.005", "score": 1, @@ -1354,11 +1399,21 @@ "score": 3, "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_odbcconf_hunting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_odbcconf_load_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_odbcconf_load_response_file.yml" }, + { + "techniqueID": "T1134.004", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_parent_pid_spoofing_with_explorer.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml" + }, { "techniqueID": "T1555.005", "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_password_managers_discovery.yml" }, + { + "techniqueID": "T1057", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_process_commandline_discovery.yml" + }, { "techniqueID": "T1055.002", "score": 3, @@ -1429,11 +1484,6 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_xsl_execution_via_url.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xsl_script_execution_with_wmic.yml" }, - { - "techniqueID": "T1134.004", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml" - }, { "techniqueID": "T1557", "score": 4, @@ -1492,7 +1542,7 @@ "#096ed7" ], "minValue": 0, - "maxValue": 71 + "maxValue": 97 }, "filters": { "platforms": [ @@ -1519,4 +1569,4 @@ "showTacticRowBackground": true, "tacticRowBackground": "#dddddd", "sorting": 3 -} \ No newline at end of file +} diff --git a/lookups/__mlspl_risky_spl_pre_trained_model.mlmodel b/lookups/__mlspl_risky_spl_pre_trained_model.mlmodel deleted file mode 100644 index 5aa2f7fd9c..0000000000 --- a/lookups/__mlspl_risky_spl_pre_trained_model.mlmodel +++ /dev/null @@ -1,2 +0,0 @@ -algo,model,options -DetectRiskySPL,"{""__mlspl_type"": [""algos.DetectRiskySPL"", ""DetectRiskySPL""], ""dict"": {""classes"": null, ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""columns"": [""spl_text""], ""estimator"": {""__mlspl_type"": [""sklearn.pipeline"", ""Pipeline""], ""dict"": {""steps"": [[""features"", {""__mlspl_type"": [""sklearn.feature_extraction.text"", ""CountVectorizer""], ""dict"": {""input"": ""content"", ""encoding"": ""utf-8"", ""decode_error"": ""strict"", ""strip_accents"": null, ""preprocessor"": null, ""tokenizer"": null, ""analyzer"": ""word"", ""lowercase"": true, ""token_pattern"": "" collect | delete | fit | outputcsv | outputlookup |adhoc| sendalert | sendemail |splunk\\-system\\-user| tscollect | run | script | runshellscript "", ""stop_words"": null, ""max_df"": 1.0, ""min_df"": 1, ""max_features"": null, ""ngram_range"": [1, 1], ""vocabulary"": null, ""binary"": false, ""dtype"": {""__mlspl_type"": [""builtins"", ""type""], ""type"": [""numpy"", ""int64""]}, ""fixed_vocabulary_"": false, ""_stop_words_id"": 94300723879360, ""stop_words_"": {""__mlspl_type"": [""builtins"", ""set""], ""set"": []}, ""vocabulary_"": {""splunk-system-user"": 12, "" delete "": 1, ""adhoc"": 11, "" outputlookup "": 4, "" script "": 7, "" run "": 5, "" collect "": 0, "" sendemail "": 9, "" sendalert "": 8, "" outputcsv "": 3, "" fit "": 2, "" runshellscript "": 6, "" tscollect "": 10}}}], [""predictor"", {""__mlspl_type"": [""sklearn.linear_model._logistic"", ""LogisticRegression""], ""dict"": {""penalty"": ""l2"", ""dual"": false, ""tol"": 0.0001, ""C"": 1.0, ""fit_intercept"": true, ""intercept_scaling"": 1, ""class_weight"": {""0"": 1, ""1"": 10}, ""random_state"": null, ""solver"": ""liblinear"", ""max_iter"": 100, ""multi_class"": ""auto"", ""verbose"": 0, ""warm_start"": false, ""n_jobs"": null, ""l1_ratio"": null, ""n_features_in_"": 13, ""classes_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDIsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoAAAAAAAAAAAEAAAAAAAAA""}, ""coef_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsIDEzKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAqulbT8VG8TQJU6VfC9QuY/kCCmapJVFUDQl14TS2ApPw5vYc32jBxAxVuQ3Sv35D8Y+azG/kDmP9vpUE0rTwlALsMVcoUGE0ASjjFaKyMaQA2zZ/yMQRZAQLZHc97OHEAfrzTDBGwSwA==""}, ""intercept_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAqBnhyKtBckwA==""}, ""n_iter_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk0JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoLAAAA""}}}]], ""memory"": null, ""verbose"": false}}}}","{""args"": [""risk_score"", ""spl_text""], ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""model_name"": ""risky_spl_pre_trained_model"", ""algo_name"": ""LogisticRegression"", ""mlspl_limits"": {""handle_new_cat"": ""default"", ""max_distinct_cat_values"": ""100"", ""max_distinct_cat_values_for_classifiers"": ""100"", ""max_distinct_cat_values_for_scoring"": ""100"", ""max_fit_time"": ""600"", ""max_inputs"": ""100000"", ""max_memory_usage_mb"": ""1024"", ""max_model_size_mb"": ""15"", ""max_score_time"": ""600"", ""streaming_apply"": ""false"", ""use_sampling"": ""true""}, ""kfold_cv"": null}" diff --git a/lookups/__mlspl_risky_spl_pre_trained_model.yml b/lookups/__mlspl_risky_spl_pre_trained_model.yml deleted file mode 100644 index da0fe9b35e..0000000000 --- a/lookups/__mlspl_risky_spl_pre_trained_model.yml +++ /dev/null @@ -1,6 +0,0 @@ -description: Detect Risky SPL using Pretrained ML Model -filename: __mlspl_risky_spl_pre_trained_model.mlmodel -name: __mlspl_risky_spl_pre_trained_model -case_sensitive_match: 'false' -min_matches: 1 -default_match: 'false' diff --git a/lookups/ransomware_extensions.csv b/lookups/ransomware_extensions.csv deleted file mode 100644 index 145fea7a9f..0000000000 --- a/lookups/ransomware_extensions.csv +++ /dev/null @@ -1,303 +0,0 @@ -Extensions,Name -.enc,.CryptoHasYou. -.777,777 -.R4A,7ev3n -.R5A,7ev3n -.7h9r,7h9r -.8lock8,8lock8 -.encrypt,Alpha Ransomware -.amba,AMBA -.adk,Angry Duck -.encrypted,Apocalypse -.SecureCrypted,Apocalypse -.FuckYourData,Apocalypse -.unavailable,Apocalypse -.bleepYourFiles,Apocalypse -.Where_my_files.txt,Apocalypse -.encrypted,ApocalypseVM -.locked,ApocalypseVM -.locky,AutoLocky -.adr,BaksoCrypt -.avos,AvosLocker -.avos2,AvosLocker -.avoslinux,AvosLocker -.bart.zip,Bart -.bart,Bart -.perl,Bart -.clf,BitCryptor -.bitstak,BitStak -.Silent,BlackShades Crypter -.blocatto,Blocatto -.cry,Central Security Treatment Organization -.cerber,Cerber -.cerber2,Cerber -.cerber3,Cerber -.clf,CoinVault -.coverton,Coverton -.enigma,Coverton -.czvxce,Coverton -.criptiko,CryFile -.criptoko,CryFile -.criptokod,CryFile -.cripttt,CryFile -.aga,CryFile -.cry,CryLocker -.ENCRYPTED,Crypren -.crypt38,Crypt38 -.scl,CryptFIle2 -.crinf,CryptInfinite -.frtrss,CryptoFortress -.clf,CryptoGraphic Locker -.crjoker,CryptoJoker -.encrypted ,CryptoLocker -.ENC,CryptoLocker -.code,CryptoMix -.scl,CryptoMix -.crptrgr,CryptoRoger -.locked,CryptoShocker -.CryptoTorLocker2015!,CryptoTorLocker2015 -.crypt,CryptXXX -.crypt,CryptXXX 2.0 -.crypt,CryptXXX 3.0 -.cryp1,CryptXXX 3.0 -.crypz,CryptXXX 3.0 -.cryptz,CryptXXX 3.0 -.cryp1,CryptXXX 3.1 -.ctbl,CTB-Locker -.encrypted,CuteRansomware -.ded,DEDCryptor -.domino,Domino -.locked,EDA2 / HiddenTear -.isis,EduCrypt -.locked,EduCrypt -.ha3,El-Polocker -.enigma,Enigma -.1txt,Enigma -.exotic,Exotic -.locked,Fakben -.fantom,Fantom -.Z81928819,GhostCrypt -.purge,Globe v1 -.globe,Globe v3 -.locked,GNL Locker -.crypt,Gomasom -.herbst,Herbst -.cry,Hi Buddy! -.locky,Hucky -.crime,iLock -.crime,iLockLight -.btc,Jigsaw -.kkk,Jigsaw -.fun,Jigsaw -.gws,Jigsaw -.porno,Jigsaw -.payransom,Jigsaw -.payms,Jigsaw -.paymst,Jigsaw -.AFD,Jigsaw -.paybtcs,Jigsaw -.epic,Jigsaw -.xyz,Jigsaw -.locked,Job Crypter -.encrypted,KeRanger -.keybtc@inbox_com,KeyBTC -.rip,Killer Locker -.kimcilware,KimcilWare -.locked,KimcilWare -.kostya,Kostya -.kratos,KratosCrypt -.LeChiffre,LeChiffre -.locky,Locky -.zepto,Locky -.odin,Locky -.shit,Locky -.thor,Locky -.asier,Locky -.zzzzz,Locky -.osiris,Locky -.lock93,Lock93 -.crime,Lortok -.oor,LowLevel04 -.magic,Magic -.Lock,MIRCOP -.fucked,MireWare -.fuck,MireWare -.locked,MM Locker -.KEYZ,Mobef -.KEYH0LES,Mobef -.crypted,Nemucod -.odcodc,ODCODC -.cbf,Offline ransomware -.LOL!,OMG! Ransomware -.OMG!,OMG! Ransomware -.padcrypt,PadCrypt -.locked,Philadelphia -.locked,PokemonGO -.filock,Popcorn Time -.locky,PowerWare -.crypt,R980 -.locked,RAA encryptor -.RDM,Radamant -.RRK,Radamant -.RAD,Radamant -.RADAMANT,Radamant -.locked,Rakhni -.kraken,Rakhni -.darkness,Rakhni -.nochance,Rakhni -.oshit,Rakhni -.oplata@qq_com,Rakhni -.relock@qq_com,Rakhni -.crypto,Rakhni -.helpdecrypt@ukr.net,Rakhni -.pizda@qq_com,Rakhni -.dyatel@qq_com,Rakhni -._ryp,Rakhni -.nalog@qq_com,Rakhni -.chifrator@qq_com,Rakhni -.gruzin@qq_com,Rakhni -.troyancoder@qq_com,Rakhni -.encrypted,Rakhni -.cry,Rakhni -.AES256,Rakhni -.enc,Rakhni -.hb15,Rakhni -.vscrypt,Rector -.infected,Rector -.bloc,Rector -.korrektor,Rector -.rekt,RektLocker -.remind,RemindMe -.crashed,RemindMe -.rokku,Rokku -.encryptedAES,Samas-Samsam -.encryptedRSA,Samas-Samsam -.encedRSA,Samas-Samsam -.justbtcwillhelpyou,Samas-Samsam -.btcbtcbtc,Samas-Samsam -.btc-help-you,Samas-Samsam -.only-we_can-help_you,Samas-Samsam -.iwanthelpuuu,Samas-Samsam -.notfoundrans,Samas-Samsam -.encmywork,Samas-Samsam -.weapologize,Samas-Samsam -.stubbin,Samas-Samsam -.areyoulovemyrans,Samas-Samsam -.loveransisgood,Samas-Samsam -.myransext2017,Samas-Samsam -.disposed2017,Samas-Samsam -.prosperous666,Samas-Samsam -.supported2017,Samas-Samsam -.country82000,Samas-Samsam -.moments2900,Samas-Samsam -.breeding123,Samas-Samsam -.mention9823,Samas-Samsam -.suppose666,Samas-Samsam -.skjdthghh,Samas-Samsam -.cifgksaffsfyghd,Samas-Samsam -.iaufkakfhsaraf,Samas-Samsam -.filegofprencrp,Samas-Samsam -.weencedufiles,Samas-Samsam -.encryptedyourfiles,Samas-Samsam -.letmetrydecfiles,Samas-Samsam -.otherinformation,Samas-Samsam -.weareyourfriends,Samas-Samsam -.noproblemwedecfiles,Samas-Samsam -.powerfulldecrypt,Samas-Samsam -.wowreadfordecryp,Samas-Samsam -.wowwhereismyfiles,Samas-Samsam -.helpmeencedfiles,Samas-Samsam -.theworldisyours,Samas-Samsam -.vekanhelpu,Samas-Samsam -.howcanihelpusir,Samas-Samsam -.VforVendetta,Samas-Samsam -.checkdiskenced,Samas-Samsam -.goforhelp,Samas-Samsam -.iloveworld,Samas-Samsam -.canihelpyou,Samas-Samsam -.AreYouLoveMyRansFile,Samas-Samsam -.fucku,Samas-Samsam -.happenencedfiles,Samas-Samsam -.iwishiyou,Samas-Samsam -.powerfulldecryp,Samas-Samsam -.suppose665,Samas-Samsam -.Whereisyourfiles,Samas-Samsam -.sanction,Sanction -.locked,Shark -.shino,ShinoLocker -.locked,SkidLocker / Pompous -.encrypted,Smrss32 -.RSNSlocked,SNSLocker -.RSplited,SNSLocker -.sport,Sport -.locked,Stampado -.locked,Strictor -.surprise,Surprise -.tzu,Surprise -.szf,SZFLocker -.xcri,TeleCrypt -.vvv,TeslaCrypt 0.x - 2.2.0 -.ecc,TeslaCrypt 0.x - 2.2.0 -.exx,TeslaCrypt 0.x - 2.2.0 -.ezz,TeslaCrypt 0.x - 2.2.0 -.abc,TeslaCrypt 0.x - 2.2.0 -.aaa,TeslaCrypt 0.x - 2.2.0 -.zzz,TeslaCrypt 0.x - 2.2.0 -.xyz,TeslaCrypt 0.x - 2.2.0 -.micro,TeslaCrypt 3.0+ -.xxx,TeslaCrypt 3.0+ -.ttt,TeslaCrypt 3.0+ -.mp3,TeslaCrypt 3.0+ -.Encrypted,TorrentLocker -.enc,TorrentLocker -.toxcrypt,Toxcrypt -.better_call_saul,Troldesh -.xtbl,Troldesh -.da_vinci_code,Troldesh -.windows10,Troldesh -.enc,TrueCrypter -.locked,Turkish Ransom -.H3LL,Ungluk -.0x0,Ungluk -.1999,Ungluk -.CRRRT,Unlock92 -.CCCRRRPPP,Unlock92 -.vault,VaultCrypt -.xort,VaultCrypt -.trun,VaultCrypt -.Venusf,VenusLocker -.Venusp,VenusLocker -.CrySiS,Virus-Encoder -.xtbl,Virus-Encoder -.wflx,WildFire Locker -.EnCiPhErEd,Xorist -.73i87A,Xorist -.p5tkjw,Xorist -.PoAr2w,Xorist -.fileiscryptedhard,Xorist -.encoderpass,Xorist -.zc3791,Xorist -.xrtn,XRTN -.zcrypt,Zcrypt -.crypto,Zimbra -.vault,Zlader / Russian -.zyklon,Zyklon -.wncry,WannaCry -.wcry,WannaCry -.wnry,WannaCry -.wncryt,WannaCry -.WNCRYT,WannaCry -.RYK,Ryuk -.Clop,Clop -.Cllp,Clop -.JSWORM,JSWorm -.NEMTY_*,Nemty -.NEFILIM,Nefilim -.OFFWHITE,Offwhite -.TELEGRAM,Telegram -.FUSION,Fusion -.MILIHPEN,Milihpen -.GANGBANG,Gangbang -.reddot,RedDot -.MEDUSA,Medusa -.rhysida,Rhysida diff --git a/lookups/ransomware_notes.csv b/lookups/ransomware_notes.csv deleted file mode 100644 index 5ab10617c1..0000000000 --- a/lookups/ransomware_notes.csv +++ /dev/null @@ -1,75 +0,0 @@ -ransomware_notes, status -HELP_TO_SAVE_FILES.txt,True -BitCryptorFileList.txt,True -BUYUNLOCKCODE,True -YOUR_FILES_ARE_ENCRYPTED.HTML,True -Coin.Locker.txt,True -DECRYPT_INSTRUCTIONS.HTML,True -ReadDecryptFilesHere.txt,True -HOW_DECRYPT.TXT,True -READ IF YOU WANT YOUR FILES BACK.HTML,True -GetYouFiles.txt,True -HOW TO DECRYPT FILES.HTML,True -DECRYPT_INSTRUCTION.TXT,True -HELP_DECRYPT.TXT,True -HELP_YOURFILES.HTML,True -HowDecrypt.gif,True -Decrypt All Files *.bmp,True -cryptinfo.txt,True -DECRYPT_Readme.TXT.ReadMe,True -qwer.html,True -qwer2.html,True -Hellothere.txt,True -FILESAREGONE.TXT,True -HOW TO DECRYPT FILES.TXT,True -DECRYPT_Readme.TXT.ReadMe,True -README_DECRYPT_HYDRA_ID_*.txt,True -DECRYPT_YOUR_FILES.HTML,True -KryptoLocker_README.txt,True -_Locky_recover_instructions.txt,True -DECRYPT_Readme.TXT.ReadMe,True -ATTENTION.RTF,True -how to get data.txt,True -IMPORTANT READ ME.txt,True -UnblockFiles.vbs,True -YOUR_FILES.url,True -exit.hhr.obleep,True -HOW_TO_DECRYPT.HTML,True -HOW-TO-DECRYPT-FILES.HTML,True -HELP_TO_SAVE_FILES.txt,True -HELP_TO_SAVE_FILES.txt,True -HELP_TO_SAVE_FILES.txt,True -_H_e_l_p_RECOVER_INSTRUCTIONS+*.txt,True -DECRYPT_INSTRUCTIONS.HTML,True -README_DECRYPT_UMBRE_ID_*.txt,True -Help_Decrypt.txt,True -CryptLogFile.txt,True -*@Please_Read_Me@.txt*,True -*@WanaDecryptor@.exe*,True -# DECRYPT MY FILES #.vbs,True -# DECRYPT MY FILES #.html,True -# DECRYPT MY FILES #.txt,True -# DECRYPT MY FILES #.vbs,True -# DECRYPT MY FILES #.html,True -# DECRYPT MY FILES #.txt,True -HELP_DECRYPT_YOUR_FILES.HTML,True -*-HELP_FOR_DECRYPT_FILE.html,True -*-SORRY-FOR-FILES.html,True -*-READ-FOR-HELLPP.html,True -RyukReadMe.html,True -ClopReadMe.txt,True -README_README.txt,True -JSWORM-DECRYPT.html,True -NEMTY_*-DECRYPT.txt,True -NEFILIM-DECRYPT.txt,True -OFFWHITE-MANUAL.txt,True -TELEGRAM-RECOVER.txt,True -FUSION-README.txt,True -MILIHPEN-INSTRUCT.txt,True -GANGBANG-NOTE.txt,True -GET_YOUR_FILES_BACK.txt,True -read_it.txt,True -*.README.txt, True -*READ_ME_MEDUSA*.TXT,True -How_to_back_files.HTML,True -CriticalBreachDetected.pdf,True \ No newline at end of file diff --git a/lookups/splunk_risky_command.yml b/lookups/splunk_risky_command.yml deleted file mode 100644 index ece0089986..0000000000 --- a/lookups/splunk_risky_command.yml +++ /dev/null @@ -1,7 +0,0 @@ -description: A list of Risky Splunk Command that are candidates for abuse -filename: splunk_risky_command_20240601.csv -name: splunk_risky_command -default_match: 'false' -match_type: WILDCARD(splunk_risky_command) -min_matches: 1 -case_sensitive_match: 'false' diff --git a/lookups/splunk_risky_command_20240601.csv b/lookups/splunk_risky_command_20240601.csv deleted file mode 100644 index 50e03f2c2f..0000000000 --- a/lookups/splunk_risky_command_20240601.csv +++ /dev/null @@ -1,16 +0,0 @@ -"splunk_risky_command","description","vulnerable_versions","CVE","other_metadata" -"*createrss*","createrss command overwrites existing RSS feeds without verifying permissions","8.1.13, 8.2.10","CVE-2023-22931", -"*pivot?seedSid=*","pivot command allows a search to bypass SPL safeguards for risky commands using a saved job","8.1.13, 8.2.10, 9.0.4","CVE-2023-22934", -"*|makeresults+&search_listener*","search_listener parameter in a Search allows for a Blind Server Side Request Forgery by an authenticated user","8.1.13, 8.2.10, 9.0.4","CVE-2023-22936", -"*| map search=*| *","map search processing language (SPL) command lets a search bypass SPL safeguards for risky commands","8.1.13, 8.2.10, 9.0.4","CVE-2023-22939", -"*|mcollect%20index*","collect command SPL aliases commands could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940", -"*|""*meventcollect*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940", -"*|""*summaryindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940", -"*|""*sumindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940", -"*|""*stash*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940", -"*| sendalert *","display.page.search.patterns.sensitivity search parameter allows a search to bypass SPL safeguards for risky commands using obfuscation","8.1.13, 8.2.10, 9.0.4","CVE-2023-22935", -"*|*runshellscript*","runshellscript searches should not be run interactively via User Interface or REST API and may be used to bypass safeguards; -runshellscript may be abused to exploit legacy internal functions in external lookups leading to arbitrary code execution","<8.1.14, <8.2.12, <9.0.6, <9.1.1; -<8.2.12, <9.0.6, <9.1.1","CVE-2023-40598, CVE-2023-46214", -"*|*mrollup*","The โ€œmrollupโ€ SPL command lets a low-privileged user view metrics on an index that they do not have permission to view. This vulnerability requires user interaction from a high-privileged user to exploit.","<9.0.8, <9.1.3, <9.1.2308.200","CVE-2024-23676", -"*|*mstats*", "The "mstats" SPL command lets malicious user can control a search query in Analytics Workspace using params from another search (via job SID) and quotation mark ' ' and " incorrect handling", "<9.0.10, <9.1.5, <9.2.2","CVE-2024-36984" \ No newline at end of file diff --git a/macros/audit_searches.yml b/macros/audit_searches.yml deleted file mode 100644 index 64520a8aaa..0000000000 --- a/macros/audit_searches.yml +++ /dev/null @@ -1,3 +0,0 @@ -definition: index=_audit sourcetype=audittrail action=search -description: Macro to enable easy searching of audittrail logs for searches -name: audit_searches diff --git a/macros/audittrail.yml b/macros/audittrail.yml deleted file mode 100644 index 56844d8e97..0000000000 --- a/macros/audittrail.yml +++ /dev/null @@ -1,3 +0,0 @@ -definition: index=_audit sourcetype=audittrail -description: Macro to enable easy searching of audittrail logs -name: audittrail diff --git a/macros/path_traversal_spl_injection.yml b/macros/path_traversal_spl_injection.yml deleted file mode 100644 index e4c4154139..0000000000 --- a/macros/path_traversal_spl_injection.yml +++ /dev/null @@ -1,4 +0,0 @@ -definition: index=_internal sourcetype=splunkd_ui_access -description: customer specific splunk configurations(eg- index, source, sourcetype). - Replace the macro definition with configurations for your Splunk Environmnent. -name: path_traversal_spl_injection diff --git a/macros/splunk_crash_log.yml b/macros/splunk_crash_log.yml deleted file mode 100644 index 540846ea73..0000000000 --- a/macros/splunk_crash_log.yml +++ /dev/null @@ -1,3 +0,0 @@ -definition: (index=_internal AND sourcetype=splunkd_crash_log) -description: Searches through the Splunk Crash Log for low-level errors and crashes -name: splunk_crash_log \ No newline at end of file diff --git a/macros/splunk_python.yml b/macros/splunk_python.yml deleted file mode 100644 index 308c5cb662..0000000000 --- a/macros/splunk_python.yml +++ /dev/null @@ -1,4 +0,0 @@ -definition: index=_internal sourcetype=splunk_python -description: customer specific splunk configurations(eg- index, source, sourcetype). - Replace the macro definition with configurations for your Splunk Environmnent. -name: splunk_python diff --git a/macros/splunkd.yml b/macros/splunkd.yml deleted file mode 100644 index 4967864d23..0000000000 --- a/macros/splunkd.yml +++ /dev/null @@ -1,4 +0,0 @@ -definition: index=_internal sourcetype=splunkd -description: customer specific splunk configurations(eg- index, source, sourcetype). - Replace the macro definition with configurations for your Splunk Environmnent. -name: splunkd \ No newline at end of file diff --git a/macros/splunkd_failed_auths.yml b/macros/splunkd_failed_auths.yml deleted file mode 100644 index 2cd71209e8..0000000000 --- a/macros/splunkd_failed_auths.yml +++ /dev/null @@ -1,4 +0,0 @@ -definition: index=_audit "action=login attempt" "info=failed" -description: customer specific splunk configurations(eg- index, source, sourcetype). - Replace the macro definition with configurations for your Splunk Environmnent. -name: splunkd_failed_auths \ No newline at end of file diff --git a/macros/splunkd_investigation_rest_handler.yml b/macros/splunkd_investigation_rest_handler.yml deleted file mode 100644 index 769a5efbad..0000000000 --- a/macros/splunkd_investigation_rest_handler.yml +++ /dev/null @@ -1,4 +0,0 @@ -definition: index=_internal sourcetype=investigation_rest_handler -description: customer specific splunk configurations(eg- index, source, sourcetype). - Replace the macro definition with configurations for your Splunk Environmnent. -name: splunkd_investigation_rest_handler \ No newline at end of file diff --git a/macros/splunkd_ui.yml b/macros/splunkd_ui.yml deleted file mode 100644 index afc9efe8b1..0000000000 --- a/macros/splunkd_ui.yml +++ /dev/null @@ -1,4 +0,0 @@ -definition: index=_internal sourcetype=splunkd_ui_access -description: customer specific splunk configurations(eg- index, source, sourcetype). - Replace the macro definition with configurations for your Splunk Environmnent. -name: splunkd_ui \ No newline at end of file diff --git a/macros/splunkd_web.yml b/macros/splunkd_web.yml deleted file mode 100644 index 95e6ca7cbf..0000000000 --- a/macros/splunkd_web.yml +++ /dev/null @@ -1,4 +0,0 @@ -definition: index=_internal sourcetype=splunk_web_access -description: customer specific splunk configurations(eg- index, source, sourcetype). - Replace the macro definition with configurations for your Splunk Environmnent. -name: splunkd_web \ No newline at end of file diff --git a/macros/splunkd_webs.yml b/macros/splunkd_webs.yml deleted file mode 100644 index 439e0b1bea..0000000000 --- a/macros/splunkd_webs.yml +++ /dev/null @@ -1,4 +0,0 @@ -definition: index=_internal sourcetype=splunk_web_service -description: customer specific splunk configurations(eg- index, source, sourcetype). - Replace the macro definition with configurations for your Splunk Environmnent. -name: splunkd_webs \ No newline at end of file diff --git a/macros/splunkd_webx.yml b/macros/splunkd_webx.yml deleted file mode 100644 index f5bd36df7b..0000000000 --- a/macros/splunkd_webx.yml +++ /dev/null @@ -1,4 +0,0 @@ -definition: index=_internal sourcetype=splunk_web_access -description: customer specific splunk configurations(eg- index, source, sourcetype). - Replace the macro definition with configurations for your Splunk Environmnent. -name: splunkd_webx \ No newline at end of file diff --git a/macros/splunkda.yml b/macros/splunkda.yml deleted file mode 100644 index a264dcaf60..0000000000 --- a/macros/splunkda.yml +++ /dev/null @@ -1,4 +0,0 @@ -definition: index=_internal sourcetype=splunkd_access -description: customer specific splunk configurations(eg- index, source, sourcetype). - Replace the macro definition with configurations for your Splunk Environmnent. -name: splunkda \ No newline at end of file diff --git a/ssa_detections/deprecated/ssa___credential_extractionfgdump_and_cachedump.yml b/ssa_detections/deprecated/ssa___credential_extractionfgdump_and_cachedump.yml deleted file mode 100644 index bf85bce31d..0000000000 --- a/ssa_detections/deprecated/ssa___credential_extractionfgdump_and_cachedump.yml +++ /dev/null @@ -1,74 +0,0 @@ -name: Credential ExtractionFGDump and CacheDump -id: 3c40b0ef-a03f-460a-9484-e4b9117cbb38 -version: 2 -date: '2021-11-29' -author: Stanislav Miskovic, Splunk -status: deprecated -type: TTP -description: The following analytic identifies the use of CacheDump with the `-v` - parameter to dump cached credentials on the associated endpoint. Adversaries use - Cachedump as it is a publicly-available tool that extracts cached password hashes - from a system's registry. -data_source: -- Windows Security 4688 -search: ' | from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, - "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), - "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) - | where cmd_line != null AND process_name != null AND process_path != null AND match_regex(process_name, - /(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path, /(?i)\\Temp/)=true - AND match_regex(cmd_line, /(?i)\-v/)=true - - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name]) | into write_ssa_detected_events();' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: False positives will be limited as this analytic targets specific - credential dumping process names. Filter as needed. -references: [] -tags: - analytic_story: - - Unusual Processes - - Credential Dumping - asset_type: Windows - confidence: 90 - impact: 70 - message: Malicious actor is accessing stored credentials via FGDump or CacheDump - tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ - via process $process_name$ - mitre_attack_id: - - T1003 - - T1003.002 - observable: - - name: dest_user_id - type: User - role: - - Actor - - name: dest_device_id - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - process_name - - _time - - process_path - - dest_user_id - - process - - cmd_line - kill_chain_phases: - - Actions on Objectives - risk_score: 63 - security_domain: endpoint diff --git a/ssa_detections/deprecated/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml b/ssa_detections/deprecated/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml deleted file mode 100644 index 77c82ceca1..0000000000 --- a/ssa_detections/deprecated/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml +++ /dev/null @@ -1,83 +0,0 @@ -name: Potential Pass the Token or Hash Observed at the Destination Device -id: 82e76b80-5cdb-4899-9b43-85dbe777b36d -version: 3 -date: '2021-11-30' -author: Stanislav Miskovic, Splunk -status: deprecated -type: TTP -description: This detection identifies potential Pass the Token or Pass the Hash credential - stealing. We detect the main side effect of these attacks, which is a transition - from the dominant Kerberos logins to rare NTLM logins for a given user, as reported - by a detination device. -data_source: [] -search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamodels) - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - dest_user=lower(ucast(map_get(input_event, "dest_user_primary_artifact"), "string", - null)), dest_user_id= ucast(map_get(input_event, "dest_user_id"), "string", null), - dest_device_id= ucast(map_get(input_event, "dest_device_id"), "string", null), - signature_id= lower(ucast(map_get(input_event, "signature_id"), "string", null)), - authentication_method= lower(ucast(map_get(input_event, "authentication_method"), - "string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null) - - | where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos") - AND dest_user_id != null AND dest_device_id != null - - | eval isKerberos=if(authentication_method == "kerberos", 1, 0), isNtlm=if(authentication_method - == "ntlmssp", 1, 0), timeNTLM=if(isNtlm > 0, timestamp, null) - - | stats sum(isKerberos) as totalKerberos, sum(isNtlm) as totalNtlm, min(timestamp) as - startTime, min(timeNTLM) as startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as - endNTLMTime by dest_user_id, dest_user, dest_device_id, span(timestamp, 86400s) - - | where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime - - startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND - (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime) - - | eval start_time=ucast(startNTLMTime, "long", null), end_time=ucast(endNTLMTime, - "long", null), entities=mvappend(dest_user_id, dest_device_id), body=create_map(["event_id", - event_id, "total_kerberos", totalKerberos, "total_ntlm", totalNtlm, "analysis_start_time", - startTime, "analysis_end_time", endTime, "pth_start_time", startNTLMTime, "pth_end_time", - endNTLMTime]) - - | into write_ssa_detected_events();' -how_to_implement: You must be ingesting Windows Security logs from endpoint devices, - i.e., destinations of interest. Please make sure that event ID 4624 is being logged. -known_false_positives: Environments in which NTLM is used extremely rarely and for - benign purposes (such as a rare use of SMB shares). -references: -- https://attack.mitre.org/techniques/T1550/002/ -- https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/ -tags: - analytic_story: - - Active Directory Lateral Movement - asset_type: Windows - confidence: 90 - impact: 80 - message: Potential lateral movement and credential stealing via Pass the Token or - Pass the Hash techniques. Operation is performed via credentials of the account - $dest_user_id$ and observed by the destination device $dest_device_id$ - mitre_attack_id: - - T1550 - - T1550.002 - observable: - - name: dest_user_id - type: User - role: - - Actor - - name: dest_device_id - type: Hostname - role: - - Other - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - signature_id - - dest_user - - dest_user_id - - dest_device_id - - authentication_method - kill_chain_phases: - - Exploitation - risk_score: 72 - security_domain: endpoint diff --git a/ssa_detections/deprecated/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml b/ssa_detections/deprecated/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml deleted file mode 100644 index ff87984bae..0000000000 --- a/ssa_detections/deprecated/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml +++ /dev/null @@ -1,84 +0,0 @@ -name: Potential Pass the Token or Hash Observed by an Event Collecting Device -id: 1058ba3e-a698-49bc-a1e5-7cedece4ea87 -version: 2 -date: '2021-11-05' -author: Stanislav Miskovic, Splunk -status: deprecated -type: TTP -description: This detection identifies potential Pass the Token or Pass the Hash credential - stealing. We detect the main side effect of these attacks, which is a transition - from the dominant Kerberos logins to rare NTLM logins for a given user, as reported - by an event-collecting device (i.e., a specific domain controller or an endpoint - destination). -data_source: [] -search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamodels) - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"), - "string", null)), dest_user_id= ucast(map_get(input_event, "dest_user_id"), "string", - null), origin_device_id= ucast(map_get(input_event, "origin_device_id"), "string", - null), signature_id= lower(ucast(map_get(input_event, "signature_id"), "string", - null)), authentication_method= lower(ucast(map_get(input_event, "authentication_method"), - "string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null) - | where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos") - AND dest_user_id != null AND origin_device_id != null - - | eval isKerberos=if(authentication_method == "kerberos", 1, 0), isNtlm=if(authentication_method - == "ntlmssp", 1, 0), timeNTLM=if(isNtlm > 0, timestamp, null) - - | stats sum(isKerberos) as totalKerberos, sum(isNtlm) as totalNtlm, min(timestamp) as - startTime, min(timeNTLM) as startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as - endNTLMTime by dest_user_id, dest_user, origin_device_id, span(timestamp, 86400s) - - | where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime - - startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND - (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime) - - | eval start_time=startNTLMTime, end_time=endNTLMTime, entities=mvappend(dest_user_id, - origin_device_id), body=create_map(["event_id", event_id, "total_kerberos", totalKerberos, - "total_ntlm", totalNtlm, "analysis_start_time", startTime, "analysis_end_time", - endTime, "detection_start_time", startNTLMTime, "detection_end_time", endNTLMTime]) - - | into write_ssa_detected_events();' -how_to_implement: You must be ingesting Windows Security logs from devices of interest - - at least from domain controllers. Please make sure that event ID 4624 is being - logged. -known_false_positives: Environments in which NTLM is used extremely rarely and for - benign purposes (such as a rare use of SMB shares). -references: -- https://attack.mitre.org/techniques/T1550/002/ -- https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/ -tags: - analytic_story: - - Active Directory Lateral Movement - asset_type: Windows - confidence: 80 - impact: 80 - message: Potential lateral movement and credential stealing via Pass the Token or - Pass the Hash techniques. Operation is performed via credentials of the account - $dest_user_id$ and observed by the logging device $origin_device_id$ - mitre_attack_id: - - T1550 - - T1550.002 - observable: - - name: dest_user_id - type: User - role: - - Actor - - name: origin_device_id - type: Hostname - role: - - Other - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - signature_id - - dest_user - - dest_user_id - - origin_device_id - - authentication_method - kill_chain_phases: - - Exploitation - risk_score: 64 - security_domain: endpoint diff --git a/ssa_detections/deprecated/ssa___unusual_lolbas_in_short_period_of_time.yml b/ssa_detections/deprecated/ssa___unusual_lolbas_in_short_period_of_time.yml deleted file mode 100644 index 923451333d..0000000000 --- a/ssa_detections/deprecated/ssa___unusual_lolbas_in_short_period_of_time.yml +++ /dev/null @@ -1,84 +0,0 @@ -name: Unusual LOLBAS in short period of time -id: 59c0dd70-169c-4900-9a1f-bfcf13302f93 -version: 2 -date: '2020-08-25' -author: Ignacio Bermudez Corrales, Splunk -status: deprecated -type: Anomaly -description: Attacker activity may compromise executing several LOLBAS applications - in conjunction to accomplish their objectives. We are looking for more than usual - LOLBAS applications over a window of time, by building profiles per machine. -data_source: -- Windows Security 4688 -search: ' | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, - "dest_device_id"), "string", null), process_name=lower(ucast(map_get(input_event, - "process_name"), "string", null)), timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)) | where process_name=="regsvcs.exe" OR process_name=="ftp.exe" - OR process_name=="dfsvc.exe" OR process_name=="rasautou.exe" OR process_name=="schtasks.exe" - OR process_name=="xwizard.exe" OR process_name=="findstr.exe" OR process_name=="esentutl.exe" - OR process_name=="cscript.exe" OR process_name=="reg.exe" OR process_name=="csc.exe" - OR process_name=="atbroker.exe" OR process_name=="print.exe" OR process_name=="pcwrun.exe" - OR process_name=="vbc.exe" OR process_name=="rpcping.exe" OR process_name=="wsreset.exe" - OR process_name=="ilasm.exe" OR process_name=="certutil.exe" OR process_name=="replace.exe" - OR process_name=="mshta.exe" OR process_name=="bitsadmin.exe" OR process_name=="wscript.exe" - OR process_name=="ieexec.exe" OR process_name=="cmd.exe" OR process_name=="microsoft.workflow.compiler.exe" - OR process_name=="runscripthelper.exe" OR process_name=="makecab.exe" OR process_name=="forfiles.exe" - OR process_name=="desktopimgdownldr.exe" OR process_name=="control.exe" OR process_name=="msbuild.exe" - OR process_name=="register-cimprovider.exe" OR process_name=="tttracer.exe" OR process_name=="ie4uinit.exe" - OR process_name=="sc.exe" OR process_name=="bash.exe" OR process_name=="hh.exe" - OR process_name=="cmstp.exe" OR process_name=="mmc.exe" OR process_name=="jsc.exe" - OR process_name=="scriptrunner.exe" OR process_name=="odbcconf.exe" OR process_name=="extexport.exe" - OR process_name=="msdt.exe" OR process_name=="diskshadow.exe" OR process_name=="extrac32.exe" - OR process_name=="eventvwr.exe" OR process_name=="mavinject.exe" OR process_name=="regasm.exe" - OR process_name=="gpscript.exe" OR process_name=="rundll32.exe" OR process_name=="regsvr32.exe" - OR process_name=="regedit.exe" OR process_name=="msiexec.exe" OR process_name=="gfxdownloadwrapper.exe" - OR process_name=="presentationhost.exe" OR process_name=="regini.exe" OR process_name=="wmic.exe" - OR process_name=="runonce.exe" OR process_name=="syncappvpublishingserver.exe" OR - process_name=="verclsid.exe" OR process_name=="psr.exe" OR process_name=="infdefaultinstall.exe" - OR process_name=="explorer.exe" OR process_name=="expand.exe" OR process_name=="installutil.exe" - OR process_name=="netsh.exe" OR process_name=="wab.exe" OR process_name=="dnscmd.exe" - OR process_name=="at.exe" OR process_name=="pcalua.exe" OR process_name=="cmdkey.exe" - OR process_name=="msconfig.exe" | stats count(process_name) as lolbas_counter by - device,span(timestamp, 300s) | eval lolbas_counter=lolbas_counter*1.0 | rename window_end - as timestamp | adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device" - window=2419200000L | where label AND quantile>0.99 | eval start_time = window_start, - end_time = timestamp, entities = mvappend(device), body=create_map(["lolbas_counter", - lolbas_counter, "quantile", quantile, "device", device]) | into write_ssa_detected_events();' -how_to_implement: Collect endpoint data such as sysmon or 4688 events. -known_false_positives: 'Some administrative tasks may involve multiple use of LOLBAS - applications in a short period of time. This might trigger false positives at the - beginning when it hasn''t collected yet enough data to construct the baseline. - - ' -references: -- https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries -tags: - analytic_story: - - Unusual Processes - asset_type: Endpoint - confidence: 50 - impact: 50 - message: A system process $process_name$ with commandline $cmd_line$ spawn iin short - period of time in host $dest_device_id$ - mitre_attack_id: - - T1059 - - T1053 - observable: - - name: dest_device_id - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Other - product: - - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - _time - - process_name - kill_chain_phases: - - Exploitation - risk_score: 25 - security_domain: endpoint diff --git a/ssa_detections/deprecated/ssa___unusually_long_command_line.yml b/ssa_detections/deprecated/ssa___unusually_long_command_line.yml deleted file mode 100644 index a19cff5bcd..0000000000 --- a/ssa_detections/deprecated/ssa___unusually_long_command_line.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Unusually Long Command Line -id: 58f43aba-1775-445e-b19c-be2b87d83ae3 -version: 1 -date: '2020-10-06' -author: Ignacio Bermudez Corrales, Splunk -status: deprecated -type: Anomaly -description: Command lines that are extremely long may be indicative of malicious - activity on your hosts. This search leverages the Splunk Streaming ML DSP plugin - to help identify command lines with lengths that are unusual for a given user. This - detection is inspired on Unusually Long Command Line authored by Rico Valdez. -data_source: -- Windows Security 4688 -search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)) | eval cmd_line=ucast(map_get(input_event, "process"), - "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", - null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), - process_name=ucast(map_get(input_event, "process_name"), "string", null), event_id=ucast(map_get(input_event, - "event_id"), "string", null) | where cmd_line!=null and dest_user_id!=null | eval - cmd_line_norm=replace(cast(cmd_line, "string"), /\s(--?\w+)|(\/\w+)/, " ARG"), cmd_line_norm=replace(cmd_line_norm, - /\w:\\[^\s]+/, "PATH"), cmd_line_norm=replace(cmd_line_norm, /\d+/, "N"), input=parse_double(len(coalesce(cmd_line_norm, - ""))) | select timestamp, process_name, dest_device_id, dest_user_id, cmd_line, - input | adaptive_threshold algorithm="quantile" entity="process_name" window=60480000 - | where label AND quantile>0.99 | first_time_event input_columns=["dest_device_id", - "cmd_line"] | where first_time_dest_device_id_cmd_line | eval start_time = timestamp, - end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map(["event_id", - event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' -how_to_implement: You must be ingesting sysmon endpoint data that monitors command - lines. -known_false_positives: This detection may flag suspiciously long command lines when - there is not sufficient evidence (samples) for a given process that this detection - is tracking; or when there is high variability in the length of the command line - for the tracked process. Also, some legitimate applications may use long command - lines. Such is the case of Ansible, that encodes Powershell scripts using long base64. - Attackers may use this technique to obfuscate their payloads. -references: [] -tags: - analytic_story: - - Unusual Processes - asset_type: Endpoint - confidence: 40 - impact: 30 - message: A process $process_name$ with a long commandline $cmd_line$ executed in - host $dest_device_id$ - observable: - - name: dest_device_id - type: Hostname - role: - - Victim - - name: dest_user_id - type: User - role: - - Victim - product: - - Splunk Behavioral Analytics - required_fields: - - process_name - - _time - - dest_device_id - - dest_user_id - - process - kill_chain_phases: - - Actions on Objectives - risk_score: 12 - security_domain: endpoint diff --git a/ssa_detections/endpoint/ssa___anomalous_usage_of_account_credentials.yml b/ssa_detections/endpoint/ssa___anomalous_usage_of_account_credentials.yml deleted file mode 100644 index 1c4f3f48a7..0000000000 --- a/ssa_detections/endpoint/ssa___anomalous_usage_of_account_credentials.yml +++ /dev/null @@ -1,51 +0,0 @@ -name: Anomalous Usage of Account Credentials -id: 629cbf9e-5785-11ec-9611-acde48001122 -version: 1 -date: '2021-12-07' -author: Lou Stella, Splunk -status: experimental -type: Anomaly -description: This is an anomaly generating detection looking for multiple interactive - logins within a specific time period. An insider threat may attempt to steal colleagues - credentials in low tech, undetectable methods, in order to gain access to additional - information or to hide their own behavior. This should capture their attempted use - of those credentials on a workstation. -data_source: -- Windows Security 4624 -search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, - "dest_device_id"), "string", null), auth_type=ucast(map_get(input_event, "authentication_type"), - "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", - null)), src_user=ucast(map_get(input_event, "dest_user_original_artifact"), "string", - null), signature_id=ucast(map_get(input_event, "EventCode"), "string", null) | where - signature_id="4624" | where auth_type="2" OR auth_type="11" | where NOT (src_user="SYSTEM") - AND NOT (src_user="ANONYMOUS LOGON") | stats estdc(src_user) AS user_counter by - device, span(timestamp, 600s, 300s) | where user_counter>=2 | rename window_end - AS timestamp | eval start_time=window_start, end_time=timestamp, entities=mvappend(device), - body=create_map(["user_counter", user_counter, "device", device]) | into write_ssa_detected_events();' -how_to_implement: To successfully implement this detection, you need to be ingesting - logon events from workstations. -known_false_positives: Shared workstations can cause false positives -references: -- https://attack.mitre.org/techniques/T1078/002/ -tags: - analytic_story: - - Insider Threat - asset_type: Endpoint - confidence: 30 - impact: 20 - message: Multiple interactive logins detected on $device$ - mitre_attack_id: - - T1078.002 - observable: - - name: device - type: Hostname - role: - - Victim - product: - - Splunk Behavioral Analytics - required_fields: - - _time - kill_chain_phases: - - Exploitation - risk_score: 6 - security_domain: access diff --git a/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml b/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml deleted file mode 100644 index 6d2b17022e..0000000000 --- a/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml +++ /dev/null @@ -1,99 +0,0 @@ -name: Anomalous usage of Archive Tools -id: 63614a58-10e2-4c6c-ae81-ea1113681439 -version: 4 -date: '2021-11-22' -author: Patrick Bareiss, Splunk -type: Anomaly -status: production -description: The following detection identifies the usage of archive tools from the - command line. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_file_name="winrar.exe" - OR process_file_name LIKE "7z%" OR process_file_name LIKE "winzip%") AND (actor_process_file_name - LIKE "%powershell.exe" OR actor_process_file_name LIKE "%cmd.exe") --finding_report--' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: False positives can be ligitmate usage of archive tools from - the command line. -references: -- https://attack.mitre.org/techniques/T1560/001/ -tags: - analytic_story: - - Cobalt Strike - - NOBELIUM Group - - Insider Threat - asset_type: Endpoint - confidence: 60 - impact: 70 - mitre_attack_id: - - T1560.001 - - T1560 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading - of 7zip. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 42 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_tools/windows-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___attacker_tools_on_endpoint.yml b/ssa_detections/endpoint/ssa___attacker_tools_on_endpoint.yml deleted file mode 100644 index bb1374ab9c..0000000000 --- a/ssa_detections/endpoint/ssa___attacker_tools_on_endpoint.yml +++ /dev/null @@ -1,134 +0,0 @@ -name: Attacker Tools On Endpoint -id: 241b1159-cf78-4201-8fad-1c21c3c96213 -version: 1 -date: '2024-03-19' -author: Patrick Bareiss, Splunk -type: TTP -status: validation -description: The following analytic detects the use of tools that are commonly exploited - by cybercriminals since these tools are usually associated with malicious activities - such as unauthorized access, network scanning, or data exfiltration and pose a significant - threat to an organization's security infrastructure. It also provides enhanced visibility - into potential security threats and helps to proactively detect and respond to mitigate - the risks associated with cybercriminal activities. This detection is made by examining - the process activity on the host, specifically focusing on processes that are known - to be associated with attacker tool names. This detection is important because it - acts as an early warning system for potential security incidents that allows you - to respond to security incidents promptly. False positives might occur due to legitimate - administrative activities that can resemble malicious actions. You must develop - a comprehensive understanding of typical endpoint activities and behaviors within - the organization to accurately interpret and respond to the alerts generated by - this analytic. This ensures a proper balance between precision and minimizing false - positives. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_cmd_line LIKE "%adrecon%" - OR process_cmd_line LIKE "%adcollector%" OR process_cmd_line LIKE "%nmap%" OR process_cmd_line - LIKE "%pingcastle%" OR process_cmd_line LIKE "%sharphound%" OR process_cmd_line - LIKE "%aclight%" OR process_cmd_line LIKE "%adaclscan%" OR process_cmd_line LIKE - "%liza%" OR process_cmd_line LIKE "%lapstoolkit%" OR process_cmd_line LIKE "%rubeus%" - OR process_cmd_line LIKE "%passthecert%" OR process_cmd_line LIKE "%responder%" - OR process_cmd_line LIKE "%inveigh%" OR process_cmd_line LIKE "%hydra%" OR process_cmd_line - LIKE "%mimikatz%" OR process_cmd_line LIKE "%sharpkatz%" OR process_cmd_line LIKE - "%nanodump%" OR process_cmd_line LIKE "%powersploit%" OR process_cmd_line LIKE "%powersharppack%" - OR process_cmd_line LIKE "%privesccheck%" OR process_cmd_line LIKE "%seatbelt%" - OR process_cmd_line LIKE "%krbrelayup%" OR process_cmd_line LIKE "%sharpimpersonation%" - OR process_cmd_line LIKE "%tokenvator%" OR process_cmd_line LIKE "%bloodyad%" OR - process_cmd_line LIKE "%nimcrypt%" OR process_cmd_line LIKE "%protectmytooling%" - OR process_cmd_line LIKE "%invoke-obfuscation%" OR process_cmd_line LIKE "%chameleon%" - OR process_cmd_line LIKE "%covenant%" --finding_report--' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: Some administrator activity can be potentially triggered, please - add those users to the filter macro. -references: -- https://github.com/Jean-Francois-C/Windows-Penetration-Testing -tags: - analytic_story: - - Monitor for Unauthorized Software - - XMRig - - SamSam Ransomware - - Unusual Processes - - CISA AA22-264A - asset_type: Endpoint - confidence: 80 - impact: 80 - mitre_attack_id: - - T1036.005 - - T1036 - - T1003 - - T1595 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An attacker tool $process_name$,listed in attacker_tools.csv is executed - on host $dest$ by User $user$. This process $process_name$ is known to do- $description$ - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 64 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1595/attacker_scan_tools/windows-security.log - source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___attempt_to_delete_services.yml b/ssa_detections/endpoint/ssa___attempt_to_delete_services.yml deleted file mode 100644 index ad534a031c..0000000000 --- a/ssa_detections/endpoint/ssa___attempt_to_delete_services.yml +++ /dev/null @@ -1,102 +0,0 @@ -name: Attempt To Delete Services -id: a0c8c292-d01a-11eb-aa18-acde48001122 -version: 6 -date: '2021-11-24' -author: Teoderick Contreras, splunk -type: TTP -status: production -description: The following analytic identifies Windows Service Control, `sc.exe`, - attempting to delete a service. This is typically identified in parallel with other - instances of service enumeration of attempts to stop a service and then delete it. - Adversaries utilize this technique to terminate security services or other related - services to continue there objective and evade detections. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_file_name="sc.exe" AND - process_cmd_line LIKE "%delete%" --finding_report--' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: It is possible administrative scripts may start/stop/delete - services. Filter as needed. -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md -tags: - analytic_story: - - XMRig - - Ransomware - asset_type: Endpoint - confidence: 60 - impact: 60 - mitre_attack_id: - - T1489 - - T1543 - - T1543.003 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a service. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 36 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_del.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___attempt_to_disable_services.yml b/ssa_detections/endpoint/ssa___attempt_to_disable_services.yml deleted file mode 100644 index a65d0f22ac..0000000000 --- a/ssa_detections/endpoint/ssa___attempt_to_disable_services.yml +++ /dev/null @@ -1,101 +0,0 @@ -name: Attempt To Disable Services -id: afb31de4-d023-11eb-98d5-acde48001122 -version: 6 -date: '2021-11-24' -author: Teoderick Contreras, Splunk -type: TTP -status: production -description: The following analytic identifies Windows Service Control, `sc.exe`, - attempting to disable a service. This is typically identified in parallel with other - instances of service enumeration of attempts to stop a service and then disable - it. Adversaries utilize this technique to terminate security services or other related - services to continue there objective and evade detections. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_cmd_line LIKE "%config%" - AND process_cmd_line LIKE "%disabled%" AND process_file_name="sc.exe" --finding_report--' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: It is possible administrative scripts may start/stop/delete - services. Filter as needed. -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service -tags: - analytic_story: - - XMRig - - Ransomware - asset_type: Endpoint - confidence: 60 - impact: 60 - mitre_attack_id: - - T1489 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable a service. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 36 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_disable.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml deleted file mode 100644 index 04f6bee8f1..0000000000 --- a/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ /dev/null @@ -1,101 +0,0 @@ -name: Attempted Credential Dump From Registry via Reg exe -id: 14038953-e5f2-4daf-acff-5452062baf03 -version: 7 -date: '2021-11-29' -author: Jose Hernandez, Splunk -type: TTP -status: production -description: The following analytic identifies the use of `reg.exe` attempting to - export Windows registry keys that contain hashed credentials. Adversaries will utilize - this technique to capture and perform offline password cracking. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_file_name IN ("reg.exe", - "cmd.exe")) AND (match(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true - OR match(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR match(process_cmd_line, - /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match(process_cmd_line, /(?i)HKLM\\System/)=true - OR match(process_cmd_line, /(?i)HKLM\\SAM/)=true OR match(process_cmd_line, /(?i)HKLM\\Security/)=true) - AND match(process_cmd_line, /(?i)save/)=true --finding_report--' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: None identified. -references: -- https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets -tags: - analytic_story: - - Credential Dumping - asset_type: Endpoint - confidence: 90 - impact: 70 - mitre_attack_id: - - T1003 - - T1003.002 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An attempt to save registry keys storing credentials has been performed - on - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 63 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml b/ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml deleted file mode 100644 index 76506c749c..0000000000 --- a/ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml +++ /dev/null @@ -1,98 +0,0 @@ -name: BCDEdit Failure Recovery Modification -id: 76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13 -version: 4 -date: '2021-12-07' -author: Michael Haag, Splunk -type: TTP -status: production -description: This search looks for flags passed to bcdedit.exe modifications to the - built-in Windows error recovery boot configurations. This is typically used by ransomware - to prevent recovery. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_file_name="bcdedit.exe" - AND (process_cmd_line LIKE "%no%" AND process_cmd_line LIKE "%recoveryenabled%") - --finding_report--' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint_Processess` datamodel. -known_false_positives: Administrators may modify the boot configuration. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair -tags: - analytic_story: - - Ryuk Ransomware - - Ransomware - - Information Sabotage - asset_type: Endpoint - confidence: 80 - impact: 100 - mitre_attack_id: - - T1490 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting disable the ability - to recover the endpoint. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 80 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-security_bcdedit_wbadmin.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml b/ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml deleted file mode 100644 index 54cda3214d..0000000000 --- a/ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml +++ /dev/null @@ -1,98 +0,0 @@ -name: Clear Unallocated Sector Using Cipher App -id: 8f907d90-6173-11ec-9c23-acde48001122 -version: 4 -date: '2021-12-20' -author: Teoderick Contreras, Splunk -type: TTP -status: production -description: this search is to detect execution of `cipher.exe` to clear the unallocated - sectors of a specific disk. This technique was seen in some ransomware to make it - impossible to forensically recover deleted files. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_file_name="cipher.exe" - AND process_cmd_line LIKE "%/w:%" --finding_report--' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: administrator may execute this app to manage disk -references: -- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/ -- https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf -tags: - analytic_story: - - Ransomware - - Information Sabotage - asset_type: Endpoint - confidence: 100 - impact: 90 - mitre_attack_id: - - T1070.004 - - T1070 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors - of a specific disk. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 90 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.004/cipher/security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___create_local_admin_accounts_using_net_exe.yml b/ssa_detections/endpoint/ssa___create_local_admin_accounts_using_net_exe.yml deleted file mode 100644 index e87037c202..0000000000 --- a/ssa_detections/endpoint/ssa___create_local_admin_accounts_using_net_exe.yml +++ /dev/null @@ -1,117 +0,0 @@ -name: Create Local Admin Accounts Using Net Exe -id: 890f0937-5a83-48fb-b793-68f792ded5db -version: 3 -date: '2023-10-23' -author: Teoderick Contreras, Splunk -type: Anomaly -status: production -description: The following analytic detects the creation of local administrator accounts - using the net.exe command to mitigate the risks associated with unauthorized access - and prevent further damage to the environment by responding to potential threats - earlier and taking appropriate actions to protect the organization's systems and - data. This detection is made by a Splunk query to search for processes with the - name net.exe or net1.exe that include the "/add" parameter and have specific keywords - related to administrator accounts in their process name. This detection is important - because the creation of unauthorized local administrator accounts might indicate - that an attacker has successfully created a new administrator account and is trying - to gain persistent access to a system or escalate their privileges for data theft, - or other malicious activities. False positives might occur since there might be - legitimate uses of the net.exe command and the creation of administrator accounts - in certain circumstances. You must consider the context of the activity and other - indicators of compromise before taking any action. For next steps, review the details - of the identified process, including the user, parent process, and parent process - name. Examine any relevant on-disk artifacts and look for concurrent processes to - determine the source of the attack. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_cmd_line LIKE "%localgroup%" - AND process_cmd_line LIKE "%/add%" AND (process_cmd_line LIKE "%administrators%" - OR process_cmd_line LIKE "%administratoren%" OR process_cmd_line LIKE "%administrateurs%" - OR process_cmd_line LIKE "%administrador%" OR process_cmd_line LIKE "%amministratori%" - OR process_cmd_line LIKE "%administratorer%") AND (process_file_name IN ("net.exe", - "net1.exe")) --finding_report--' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed net.exe may be used. -known_false_positives: System administrators or scripts may add user accounts via - this technique. Filter as needed. -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -tags: - analytic_story: - - XMRig - - Ransomware - asset_type: Endpoint - confidence: 60 - impact: 50 - mitre_attack_id: - - T1136.001 - - T1136 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators - group. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 30 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/net_create_user/net_user_security.log - source: XmlWinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___create_local_user_accounts_using_net_exe.yml b/ssa_detections/endpoint/ssa___create_local_user_accounts_using_net_exe.yml deleted file mode 100644 index 0e1b300e9e..0000000000 --- a/ssa_detections/endpoint/ssa___create_local_user_accounts_using_net_exe.yml +++ /dev/null @@ -1,112 +0,0 @@ -name: Create Local User Accounts Using Net Exe -id: 3e66edb4-b4dc-4b65-b57f-779a88d7d1d9 -version: 6 -date: '2023-10-23' -author: Teoderick Contreras, Mauricio Velazco, Splunk -type: Anomaly -status: production -description: The following analytic detects the creation of local administrator accounts - using the net.exe command to mitigate the risks associated with unauthorized access - and prevent further damage to the environment by responding to potential threats - earlier and taking appropriate actions to protect the organization's systems and - data. This detection is made by a Splunk query to search for processes with the - name net.exe or net1.exe that include the "/add" parameter in their process name. - This detection is important because the creation of unauthorized local user accounts - might indicate that an attacker has successfully created a new user account and - is trying to gain persistent access to a system or escalate their privileges for - data theft, or other malicious activities. False positives might occur since there - might be legitimate uses of the net.exe command and the creation of user accounts - in certain circumstances. You must consider the context of the activity and other - indicators of compromise before taking any action. For next steps, review the details - of the identified process, including the user, parent process, and parent process - name. Examine any relevant on-disk artifacts and look for concurrent processes to - determine the source of the attack. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_cmd_line LIKE "%user%" - AND process_cmd_line LIKE "%/add%" AND (process_file_name IN ("net.exe", "net1.exe")) - --finding_report--' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed net.exe may be used. -known_false_positives: System administrators or scripts may add user accounts via - this technique. Filter as needed. -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -tags: - analytic_story: - - XMRig - - Ransomware - asset_type: Endpoint - confidence: 30 - impact: 30 - mitre_attack_id: - - T1136.001 - - T1136 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to add a user to the local group. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 9 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/net_create_user/net_user_security.log - source: XmlWinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___delete_a_net_user.yml b/ssa_detections/endpoint/ssa___delete_a_net_user.yml deleted file mode 100644 index 8ebd9665ed..0000000000 --- a/ssa_detections/endpoint/ssa___delete_a_net_user.yml +++ /dev/null @@ -1,104 +0,0 @@ -name: Delete A Net User -id: 8776d79c-d26e-11eb-9a56-acde48001122 -version: 8 -date: '2022-03-17' -author: Teoderick Contreras, Splunk -type: Anomaly -status: production -description: This analytic will detect a suspicious net.exe/net1.exe command-line - to delete a user on a system. This technique may be use by an administrator for - legitimate purposes, however this behavior has been used in the wild to impair some - user or deleting adversaries tracks created during its lateral movement additional - systems. During triage, review parallel processes for additional behavior. Identify - any other user accounts created before or after. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_cmd_line LIKE "%user%" - AND process_cmd_line LIKE "%/delete%" AND (process_file_name IN ("net.exe", "net1.exe")) - --finding_report--' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed net.exe may be used. -known_false_positives: System administrators or scripts may delete user accounts via - this technique. Filter as needed. -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -tags: - analytic_story: - - XMRig - - Ransomware - asset_type: Endpoint - confidence: 70 - impact: 70 - mitre_attack_id: - - T1531 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a user - account. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 49 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_del.log - source: WinEventLog:Security - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/atomic_red_team/security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___deleting_shadow_copies.yml b/ssa_detections/endpoint/ssa___deleting_shadow_copies.yml deleted file mode 100644 index 68fbcc839a..0000000000 --- a/ssa_detections/endpoint/ssa___deleting_shadow_copies.yml +++ /dev/null @@ -1,103 +0,0 @@ -name: Deleting Shadow Copies -id: 19c85f5e-24a5-4355-a430-db9a58d1dc15 -version: 5 -date: '2023-10-03' -author: Bhavin Patel, Splunk -type: TTP -status: production -description: The vssadmin.exe utility is used to interact with the Volume Shadow Copy - Service. Wmic is an interface to the Windows Management Instrumentation. This search - looks for either of these tools being used to delete shadow copies. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_file_name IN ("vssadmin.exe", - "wmic.exe")) AND process_cmd_line LIKE "%delete%" AND process_cmd_line LIKE "%shadow%" - --finding_report--' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. -known_false_positives: System administrators may resize the shadowstorage for valid - purposes. Filter as needed. -references: -- https://atomicredteam.io/impact/T1490/ -- https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html -tags: - analytic_story: - - Clop Ransomware - - Ransomware - asset_type: Endpoint - confidence: 80 - impact: 80 - mitre_attack_id: - - T1490 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of shadow copy was deleted was deleted using command line - $process.cmd_line$ - with process name `vssadmin.exe` or `wmic.exe` on host machine - $device.hostname$ - by user $actor.user.name$. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 64 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/4688_xml_windows_security_delete_shadow.log - source: XmlWinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml b/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml deleted file mode 100644 index 7938e48e05..0000000000 --- a/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml +++ /dev/null @@ -1,98 +0,0 @@ -name: Deny Permission using Cacls Utility -id: b76eae28-cd25-11eb-9c92-acde48001122 -version: 7 -date: '2021-11-29' -author: Teoderick Contreras, Splunk -type: TTP -status: production -description: The following analytic identifies the use of `cacls.exe`, `icacls.exe` - or `xcacls.exe` placing the deny permission on a file or directory. Adversaries - perform this behavior to prevent responders from reviewing or gaining access to - adversary files on disk. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_file_name IN ("icacls.exe", - "xcacls.exe", "cacls.exe")) AND match(process_cmd_line, /(?i)deny/)=true --finding_report--' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. -known_false_positives: System administrators may use cacls utilities but this is not - a common practice. Filter as needed. -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -tags: - analytic_story: - - XMRig - - Information Sabotage - asset_type: Endpoint - confidence: 70 - impact: 50 - mitre_attack_id: - - T1222 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: A cacls process $process_name$ with commandline $process$ try to deny a - permission of a file or directory in host $dest_device_id$ - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 35 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___detect_kerberoasting.yml b/ssa_detections/endpoint/ssa___detect_kerberoasting.yml deleted file mode 100644 index c31a5bb99b..0000000000 --- a/ssa_detections/endpoint/ssa___detect_kerberoasting.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Detect Kerberoasting -id: dabdd6d7-3e10-42be-8711-4e124f7a3850 -version: 2 -date: '2020-10-21' -author: Xiao Lin, Splunk -status: experimental -type: TTP -description: This search detects a potential kerberoasting attack via service principal - name requests -data_source: -- Windows Security 4769 -search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_time"), - EventCode=map_get(input_event, "event_code"), TicketOptions=map_get(input_event, - "ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"), - ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event, - "service_id"), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", - null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), - event_id=ucast(map_get(input_event, "event_id"), "string", null) | where EventCode="4769" - AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" | first_time_event - input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"] - | where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID - | eval start_time=_time, end_time=_time | eval body=create_map(["event_id", event_id, - "EventCode", EventCode, "ServiceName", ServiceName, "TicketOptions", TicketOptions, - "TicketEncryptionType", TicketEncryptionType]), entities = mvappend(ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)) | select start_time, end_time, entities, body | into write_ssa_detected_events();' -how_to_implement: The test data is converted from Windows Security Event logs generated - from Attach Range simulation and used in SPL search and extended to SPL2 -known_false_positives: Older systems that support kerberos RC4 by default NetApp may - generate false positives -references: -- Initial ESCU implementation by Jose Hernandez and Patrick Bareiss -tags: - analytic_story: - - Credential Dumping - asset_type: Endpoint - confidence: 20 - impact: 70 - message: Kerberoasting malware is potentially applying stolen credentials. Operation - is performed at the device $dest_device_id$, by the account $dest_user_id$ via - command $cmd_line$ - mitre_attack_id: - - T1558.003 - - T1558 - observable: - - name: dest_user_id - type: User - role: - - Actor - - name: dest_device_id - type: Hostname - role: - - Victim - - name: cmd_line - type: Process - role: - - Other - product: - - Splunk Behavioral Analytics - required_fields: - - service_name - - _time - - event_code - - ticket_encryption_type - - service_id - - ticket_options - kill_chain_phases: - - Actions on Objectives - risk_score: 14 - security_domain: endpoint diff --git a/ssa_detections/endpoint/ssa___detect_powershell_applications_spawning_cmd_exe.yml b/ssa_detections/endpoint/ssa___detect_powershell_applications_spawning_cmd_exe.yml deleted file mode 100644 index ea403f736c..0000000000 --- a/ssa_detections/endpoint/ssa___detect_powershell_applications_spawning_cmd_exe.yml +++ /dev/null @@ -1,97 +0,0 @@ -name: Detect PowerShell Applications Spawning cmd exe -id: d20a18cb-fd70-4ffa-a844-25126e0b0d94 -version: 3 -date: '2023-12-11' -author: Lou Stella, Splunk -type: Anomaly -status: production -description: The following analytic identifies parent processes that are powershell, - spawning cmd.exe. By its very nature, many applications spawn cmd.exe natively or - built into macros. Much of this will need to be tuned to further enhance the risk. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = lower(actor_process_file.name) - | eval device_hostname = device.hostname | where (actor_process_file_name IN ("powershell.exe", - "pwsh.exe")) AND process_file_name="cmd.exe" --finding_report--' -how_to_implement: In order to successfully implement this analytic, you will need - endpoint process data from a EDR product or Sysmon. This search has been modified - to process raw sysmon data from attack_range's nxlogs on DSP. -known_false_positives: There are circumstances where an application may legitimately - execute and interact with the Windows command-line interface. -references: -- https://attack.mitre.org/techniques/T1059/ -tags: - analytic_story: - - Suspicious Command-Line Executions - - Insider Threat - asset_type: Endpoint - confidence: 50 - impact: 70 - mitre_attack_id: - - T1059 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event - that warrants investigating. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 35 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml deleted file mode 100644 index d528661fbe..0000000000 --- a/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ /dev/null @@ -1,102 +0,0 @@ -name: Detect Prohibited Applications Spawning cmd exe -id: c10a18cb-fd80-4ffa-a844-25026e0a0c94 -version: 6 -date: '2022-03-01' -author: Ignacio Bermudez Corrales, Splunk -type: Anomaly -status: deprecated -description: The following analytic identifies parent processes, browsers, Windows - terminal applications, Office Products and Java spawning cmd.exe. By its very nature, - many applications spawn cmd.exe natively or built into macros. Much of this will - need to be tuned to further enhance the risk. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = lower(process.cmd_line) | eval actor_user = actor.user | eval actor_user_name - = actor_user.name | eval actor_process = actor.process | eval actor_process_pid - = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path - = actor_process_file.path | eval actor_process_file_name = lower(actor_process_file.name) - | eval device_hostname = device.hostname | where ((actor_process_file_name IN ("winword.exe", - "excel.exe", "outlook.exe", "acrobat.exe", "acrord32.exe", "iexplore.exe", "opera.exe", - "firefox.exe", "powershell.exe")) OR (actor_process_file_name="java.exe" AND (NOT - match(actor_process_file_name, /(?i)patch1-Hotfix1a/)=true)) OR (actor_process_file_name="chrome.exe" - AND (NOT process_cmd_line="chrome-extension"))) AND process_file_name="cmd.exe" - --finding_report--' -how_to_implement: In order to successfully implement this analytic, you will need - endpoint process data from a EDR product or Sysmon. This search has been modified - to process raw sysmon data from attack_range's nxlogs on DSP. -known_false_positives: There are circumstances where an application may legitimately - execute and interact with the Windows command-line interface. -references: -- https://attack.mitre.org/techniques/T1059/ -tags: - analytic_story: - - Suspicious Command-Line Executions - - Insider Threat - asset_type: Endpoint - confidence: 50 - impact: 70 - mitre_attack_id: - - T1059 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event - that warrants investigating. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 35 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___detect_prohibited_browsers_spawning_cmd_exe.yml b/ssa_detections/endpoint/ssa___detect_prohibited_browsers_spawning_cmd_exe.yml deleted file mode 100644 index abb9de0f6f..0000000000 --- a/ssa_detections/endpoint/ssa___detect_prohibited_browsers_spawning_cmd_exe.yml +++ /dev/null @@ -1,98 +0,0 @@ -name: Detect Prohibited Browsers Spawning cmd exe -id: c10a18cb-fa70-4dfa-a944-25026e1b0c94 -version: 8 -date: '2023-12-11' -author: Lou Stella, Splunk -type: Anomaly -status: production -description: The following analytic identifies parent processes that are browsers, - spawning cmd.exe. By its very nature, many applications spawn cmd.exe natively or - built into macros. Much of this will need to be tuned to further enhance the risk. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = lower(process.cmd_line) | eval actor_user = actor.user | eval actor_user_name - = actor_user.name | eval actor_process = actor.process | eval actor_process_pid - = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path - = actor_process_file.path | eval actor_process_file_name = lower(actor_process_file.name) - | eval device_hostname = device.hostname | where ((actor_process_file_name IN ("iexplore.exe", - "opera.exe", "firefox.exe")) OR (actor_process_file_name="chrome.exe" AND (NOT process_cmd_line="chrome-extension"))) - AND process_file_name="cmd.exe" --finding_report--' -how_to_implement: In order to successfully implement this analytic, you will need - endpoint process data from a EDR product or Sysmon. This search has been modified - to process raw sysmon data from attack_range's nxlogs on DSP. -known_false_positives: There are circumstances where an application may legitimately - execute and interact with the Windows command-line interface. -references: -- https://attack.mitre.org/techniques/T1059/ -tags: - analytic_story: - - Suspicious Command-Line Executions - - Insider Threat - asset_type: Endpoint - confidence: 50 - impact: 70 - mitre_attack_id: - - T1059 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event - that warrants investigating. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 35 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/ssa_validation/browsers/windows-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___detect_prohibited_office_applications_spawning_cmd_exe.yml b/ssa_detections/endpoint/ssa___detect_prohibited_office_applications_spawning_cmd_exe.yml deleted file mode 100644 index 924f933e62..0000000000 --- a/ssa_detections/endpoint/ssa___detect_prohibited_office_applications_spawning_cmd_exe.yml +++ /dev/null @@ -1,99 +0,0 @@ -name: Detect Prohibited Office Applications Spawning cmd exe -id: c10a18cb-fd70-44fb-a8f4-25026a0b0c94 -version: 3 -date: '2023-12-11' -author: Lou Stella, Splunk -type: Anomaly -status: production -description: The following analytic identifies parent processes that are office/productivity - applications, spawning cmd.exe. By its very nature, many applications spawn cmd.exe - natively or built into macros. Much of this will need to be tuned to further enhance - the risk. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = lower(actor_process_file.name) - | eval device_hostname = device.hostname | where (actor_process_file_name IN ("winword.exe", - "excel.exe", "outlook.exe", "powerpnt.exe", "acrobat.exe", "acrord32.exe")) AND - process_file_name="cmd.exe" --finding_report--' -how_to_implement: In order to successfully implement this analytic, you will need - endpoint process data from a EDR product or Sysmon. This search has been modified - to process raw sysmon data from attack_range's nxlogs on DSP. -known_false_positives: There are circumstances where an application may legitimately - execute and interact with the Windows command-line interface. -references: -- https://attack.mitre.org/techniques/T1059/ -tags: - analytic_story: - - Suspicious Command-Line Executions - - Insider Threat - asset_type: Endpoint - confidence: 50 - impact: 70 - mitre_attack_id: - - T1059 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event - that warrants investigating. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 35 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/ssa_validation/office/windows-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml b/ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml deleted file mode 100644 index dd56cc3e42..0000000000 --- a/ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml +++ /dev/null @@ -1,110 +0,0 @@ -name: Detect RClone Command-Line Usage -id: e8b74268-5454-11ec-a799-acde48001122 -version: 4 -date: '2021-12-03' -author: Michael Haag, Splunk -type: TTP -status: production -description: This analytic identifies commonly used command-line arguments used by - `rclone.exe` to initiate a file transfer. Some arguments were negated as they are - specific to the configuration used by adversaries. In particular, an adversary may - list the files or directories of the remote file share using `ls` or `lsd`, which - is not indicative of malicious behavior. During triage, at this stage of a ransomware - event, exfiltration is about to occur or has already. Isolate the endpoint and continue - investigating by review file modifications and parallel processes. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%--multi-thread-streams%" - OR process_cmd_line LIKE "%--transfers%" OR process_cmd_line LIKE "%--auto-confirm%" - OR process_cmd_line LIKE "%--ignore-existing%" OR process_cmd_line LIKE "%--no-check-certificate%" - OR process_cmd_line LIKE "%--progress%" OR process_cmd_line LIKE "%--config%" OR - process_cmd_line LIKE "%ftp%" OR process_cmd_line LIKE "%pcloud%" OR process_cmd_line - LIKE "%mega%" OR process_cmd_line LIKE "%copy%") AND process_file_name="rclone.exe" - --finding_report--' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint_Processess` datamodel. -known_false_positives: False positives should be limited as this is restricted to - the Rclone process name. Filter or tune the analytic as needed. -references: -- https://redcanary.com/blog/rclone-mega-extortion/ -- https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations -- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ -- https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/ -tags: - analytic_story: - - DarkSide Ransomware - - Ransomware - - Insider Threat - asset_type: Endpoint - confidence: 70 - impact: 50 - mitre_attack_id: - - T1020 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting to connect to a - remote cloud service to move files or folders. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 35 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___disable_defender_antivirus_registry.yml b/ssa_detections/endpoint/ssa___disable_defender_antivirus_registry.yml deleted file mode 100644 index 78ad39a86e..0000000000 --- a/ssa_detections/endpoint/ssa___disable_defender_antivirus_registry.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Disable Defender AntiVirus Registry -id: aa4f115a-3024-11ec-9987-acde48001122 -version: 1 -date: '2021-12-08' -author: Bhavin Patel, Splunk -status: experimental -type: TTP -description: This particular behavior is typically executed when an adversaries or - malware gains access to an endpoint and beings to perform execution and to evade - detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled - task modifications will occur. During triage, review parallel processes and identify - any further file modifications. Endpoint should be isolated. -data_source: -- Sysmon Event ID 13 -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"), - "string", null)), registry_path=lower(ucast(map_get(input_event, "registry_path"), - "string", null)), registry_key_name=lower(ucast(map_get(input_event, "registry_key_name"), - "string", null)), registry_value_data=ucast(map_get(input_event, "registry_value_data"), - "string", null), process_guid=ucast(map_get(input_event, "process_guid"), "string", - null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where - like(registry_path, "%\\Policies\\Microsoft\\Windows Defender%") AND registry_key_name="DisableAntiVirus" - AND registry_value_data="(0x00000001)" | eval start_time=timestamp, end_time=timestamp, - entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, - "dest_device_id"), "string", null)), body=create_map( [ "event_id", event_id, "registry_path", - registry_path, "registry_key_name", registry_key_name, "process_guid", process_guid,"registry_value_data",registry_value_data]) - | into write_ssa_detected_events();' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the registry value name, registry path, and registry value data from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Admin or user may choose to disable windows defender product -references: -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ -tags: - analytic_story: - - IcedID - asset_type: Endpoint - confidence: 70 - impact: 70 - message: Modified/added/deleted registry entry $registry_path$ in $dest$ - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - Registry.dest - - Registry.user - - Registry.registry_value_name - - Registry.registry_key_name - - Registry.registry_path - - Registry.registry_value_data - kill_chain_phases: - - Exploitation - risk_score: 49 - security_domain: endpoint diff --git a/ssa_detections/endpoint/ssa___disable_net_user_account.yml b/ssa_detections/endpoint/ssa___disable_net_user_account.yml deleted file mode 100644 index 076bdbd9b3..0000000000 --- a/ssa_detections/endpoint/ssa___disable_net_user_account.yml +++ /dev/null @@ -1,101 +0,0 @@ -name: Disable Net User Account -id: ba858b08-d26c-11eb-af9b-acde48001122 -version: 7 -date: '2021-11-30' -author: Teoderick Contreras, Splunk -type: TTP -status: production -description: This analytic will identify a suspicious command-line that disables a - user account using the native `net.exe` or `net1.exe` utility to Windows. This technique - may used by the adversaries to interrupt availability of accounts and continue the - impact against the organization. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_cmd_line LIKE "%user%" - AND process_cmd_line LIKE "%/active:no%" AND (process_file_name IN ("net.exe", "net1.exe")) - --finding_report--' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be - used. -known_false_positives: System administrators or automated scripts may disable an account - but not a common practice. Filter as needed. -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -tags: - analytic_story: - - XMRig - - Ransomware - asset_type: Endpoint - confidence: 70 - impact: 70 - mitre_attack_id: - - T1489 - - T1078 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable accounts. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 49 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_dis.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml b/ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml deleted file mode 100644 index 6bd609f70d..0000000000 --- a/ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml +++ /dev/null @@ -1,106 +0,0 @@ -name: DNS Exfiltration Using Nslookup App -id: 2452e632-9e0d-11eb-34ba-acde48001122 -version: 4 -date: '2021-12-07' -author: Michael Haag, Splunk -type: TTP -status: production -description: This search is to detect potential DNS exfiltration using nslookup application. - This technique are seen in couple of malware and APT group to exfiltrated collected - data in a infected machine or infected network. This detection is looking for unique - use of nslookup where it tries to use specific record type, TXT, A, AAAA, that are - commonly used by attacker and also the retry parameter which is designed to query - C2 DNS multiple tries. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%-retry=%" - OR process_cmd_line LIKE "%-type=%" OR process_cmd_line LIKE "%-q=%" OR process_cmd_line - LIKE "%-qt=%" OR process_cmd_line LIKE "%-querytype=%") AND process_file_name="nslookup.exe" - --finding_report--' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint_Processess` datamodel. -known_false_positives: It is possible for some legitimate administrative utilities - to use similar process parameters. Filter as needed. -references: -- https://www.mandiant.com/resources/fin7-spear-phishing-campaign-targets-personnel-involved-sec-filings -- https://www.varonis.com/blog/dns-tunneling -- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ -tags: - analytic_story: - - Suspicious DNS Traffic - - Dynamic DNS - - Data Exfiltration - - Command And Control - asset_type: Endpoint - confidence: 80 - impact: 90 - mitre_attack_id: - - T1048 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ performing activity related - to DNS exfiltration. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 72 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___excessive_number_of_office_files_copied.yml b/ssa_detections/endpoint/ssa___excessive_number_of_office_files_copied.yml deleted file mode 100644 index 4efbdff950..0000000000 --- a/ssa_detections/endpoint/ssa___excessive_number_of_office_files_copied.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Excessive Number of Office Files Copied -id: 3c6594a9-8df6-45a1-9357-d73b62083c63 -version: 1 -date: '2021-12-07' -author: Patrick Bareiss, Splunk -status: experimental -type: Anomaly -description: This detection detects a high amount of office file copied. This can - be an indicator for a malicious insider. -data_source: -- Sysmon Event ID 11 -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)) | eval action=ucast(map_get(input_event, "action"), "string", - null), process=ucast(map_get(input_event, "process"), "string", null), file_name=ucast(map_get(input_event, - "file_name"), "string", null), file_path=ucast(map_get(input_event, "file_path"), - "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", - null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) - | where "Endpoint_Filesystem" IN(_datamodels) | where action="created" | where like(file_name, - "%.doc%") OR like(file_name, "%.xls%") OR like(file_name, "%.ppt%") | stats count(file_name) - AS count BY dest_user_id, dest_device_id, span(timestamp, 10m) | where count > 20 - | eval start_time=window_start, end_time=window_end, entities=mvappend(dest_user_id, - dest_device_id), body=create_map(["count", count]) | into write_ssa_detected_events();' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Filesytem` node. -known_false_positives: user may copy a lot of office fies from one folder to another -references: [] -tags: - analytic_story: - - Insider Threat - asset_type: Endpoint - confidence: 80 - impact: 90 - message: High number of files copied - mitre_attack_id: - - T1048.003 - observable: - - name: dest_user_id - type: User - role: - - Actor - - name: dest_device_id - type: Hostname - role: - - Victim - product: - - Splunk Behavioral Analytics - required_fields: - - action - - process - - file_name - - file_path - kill_chain_phases: - - Exploitation - risk_score: 72 - security_domain: endpoint diff --git a/ssa_detections/endpoint/ssa___executable_file_written_in_administrative_smb_share.yml b/ssa_detections/endpoint/ssa___executable_file_written_in_administrative_smb_share.yml deleted file mode 100644 index 7541d60412..0000000000 --- a/ssa_detections/endpoint/ssa___executable_file_written_in_administrative_smb_share.yml +++ /dev/null @@ -1,112 +0,0 @@ -name: Executable File Written in Administrative SMB Share -id: d3bba9cb-c066-4e49-a81e-29eeb8e8506b -version: 1 -date: "2024-05-28" -author: Teoderick Contreras, Mauricio Velazco, Splunk -type: TTP -status: validation -description: - The following analytic identifies executable files (.exe or .dll) being - written to Windows administrative SMB shares (Admin$, IPC$, C$). This represents - suspicious behavior as its commonly used by tools like PsExec/PaExec and others - to stage service binaries before creating and starting a Windows service on remote - endpoints. Red Teams and adversaries alike may abuse administrative shares for lateral - movement and remote code execution. The Trickbot malware family also implements - this behavior to try to infect other machines in the infected network. -data_source: - - Windows Event Log Security 5145 -search: - ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval file_type = lower(file.type) | eval actor_user = actor.user | eval actor_user_domain - = actor_user.domain | eval src_endpoint_ip = src_endpoint.ip | eval file_path = - file.path | eval src_endpoint_port = src_endpoint.port | eval actor_user_name = - actor_user.name | eval actor_session = actor.session | eval actor_session_uid = - actor_session.uid | eval actor_user_uid = actor_user.uid | eval device_hostname - = device.hostname | where (file_path LIKE "%.exe" OR file_path LIKE "%.dll") AND - file_type="file" AND (share LIKE "\\%\\c$" OR share LIKE "\\%\\ipc$" OR share LIKE - "\\%\\admin$") AND access_mask=2 --finding_report--' -how_to_implement: - To successfully implement this search, you need to be ingesting - Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also - required. Also enable the object Audit access success/failure in your group policy. -known_false_positives: - System Administrators may use looks like PsExec for troubleshooting - or administrations tasks. However, this will typically come only from certain users - and certain systems that can be added to an allow list. -references: - - https://attack.mitre.org/techniques/T1021/002/ - - https://www.rapid7.com/blog/post/2013/03/09/psexec-demystified/ - - https://labs.vipre.com/trickbot-and-its-modules/ - - https://whitehat.eu/incident-response-case-study-featuring-ryuk-and-trickbot-part-2/ - - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ -tags: - analytic_story: - - Active Directory Lateral Movement - - Prestige Ransomware - - Graceful Wipe Out Attack - - Industroyer2 - - IcedID - - Data Destruction - - Hermetic Wiper - - Trickbot - asset_type: Endpoint - confidence: 100 - impact: 70 - message: - $src_user$ dropped or created an executable file in known sensitive SMB - share. Share name=$ShareName$, Target name=$RelativeTargetName$, and Access mask=$AccessMask$ - mitre_attack_id: - - T1021 - - T1021.002 - observable: [] - product: - - Splunk Behavioral Analytics - required_fields: - - share - - file.type - - access_mask - - actor.user.domain - - src_endpoint.ip - - access_result - - file.path - - src_endpoint.port - - actor.user.name - - actor.session.uid - - actor.user.uid - - access_list - - device.hostname - risk_score: 70 - security_domain: endpoint - mappings: - - ocsf: access_list - cim: access_list - - ocsf: access_mask - cim: access_mask - - ocsf: access_result - cim: access_result - - ocsf: file.path - cim: relative_target_name - - ocsf: src_endpoint.ip - cim: src_ip - - ocsf: src_endpoint.port - cim: src_port - - ocsf: actor.user.name - cim: user - - ocsf: share - cim: share - - ocsf: file.type - cim: object_type - - ocsf: actor.user.domain - cim: user_domain - - ocsf: actor.session.uid - cim: user_logon_id - - ocsf: actor.user.uid - cim: user_sid - - ocsf: device.hostname - cim: dest -tests: - - name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/exe_smbshare/windows-xml.log - source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml b/ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml deleted file mode 100644 index 090115a596..0000000000 --- a/ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml +++ /dev/null @@ -1,100 +0,0 @@ -name: Fsutil Zeroing File -id: f792cdc9-43ee-4429-a3c0-ffce4fed1a85 -version: 4 -date: '2021-12-07' -author: Michael Haag, Splunk -type: TTP -status: production -description: This search is to detect a suspicious fsutil process to zeroing a target - file. This technique was seen in lockbit ransomware where it tries to zero out its - malware path as part of its defense evasion after encrypting the compromised host. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_cmd_line LIKE "%setzerodata%" - AND process_file_name="fsutil.exe" --finding_report--' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed net.exe may be used. -known_false_positives: System administrators or scripts may delete user accounts via - this technique. Filter as needed. -references: -- https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/ -- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file -tags: - analytic_story: - - Ransomware - - Insider Threat - - Information Sabotage - asset_type: Endpoint - confidence: 90 - impact: 60 - mitre_attack_id: - - T1070 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ atempting to perform file - deletion. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 54 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml b/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml deleted file mode 100644 index 3eaa7a62e1..0000000000 --- a/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml +++ /dev/null @@ -1,98 +0,0 @@ -name: Grant Permission Using Cacls Utility -id: c6da561a-cd29-11eb-ae65-acde48001122 -version: 7 -date: '2021-11-30' -author: Teoderick Contreras, Splunk -type: TTP -status: production -description: The following analytic identifies the use of `cacls.exe`, `icacls.exe` - or `xcacls.exe` placing the grant permission on a file or directory. Adversaries - perform this behavior to allow components of their files to run, however it allows - responders to review or gaining access to adversary files on disk. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_file_name IN ("icacls.exe", - "xcacls.exe", "cacls.exe")) AND match(process_cmd_line, /(?i)grant/)=true --finding_report--' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. -known_false_positives: System administrators may use cacls utilities but this is not - a common practice. Filter as needed. -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -tags: - analytic_story: - - XMRig - - Insider Threat - asset_type: Endpoint - confidence: 70 - impact: 50 - mitre_attack_id: - - T1222 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: A cacls process $process_name$ with commandline $process$ try to grant - user a permission to a file or directory in host $dest_device_id$ - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 35 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml b/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml deleted file mode 100644 index dd54529f23..0000000000 --- a/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ /dev/null @@ -1,101 +0,0 @@ -name: Hiding Files And Directories With Attrib exe -id: 028e4406-6176-11ec-aec2-acde48001122 -version: 4 -date: '2021-12-20' -author: Teoderick Contreras, Splunk -type: TTP -status: production -description: Attackers leverage an existing Windows binary, attrib.exe, to mark specific - as hidden by using specific flags so that the victim does not see the file. The - search looks for specific command-line arguments to detect the use of attrib.exe - to hide files. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_file_name="attrib.exe" - AND match(process_cmd_line, /(?i)/)=true --finding_report--' -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. -known_false_positives: 'Some applications and users may legitimately use attrib.exe - to interact with the files. ' -references: -- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/attrib -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Persistence Techniques - - Information Sabotage - - Insider Threat - asset_type: Endpoint - confidence: 90 - impact: 80 - mitre_attack_id: - - T1222.001 - - T1222 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is detected. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 72 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/attrib_hidden/security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___high_file_deletion_frequency.yml b/ssa_detections/endpoint/ssa___high_file_deletion_frequency.yml deleted file mode 100644 index cc97b0d99b..0000000000 --- a/ssa_detections/endpoint/ssa___high_file_deletion_frequency.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: High File Deletion Frequency -id: b6200efd-13bd-4336-920a-057b25bbcfaf -version: 1 -date: '2021-12-07' -author: Patrick Bareiss, Splunk -status: experimental -type: Anomaly -description: This detection detects a high amount of file deletions in a short time - for specific file types. This can be an indicator for a malicious insider. -data_source: -- Sysmon Event ID 23 -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)) | eval action=ucast(map_get(input_event, "action"), "string", - null), process=ucast(map_get(input_event, "process"), "string", null), file_name=ucast(map_get(input_event, - "file_name"), "string", null), file_path=ucast(map_get(input_event, "file_path"), - "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", - null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) - | where "Endpoint_Filesystem" IN(_datamodels) | where action="deleted" | where like(file_name, - "%.cmd") OR like(file_name, "%.ini") OR like(file_name, "%.gif") OR like(file_name, - "%.jpg") OR like(file_name, "%.jpeg") OR like(file_name, "%.db") OR like(file_name, - "%.doc%") OR like(file_name, "%.ps1") OR like(file_name, "%.xls%") OR like(file_name, - "%.ppt%") OR like(file_name, "%.bmp") OR like(file_name, "%.zip") OR like(file_name, - "%.rar") OR like(file_name, "%.7z") OR like(file_name, "%.chm") OR like(file_name, - "%.png") OR like(file_name, "%.log") OR like(file_name, "%.vbs") OR like(file_name, - "%.js") | stats count(file_name) AS count BY dest_user_id, dest_device_id, span(timestamp, - 10m) | where count > 20 | eval start_time=window_start, end_time=window_end, entities=mvappend(dest_user_id, - dest_device_id), body=create_map(["count", count]) | into write_ssa_detected_events();' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Filesytem` node. -known_false_positives: user may delete bunch of pictures or files in a folder. -references: -- https://www.mandiant.com/resources/fin11-email-campaigns-precursor-for-ransomware-data-theft -- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html -tags: - analytic_story: - - Clop Ransomware - - Insider Threat - asset_type: Endpoint - confidence: 80 - impact: 90 - message: High frequency file deletion activity detected on host $Computer$ - mitre_attack_id: - - T1485 - observable: - - name: user - type: User - role: - - Victim - - name: Computer - type: Endpoint - role: - - Victim - - name: deleted_files - type: File Name - role: - - Target - product: - - Splunk Behavioral Analytics - required_fields: - - action - - process - - file_name - - file_path - kill_chain_phases: - - Exploitation - risk_score: 72 - security_domain: endpoint diff --git a/ssa_detections/endpoint/ssa___impacket_lateral_movement_smbexec_commandline_parameters.yml b/ssa_detections/endpoint/ssa___impacket_lateral_movement_smbexec_commandline_parameters.yml deleted file mode 100644 index c750fca38b..0000000000 --- a/ssa_detections/endpoint/ssa___impacket_lateral_movement_smbexec_commandline_parameters.yml +++ /dev/null @@ -1,132 +0,0 @@ -name: Impacket Lateral Movement smbexec CommandLine Parameters -id: c1238942-2715-41ee-b371-0475da48029c -version: 1 -date: '2024-01-01' -author: Michael Haag, Splunk -type: TTP -status: production -description: This analytic focuses on identifying suspicious command-line parameters - commonly associated with the use of Impacket wmiexec.py. Impacket is a set of Python - classes designed for working with Microsoft network protocols, and it includes several - scripts like wmiexec.py, smbexec.py, dcomexec.py, and atexec.py that enable command - execution on remote endpoints. These scripts typically utilize administrative shares - and hardcoded parameters, which can serve as signatures to detect their usage. Both - Red Teams and adversaries may employ Impacket tools for lateral movement and remote - code execution purposes. By monitoring for these specific command-line indicators, - the analytic aims to detect potentially malicious activities related to Impacket - tool usage. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_file_name="cmd.exe" AND - process_cmd_line LIKE "%cmd.exe /q /c%") AND process_cmd_line LIKE "%echo cd%" AND - (process_cmd_line LIKE "%__output%" AND match(process_cmd_line, /(?i)C:\\Windows\\[a-zA-Z]{1,8}\.bat/)=true) - --finding_report--' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: Although uncommon, Administrators may leverage Impackets tools - to start a process on remote systems for system administration or automation use - cases. -references: -- https://attack.mitre.org/techniques/T1021/002/ -- https://attack.mitre.org/techniques/T1021/003/ -- https://attack.mitre.org/techniques/T1047/ -- https://attack.mitre.org/techniques/T1053/ -- https://attack.mitre.org/techniques/T1053/005/ -- https://github.com/SecureAuthCorp/impacket -- https://vk9-sec.com/impacket-remote-code-execution-rce-on-windows-from-linux/ -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ -tags: - analytic_story: - - Active Directory Lateral Movement - - CISA AA22-277A - - WhisperGate - - Prestige Ransomware - - Volt Typhoon - - Graceful Wipe Out Attack - - Industroyer2 - - Data Destruction - asset_type: Endpoint - confidence: 70 - impact: 90 - mitre_attack_id: - - T1021 - - T1021.002 - - T1021.003 - - T1047 - - T1543.003 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: Suspicious command-line parameters on $dest_device_id$ may represent lateral - movement using smbexec. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 63 - security_domain: endpoint - atomic_guid: [] - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.002/impacket_smbexec/windows_security_xml.log - source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___impacket_lateral_movement_wmiexec_commandline_parameters.yml b/ssa_detections/endpoint/ssa___impacket_lateral_movement_wmiexec_commandline_parameters.yml deleted file mode 100644 index 92f0332807..0000000000 --- a/ssa_detections/endpoint/ssa___impacket_lateral_movement_wmiexec_commandline_parameters.yml +++ /dev/null @@ -1,129 +0,0 @@ -name: Impacket Lateral Movement WMIExec Commandline Parameters -id: 9d07ff50-e968-456e-a3d9-c65c38ed0ab0 -version: 1 -date: '2024-02-01' -author: Michael Haag, Splunk -type: TTP -status: production -description: This analytic looks for the presence of suspicious commandline parameters - typically present when using Impacket tools. Impacket is a collection of python - classes meant to be used with Microsoft network protocols. There are multiple scripts - that leverage impacket libraries like `wmiexec.py`, `smbexec.py`, `dcomexec.py` - and `atexec.py` used to execute commands on remote endpoints. By default, these - scripts leverage administrative shares and hardcoded parameters that can be used - as a signature to detect its use. Red Teams and adversaries alike may leverage Impackets - tools for lateral movement and remote code execution. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = lower(actor_process_file.name) - | eval device_hostname = device.hostname | where actor_process_file_name="wmiprvse.exe" - AND process_cmd_line LIKE "%\\127.0.0.1%" AND match(process_cmd_line, /(?i)__\d{1,10}\.\d{1,10}/)=true - --finding_report--' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: Although uncommon, Administrators may leverage Impackets tools - to start a process on remote systems for system administration or automation use - cases. -references: -- https://attack.mitre.org/techniques/T1021/002/ -- https://attack.mitre.org/techniques/T1021/003/ -- https://attack.mitre.org/techniques/T1047/ -- https://attack.mitre.org/techniques/T1053/ -- https://attack.mitre.org/techniques/T1053/005/ -- https://github.com/SecureAuthCorp/impacket -- https://vk9-sec.com/impacket-remote-code-execution-rce-on-windows-from-linux/ -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ -tags: - analytic_story: - - Active Directory Lateral Movement - - CISA AA22-277A - - WhisperGate - - Prestige Ransomware - - Volt Typhoon - - Graceful Wipe Out Attack - - Industroyer2 - - Data Destruction - asset_type: Endpoint - confidence: 70 - impact: 90 - mitre_attack_id: - - T1021 - - T1021.002 - - T1021.003 - - T1047 - - T1543.003 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: Suspicious command-line parameters on $dest_device_id$ may represent lateral - movement using wmiexec. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 63 - security_domain: endpoint - atomic_guid: [] - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.002/impacket_wmiexec/windows_security_xml.log - source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml deleted file mode 100644 index 16fdc743ed..0000000000 --- a/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml +++ /dev/null @@ -1,100 +0,0 @@ -name: Modify ACLs Permission Of Files Or Folders -id: 9ae9a48a-cdbe-11eb-875a-acde48001122 -version: 7 -date: '2022-03-17' -author: Teoderick Contreras, Splunk -type: Anomaly -status: production -description: This analytic identifies suspicious modification of ACL permission to - a files or folder to make it available to everyone or to a specific user. This technique - may be used by the adversary to evade ACLs or protected files access. This changes - is commonly configured by the file or directory owner with appropriate permission. - This behavior raises suspicion if this command is seen on an endpoint utilized by - an account with no permission to do so. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (match(process_cmd_line, /(?i)S-1-1-0:/)=true - OR match(process_cmd_line, /(?i)SYSTEM:/)=true OR match(process_cmd_line, /(?i)everyone:/)=true) - AND (process_file_name IN ("icacls.exe", "xcacls.exe", "cacls.exe")) --finding_report--' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used. -known_false_positives: System administrators may use this windows utility. filter - is needed. -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -tags: - analytic_story: - - XMRig - asset_type: Endpoint - confidence: 70 - impact: 50 - mitre_attack_id: - - T1222 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: A cacls process $process_name$ with commandline $process$ try to modify - a permission of a file or directory in host $dest_device_id$ - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 35 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml b/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml deleted file mode 100644 index c9e87dba3a..0000000000 --- a/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml +++ /dev/null @@ -1,100 +0,0 @@ -name: Office Product Spawning Windows Script Host -id: 3ea3851a-8736-41a0-bc09-7e4485b48fa6 -version: 5 -date: '2022-10-12' -author: Michael Haag, Splunk -type: TTP -status: production -description: The following analytic will identify a Windows Office Product spawning - WScript.exe or CScript.exe. Tuning may be required based on legitimate application - usage that may spawn scripts from an Office product. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_file_name IN ("cscript.exe", - "wscript.exe")) AND (match(actor_process_file_name, /(?i)visio.exe/)=true OR match(actor_process_file_name, - /(?i)mspub.exe/)=true OR match(actor_process_file_name, /(?i)powerpnt.exe/)=true - OR match(actor_process_file_name, /(?i)excel.exe/)=true OR match(actor_process_file_name, - /(?i)winword.exe/)=true) --finding_report--' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: False positives may be present based on macro based approved - documents in the organization. Filtering may be needed. -references: -- https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/ -tags: - analytic_story: - - Spearphishing Attachments - asset_type: Endpoint - confidence: 90 - impact: 70 - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: A Microsoft office parent process $parent_process_name$ has spawned a suspicious - child process $process_name$ on host $dest$. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 63 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-security.log - source: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___possible_lateral_movement_powershell_spawn.yml b/ssa_detections/endpoint/ssa___possible_lateral_movement_powershell_spawn.yml deleted file mode 100644 index f2e0b9c5ac..0000000000 --- a/ssa_detections/endpoint/ssa___possible_lateral_movement_powershell_spawn.yml +++ /dev/null @@ -1,126 +0,0 @@ -name: Possible Lateral Movement PowerShell Spawn -id: 22282a2d-dc19-4b88-ac61-6c86ff92904f -version: 1 -date: '2024-02-01' -author: Mauricio Velazco, Splunk -type: TTP -status: production -description: 'The following analytic is designed to identify possible lateral movement - attacks that involve the spawning of a PowerShell process as a child or grandchild - process of commonly abused processes. These processes include services.exe, wmiprsve.exe, - svchost.exe, wsmprovhost.exe, and mmc.exe.\ - - Such behavior is indicative of legitimate Windows features such as the Service Control - Manager, Windows Management Instrumentation, Task Scheduler, Windows Remote Management, - and the DCOM protocol being abused to start a process on a remote endpoint. This - behavior is often seen during lateral movement techniques where adversaries or red - teams abuse these services for lateral movement and remote code execution.' -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = lower(actor_process_file.name) - | eval device_hostname = device.hostname | where (actor_process_file_name IN ("wmiprvse.exe", - "services.exe", "svchost.exe", "wsmprovhost.exe", "mmc.exe")) AND ((process_file_name - IN ("powershell.exe", "pwsh.exe")) OR (process_file_name="cmd.exe" AND (process_cmd_line - LIKE "%powershell.exe%" OR process_cmd_line LIKE "%pwsh.exe%"))) --finding_report--' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: Legitimate applications may spawn PowerShell as a child process - of the the identified processes. Filter as needed. -references: -- https://attack.mitre.org/techniques/T1021/003/ -- https://attack.mitre.org/techniques/T1021/006/ -- https://attack.mitre.org/techniques/T1047/ -- https://attack.mitre.org/techniques/T1053/005/ -- https://attack.mitre.org/techniques/T1543/003/ -tags: - analytic_story: - - Active Directory Lateral Movement - - Malicious PowerShell - - Hermetic Wiper - - Data Destruction - - Scheduled Tasks - asset_type: Endpoint - confidence: 50 - impact: 90 - mitre_attack_id: - - T1021 - - T1021.003 - - T1021.006 - - T1047 - - T1053.005 - - T1543.003 - - T1059.001 - - T1218.014 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: A PowerShell process was spawned as a child process of typically abused - processes on $dest_device_id$ - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 45 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement/windows_security_xml.log - source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___rare_parent_child_process_relationship.yml b/ssa_detections/endpoint/ssa___rare_parent_child_process_relationship.yml deleted file mode 100644 index ce88669c96..0000000000 --- a/ssa_detections/endpoint/ssa___rare_parent_child_process_relationship.yml +++ /dev/null @@ -1,95 +0,0 @@ -name: Rare Parent-Child Process Relationship -id: cf090c78-bcc6-11eb-8529-0242ac130003 -version: 2 -date: '2021-11-30' -author: Peter Gael, Splunk; Ignacio Bermudez Corrales, Splunk -status: experimental -type: Anomaly -description: An attacker may use LOLBAS tools spawned from vulnerable applications - not typically used by system administrators. This analytic leverages the Splunk - Streaming ML DSP plugin to find rare parent/child relationships. The list of application - has been extracted from https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries -data_source: -- Windows Security 4688 -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)) | eval parent_process=lower(ucast(map_get(input_event, - "parent_process_name"), "string", null)), parent_process_name=mvindex(split(parent_process, - "\\"), -1), process_name=lower(ucast(map_get(input_event, "process_name"), "string", - null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), dest_user_id=ucast(map_get(input_event, - "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), - "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) - | where parent_process_name!=null | select parent_process_name, process_name, cmd_line, - timestamp, dest_device_id, dest_user_id | conditional_anomaly conditional="parent_process_name" - target="process_name" | where (process_name="powershell.exe" OR process_name="regsvcs.exe" - OR process_name="ftp.exe" OR process_name="dfsvc.exe" OR process_name="rasautou.exe" - OR process_name="schtasks.exe" OR process_name="xwizard.exe" OR process_name="findstr.exe" - OR process_name="esentutl.exe" OR process_name="cscript.exe" OR process_name="reg.exe" - OR process_name="csc.exe" OR process_name="atbroker.exe" OR process_name="print.exe" - OR process_name="pcwrun.exe" OR process_name="vbc.exe" OR process_name="rpcping.exe" - OR process_name="wsreset.exe" OR process_name="ilasm.exe" OR process_name="certutil.exe" - OR process_name="replace.exe" OR process_name="mshta.exe" OR process_name="bitsadmin.exe" - OR process_name="wscript.exe" OR process_name="ieexec.exe" OR process_name="cmd.exe" - OR process_name="microsoft.workflow.compiler.exe" OR process_name="runscripthelper.exe" - OR process_name="makecab.exe" OR process_name="forfiles.exe" OR process_name="desktopimgdownldr.exe" - OR process_name="control.exe" OR process_name="msbuild.exe" OR process_name="register-cimprovider.exe" - OR process_name="tttracer.exe" OR process_name="ie4uinit.exe" OR process_name="sc.exe" - OR process_name="bash.exe" OR process_name="hh.exe" OR process_name="cmstp.exe" - OR process_name="mmc.exe" OR process_name="jsc.exe" OR process_name="scriptrunner.exe" - OR process_name="odbcconf.exe" OR process_name="extexport.exe" OR process_name="msdt.exe" - OR process_name="diskshadow.exe" OR process_name="extrac32.exe" OR process_name="eventvwr.exe" - OR process_name="mavinject.exe" OR process_name="regasm.exe" OR process_name="gpscript.exe" - OR process_name="rundll32.exe" OR process_name="regsvr32.exe" OR process_name="regedit.exe" - OR process_name="msiexec.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="presentationhost.exe" - OR process_name="regini.exe" OR process_name="wmic.exe" OR process_name="runonce.exe" - OR process_name="syncappvpublishingserver.exe" OR process_name="verclsid.exe" OR - process_name="psr.exe" OR process_name="infdefaultinstall.exe" OR process_name="explorer.exe" - OR process_name="expand.exe" OR process_name="installutil.exe" OR process_name="netsh.exe" - OR process_name="wab.exe" OR process_name="dnscmd.exe" OR process_name="at.exe" - OR process_name="pcalua.exe" OR process_name="cmdkey.exe" OR process_name="msconfig.exe") - | eval input = (-1)*log(output) | adaptive_threshold algorithm="gaussian" threshold=0.001 - window=604800000L | where label AND input > mean | eval start_time = timestamp, - end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = - create_map(["process_name", process_name, "parent_process_name", parent_process_name, - "input", input, "mean", mean, "variance", variance, "output", output, "cmd_line", - cmd_line]) | into write_ssa_detected_events();' -how_to_implement: Collect endpoint data such as sysmon or 4688 events. -known_false_positives: Some custom tools used by administrators could be used rarely - to launch remotely applications. This might trigger false positives at the beginning - when it has not collected yet enough data to construct the baseline. -references: -- https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries -tags: - analytic_story: - - Unusual Processes - asset_type: Endpoint - confidence: 50 - impact: 50 - message: Rare Parent-Child Process Relationship - mitre_attack_id: - - T1203 - - T1059 - - T1053 - - T1072 - observable: - - name: dest_user_id - type: User - role: - - Actor - - name: dest_device_id - type: Hostname - role: - - Victim - product: - - Splunk Behavioral Analytics - required_fields: - - process - - process_name - - parent_process_name - - _time - - dest_device_id - - dest_user_id - - cmd_line - kill_chain_phases: - - Exploitation - risk_score: 25 - security_domain: endpoint diff --git a/ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml b/ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml deleted file mode 100644 index 238da75029..0000000000 --- a/ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml +++ /dev/null @@ -1,101 +0,0 @@ -name: Resize Shadowstorage Volume -id: dbc30554-d27e-11eb-9e5e-acde48001122 -version: 6 -date: '2021-11-30' -author: Teoderick Contreras, Splunk -type: TTP -status: production -description: The following analytic identifies the resizing of shadowstorage using - vssadmin.exe to avoid the shadow volumes being made again. This technique is typically - found used by adversaries during a ransomware event and a precursor to deleting - the shadowstorage. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_cmd_line LIKE "%shadowstorage%" - AND process_cmd_line LIKE "%resize%" AND process_cmd_line LIKE "%maxsize%" AND process_file_name="vssadmin.exe" - --finding_report--' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: System administrators may resize the shadowstorage for valid - purposes. Filter as needed. -references: -- https://www.mandiant.com/resources/fin11-email-campaigns-precursor-for-ransomware-data-theft -- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html -tags: - analytic_story: - - Clop Ransomware - - Ransomware - asset_type: Endpoint - confidence: 80 - impact: 80 - mitre_attack_id: - - T1489 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting to create a shadow - copy to perform offline password cracking. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 64 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/windows-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___sdelete_application_execution.yml b/ssa_detections/endpoint/ssa___sdelete_application_execution.yml deleted file mode 100644 index 6f377a2c32..0000000000 --- a/ssa_detections/endpoint/ssa___sdelete_application_execution.yml +++ /dev/null @@ -1,113 +0,0 @@ -name: Sdelete Application Execution -id: fcc52b9a-4616-11ec-8454-acde48001122 -version: 4 -date: '2021-11-15' -author: Teoderick Contreras, Splunk -type: Anomaly -status: production -description: This analytic will detect the execution of sdelete.exe attempting to - delete potentially important files that may related to adversary or insider threats - to destroy evidence or information sabotage. Sdelete is a SysInternals utility meant - to securely delete files on disk. This tool is commonly used to clear tracks and - artifact on the targeted host. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%.xls%" - OR process_cmd_line LIKE "%.gz%" OR process_cmd_line LIKE "%.tar%" OR process_cmd_line - LIKE "%.rar%" OR process_cmd_line LIKE "%.zip%" OR process_cmd_line LIKE "%.7z%" - OR process_cmd_line LIKE "%.bmp%" OR process_cmd_line LIKE "%.gif%" OR process_cmd_line - LIKE "%.png%" OR process_cmd_line LIKE "%.jpg%" OR process_cmd_line LIKE "%.txt%" - OR process_cmd_line LIKE "%.log%" OR process_cmd_line LIKE "%.key%" OR process_cmd_line - LIKE "%.pdf%" OR process_cmd_line LIKE "%.rtf%" OR process_cmd_line LIKE "%.ppt%" - OR process_cmd_line LIKE "%.xls%" OR process_cmd_line LIKE "%.doc%" OR process_cmd_line - LIKE "%-nobanner%" OR process_cmd_line LIKE "%/accepteula%" OR process_cmd_line - LIKE "%-z %" OR process_cmd_line LIKE "%-s %" OR process_cmd_line LIKE "%-q %" OR - process_cmd_line LIKE "%-r %" OR process_cmd_line LIKE "%-p %" OR process_cmd_line - LIKE "%-f %" OR process_cmd_line LIKE "%-c %") AND process_file_name LIKE "%sdelete%" - --finding_report--' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited, filter as needed. -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md -tags: - analytic_story: - - Information Sabotage - - Insider Threat - asset_type: Endpoint - confidence: 70 - impact: 60 - mitre_attack_id: - - T1485 - - T1070.004 - - T1070 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: Sdelete process $process_name$ executed on $dest_device_id$ attempting - to permanently delete files by $dest_user_id$. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 42 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___serviceprincipalnames_discovery_with_powershell.yml b/ssa_detections/endpoint/ssa___serviceprincipalnames_discovery_with_powershell.yml deleted file mode 100644 index 983a576a5b..0000000000 --- a/ssa_detections/endpoint/ssa___serviceprincipalnames_discovery_with_powershell.yml +++ /dev/null @@ -1,101 +0,0 @@ -name: ServicePrincipalNames Discovery with PowerShell -id: 043f07a0-7fd8-40e2-b526-80406fb59abb -version: 2 -date: '2024-02-01' -author: Michael Haag, Splunk -type: TTP -status: production -description: 'The following analytic identifies `powershell.exe` usage, using Script - Block Logging EventCode 4104, related to querying the domain for Service Principle - Names. typically, this is a precursor activity related to kerberoasting or the silver - ticket attack. \ - - What is a ServicePrincipleName? \ - - A service principal name (SPN) is a unique identifier of a service instance. SPNs - are used by Kerberos authentication to associate a service instance with a service - logon account. This allows a client application to request that the service authenticate - an account even if the client does not have the account name.\ - - The following analytic identifies the use of KerberosRequestorSecurityToken class - within the script block. Using .NET System.IdentityModel.Tokens.KerberosRequestorSecurityToken - class in PowerShell is the equivelant of using setspn.exe. \ - - During triage, review parallel processes for further suspicious activity.' -data_source: -- Powershell 4104 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval device_hostname = device.hostname | eval process_file = process.file | eval - process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where match(process_cmd_line, /(?i)KerberosRequestorSecurityToken/)=true --finding_report--' -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: False positives should be limited, however filter as needed. -references: -- https://docs.microsoft.com/en-us/windows/win32/ad/service-principal-names -- https://docs.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8 -- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting -- https://strontic.github.io/xcyclopedia/library/setspn.exe-5C184D581524245DAD7A0A02B51FD2C2.html -- https://attack.mitre.org/techniques/T1558/003/ -- https://social.technet.microsoft.com/wiki/contents/articles/717.service-principal-names-spn-setspn-syntax.aspx -- https://web.archive.org/web/20220212163642/https://www.harmj0y.net/blog/powershell/kerberoasting-without-mimikatz/ -- https://blog.zsec.uk/paving-2-da-wholeset/ -- https://msitpros.com/?p=3113 -- https://adsecurity.org/?p=3466 -- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 -- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf -- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ -tags: - analytic_story: - - Active Directory Discovery - - Active Directory Kerberos Attacks - - Malicious PowerShell - - Active Directory Privilege Escalation - asset_type: Endpoint - confidence: 100 - impact: 80 - mitre_attack_id: - - T1558.003 - observable: - - name: device.hostname - type: Hostname - - name: process.file.path - type: File - - name: process.uid - type: Other - - name: process.cmd_line - type: Other - - name: actor.user.uid - type: Other - message: An instance of attempting to identify service principle detected on $dest$ - names. - product: - - Splunk Behavioral Analytics - required_fields: - - device.hostname - - process.file.path - - process.uid - - process.cmd_line - - actor.user.uid - risk_score: 80 - security_domain: endpoint - mappings: - - ocsf: device.hostname - cim: dest - - ocsf: process.file.path - cim: process_path - - ocsf: process.uid - cim: process_id - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.uid - cim: user_id -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___services_lolbas_execution_process_spawn.yml b/ssa_detections/endpoint/ssa___services_lolbas_execution_process_spawn.yml deleted file mode 100644 index 6aca3f5340..0000000000 --- a/ssa_detections/endpoint/ssa___services_lolbas_execution_process_spawn.yml +++ /dev/null @@ -1,119 +0,0 @@ -name: Services lolbas Execution Process Spawn -id: 0d85fde3-0de9-4eec-b386-6a8ba70f3935 -version: 5 -date: '2023-10-02' -author: Bhavin Patel, Splunk -type: Anomaly -status: validation -description: The following analytic identifies services.exe spawning a LOLBAS execution - process. When adversaries execute code on remote endpoints abusing the Service Control - Manager and creating a remote malicious service, the executed command is spawned - as a child process of services.exe. The LOLBAS project documents Windows native - binaries that can be abused by threat actors to perform tasks like executing malicious - code. Looking for child processes of services.exe that are part of the LOLBAS project - can help defenders identify lateral movement activity. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = lower(actor_process_file.name) - | eval device_hostname = device.hostname | where actor_process_file_name="services.exe" - AND (process_file_name IN ("at.exe", "atbroker.exe", "bash.exe", "bitsadmin.exe", - "certoc.exe", "cmd.exe", "cmstp.exe", "dllhost.exe", "dnscmd.exe", "extexport.exe", - "explorer.exe", "forfiles.exe", "ftp.exe", "gpscript.exe", "hh.exe", "ie4uinit.exe", - "ieexec.exe", "infdefaultinstall.exe", "installutil.exe", "lucallbackproxy.exe", - "mavinject.exe", "microsoft.workflow.compiler.exe", "mmc.exe", "msbuild.exe", "msconfig.exe", - "msdt.exe", "mshta.exe", "msiexec.exe", "netsh.exe", "odbcconf.exe", "offlinescannershell.exe", - "pcwrun.exe", "pcalua.exe", "pnputil.exe", "presentationhost.exe", "rasautou.exe", - "regasm.exe", "regsvcs.exe", "regsvr32.exe", "register-cimprovider.exe", "rundll32.exe", - "runonce.exe", "runscripthelper.exe", "schtasks.exe", "scriptrunner.exe", "settingsynchost.exe", - "stordiag.exe", "syncappvpublishingserver.exe", "ttdinject.exe", "tttracer.exe", - "verclsid.exe", "wab.exe", "wmic.exe", "wuauclt.exe", "xwizard.exe")) --finding_report--' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the Processes node of the Endpoint - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: There are circumstances where the services application may - legitimately execute and spawn a windows native binary to do an activity that is - benign. -references: -- https://attack.mitre.org/techniques/T1543/003/ -- https://pentestlab.blog/2020/07/21/lateral-movement-services -tags: - analytic_story: - - Suspicious Command-Line Executions - - Insider Threat - asset_type: Endpoint - confidence: 50 - impact: 70 - mitre_attack_id: - - T1543.003 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of services.exe spawning $process_name$ was identified on endpoint - $dest_device_id$ by user $dest_user_id$, producing a suspicious event that warrants - investigating. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 35 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/services_lolbas_execution/4688_xml_windows_security.log - source: XmlWinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml b/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml deleted file mode 100644 index e9f43f3419..0000000000 --- a/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml +++ /dev/null @@ -1,205 +0,0 @@ -name: System Process Running from Unexpected Location -id: 28179107-099a-464a-94d3-08301e6c055f -version: 8 -date: '2022-03-24' -author: Jose Hernadnez, Ignacio Bermudez Corrales, Splunk -type: Anomaly -status: production -description: An attacker tries might try to use different version of a system command - without overriding original, or they might try to avoid some detection running the - process from a different folder. This detection checks that a list of system processes - run inside C:\\Windows\System32 or C:\\Windows\SysWOW64 The list of system processes - has been extracted from https://github.com/splunk/security_content/blob/develop/lookups/is_windows_system_file.csv - and the original detection https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_file_name IN ("xwizard.exe", - "xpsrchvw.exe", "xcopy.exe", "wusa.exe", "wuauclt.exe", "wuapp.exe", "wuapihost.exe", - "wsqmcons.exe", "wsmprovhost.exe", "wscript.exe", "write.exe", "wpr.exe", "wpnpinst.exe", - "wowreg32.exe", "wlrmdr.exe", "wlanext.exe", "wksprt.exe", "wkspbroker.exe", "wisptis.exe", - "winver.exe", "winrshost.exe", "winrs.exe", "winresume.exe", "winlogon.exe", "winload.exe", - "wininit.exe", "wimserv.exe", "wifitask.exe", "wiawow64.exe", "wiaacmgr.exe", "whoami.exe", - "where.exe", "wextract.exe", "wevtutil.exe", "wermgr.exe", "wecutil.exe", "wbengine.exe", - "wbadmin.exe", "waitfor.exe", "w32tm.exe", "vssadmin.exe", "vmicsvc.exe", "verifiergui.exe", - "verifier.exe", "verclsid.exe", "vdsldr.exe", "vds.exe", "userinit.exe", "upnpcont.exe", - "unregmp2.exe", "unlodctr.exe", "ucsvc.exe", "tzutil.exe", "tzsync.exe", "typeperf.exe", - "tskill.exe", "tsdiscon.exe", "tscon.exe", "tracerpt.exe", "tpmvscmgrsvr.exe", "tpmvscmgr.exe", - "timeout.exe", "tcmsetup.exe", "taskmgr.exe", "tasklist.exe", "taskkill.exe", "taskhostw.exe", - "taskhost.exe", "taskeng.exe", "takeown.exe", "tabcal.exe", "systray.exe", "systemreset.exe", - "systeminfo.exe", "syskey.exe", "sxstrace.exe", "svchost.exe", "subst.exe", "srdelayed.exe", - "spreview.exe", "sppsvc.exe", "spoolsv.exe", "spinstall.exe", "sort.exe", "snmptrap.exe", - "smss.exe", "slui.exe", "sihost.exe", "sigverif.exe", "shutdown.exe", "shrpubw.exe", - "shadow.exe", "setx.exe", "setupugc.exe", "setupcl.exe", "setspn.exe", "sethc.exe", - "sessionmsg.exe", "services.exe", "secinit.exe", "sdiagnhost.exe", "sdclt.exe", - "sdchange.exe", "sdbinst.exe", "schtasks.exe", "sc.exe", "sbunattend.exe", "rwinsta.exe", - "runonce.exe", "rundll32.exe", "runas.exe", "rstrui.exe", "rrinstaller.exe", "rmttpmvscmgrsvr.exe", - "resmon.exe", "reset.exe", "replace.exe", "repair-bde.exe", "relog.exe", "rekeywiz.exe", - "regsvr32.exe", "regini.exe", "regedt32.exe", "reg.exe", "recover.exe", "recdisc.exe", - "rdrleakdiag.exe", "rdpinput.exe", "rdpclip.exe", "rasphone.exe", "raserver.exe", - "rasdial.exe", "rasautou.exe", "qwinsta.exe", "quser.exe", "query.exe", "qprocess.exe", - "qappsrv.exe", "pwlauncher.exe", "psr.exe", "provtool.exe", "proquota.exe", "printui.exe", - "printfilterpipelinesvc.exe", "print.exe", "prevhost.exe", "powercfg.exe", "poqexec.exe", - "plasrv.exe", "phoneactivate.exe", "perfmon.exe", "pcwrun.exe", "pcawrk.exe", "pcaui.exe", - "pcalua.exe", "p2phost.exe", "osk.exe", "openfiles.exe", "omadmprc.exe", "omadmclient.exe", - "odbcconf.exe", "odbcad32.exe", "ocsetup.exe", "ntprint.exe", "ntoskrnl.exe", "nslookup.exe", - "notepad.exe", "nltest.exe", "newdev.exe", "netsh.exe", "netiougc.exe", "netcfg.exe", - "netbtugc.exe", "net1.exe", "net.exe", "ndadmin.exe", "nbtstat.exe", "mtstocom.exe", - "mstsc.exe", "msra.exe", "mspaint.exe", "msinfo32.exe", "msiexec.exe", "mshta.exe", - "msg.exe", "msfeedssync.exe", "msdtc.exe", "msdt.exe", "msconfig.exe", "mpnotify.exe", - "mountvol.exe", "mobsync.exe", "mmc.exe", "mfpmp.exe", "mctadmin.exe", "mcbuilder.exe", - "mblctr.exe", "manage-bde.exe", "makecab.exe", "lsm.exe", "lsass.exe", "lpremove.exe", - "lpksetup.exe", "lpkinstall.exe", "logoff.exe", "logman.exe", "logagent.exe", "lodctr.exe", - "licensingdiag.exe", "label.exe", "ktmutil.exe", "ksetup.exe", "klist.exe", "isoburn.exe", - "iscsicpl.exe", "iscsicli.exe", "irftp.exe", "ipconfig.exe", "immersivetpmvscmgrsvr.exe", - "iexpress.exe", "ieetwcollector.exe", "ieunatt.exe", "ie4uinit.exe", "icsunattend.exe", - "icardagt.exe", "icacls.exe", "hwrreg.exe", "hwrcomp.exe", "help.exe", "hdwwiz.exe", - "grpconv.exe", "gpupdate.exe", "gpscript.exe", "gpresult.exe", "getmac.exe", "fveprompt.exe", - "fvenotify.exe", "ftp.exe", "fsutil.exe", "fsquirt.exe", "fsavailux.exe", "forfiles.exe", - "fontview.exe", "fontdrvhost.exe", "fodhelper.exe", "fltmc.exe", "fixmapi.exe", - "finger.exe", "findstr.exe", "find.exe", "fhmanagew.exe", "fc.exe", "extrac32.exe", - "expand.exe", "eventvwr.exe", "eventcreate.exe", "eudcedit.exe", "esentutl.exe", - "embeddedapplauncher.exe", "efsui.exe", "easinvoker.exe", "dxdiag.exe", "dwm.exe", - "dvdupgrd.exe", "dvdplay.exe", "dstokenclean.exe", "dsregcmd.exe", "drvinst.exe", - "drvcfg.exe", "driverquery.exe", "dpnsvr.exe", "dpapimig.exe", "doskey.exe", "dnscacheugc.exe", - "dmclient.exe", "dmcfghost.exe", "dmcertinst.exe", "dllhst3g.exe", "dllhost.exe", - "djoin.exe", "dispdiag.exe", "diskraid.exe", "diskperf.exe", "diskpart.exe", "dinotify.exe", - "diantz.exe", "dialer.exe", "dfrgui.exe", "ddodiag.exe", "dcomcnfg.exe", "dccw.exe", - "dashost.exe", "cttunesvr.exe", "cttune.exe", "ctfmon.exe", "csrss.exe", "cscript.exe", - "credwiz.exe", "convert.exe", "control.exe", "consent.exe", "conhost.exe", "compact.exe", - "comp.exe", "colorcpl.exe", "cofire.exe", "cmstp.exe", "cmmon32.exe", "cmdl32.exe", - "cmdkey.exe", "cmd.exe", "clip.exe", "cliconfg.exe", "cleanmgr.exe", "cipher.exe", - "choice.exe", "chkntfs.exe", "chkdsk.exe", "chgusr.exe", "chgport.exe", "chglogon.exe", - "charmap.exe", "changepk.exe", "change.exe", "certutil.exe", "certreq.exe", "cdpreference.exe", - "calc.exe", "cacls.exe", "bthudtask.exe", "browser_broker.exe", "bridgeunattend.exe", - "bootsect.exe", "bootim.exe", "bootcfg.exe", "bitsadmin.exe", "bdeunlock.exe", "bdechangepin.exe", - "bcdedit.exe", "bcdboot.exe", "bcastdvr.exe", "backgroundtaskhost.exe", "baaupdate.exe", - "autofmt.exe", "autoconv.exe", "autochk.exe", "auditpol.exe", "audiodg.exe", "attrib.exe", - "at.exe", "appidpolicyconverter.exe", "appidcertstorecheck.exe", "alg.exe", "aitstatic.exe", - "aitagent.exe", "acu.exe", "wpcmon.exe", "workfolders.exe", "windowsupdateelevatedinstaller.exe", - "windowsanytimeupgradeui.exe", "windowsanytimeupgraderesults.exe", "windowsanytimeupgrade.exe", - "windowsactiondialog.exe", "windows.media.backgroundplayback.exe", "winsat.exe", - "werfaultsecure.exe", "werfault.exe", "webcache.exe", "wallpaperhost.exe", "wwahost.exe", - "wudfhost.exe", "wsreset.exe", "wsmanhttpconfig.exe", "wscollect.exe", "wpdshextautoplay.exe", - "wmpdmc.exe", "wfs.exe", "vaultsysui.exe", "vaultcmd.exe", "vssvc.exe", "utilman.exe", - "usoclient.exe", "useraccountcontrolsettings.exe", "useraccountbroker.exe", "upgraderesultsui.exe", - "ui0detect.exe", "tswpfwrp.exe", "tpminit.exe", "tokenbrokercookies.exe", "thumbnailextractionhost.exe", - "taskmgr.exe", "tapiunattend.exe", "tswbprxy.exe", "tstheme.exe", "tracert.exe", - "tcpsvcs.exe", "systemsettingsremovedevice.exe", "systemsettingsbroker.exe", "systemsettingsadminflows.exe", - "systempropertiesremote.exe", "systempropertiesprotection.exe", "systempropertiesperformance.exe", - "systempropertieshardware.exe", "systempropertiesdataexecutionprevention.exe", "systempropertiescomputername.exe", - "systempropertiesadvanced.exe", "sysreseterr.exe", "synchost.exe", "stikynot.exe", - "srtasks.exe", "sppextcomobj.exe", "spaceagent.exe", "soundrecorder.exe", "snippingtool.exe", - "sndvol.exe", "smartscreensettings.exe", "slidetoshutdown.exe", "settingsynchost.exe", - "setieinstalleddate.exe", "sensordataservice.exe", "secedit.exe", "searchprotocolhost.exe", - "searchindexer.exe", "searchfilterhost.exe", "sihclient.exe", "runtimebroker.exe", - "runlegacycplelevated.exe", "rpcping.exe", "rmclient.exe", "remoteposworker.exe", - "relpost.exe", "registeriepkeys.exe", "register-cimprovider.exe", "recoverydrive.exe", - "reagentc.exe", "rdpsauachelper.exe", "rdpsaproxy.exe", "rdpsa.exe", "route.exe", - "rmactivate_ssp_isv.exe", "rmactivate_ssp.exe", "rmactivate_isv.exe", "rmactivate.exe", - "rdspnf.exe", "proximityuxhost.exe", "printisolationhost.exe", "printdialoghost3d.exe", - "printdialoghost.exe", "printbrmui.exe", "presentationsettings.exe", "presentationhost.exe", - "pnputil.exe", "pnpunattend.exe", "pkgmgr.exe", "pickerhost.exe", "passwordonwakesettingflyout.exe", - "ping.exe", "pathping.exe", "optionalfeatures.exe", "openwith.exe", "networkuxbroker.exe", - "netplwiz.exe", "netproj.exe", "netevtfwdr.exe", "netcfgnotifyobjecthost.exe", "narrator.exe", - "netstat.exe", "napstat.exe", "musnotificationux.exe", "musnotification.exe", "multidigimon.exe", - "muiunattend.exe", "msspellcheckinghost.exe", "mpsigstub.exe", "migautoplay.exe", - "mdsched.exe", "mdres.exe", "mbaeparsertask.exe", "magnify.exe", "mschedexe.exe", - "mrt.exe", "mrinfo.exe", "mdmappinstaller.exe", "mdmagent.exe", "mdeserver.exe", - "lsaiso.exe", "logonui.exe", "lockscreencontentserver.exe", "lockapphost.exe", "locator.exe", - "locationnotifications.exe", "locationnotificationwindows.exe", "licensingui.exe", - "licensemanagershellext.exe", "legacynetuxhost.exe", "launchwinapp.exe", "launchtm.exe", - "languagecomponentsinstallercomhandler.exe", "installagent.exe", "infdefaultinstall.exe", - "icsentitlementhost.exe", "hostname.exe", "gettingstarted.exe", "genvalobj.exe", - "gamepanel.exe", "fondue.exe", "filehistory.exe", "fxsunatd.exe", "fxssvc.exe", - "fxscover.exe", "ehstorauthn.exe", "easeofaccessdialog.exe", "easpoliciesbrokerhost.exe", - "eap3host.exe", "eosnotify.exe", "edpcleanup.exe", "dxpserver.exe", "dsmusertask.exe", - "dpiscaling.exe", "dmomacpmo.exe", "dmnotificationbroker.exe", "displayswitch.exe", - "dism.exe", "disksnapshot.exe", "deviceproperties.exe", "devicepairingwizard.exe", - "deviceenroller.exe", "deviceeject.exe", "devicedisplayobjectprovider.exe", "defrag.exe", - "dataexchangehost.exe", "dwwin.exe", "dfdwiz.exe", "credentialuibroker.exe", "computerdefaults.exe", - "compattelrunner.exe", "compmgmtlauncher.exe", "cloudstoragewizard.exe", "cloudnotifications.exe", - "cloudexperiencehostbroker.exe", "clipup.exe", "checknetisolation.exe", "certenrollctrl.exe", - "castsrv.exe", "camerasettingsuihost.exe", "bytecodegenerator.exe", "bitlockerwizardelev.exe", - "bitlockerwizard.exe", "bitlockerdeviceencryption.exe", "bdeunlockwizard.exe", "bdeuisrv.exe", - "bdehdcfg.exe", "backgroundtransferhost.exe", "axinstui.exe", "autoworkplace.exe", - "authhost.exe", "atbroker.exe", "applicationframehost.exe", "adaptertroubleshooter.exe", - "arp.exe")) AND (NOT match(process_file_path, /(?i)\\windows\\syswow64/)=true) AND - (NOT match(process_file_path, /(?i)\\windows\\system32/)=true) --finding_report--' -how_to_implement: Collect endpoint data such as sysmon or 4688 events. -known_false_positives: None -references: [] -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Masquerading - Rename System Utilities - asset_type: Endpoint - confidence: 80 - impact: 70 - mitre_attack_id: - - T1036 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: A system process $process_name$ with commandline $process$ spawn in non-default - folder path in host $dest_device_id$ - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 56 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/windows-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml b/ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml deleted file mode 100644 index 96cfad43d2..0000000000 --- a/ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml +++ /dev/null @@ -1,100 +0,0 @@ -name: WBAdmin Delete System Backups -id: 71efbf52-4dbb-4c00-a520-306aa546cbb7 -version: 4 -date: '2021-12-07' -author: Michael Haag, Splunk -type: TTP -status: production -description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator - Tool) that delete backup files. This is typically used by ransomware to prevent - recovery. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_file_name="wbadmin.exe" - AND (process_cmd_line LIKE "%systemstatebackup%" OR process_cmd_line LIKE "%catalog%" - OR process_cmd_line LIKE "%delete%") --finding_report--' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint_Processess` datamodel. -known_false_positives: Administrators may modify the boot configuration. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md -- https://thedfirreport.com/2020/10/08/ryuks-return/ -- https://attack.mitre.org/techniques/T1490/ -- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin -tags: - analytic_story: - - Ryuk Ransomware - - Ransomware - asset_type: Endpoint - confidence: 50 - impact: 30 - mitre_attack_id: - - T1490 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete system - backups. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 15 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-security_bcdedit_wbadmin.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml deleted file mode 100644 index a41b9cfe34..0000000000 --- a/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml +++ /dev/null @@ -1,105 +0,0 @@ -name: WevtUtil Usage To Clear Logs -id: 5438113c-cdd9-11eb-93b8-acde48001122 -version: 5 -date: '2021-06-15' -author: Teoderick Contreras, Splunk -type: TTP -status: production -description: The wevtutil.exe application is the windows event log utility. This searches - for wevtutil.exe with parameters for clearing the application, security, setup, - powershell, sysmon, or system event logs. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (match(process_cmd_line, /(?i)powershell/)=true - OR match(process_cmd_line, /(?i)setup/)=true OR match(process_cmd_line, /(?i)application/)=true - OR match(process_cmd_line, /(?i)sysmon/)=true OR match(process_cmd_line, /(?i)system/)=true - OR match(process_cmd_line, /(?i)security/)=true) AND process_cmd_line LIKE "% cl - %" AND process_file_name="wevtutil.exe" --finding_report--' -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. -known_false_positives: The wevtutil.exe application is a legitimate Windows event - log utility. Administrators may use it to manage Windows event logs. -references: -- https://www.splunk.com/en_us/blog/security/detecting-clop-ransomware.html -tags: - analytic_story: - - Windows Log Manipulation - - Ransomware - - Clop Ransomware - - Insider Threat - - CISA AA22-264A - asset_type: Endpoint - confidence: 90 - impact: 70 - mitre_attack_id: - - T1070 - - T1070.001 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: A wevtutil process $process_name$ with commandline $process$ to clear event - logs in host $dest_device_id$ - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 63 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml b/ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml deleted file mode 100644 index d2b5835f3b..0000000000 --- a/ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml +++ /dev/null @@ -1,101 +0,0 @@ -name: Wevtutil Usage To Disable Logs -id: a4bdc944-cdd9-11eb-ac97-acde48001122 -version: 5 -date: '2021-06-15' -author: Teoderick Contreras, Splunk -type: TTP -status: production -description: This search is to detect execution of wevtutil.exe to disable logs. This - technique was seen in several ransomware to disable the event logs to evade alerts - and detections in compromised host. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_cmd_line LIKE "%/e:false%" - AND process_cmd_line LIKE "% sl %" AND process_file_name="wevtutil.exe" --finding_report--' -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. -known_false_positives: network operator may disable audit event logs for debugging - purposes. -references: -- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/ -tags: - analytic_story: - - Windows Log Manipulation - - Ransomware - - Insider Threat - - Information Sabotage - asset_type: Endpoint - confidence: 90 - impact: 70 - mitre_attack_id: - - T1070 - - T1070.001 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: A wevtutil process $process_name$ with commandline $process$ to disable - event logs in host $dest_device_id$ - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 63 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml b/ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml deleted file mode 100644 index b923a373ad..0000000000 --- a/ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml +++ /dev/null @@ -1,109 +0,0 @@ -name: Windows Bits Job Persistence -id: 1e25e97a-8ea4-11ec-9767-acde48001122 -version: 4 -date: '2022-02-15' -author: Michael Haag, Splunk -type: TTP -status: production -description: The following query identifies Microsoft Background Intelligent Transfer - Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint. - The query identifies the parameters used to create, resume or add a file to a BITS - job. Typically seen combined in a oneliner or ran in sequence. If identified, review - the BITS job created and capture any files written to disk. It is possible for BITS - to be used to upload files and this may require further network data analysis to - identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%resume%" - OR process_cmd_line LIKE "%setcustomheaders%" OR process_cmd_line LIKE "%setminretrydelay%" - OR process_cmd_line LIKE "%setnotifycmdline%" OR process_cmd_line LIKE "%setnotifyflags%" - OR process_cmd_line LIKE "%addfile%" OR process_cmd_line LIKE "%create%") AND process_file_name="bitsadmin.exe" - --finding_report--' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives will be present. Typically, applications - will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments - (legitimate applications) or parent process. -references: -- https://attack.mitre.org/techniques/T1197/ -- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute -- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ -tags: - analytic_story: - - BITS Jobs - - Living Off The Land - asset_type: Endpoint - confidence: 80 - impact: 70 - mitre_attack_id: - - T1197 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $dest_user_id$ attempting to persist using BITS. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 56 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml b/ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml deleted file mode 100644 index e8831d036f..0000000000 --- a/ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml +++ /dev/null @@ -1,113 +0,0 @@ -name: Windows Bitsadmin Download File -id: d76e8188-8f5a-11ec-ace4-acde48001122 -version: 4 -date: '2022-02-16' -author: Michael Haag, Splunk -type: TTP -status: production -description: The following query identifies Microsoft Background Intelligent Transfer - Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote - object. In addition, look for `download` or `upload` on the command-line, the switches - are not required to perform a transfer. Capture any files downloaded. Review the - reputation of the IP or domain used. Typically once executed, a follow on command - will be used to execute the dropped file. Note that the network connection or file - modification events related will not spawn or create from `bitsadmin.exe`, but the - artifacts will appear in a parallel process of `svchost.exe` with a command-line - similar to `svchost.exe -k netsvcs -s BITS`. It's important to review all parallel - and child processes to capture any behaviors and artifacts. In some suspicious and - malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose` - to list out the jobs during investigation. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_cmd_line LIKE "%transfer%" - AND process_file_name="bitsadmin.exe" --finding_report--' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives, however it may be required to filter - based on parent process name or network connection. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download -- https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md -- https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool -- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ -tags: - analytic_story: - - Ingress Tool Transfer - - BITS Jobs - - DarkSide Ransomware - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 70 - mitre_attack_id: - - T1197 - - T1105 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $dest_user_id$ attempting to download a file. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 49 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml b/ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml deleted file mode 100644 index bcfff7876f..0000000000 --- a/ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml +++ /dev/null @@ -1,109 +0,0 @@ -name: Windows CertUtil Decode File -id: b06983f4-8f72-11ec-ab50-acde48001122 -version: 4 -date: '2022-02-16' -author: Michael Haag, Splunk -type: TTP -status: production -description: CertUtil.exe may be used to `encode` and `decode` a file, including PE - and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----` - and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded - file that was downloaded. Once decoded, it will be loaded by a parallel process. - Note that there are two additional command switches that may be used - `encodehex` - and `decodehex`. Similarly, the file will be encoded in HEX and later decoded for - further execution. During triage, identify the source of the file being decoded. - Review its contents or execution behavior for further analysis. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_cmd_line LIKE "%decode%" - AND process_file_name="certutil.exe" --finding_report--' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Typically seen used to `encode` files, but it is possible to - see legitimate use of `decode`. Filter based on parent-child relationship, file - paths, endpoint or user. -references: -- https://attack.mitre.org/techniques/T1140/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1140/T1140.md -- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil -- https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/ -tags: - analytic_story: - - Deobfuscate-Decode Files or Information - - Living Off The Land - - Forest Blizzard - asset_type: Endpoint - confidence: 80 - impact: 50 - mitre_attack_id: - - T1140 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting to decode a file - on disk. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 40 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/atomic_red_team/encode-windows-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml b/ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml deleted file mode 100644 index 6e4dbd959d..0000000000 --- a/ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml +++ /dev/null @@ -1,106 +0,0 @@ -name: Windows CertUtil URLCache Download -id: 8cb1ad38-8f6d-11ec-87a3-acde48001122 -version: 4 -date: '2022-02-16' -author: Michael Haag, Splunk -type: TTP -status: production -description: Certutil.exe may download a file from a remote destination using `-urlcache`. - This behavior does require a URL to be passed on the command-line. In addition, - `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will - be used. It is not entirely common for `certutil.exe` to contact public IP space. - However, it is uncommon for `certutil.exe` to write files to world writeable paths. - - During triage, capture any files on disk and review. Review the reputation of the - remote IP or domain in question. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_file_name="certutil.exe" - AND process_cmd_line LIKE "%split%" AND process_cmd_line LIKE "%urlcache%") OR process_cmd_line - LIKE "%urlcache%" --finding_report--' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Limited false positives in most environments, however tune - as needed based on parent-child relationship or network connection. -references: -- https://attack.mitre.org/techniques/T1105/ -- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats -- https://web.archive.org/web/20210921110637/https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html -tags: - analytic_story: - - Ingress Tool Transfer - - DarkSide Ransomware - - Living Off The Land - - Forest Blizzard - asset_type: Endpoint - confidence: 100 - impact: 90 - mitre_attack_id: - - T1105 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 90 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml b/ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml deleted file mode 100644 index fe1b1e4733..0000000000 --- a/ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml +++ /dev/null @@ -1,105 +0,0 @@ -name: Windows CertUtil VerifyCtl Download -id: 9ac29c40-8f6b-11ec-b19a-acde48001122 -version: 4 -date: '2022-02-16' -author: Michael Haag, Splunk -type: TTP -status: production -description: 'Certutil.exe may download a file from a remote destination using `-VerifyCtl`. - This behavior does require a URL to be passed on the command-line. In addition, - `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will - be used. It is not entirely common for `certutil.exe` to contact public IP space. - \ During triage, capture any files on disk and review. Review the reputation of - the remote IP or domain in question. Using `-VerifyCtl`, the file will either be - written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\`. ' -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_file_name="certutil.exe" - AND process_cmd_line LIKE "%split%" AND process_cmd_line LIKE "%verifyctl%") OR - process_cmd_line LIKE "%verifyctl%" --finding_report--' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Limited false positives in most environments, however tune - as needed based on parent-child relationship or network connection. -references: -- https://attack.mitre.org/techniques/T1105/ -- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/ -- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl -- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats -tags: - analytic_story: - - Ingress Tool Transfer - - DarkSide Ransomware - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 90 - mitre_attack_id: - - T1105 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 90 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml b/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml deleted file mode 100644 index ccbe99a024..0000000000 --- a/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml +++ /dev/null @@ -1,104 +0,0 @@ -name: Windows COM Hijacking InprocServer32 Modification -id: 0ae05a0f-bc84-456b-822a-a5b9c081c7ca -version: 4 -date: '2022-10-12' -author: Michael Haag, Splunk -type: TTP -status: production -description: The following analytic identifies the use of reg.exe performing an add - to the InProcServer32, which may be related to COM hijacking. Adversaries can use - the COM system to insert malicious code that can be executed in place of legitimate - software through hijacking the COM references and relationships as a means for persistence. - Hijacking a COM object requires a change in the Registry to replace a reference - to a legitimate system component which may cause that component to not work when - executed. When that system component is executed through normal system operation - the adversary's code will be executed instead. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where match(process_cmd_line, /(?i)inprocserver32/)=true - AND process_file_name="reg.exe" --finding_report--' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: False positives may be present and some filtering may be required. -references: -- https://attack.mitre.org/techniques/T1546/015/ -- https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.015/T1546.015.md -tags: - analytic_story: - - Living Off The Land - asset_type: Endpoint - confidence: 80 - impact: 80 - mitre_attack_id: - - T1546.015 - - T1546 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ has spawned $process_name$ attempting - to modify InProcServer32 within the registry on $dest_device_id$ by $dest_user_id$. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 64 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/atomic_red_team/windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml b/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml deleted file mode 100644 index f59def188d..0000000000 --- a/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml +++ /dev/null @@ -1,113 +0,0 @@ -name: Windows Curl Upload to Remote Destination -id: cc8d046a-543b-11ec-b864-acde48001122 -version: 4 -date: '2021-12-03' -author: Michael Haag, Splunk -type: TTP -status: production -description: 'The following analytic identifies the use of Windows Curl.exe uploading - a file to a remote destination. - - `-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination. - - `-d` or `--data` POST is the HTTP method that was invented to send data to a receiving - web application, and it is, for example, how most common HTML forms on the web work. - - HTTP multipart formposts are done with `-F`, but this appears to not be compatible - with the Windows version of Curl. Will update if identified adversary tradecraft. - - Adversaries may use one of the three methods based on the remote destination and - what they are attempting to upload (zip vs txt). During triage, review parallel - processes for further behavior. In addition, identify if the upload was successful - in network logs. If a file was uploaded, isolate the endpoint and review.' -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%-f %" - OR process_cmd_line LIKE "%--data %" OR process_cmd_line LIKE "%-d %" OR process_cmd_line - LIKE "%--upload-file %" OR process_cmd_line LIKE "%-t %") AND match(process_file_name, - /(?i)curl.exe/)=true --finding_report--' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint_Processess` datamodel. -known_false_positives: False positives may be limited to source control applications - and may be required to be filtered out. -references: -- https://everything.curl.dev/usingcurl/uploads -- https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409 -- https://twitter.com/d1r4c/status/1279042657508081664?s=20 -tags: - analytic_story: - - Ingress Tool Transfer - - Insider Threat - asset_type: Endpoint - confidence: 100 - impact: 80 - mitre_attack_id: - - T1105 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ uploading a file to a remote - destination. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 80 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_default_group_policy_object_modified_with_gpme.yml b/ssa_detections/endpoint/ssa___windows_default_group_policy_object_modified_with_gpme.yml deleted file mode 100644 index d7115432d7..0000000000 --- a/ssa_detections/endpoint/ssa___windows_default_group_policy_object_modified_with_gpme.yml +++ /dev/null @@ -1,109 +0,0 @@ -name: Windows Default Group Policy Object Modified with GPME -id: bcb55c13-067b-4648-98f3-627010f72520 -version: 5 -date: '2023-05-02' -author: Mauricio Velazco, Splunk -type: TTP -status: production -description: The following analytic identifies the potential edition of a default - Group Policy Object. A fresh installation of an Active Directory network will typically - contain two default group policy objects `Default Domain Controllers Policy` and - `Default Domain Policy`. The default domain controllers policy is used to enforce - and set policies to all the domain controllers within the domain environment. The - default domain policy is linked to all users and computers by default. An adversary - who has obtained privileged access to an Active Directory network may modify the - default group policy objects to obtain further access, deploy persistence or execute - malware across a large number of hosts. Security teams should monitor the edition - of the default GPOs. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_file_name="mmc.exe" AND - process_cmd_line LIKE "%gpme.msc%") OR process_cmd_line LIKE "%31b2f340-016d-11d2-945f-00c04fb984f9%" - OR process_cmd_line LIKE "%6ac1786c-016f-11d2-945f-00c04fb984f9%" --finding_report--' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: The default Group Policy Objects within an AD network may be - legitimately updated for administrative operations, filter as needed. -references: -- https://attack.mitre.org/techniques/T1484/ -- https://attack.mitre.org/techniques/T1484/001 -- https://www.trustedsec.com/blog/weaponizing-group-policy-objects-access/ -- https://adsecurity.org/?p=2716 -- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn265969(v=ws.11) -tags: - analytic_story: - - Active Directory Privilege Escalation - asset_type: Endpoint - confidence: 50 - impact: 100 - mitre_attack_id: - - T1484 - - T1484.001 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: A default group policy object was opened with Group Policy Manage Editor - on $dest$ - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 50 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/default_domain_policy_modified/security-4688.log - source: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml deleted file mode 100644 index 0ea4db8baf..0000000000 --- a/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml +++ /dev/null @@ -1,95 +0,0 @@ -name: Windows Defender Tools in Non Standard Path -id: c205bd2e-cd5b-4224-8510-578a2a1f83d7 -version: 4 -date: '2022-07-18' -author: Lou Stella, Splunk -type: Anomaly -status: production -description: The following analytic identifies usage of the MPCmdRun utility that - can be abused by adversaries by moving it to a new directory. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where match(process_file_name, /(?i)mpcmdrun.exe/)=true - AND (NOT match(process_file_path, /(?i)\\windows defender/)=true) AND (NOT match(process_file_path, - /(?i)\\microsoft\\windows defender\\platform/)=true) --finding_report--' -how_to_implement: Collect endpoint data such as sysmon or 4688 events. -known_false_positives: False positives may be present and filtering may be required. -references: -- https://attack.mitre.org/techniques/T1036/003/ -- https://lolbas-project.github.io/lolbas/Binaries/MpCmdRun/ -tags: - analytic_story: - - Living Off The Land - asset_type: Endpoint - confidence: 80 - impact: 70 - mitre_attack_id: - - T1036 - - T1036.003 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: Process $process_name$ with commandline $process$ spawn in non-default - folder path on host $dest_device_id$ - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 56 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/mpcmdrun/windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml b/ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml deleted file mode 100644 index ee82aa42f3..0000000000 --- a/ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml +++ /dev/null @@ -1,98 +0,0 @@ -name: Windows Diskshadow Proxy Execution -id: aa502688-9037-11ec-842d-acde48001122 -version: 4 -date: '2022-02-17' -author: Lou Stella, Splunk -type: Anomaly -status: production -description: DiskShadow.exe is a Microsoft Signed binary present on Windows Server. - It has a scripting mode intended for complex scripted backup operations. This feature - also allows for execution of arbitrary unsigned code. This analytic looks for the - usage of the scripting mode flags in executions of DiskShadow. During triage, compare - to known backup behavior in your environment and then review the scripts called - by diskshadow. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%/s%" OR - process_cmd_line LIKE "%-s%") AND process_file_name="diskshadow.exe" --finding_report--' -how_to_implement: To successfully implement this search you need to be ingesting information - on processes that include the name of the process responsible for the changes from - your endpoints into the `Endpoint_Processess` datamodel. -known_false_positives: Administrators using the DiskShadow tool in their infrastructure - as a main backup tool with scripts will cause false positives -references: -- https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/ -tags: - analytic_story: - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 70 - mitre_attack_id: - - T1218 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting to run a script. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 49 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/diskshadow/windows-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml deleted file mode 100644 index 4f4ffa9cc9..0000000000 --- a/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml +++ /dev/null @@ -1,137 +0,0 @@ -name: Windows DotNet Binary in Non Standard Path -id: 21179107-099a-324a-94d3-08301e6c065f -version: 4 -date: '2022-03-17' -author: Michael Haag, Splunk -type: Anomaly -status: production -description: The following analytic identifies native .net binaries within the Windows - operating system that may be abused by adversaries by moving it to a new directory. - The analytic identifies the .net binary by using a list. If one or the other matches - an alert will be generated. Adversaries abuse these binaries as they are native - to Windows and native DotNet. Note that not all SDK (post install of Windows) are - captured in the list. Lookup - https://github.com/splunk/security_content/blob/develop/lookups/is_net_windows_file.csv. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (match(process_file_name, /(?i)MSBuild.exe/)=true - OR match(process_file_name, /(?i)comsvcconfig.exe/)=true OR match(process_file_name, - /(?i)dfsradmin.exe/)=true OR match(process_file_name, /(?i)dfsvc.exe/)=true OR match(process_file_name, - /(?i)microsoft.workflow.compiler.exe/)=true OR match(process_file_name, /(?i)smsvchost.exe/)=true - OR match(process_file_name, /(?i)wsatconfig.exe/)=true OR match(process_file_name, - /(?i)addinprocess.exe/)=true OR match(process_file_name, /(?i)addinprocess32.exe/)=true - OR match(process_file_name, /(?i)addinutil.exe/)=true OR match(process_file_name, - /(?i)aspnet_compiler.exe/)=true OR match(process_file_name, /(?i)aspnet_regbrowsers.exe/)=true - OR match(process_file_name, /(?i)aspnet_regsql.exe/)=true OR match(process_file_name, - /(?i)caspol.exe/)=true OR match(process_file_name, /(?i)datasvcutil.exe/)=true OR - match(process_file_name, /(?i)edmgen.exe/)=true OR match(process_file_name, /(?i)installutil.exe/)=true - OR match(process_file_name, /(?i)jsc.exe/)=true OR match(process_file_name, /(?i)ngentask.exe/)=true - OR match(process_file_name, /(?i)regasm.exe/)=true OR match(process_file_name, /(?i)regsvcs.exe/)=true - OR match(process_file_name, /(?i)sdnbr.exe/)=true OR match(process_file_name, /(?i)acu.exe/)=true - OR match(process_file_name, /(?i)appvstreamingux.exe/)=true OR match(process_file_name, - /(?i)dsac.exe/)=true OR match(process_file_name, /(?i)lbfoadmin.exe/)=true OR match(process_file_name, - /(?i)microsoft.uev.synccontroller.exe/)=true OR match(process_file_name, /(?i)mtedit.exe/)=true - OR match(process_file_name, /(?i)scriptrunner.exe/)=true OR match(process_file_name, - /(?i)servermanager.exe/)=true OR match(process_file_name, /(?i)stordiag.exe/)=true - OR match(process_file_name, /(?i)tzsync.exe/)=true OR match(process_file_name, /(?i)uevagentpolicygenerator.exe/)=true - OR match(process_file_name, /(?i)uevappmonitor.exe/)=true OR match(process_file_name, - /(?i)uevtemplatebaselinegenerator.exe/)=true OR match(process_file_name, /(?i)uevtemplateconfigitemgenerator.exe/)=true - OR match(process_file_name, /(?i)powershell_ise.exe/)=true OR match(process_file_name, - /(?i)iediagcmd.exe/)=true OR match(process_file_name, /(?i)xbox.tcui.exe/)=true - OR match(process_file_name, /(?i)microsoft.activedirectory.webservices.exe/)=true - OR match(process_file_name, /(?i)iisual.exe/)=true OR match(process_file_name, /(?i)filehistory.exe/)=true - OR match(process_file_name, /(?i)secureassessmentbrowser.exe/)=true) AND (NOT (match(process_file_path, - /(?i)\\windows\\system32/)=true OR match(process_file_path, /(?i)\\windows\\syswow64/)=true - OR match(process_file_path, /(?i)\\windows\\adws/)=true OR match(process_file_path, - /(?i)\\windows\\networkcontroller/)=true OR match(process_file_path, /(?i)\\windows\\systemapps/)=true - OR match(process_file_path, /(?i)\\winsxs/)=true OR match(process_file_path, /(?i)\\microsoft.net/)=true)) - --finding_report--' -how_to_implement: Collect endpoint data such as sysmon or 4688 events. -known_false_positives: False positives may be present and filtering may be required. - Certain utilities will run from non-standard paths based on the third-party application - in use. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml -- https://attack.mitre.org/techniques/T1036/003/ -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md -tags: - analytic_story: - - Masquerading - Rename System Utilities - - Unusual Processes - - Ransomware - - Signed Binary Proxy Execution InstallUtil - - WhisperGate - asset_type: Endpoint - confidence: 70 - impact: 70 - mitre_attack_id: - - T1036 - - T1036.003 - - T1218 - - T1218.004 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: A system process $process_name$ with commandline $process$ spawn in non-default - folder path on host $dest_device_id$ - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 49 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml b/ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml deleted file mode 100644 index 3a3032f3ec..0000000000 --- a/ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml +++ /dev/null @@ -1,102 +0,0 @@ -name: Windows Exchange PowerShell Module Usage -id: 1118bc65-b0c7-4589-bc2f-ad6802fd0909 -version: 4 -date: '2022-10-12' -author: Michael Haag, Splunk -type: TTP -status: production -description: 'The following analytic identifies the usage of Exchange PowerShell modules - that were recently used for a proof of concept related to ProxyShell. Currently, - there is no active data shared or data we could re-produce relate to this part of - the ProxyShell chain of exploits. - - Inherently, the usage of the modules is not malicious, but reviewing parallel processes, - and user, of the session will assist with determining the intent. - - Module - New-MailboxExportRequest will begin the process of exporting contents of - a primary mailbox or archive to a .pst file. - - Module - New-managementroleassignment can assign a management role to a management - role group, management role assignment policy, user, or universal security group - (USG). - - Module - New-MailboxSearch cmdlet to create a mailbox search and either get an estimate - of search results, place search results on In-Place Hold or copy them to a Discovery - mailbox. You can also place all contents in a mailbox on hold by not specifying - a search query, which accomplishes similar results as Litigation Hold. \ Module - - Get-Recipient cmdlet to view existing recipient objects in your organization. - This cmdlet returns all mail-enabled objects (for example, mailboxes, mail users, - mail contacts, and distribution groups).' -data_source: -- Powershell 4104 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval device_hostname = device.hostname | eval process_file = process.file | eval - process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where match(process_cmd_line, /(?i)get-recipient/)=true OR match(process_cmd_line, - /(?i)new-mailboxsearch/)=true OR match(process_cmd_line, /(?i)new-managementroleassignment/)=true - OR match(process_cmd_line, /(?i)new-mailboxexportrequest/)=true --finding_report--' -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. - This will only work with Multiline event logs, not XML. -known_false_positives: Administrators or power users may use this PowerShell commandlet -references: -- https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps -- https://docs.microsoft.com/en-us/powershell/module/exchange/new-managementroleassignment?view=exchange-ps -- https://blog.orange.tw/2021/08/proxyshell-a-new-attack-surface-on-ms-exchange-part-3.html -- https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell -- https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/ -- https://www.cisa.gov/uscert/ncas/alerts/aa22-264a -- https://learn.microsoft.com/en-us/powershell/module/exchange/new-mailboxsearch?view=exchange-ps -- https://learn.microsoft.com/en-us/powershell/module/exchange/get-recipient?view=exchange-ps -- https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/ -tags: - analytic_story: - - ProxyShell - - CISA AA22-264A - asset_type: Endpoint - confidence: 80 - impact: 40 - mitre_attack_id: - - T1059 - - T1059.001 - observable: - - name: device.hostname - type: Hostname - - name: process.file.path - type: File - - name: process.uid - type: Other - - name: process.cmd_line - type: Other - - name: actor.user.uid - type: Other - message: Exchange enumeration using PowerShell on $dest_device_id$. - product: - - Splunk Behavioral Analytics - required_fields: - - device.hostname - - process.file.path - - process.uid - - process.cmd_line - - actor.user.uid - risk_score: 32 - security_domain: endpoint - mappings: - - ocsf: device.hostname - cim: dest - - ocsf: process.file.path - cim: process_path - - ocsf: process.uid - cim: process_id - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.uid - cim: user_id -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/exchange/windows-powershell.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml deleted file mode 100644 index eeeec4cda2..0000000000 --- a/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml +++ /dev/null @@ -1,108 +0,0 @@ -name: Windows Execute Arbitrary Commands with MSDT -id: f253f9c2-10f0-4cc8-b469-f505ba8c2038 -version: 4 -date: '2022-09-15' -author: Michael Haag, Splunk -type: TTP -status: production -description: The following analytic identifies a recently disclosed arbitraty command - execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample - identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve - a remote payload. During triage, review file modifications for html. Identify parallel - process execution that may be related, including an Office Product. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where ((process_cmd_line LIKE "%ms-msdt:/id%" - OR process_cmd_line LIKE "%ms-msdt:-id%" OR process_cmd_line LIKE "%ms-msdt:/id%" - OR process_cmd_line LIKE "%ms-msdt:%" OR process_cmd_line LIKE "%msdt%") AND process_file_name="msdt.exe") - AND (match(process_cmd_line, /(?i).xml/)=true OR match(process_cmd_line, /(?i)it_rebrowseforfile=/)=true - OR match(process_cmd_line, /(?i)it_browseforfile=/)=true) AND match(process_cmd_line, - /(?i)pcwdiagnostic/)=true --finding_report--' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: False positives may be present, filter as needed. Added .xml - to potentially capture any answer file usage. Remove as needed. -references: -- https://isc.sans.edu/diary/rss/28694 -- https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e -- https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A -- https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ -- https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection -- https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html -tags: - analytic_story: - - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190 - asset_type: Endpoint - confidence: 100 - impact: 100 - mitre_attack_id: - - T1218 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: $process_name$ on $dest_device_id$ under user $dest_user_id$ possibly indicative - of indirect command execution. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 100 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt-windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___windows_file_share_discovery_with_powerview.yml b/ssa_detections/endpoint/ssa___windows_file_share_discovery_with_powerview.yml deleted file mode 100644 index 661e8529ae..0000000000 --- a/ssa_detections/endpoint/ssa___windows_file_share_discovery_with_powerview.yml +++ /dev/null @@ -1,77 +0,0 @@ -name: Windows File Share Discovery With Powerview -id: ec4f671e-c736-4f78-a4c0-8fe809e952e5 -version: 4 -date: '2023-05-02' -author: Mauricio Velazco, Splunk -type: TTP -status: production -description: The following analytic identifies the use of the Invoke-ShareFinder PowerShell - commandlet part of PowerView. This module obtains the list of all active domain - computers and lists the active shares on each computer. Network file shares in Active - Directory environments may contain sensitive information like backups, scripts, - credentials, etc. Adversaries who have obtained a foothold in an AD network may - leverage PowerView to identify secrets and leverage them for Privilege Escalation - or Lateral Movement. -data_source: -- Powershell 4104 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval device_hostname = device.hostname | eval process_file = process.file | eval - process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where match(process_cmd_line, /(?i)invoke-sharefinder/)=true --finding_report--' -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: Unknown -references: -- https://github.com/PowerShellEmpire/PowerTools/blob/master/PowerView/powerview.ps1 -- https://thedfirreport.com/2023/01/23/sharefinder-how-threat-actors-discover-file-shares/ -- https://attack.mitre.org/techniques/T1135/ -tags: - analytic_story: - - Active Directory Privilege Escalation - asset_type: Endpoint - confidence: 80 - impact: 60 - mitre_attack_id: - - T1552 - - T1552.006 - observable: - - name: device.hostname - type: Hostname - - name: process.file.path - type: File - - name: process.uid - type: Other - - name: process.cmd_line - type: Other - - name: actor.user.uid - type: Other - message: Invoke-ShareFinder commandlet was executed on $Computer$ - product: - - Splunk Behavioral Analytics - required_fields: - - device.hostname - - process.file.path - - process.uid - - process.cmd_line - - actor.user.uid - risk_score: 48 - security_domain: endpoint - mappings: - - ocsf: device.hostname - cim: dest - - ocsf: process.file.path - cim: process_path - - ocsf: process.uid - cim: process_id - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.uid - cim: user_id -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/powerview_sharefinder/windows-powershell.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___windows_findstr_gpp_discovery.yml b/ssa_detections/endpoint/ssa___windows_findstr_gpp_discovery.yml deleted file mode 100644 index 9361ded62d..0000000000 --- a/ssa_detections/endpoint/ssa___windows_findstr_gpp_discovery.yml +++ /dev/null @@ -1,105 +0,0 @@ -name: Windows Findstr GPP Discovery -id: 73ed0f19-080e-4917-b7c6-56e1760a50d4 -version: 4 -date: '2023-05-02' -author: Mauricio Velazco, Splunk -type: TTP -status: production -description: The following analytic identifies the use of the findstr command employed - to search for unsecured credentials Group Policy Preferences (GPP). GPP are tools - that allow administrators to create domain policies with embedded credentials. These - policies allow administrators to set local accounts. These group policies are stored - in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL - share and decrypt the password (using the AES key that has been made public). While - Microsoft released a patch that impedes Administrators to create unsecure credentials, - existing Group Policy Preferences files with passwords are not removed from SYSVOL. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_file_name="findstr.exe" - AND process_cmd_line LIKE "%cpassword%" --finding_report--' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrators may leverage findstr to find passwords in GPO - to validate exposure. Filter as needed. -references: -- https://attack.mitre.org/techniques/T1552/006/ -- https://pentestlab.blog/2017/03/20/group-policy-preferences/ -- https://adsecurity.org/?p=2288 -- https://www.hackingarticles.in/credential-dumping-group-policy-preferences-gpp/ -- https://support.microsoft.com/en-us/topic/ms14-025-vulnerability-in-group-policy-preferences-could-allow-elevation-of-privilege-may-13-2014-60734e15-af79-26ca-ea53-8cd617073c30 -tags: - analytic_story: - - Active Directory Privilege Escalation - asset_type: Endpoint - confidence: 80 - impact: 70 - mitre_attack_id: - - T1552 - - T1552.006 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: Findstr was executed to discover GPP credentials on $dest$ - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 56 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.006/findstr_gpp_discovery/windows-4688.log - source: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml b/ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml deleted file mode 100644 index d2dfd5b4ef..0000000000 --- a/ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml +++ /dev/null @@ -1,102 +0,0 @@ -name: Windows Ingress Tool Transfer Using Explorer -id: 695bfad6-9662-4f9e-a576-bf02a951aa60 -version: 4 -date: '2022-09-13' -author: Michael Haag, Splunk -type: TTP -status: production -description: The following analytic identifies the Windows Explorer process with a - URL within the command-line. Explorer.exe is known Windows process that handles - start menu, taskbar, desktop and file manager. Many adversaries abuse this process, - like DCRat malware, where it attempts to open the URL with the default browser application - on the target host by putting the URL as a parameter on explorer.exe process. This - anomaly detection might be a good pivot to check which user and how this process - was executed, what is the parent process and what is the URL link. This technique - is not commonly used to open an URL. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%https://%" - OR process_cmd_line LIKE "%http://%") AND process_file_name="explorer.exe" --finding_report--' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints. -known_false_positives: False positives may be present based on legitimate applications - or third party utilities. Filter out any additional parent process names. -references: -- https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor -tags: - analytic_story: - - DarkCrystal RAT - asset_type: Endpoint - confidence: 50 - impact: 50 - mitre_attack_id: - - T1105 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote - destination to download an additional payload. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 25 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105_explorer-windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml b/ssa_detections/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml deleted file mode 100644 index 5195d0b962..0000000000 --- a/ssa_detections/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml +++ /dev/null @@ -1,101 +0,0 @@ -name: Windows Lateral Tool Transfer RemCom -id: 25c6b8ba-2a61-41ad-b80c-8e97cf501920 -version: 4 -date: '2022-02-23' -author: Michael Haag, Splunk -type: TTP -status: experimental -description: This analytic identifies the use of RemCom.exe - The open source psexec. - This utility provides the ability to move laterally and run scripts or commands - remotely. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%/user:%" - OR process_cmd_line LIKE "%/pwd:%" OR process_cmd_line LIKE "%\\%") AND process_file_name="remcom.exe" - --finding_report--' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: It is possible legitimate applications may perform this behavior - and will need to be filtered. -references: -- https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ -- https://github.com/kavika13/RemCom -tags: - analytic_story: - - Active Directory Lateral Movement - - Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 80 - mitre_attack_id: - - T1570 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting to move laterally. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 40 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1570/remcom/4688_remcom_windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml deleted file mode 100644 index c877757e10..0000000000 --- a/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml +++ /dev/null @@ -1,122 +0,0 @@ -name: Windows LOLBin Binary in Non Standard Path -id: 25689101-012a-324a-94d3-08301e6c065a -version: 8 -date: '2022-08-31' -author: Michael Haag, Splunk -type: Anomaly -status: production -description: The following analytic identifies native living off the land binaries - within the Windows operating system that may be abused by adversaries by moving - it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io - site, and excluded common process names (cmd.exe, explorer.exe, csc.exe, hh.exe, - regedit.exe) and DotNet binaries. It also does not include the category of OtherMSBinaries. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_file_name IN ("bitsadmin.exe", - "certoc.exe", "certreq.exe", "certutil.exe", "cmdkey.exe", "cmdl32.exe", "cmstp.exe", - "configsecuritypolicy.exe", "control.exe", "cscript.exe", "datasvcutil.exe", "desktopimgdownldr.exe", - "dfsvc.exe", "diantz.exe", "diskshadow.exe", "dllhost.exe", "dnscmd.exe", "esentutl.exe", - "eventvwr.exe", "expand.exe", "extexport.exe", "extrac32.exe", "findstr.exe", "finger.exe", - "fltmc.exe", "forfiles.exe", "ftp.exe", "gfxdownloadwrapper.exe", "gpscript.exe", - "imewdbld.exe", "ie4uinit.exe", "ieexec.exe", "ilasm.exe", "infdefaultinstall.exe", - "makecab.exe", "mavinject.exe", "microsoft.workflow.compiler.exe", "mmc.exe", "msconfig.exe", - "msdt.exe", "mshta.exe", "msiexec.exe", "netsh.exe", "odbcconf.exe", "offlinescannershell.exe", - "pcalua.exe", "pcwrun.exe", "pktmon.exe", "pnputil.exe", "presentationhost.exe", - "print.exe", "printbrm.exe", "psr.exe", "rasautou.exe", "reg.exe", "regini.exe", - "register-cimprovider.exe", "regsvr32.exe", "replace.exe", "rpcping.exe", "rundll32.exe", - "runonce.exe", "runscripthelper.exe", "sc.exe", "schtasks.exe", "scriptrunner.exe", - "settingsynchost.exe", "syncappvpublishingserver.exe", "ttdinject.exe", "tttracer.exe", - "vbc.exe", "verclsid.exe", "wab.exe", "wlrmdr.exe", "wmic.exe", "workfolders.exe", - "wscript.exe", "wsreset.exe", "wuauclt.exe", "xwizard.exe")) AND (NOT (match(process_file_path, - /(?i)(?i)\\windows\\system32/)=true OR match(process_file_path, /(?i)(?i)\\windows\\syswow64/)=true - OR match(process_file_path, /(?i)(?i)\\windows\\networkcontrolle/)=true OR match(process_file_path, - /(?i)(?i)\\windows\\systemapps/)=true OR match(process_file_path, /(?i)(?i)\\winsxs/)=true - OR match(process_file_path, /(?i)(?i)\\microsoft.net/)=true)) --finding_report--' -how_to_implement: Collect endpoint data such as sysmon or 4688 events. -known_false_positives: False positives may be present and filtering may be required. - Certain utilities will run from non-standard paths based on the third-party application - in use. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml -- https://attack.mitre.org/techniques/T1036/003/ -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md -tags: - analytic_story: - - Unusual Processes - - Ransomware - - WhisperGate - asset_type: Endpoint - confidence: 70 - impact: 70 - mitre_attack_id: - - T1036 - - T1036.003 - - T1218 - - T1218.004 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: A system process $process_name$ with commandline $process$ spawn in non-default - folder path on host $dest_device_id$ - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 49 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_mshta_child_process.yml b/ssa_detections/endpoint/ssa___windows_mshta_child_process.yml deleted file mode 100644 index 7bac1b1328..0000000000 --- a/ssa_detections/endpoint/ssa___windows_mshta_child_process.yml +++ /dev/null @@ -1,103 +0,0 @@ -name: Windows MSHTA Child Process -id: f63f7e9c-9526-11ec-9fc7-acde48001122 -version: 6 -date: '2022-02-23' -author: Michael Haag, Splunk -type: TTP -status: production -description: The following analytic identifies child processes spawning from "mshta.exe". - The search will return the first time and last time these command-line arguments - were used for these executions, as well as the target system, the user, parent process - "mshta.exe" and its child process. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_file_name IN ("wscript.exe", - "cscript.exe", "searchprotocolhost.exe", "microsoft.workflow.compiler.exe", "msbuild.exe", - "colorcpl.exe", "scrcons.exe", "cmd.exe", "powershell.exe")) AND actor_process_file_name - LIKE "%mshta.exe" --finding_report--' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Although unlikely, some legitimate applications may exhibit - this behavior, triggering a false positive. -references: -- https://github.com/redcanaryco/AtomicTestHarnesses -- https://redcanary.com/blog/introducing-atomictestharnesses/ -tags: - analytic_story: - - Suspicious MSHTA Activity - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 80 - mitre_attack_id: - - T1218.005 - - T1218 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote - destination to download an additional payload. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 80 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml b/ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml deleted file mode 100644 index d18a11c25a..0000000000 --- a/ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml +++ /dev/null @@ -1,106 +0,0 @@ -name: Windows MSHTA Command-Line URL -id: 9b35c538-94ef-11ec-9439-acde48001122 -version: 4 -date: '2022-02-23' -author: Michael Haag, Splunk -type: TTP -status: production -description: This analytic identifies when Microsoft HTML Application Host (mshta.exe) - utility is used to make remote http connections. Adversaries may use mshta.exe to - proxy the download and execution of remote .hta files. The analytic identifies command - line arguments of http and https being used. This technique is commonly used by - malicious software to bypass preventative controls. The search will return the first - time and last time these command-line arguments were used for these executions, - as well as the target system, the user, process "rundll32.exe" and its parent process. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%https://%" - OR process_cmd_line LIKE "%http://%") AND process_file_name="mshta.exe" --finding_report--' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: It is possible legitimate applications may perform this behavior - and will need to be filtered. -references: -- https://github.com/redcanaryco/AtomicTestHarnesses -- https://redcanary.com/blog/introducing-atomictestharnesses/ -- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing -tags: - analytic_story: - - Suspicious MSHTA Activity - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 80 - mitre_attack_id: - - T1218.005 - - T1218 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote - destination to download an additional payload. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 80 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml b/ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml deleted file mode 100644 index c61bac0ae9..0000000000 --- a/ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml +++ /dev/null @@ -1,105 +0,0 @@ -name: Windows MSHTA Inline HTA Execution -id: 24962154-9524-11ec-9333-acde48001122 -version: 4 -date: '2022-02-23' -author: Michael Haag, Splunk -type: TTP -status: production -description: The following analytic identifies "mshta.exe" execution with inline protocol - handlers. "JavaScript", "VBScript", and "About" are the only supported options when - invoking HTA content directly on the command-line. The search will return the first - time and last time these command-line arguments were used for these executions, - as well as the target system, the user, process "mshta.exe" and its parent process. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%about%" - OR process_cmd_line LIKE "%javascript%" OR process_cmd_line LIKE "%vbscript%") AND - process_file_name="mshta.exe" --finding_report--' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Although unlikely, some legitimate applications may exhibit - this behavior, triggering a false positive. -references: -- https://github.com/redcanaryco/AtomicTestHarnesses -- https://redcanary.com/blog/introducing-atomictestharnesses/ -- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing -tags: - analytic_story: - - Suspicious MSHTA Activity - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 80 - mitre_attack_id: - - T1218.005 - - T1218 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ executing with inline HTA, - indicative of defense evasion. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 80 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml b/ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml deleted file mode 100644 index 16b21125db..0000000000 --- a/ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml +++ /dev/null @@ -1,102 +0,0 @@ -name: Windows Odbcconf Load Response File -id: 7b6c3fac-0c37-4efc-a85e-de88f42b6763 -version: 4 -date: '2022-09-15' -author: Michael Haag, Splunk -type: TTP -status: production -description: The following analytic identifies the odbcconf.exe, Windows Open Database - Connectivity utility, loading up a resource file. The file extension is arbitrary - and may be named anything. The resource file itself may have different commands - supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands. - During triage, review file modifications and parallel processes. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where ((process_cmd_line LIKE "%/f %" - OR process_cmd_line LIKE "%-f %") AND process_file_name="odbcconf.exe") AND process_cmd_line - LIKE "%.rsp%" --finding_report--' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: False positives may be present and filtering may need to occur - based on legitimate application usage. Filter as needed. -references: -- https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html -- https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw -tags: - analytic_story: - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 60 - mitre_attack_id: - - T1218.008 - - T1218 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: $process_name$ has been identified on $dest_device_id$ under user $dest_user_id$ - attempting to circumvent controls. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 42 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/odbcconf-windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml deleted file mode 100644 index 17d01f8122..0000000000 --- a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml +++ /dev/null @@ -1,113 +0,0 @@ -name: Windows OS Credential Dumping with Ntdsutil Export NTDS -id: dad9ddec-a72a-47be-87b6-a0f7ba98ed6e -version: 4 -date: '2022-08-31' -author: Michael Haag, Splunk -type: TTP -status: production -description: 'Monitor for signs that Ntdsutil is being used to Extract Active Directory - database - NTDS.dit, typically used for offline password cracking. It may be used - in normal circumstances with no command line arguments or shorthand variations of - more common arguments. Ntdsutil.exe is typically seen run on a Windows Server. Typical - command used to dump ntds.dit - - ntdsutil "ac i ntds" "ifm" "create full C:\Temp" q q - - This technique uses "Install from Media" (IFM), which will extract a copy of the - Active Directory database. A successful export of the Active Directory database - will yield a file modification named ntds.dit to the destination.' -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_file_name="ntdsutil.exe" - AND (process_cmd_line LIKE "%create%" AND process_cmd_line LIKE "%ntds%") --finding_report--' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Highly possible Server Administrators will troubleshoot with - ntdsutil.exe, generating false positives. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.003/T1003.003.md#atomic-test-3---dump-active-directory-database-with-ntdsutil -- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753343(v=ws.11) -- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf -- https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html -- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ -tags: - analytic_story: - - Credential Dumping - - HAFNIUM Group - - Living Off The Land - - Volt Typhoon - asset_type: Endpoint - confidence: 50 - impact: 100 - mitre_attack_id: - - T1003.003 - - T1003 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: Active Directory NTDS export on $dest_device_id$ using $process_name$ by - $dest_user_id$. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 50 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/4688_windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml deleted file mode 100644 index cdf72da030..0000000000 --- a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml +++ /dev/null @@ -1,108 +0,0 @@ -name: Windows OS Credential Dumping with Procdump -id: e102e297-dbe6-4a19-b319-5c08f4c19a06 -version: 5 -date: '2022-08-31' -author: Michael Haag, Splunk -type: TTP -status: production -description: 'Detect procdump.exe dumping the lsass process. This query looks for - both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump - file with all process memory. Both are highly suspect and should be reviewed. This - query does not monitor for the internal name (original_file_name=procdump) of the - PE or look for procdump64.exe. Modify the query as needed. - - During triage, confirm this is procdump.exe executing. If it is the first time a - Sysinternals utility has been ran, it is possible there will be a -accepteula on - the command line. Review other endpoint data sources for cross process (injection) - into lsass.exe.' -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where ((process_cmd_line LIKE "%-ma %" - OR process_cmd_line LIKE "%-mm %") AND (process_file_name IN ("procdump64.exe", - "procdump.exe"))) AND process_cmd_line LIKE "%lsass%" --finding_report--' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: None identified. -references: -- https://attack.mitre.org/techniques/T1003/001/ -- https://docs.microsoft.com/en-us/sysinternals/downloads/procdump -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump -- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ -tags: - analytic_story: - - Credential Dumping - - HAFNIUM Group - asset_type: Endpoint - confidence: 100 - impact: 80 - mitre_attack_id: - - T1003.001 - - T1003 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: Procdump was utilized to dump lsass on $dest_device_id$ by $dest_user_id$. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 80 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/procdump_windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml deleted file mode 100644 index 84b42ff6f2..0000000000 --- a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ /dev/null @@ -1,112 +0,0 @@ -name: Windows Powershell Connect to Internet With Hidden Window -id: 477e068e-8b6d-11ec-b6c1-81af21670352 -version: 6 -date: '2022-02-11' -author: Jose Hernandez, David Dorsey, Michael Haag Splunk -type: Anomaly -status: production -description: The following hunting analytic identifies PowerShell commands utilizing - the WindowStyle parameter to hide the window on the compromised endpoint. This combination - of command-line options is suspicious because it is overriding the default PowerShell - execution policy, attempts to hide its activity from the user, and connects to the - Internet. Removed in this version of the query is New-Object. The analytic identifies - all variations of WindowStyle, as PowerShell allows the ability to shorten the parameter. - For example w, win, windowsty and so forth. In addition, through our research it - was identified that PowerShell will interpret different command switch types beyond - the hyphen. We have added endash, emdash, horizontal bar, and forward slash. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_file_name IN ("powershell_ise.exe", - "powershell.exe", "sqltoolsps.exe", "sqlps.exe", "pwsh.exe")) AND match(process_cmd_line, - /(?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+h(i*d*d*e*n*)\s+/)=true --finding_report--' -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. -known_false_positives: Legitimate process can have this combination of command-line - options, but it's not common. -references: -- https://regexr.com/663rr -- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/Windows/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1 -- https://ss64.com/ps/powershell.html -- https://twitter.com/M_haggis/status/1440758396534214658?s=20 -- https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/ -tags: - analytic_story: - - Malicious PowerShell - - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns - - HAFNIUM Group - - Log4Shell CVE-2021-44228 - asset_type: Endpoint - confidence: 70 - impact: 50 - mitre_attack_id: - - T1020 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: PowerShell processes $process$ started with parameters to modify the execution - policy of the run, run in a hidden window, and connect to the Internet on host - $dest$ executed by user $user$. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 35 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/hidden_powershell/hidden_windows-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml b/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml deleted file mode 100644 index 006dbefa4b..0000000000 --- a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml +++ /dev/null @@ -1,80 +0,0 @@ -name: Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser -id: d57b4d91-fc91-4482-a325-47693cced1eb -version: 4 -date: '2022-11-14' -author: Michael Haag, Splunk -type: TTP -status: production -description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - to identify the execution of the `Get-ADUser` commandlet with specific parameters. - `Get-ADUser` is part of the Active Directory PowerShell module used to manage Windows - Active Directory networks. As the name suggests, `Get-ADUser` is used to query for - domain users. With the appropiate parameters, Get-ADUser allows adversaries to discover - domain accounts with Kerberos Pre Authentication disabled.\ Red Teams and adversaries - alike use may abuse Get-ADUSer to enumerate these accounts and attempt to crack - their passwords offline. -data_source: -- Powershell 4104 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval device_hostname = device.hostname | eval process_file = process.file | eval - process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where process_cmd_line LIKE "%4194304%" AND match(process_cmd_line, /(?i)get-aduser/)=true - --finding_report--' -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: Administrators or power users may use search for accounts with - Kerberos Pre Authentication disabled for legitimate purposes. -references: -- https://attack.mitre.org/techniques/T1558/004/ -- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html -- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/ -tags: - analytic_story: - - Active Directory Kerberos Attacks - asset_type: Endpoint - confidence: 90 - impact: 60 - mitre_attack_id: - - T1558 - - T1558.004 - observable: - - name: device.hostname - type: Hostname - - name: process.file.path - type: File - - name: process.uid - type: Other - - name: process.cmd_line - type: Other - - name: actor.user.uid - type: Other - message: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser from $dest_device_id$ - product: - - Splunk Behavioral Analytics - required_fields: - - device.hostname - - process.file.path - - process.uid - - process.cmd_line - - actor.user.uid - risk_score: 54 - security_domain: endpoint - mappings: - - ocsf: device.hostname - cim: dest - - ocsf: process.file.path - cim: process_path - - ocsf: process.uid - cim: process_id - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.uid - cim: user_id -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/windows-powershell.log - source: WinEventLog - sourcetype: WinEventLog diff --git a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml deleted file mode 100644 index 498141b4c0..0000000000 --- a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml +++ /dev/null @@ -1,80 +0,0 @@ -name: Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView -id: dc3f2af7-ca69-47ce-a122-9f9787e19417 -version: 4 -date: '2022-11-14' -author: Michael Haag, Splunk -type: TTP -status: production -description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - to identify the execution of the `Get-DomainUser` commandlet with specific parameters. - `Get-DomainUser` is part of PowerView, a PowerShell tool used to perform enumeration - on Windows Active Directory networks. As the name suggests, `Get-DomainUser` is - used to identify domain users and combining it with `-PreauthNotRequired` allows - adversaries to discover domain accounts with Kerberos Pre Authentication disabled. - - Red Teams and adversaries alike use may leverage PowerView to enumerate these accounts - and attempt to crack their passwords offline. -data_source: -- Powershell 4104 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval device_hostname = device.hostname | eval process_file = process.file | eval - process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where match(process_cmd_line, /(?i)preauthnotrequired/)=true AND match(process_cmd_line, - /(?i)get-domainuser/)=true --finding_report--' -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: Administrators or power users may use PowerView for troubleshooting -references: -- https://attack.mitre.org/techniques/T1558/004/ -- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html -- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/ -tags: - analytic_story: - - Active Directory Kerberos Attacks - asset_type: endpoint - confidence: 90 - impact: 60 - mitre_attack_id: - - T1558 - - T1558.004 - observable: - - name: device.hostname - type: Hostname - - name: process.file.path - type: File - - name: process.uid - type: Other - - name: process.cmd_line - type: Other - - name: actor.user.uid - type: Other - message: Disabled Kerberos Pre-Authentication Discovery With PowerView from $dest_device_id$ - product: - - Splunk Behavioral Analytics - required_fields: - - device.hostname - - process.file.path - - process.uid - - process.cmd_line - - actor.user.uid - risk_score: 54 - security_domain: endpoint - mappings: - - ocsf: device.hostname - cim: dest - - ocsf: process.file.path - cim: process_path - - ocsf: process.uid - cim: process_id - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.uid - cim: user_id -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdomainuser.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml b/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml deleted file mode 100644 index 0b02513d2a..0000000000 --- a/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml +++ /dev/null @@ -1,106 +0,0 @@ -name: Windows Powershell DownloadFile -id: 46440222-81d5-44b1-a376-19dcd70d1b08 -version: 5 -date: '2022-02-11' -author: Jose Hernandez, Michael Haag, Splunk -type: Anomaly -status: production -description: The following analytic identifies the use of PowerShell downloading a - file using `DownloadFile` method. This particular method is utilized in many different - PowerShell frameworks to download files and output to disk. Identify the source - (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell - transaction logs are available, review for further details of the implant. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_file_name IN ("powershell_ise.exe", - "powershell.exe", "sqltoolsps.exe", "sqlps.exe", "pwsh.exe", "pwsh.exe")) AND match(process_cmd_line, - /(?i)downloadfile/)=true --finding_report--' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present and filtering will need to occur - by parent process or command line argument. It may be required to modify this query - to an EDR product for more granular coverage. -references: -- https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0 -- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md -tags: - analytic_story: - - Malicious PowerShell - - Ingress Tool Transfer - - Log4Shell CVE-2021-44228 - asset_type: Endpoint - confidence: 70 - impact: 50 - mitre_attack_id: - - T1020 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile - within PowerShell. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 35 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/downloadfile_windows-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_powershell_downloadstring.yml b/ssa_detections/endpoint/ssa___windows_powershell_downloadstring.yml deleted file mode 100644 index e922810c55..0000000000 --- a/ssa_detections/endpoint/ssa___windows_powershell_downloadstring.yml +++ /dev/null @@ -1,119 +0,0 @@ -name: Windows Powershell DownloadString -id: e4a2cc58-59d4-480a-8992-9dfb95a4bacd -version: 1 -date: '2024-03-19' -author: Michael Haag, Splunk -type: TTP -status: production -description: The following analytic identifies the use of PowerShell downloading a - file using `DownloadString` method. This particular method is utilized in many different - PowerShell frameworks to download files and output to disk. Identify the source - (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell - transaction logs are available, review for further details of the implant. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_file_name IN ("powershell_ise.exe", - "powershell.exe", "sqltoolsps.exe", "sqlps.exe", "pwsh.exe", "pwsh.exe")) AND match(process_cmd_line, - /(?i)DownloadString/)=true --finding_report--' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: False positives may be present and filtering will need to occur - by parent process or command line argument. It may be required to modify this query - to an EDR product for more granular coverage. -references: -- https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-5.0 -- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md -- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ -tags: - analytic_story: - - Winter Vivern - - Ingress Tool Transfer - - Hermetic Wiper - - Malicious PowerShell - - HAFNIUM Group - - Data Destruction - - IcedID - - SysAid On-Prem Software CVE-2023-47246 Vulnerability - asset_type: Endpoint - confidence: 70 - impact: 80 - mitre_attack_id: - - T1059 - - T1059.001 - - T1105 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadString - within PowerShell. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 56 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-security-2.log - source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___windows_powershell_execution_policy_bypass.yml b/ssa_detections/endpoint/ssa___windows_powershell_execution_policy_bypass.yml deleted file mode 100644 index 998eb424cc..0000000000 --- a/ssa_detections/endpoint/ssa___windows_powershell_execution_policy_bypass.yml +++ /dev/null @@ -1,114 +0,0 @@ -name: Windows Powershell Execution Policy Bypass -id: 1d20daaa-f99e-4770-a25c-e84e8cd32825 -version: 1 -date: '2024-03-19' -author: Patrick Bareiss, Splunk -type: TTP -status: validation -description: The following analytic detects the initiation of PowerShell processes - with parameters specifically designed to bypass the local script execution policy. - It identifies this behavior by searching for commandline arguments that are commonly - used in malicious activities to circumvent the built-in security mechanisms of PowerShell. - This detection is crucial for a Security Operations Center (SOC) as bypassing the - execution policy can allow attackers to execute arbitrary scripts, leading to unauthorized - actions, data exfiltration, or further system compromise. The impact of such an - attack can be significant, potentially resulting in the loss of sensitive information - or control over critical systems. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_file_name IN ("powershell_ise.exe", - "powershell.exe", "sqltoolsps.exe", "sqlps.exe", "pwsh.exe", "pwsh.exe")) AND match(process_cmd_line, - /(?i)Bypass/)=true --finding_report--' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: There may be legitimate reasons to bypass the PowerShell execution - policy. The PowerShell script being run with this parameter should be validated - to ensure that it is legitimate. -references: -- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ -tags: - analytic_story: - - DHS Report TA18-074A - - HAFNIUM Group - - DarkCrystal RAT - - AsyncRAT - - Volt Typhoon - asset_type: Endpoint - confidence: 60 - impact: 70 - mitre_attack_id: - - T1059 - - T1059.001 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: PowerShell local execution policy bypass attempt on $dest$ - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 42 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/encoded_powershell/windows-security.log - source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___windows_powershell_export_certificate.yml b/ssa_detections/endpoint/ssa___windows_powershell_export_certificate.yml deleted file mode 100644 index 17af97eb96..0000000000 --- a/ssa_detections/endpoint/ssa___windows_powershell_export_certificate.yml +++ /dev/null @@ -1,76 +0,0 @@ -name: Windows PowerShell Export Certificate -id: 0bf87e10-4d7d-4c63-9721-c7b3f6e6e944 -version: 3 -date: '2023-05-01' -author: Michael Haag, Splunk -type: Anomaly -status: experimental -description: The following analytic identifies the PowerShell Cmdlet export-certificate - utilizing Script Block Logging. This particular behavior is related to an adversary - attempting to steal certificates local to the Windows endpoint within the Certificate - Store. -data_source: -- Powershell 4104 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval device_hostname = device.hostname | eval process_file = process.file | eval - process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where match(process_cmd_line, /(?i)export-certificate/)=true --finding_report--' -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: It is possible administrators or scripts may run these commands, - filtering may be required. -references: -- https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj -- https://learn.microsoft.com/en-us/powershell/module/pki/export-certificate?view=windowsserver2022-ps -tags: - analytic_story: - - Windows Certificate Services - asset_type: Endpoint - confidence: 60 - impact: 60 - mitre_attack_id: - - T1552.004 - - T1552 - - T1649 - observable: - - name: device.hostname - type: Hostname - - name: process.file.path - type: File - - name: process.uid - type: Other - - name: process.cmd_line - type: Other - - name: actor.user.uid - type: Other - message: A PowerShell Cmdlet related to exporting a Certificate was ran on $dest_device_id$, - attempting to export a certificate. - product: - - Splunk Behavioral Analytics - required_fields: - - device.hostname - - process.file.path - - process.uid - - process.cmd_line - - actor.user.uid - risk_score: 36 - security_domain: endpoint - mappings: - - ocsf: device.hostname - cim: dest - - ocsf: process.file.path - cim: process_path - - ocsf: process.uid - cim: process_id - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.uid - cim: user_id -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_certificate.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___windows_powershell_export_pfxcertificate.yml b/ssa_detections/endpoint/ssa___windows_powershell_export_pfxcertificate.yml deleted file mode 100644 index 6bb356132c..0000000000 --- a/ssa_detections/endpoint/ssa___windows_powershell_export_pfxcertificate.yml +++ /dev/null @@ -1,76 +0,0 @@ -name: Windows PowerShell Export PFXCertificate -id: 0c93bb7a-df21-477e-a623-b0c37c1c6661 -version: 3 -date: '2023-05-18' -author: Michael Haag, Splunk -type: Anomaly -status: experimental -description: The following analytic identifies the PowerShell Cmdlet export-pfxcertificate - utilizing Script Block Logging. This particular behavior is related to an adversary - attempting to steal certificates local to the Windows endpoint within the Certificate - Store. -data_source: -- Powershell 4104 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval device_hostname = device.hostname | eval process_file = process.file | eval - process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where match(process_cmd_line, /(?i)export-pfxcertificate/)=true --finding_report--' -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: It is possible administrators or scripts may run these commands, - filtering may be required. -references: -- https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj -- https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps -tags: - analytic_story: - - Windows Certificate Services - asset_type: Endpoint - confidence: 60 - impact: 60 - mitre_attack_id: - - T1552.004 - - T1552 - - T1649 - observable: - - name: device.hostname - type: Hostname - - name: process.file.path - type: File - - name: process.uid - type: Other - - name: process.cmd_line - type: Other - - name: actor.user.uid - type: Other - message: A PowerShell Cmdlet related to exporting a Certificate was ran on $dest_device_id$, - attempting to export a pfxcertificate. - product: - - Splunk Behavioral Analytics - required_fields: - - device.hostname - - process.file.path - - process.uid - - process.cmd_line - - actor.user.uid - risk_score: 36 - security_domain: endpoint - mappings: - - ocsf: device.hostname - cim: dest - - ocsf: process.file.path - cim: process_path - - ocsf: process.uid - cim: process_id - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.uid - cim: user_id -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_pfx-windows-powershell.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml b/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml deleted file mode 100644 index a790cbc58a..0000000000 --- a/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml +++ /dev/null @@ -1,104 +0,0 @@ -name: Windows PowerShell Start-BitsTransfer -id: 0bafd086-8f61-11ec-996e-acde48001122 -version: 5 -date: '2022-02-16' -author: Michael Haag, Splunk -type: TTP -status: production -description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar - functionality is present. This technique variation is not as commonly used by adversaries, - but has been abused in the past. Lesser known uses include the ability to set the - `-TransferType` to `Upload` for exfiltration of files. In an instance where `Upload` - is used, it is highly possible files will be archived. During triage, review parallel - processes and process lineage. Capture any files on disk and review. For the remote - domain or IP, what is the reputation? -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_file_name IN ("powershell_ise.exe", - "powershell.exe", "sqltoolsps.exe", "sqlps.exe", "pwsh.exe", "pwsh.exe")) AND match(process_cmd_line, - /(?i)start-bitstransfer/)=true --finding_report--' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint_Processess` datamodel. -known_false_positives: Limited false positives. It is possible administrators will - utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent - process or command-line arguments. -references: -- https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281 -- https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs -tags: - analytic_story: - - BITS Jobs - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 70 - mitre_attack_id: - - T1197 - - T1105 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $dest_user_id$ attempting to download a file. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 49 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/T1197_windows-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_powersploit_gpp_discovery.yml b/ssa_detections/endpoint/ssa___windows_powersploit_gpp_discovery.yml deleted file mode 100644 index 4202ace770..0000000000 --- a/ssa_detections/endpoint/ssa___windows_powersploit_gpp_discovery.yml +++ /dev/null @@ -1,82 +0,0 @@ -name: Windows PowerSploit GPP Discovery -id: fdef746e-71fb-41ce-8ab2-b4a5a6b50ca2 -version: 4 -date: '2023-05-02' -author: Mauricio Velazco, Splunk -type: TTP -status: production -description: The following analytic identifies the use of the Get-GPPPassword PowerShell - commandlet employed to search for unsecured credentials Group Policy Preferences - (GPP). GPP are tools that allow administrators to create domain policies with embedded - credentials. These policies allow administrators to set local accounts. These group - policies are stored in SYSVOL on a domain controller. This means that any domain - user can view the SYSVOL share and decrypt the password (using the AES key that - has been made public). While Microsoft released a patch that impedes Administrators - to create unsecure credentials, existing Group Policy Preferences files with passwords - are not removed from SYSVOL. -data_source: -- Powershell 4104 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval device_hostname = device.hostname | eval process_file = process.file | eval - process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where match(process_cmd_line, /(?i)get-gpppassword/)=true --finding_report--' -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: Unknown -references: -- https://attack.mitre.org/techniques/T1552/006/ -- https://pentestlab.blog/2017/03/20/group-policy-preferences/ -- https://adsecurity.org/?p=2288 -- https://www.hackingarticles.in/credential-dumping-group-policy-preferences-gpp/ -- https://adsecurity.org/?p=2288 -- https://support.microsoft.com/en-us/topic/ms14-025-vulnerability-in-group-policy-preferences-could-allow-elevation-of-privilege-may-13-2014-60734e15-af79-26ca-ea53-8cd617073c30 -tags: - analytic_story: - - Active Directory Privilege Escalation - asset_type: Endpoint - confidence: 80 - impact: 70 - mitre_attack_id: - - T1552 - - T1552.006 - observable: - - name: device.hostname - type: Hostname - - name: process.file.path - type: File - - name: process.uid - type: Other - - name: process.cmd_line - type: Other - - name: actor.user.uid - type: Other - message: Commandlets leveraged to discover GPP credentials were executed on $Computer$ - product: - - Splunk Behavioral Analytics - required_fields: - - device.hostname - - process.file.path - - process.uid - - process.cmd_line - - actor.user.uid - risk_score: 56 - security_domain: endpoint - mappings: - - ocsf: device.hostname - cim: dest - - ocsf: process.file.path - cim: process_path - - ocsf: process.uid - cim: process_id - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.uid - cim: user_id -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.006/powershell_gpp_discovery/win-powershell.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml b/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml deleted file mode 100644 index 3b8fe5bb9e..0000000000 --- a/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml +++ /dev/null @@ -1,105 +0,0 @@ -name: Windows Rasautou DLL Execution -id: 6f42b8ce-1e15-11ec-ad5a-acde48001122 -version: 4 -date: '2022-02-15' -author: Michael Haag, Splunk -type: TTP -status: production -description: The following analytic identifies the Windows Windows Remote Auto Dialer, - rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary - shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review - parent and child process behavior including file and image loads. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_file_name="rasautou.exe" - AND match(process_cmd_line, /(?i)-p /)=true AND match(process_cmd_line, /(?i)-d - /)=true --finding_report--' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives will be limited to applications that require - Rasautou.exe to load a DLL from disk. Filter as needed. -references: -- https://github.com/mandiant/DueDLLigence -- https://github.com/MHaggis/notes/blob/master/utilities/Invoke-SPLDLLigence.ps1 -- https://gist.github.com/NickTyrer/c6043e4b302d5424f701f15baf136513 -- https://www.mandiant.com/resources/staying-hidden-on-the-endpoint-evading-detection-with-shellcode -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 80 - mitre_attack_id: - - T1055.001 - - T1218 - - T1055 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ attempting to load a DLL in a suspicious manner. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 80 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_remote_create_service.yml b/ssa_detections/endpoint/ssa___windows_remote_create_service.yml deleted file mode 100644 index 09f37b09be..0000000000 --- a/ssa_detections/endpoint/ssa___windows_remote_create_service.yml +++ /dev/null @@ -1,102 +0,0 @@ -name: Windows Remote Create Service -id: 0259ff91-a6f3-4af1-af83-6360eff7fd80 -version: 4 -date: '2023-05-18' -author: Michael Haag, Splunk -type: TTP -status: experimental -description: This analytic identifies an endpoint that remotely connects to another - endpoint to create a new service using sc.exe. On the remote endpoint, the new service - will be created and this action will trigger the creation of EventCode 7045 along - with all the resulting service information. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (match(process_cmd_line, /(?i)create/)=true - OR match(process_cmd_line, /(?i)\\/)=true) AND process_file_name="sc.exe" --finding_report--' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Note that false positives may occur, and filtering may be necessary, - especially when it comes to remote service creation by administrators or software - management utilities. -references: -- https://attack.mitre.org/techniques/T1543/003/ -tags: - analytic_story: - - Active Directory Lateral Movement - asset_type: Endpoint - confidence: 50 - impact: 50 - mitre_attack_id: - - T1543 - - T1543.003 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting to create a remote - service. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 25 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/atomic_red_team/4688-remote-service-create-windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml deleted file mode 100644 index 126837f4db..0000000000 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml +++ /dev/null @@ -1,103 +0,0 @@ -name: Windows Rename System Utilities Acccheckconsole exe LOLBAS in Non Standard Path -id: c842931e-661f-42bc-a4df-0460d93cfb69 -version: 5 -date: '2024-04-03' -author: Splunk Threat Research Bot, Lou Stella, Splunk -type: Anomaly -status: production -description: The following analytic identifies AccCheckConsole.exe which is a native - living off the land binary or script (LOLBAS) within the Windows operating system - that may be abused by adversaries by moving it to a new directory. The list of binaries - was derived from the https://lolbas-project.github.io site. The specific default - filepath for AccCheckConsole.exe is within "C:\Program Files (x86)\Windows Kits\10\bin\10.0.22000.0\". -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_file_name="acccheckconsole.exe" - AND (NOT match(process_file_path, /(?i)\\program files \(x86\)\\windows kits\\10\\bin\\10.0.22000.0\\(x86|x64|arm|arm64)\\accchecker\\/)=true) - --finding_report--' -how_to_implement: To successfully implement this search, you must be ingesting logs - with the process name, command-line arguments, and parent processes from your endpoints. - Collect endpoint data such as Sysmon or Windows Events 4688. -known_false_positives: False positives may be present and filtering may be required. - Certain utilities will run from non-standard paths based on the third-party application - in use. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml -- https://attack.mitre.org/techniques/T1036/003/ -- https://lolbas-project.github.io/lolbas/OtherMSBinaries/AccCheckConsole/ -tags: - analytic_story: - - Unusual Processes - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 20 - mitre_attack_id: - - T1036 - - T1036.003 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: A system process $process_name$ with path $process_path$ spawn in non-default - folder path on host $dest_device_id$ - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 14 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml deleted file mode 100644 index 5725a063a2..0000000000 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml +++ /dev/null @@ -1,103 +0,0 @@ -name: Windows Rename System Utilities Adplus exe LOLBAS in Non Standard Path -id: ecaaf956-c516-4980-b08e-8c01c19614ca -version: 5 -date: '2022-04-03' -author: Splunk Threat Research Bot, Lou Stella, Splunk -type: Anomaly -status: production -description: The following analytic identifies adplus.exe which is a native living - off the land binary or script (LOLBAS) within the Windows operating system that - may be abused by adversaries by moving it to a new directory. The list of binaries - was derived from the https://lolbas-project.github.io site. The specific default - filepath for adplus.exe is within "C:\Program Files (x86)\Windows Kits\10\Debuggers". -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_file_name="adplus.exe" - AND (NOT match(process_file_path, /(?i)\\program files \(x86\)\\windows kits\\10\\debuggers\\(x86|x64|arm|arm64)\\/)=true) - --finding_report--' -how_to_implement: To successfully implement this search, you must be ingesting logs - with the process name, command-line arguments, and parent processes from your endpoints. - Collect endpoint data such as Sysmon or Windows Events 4688. -known_false_positives: False positives may be present and filtering may be required. - Certain utilities will run from non-standard paths based on the third-party application - in use. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml -- https://attack.mitre.org/techniques/T1036/003/ -- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Adplus/ -tags: - analytic_story: - - Unusual Processes - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 20 - mitre_attack_id: - - T1036 - - T1036.003 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: A system process $process_name$ with path $process_path$ spawn in non-default - folder path on host $dest_device_id$ - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 14 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml deleted file mode 100644 index d1546f1ae5..0000000000 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml +++ /dev/null @@ -1,103 +0,0 @@ -name: Windows Rename System Utilities Advpack dll LOLBAS in Non Standard Path -id: 3284e4f4-67f7-49b6-ad5e-a8fcead2eef8 -version: 5 -date: '2024-04-03' -author: Splunk Threat Research Bot, Lou Stella, Splunk -type: Anomaly -status: production -description: The following analytic identifies Advpack.dll which is a native living - off the land binary or script (LOLBAS) within the Windows operating system that - may be abused by adversaries by moving it to a new directory. The list of binaries - was derived from the https://lolbas-project.github.io site. The specific default - filepath for advpack.dll is within either "C:\Windows\System32" or "C:\Windows\SysWOW64". -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_file_name="advpack.dll" - AND (NOT match(process_file_path, /(?i)\\windows\\(syswow64|system32)\\/)=true) - --finding_report--' -how_to_implement: To successfully implement this search, you must be ingesting logs - with the process name, command-line arguments, and parent processes from your endpoints. - Collect endpoint data such as Sysmon or Windows Events 4688. -known_false_positives: False positives may be present and filtering may be required. - Certain utilities will run from non-standard paths based on the third-party application - in use. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml -- https://attack.mitre.org/techniques/T1036/003/ -- https://lolbas-project.github.io/lolbas/Libraries/Advpack/ -tags: - analytic_story: - - Unusual Processes - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 20 - mitre_attack_id: - - T1036 - - T1036.003 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: A system process $process_name$ with path $process_path$ spawn in non-default - folder path on host $dest_device_id$ - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 14 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml deleted file mode 100644 index 6ed5de8696..0000000000 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml +++ /dev/null @@ -1,104 +0,0 @@ -name: Windows Rename System Utilities Agentexecutor exe LOLBAS in Non Standard Path -id: e124f71f-11bc-47e4-9931-6046d256005d -version: 5 -date: '2024-04-03' -author: Splunk Threat Research Bot, Lou Stella, Splunk -type: Anomaly -status: production -description: The following analytic identifies AgentExecutor.exe which is a native - living off the land binary or script (LOLBAS) within the Windows operating system - that may be abused by adversaries by moving it to a new directory. The list of binaries - was derived from the https://lolbas-project.github.io site. The specific default - filepath for AgentExecutor.exe should be "C:\Program Files (x86)\Microsoft Intune - Management Extension". -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_file_name="agentexecutor.exe" - AND (NOT match(process_file_path, /(?i)\\program files (x86)\\microsoft intune management - extension\\/)=true) --finding_report--' -how_to_implement: To successfully implement this search, you must be ingesting logs - with the process name, command-line arguments, and parent processes from your endpoints. - Collect endpoint data such as Sysmon or Windows Events 4688. -known_false_positives: False positives may be present and filtering may be required. - Certain utilities will run from non-standard paths based on the third-party application - in use. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml -- https://attack.mitre.org/techniques/T1036/003/ -- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Agentexecutor/ -tags: - analytic_story: - - Unusual Processes - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 20 - mitre_attack_id: - - T1036 - - T1036.003 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: A system process $process_name$ with path $process_path$ spawn in non-default - folder path on host $dest_device_id$ - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 14 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml deleted file mode 100644 index 81cf2c50b0..0000000000 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml +++ /dev/null @@ -1,103 +0,0 @@ -name: Windows Rename System Utilities Appinstaller exe LOLBAS in Non Standard Path -id: 057c06c7-ef31-4749-b5c9-199152e53a06 -version: 5 -date: '2024-04-03' -author: Splunk Threat Research Bot, Lou Stella, Splunk -type: Anomaly -status: production -description: The following analytic identifies AppInstaller.exe which is a native - living off the land binary or script (LOLBAS) within the Windows operating system - that may be abused by adversaries by moving it to a new directory. The list of binaries - was derived from the https://lolbas-project.github.io site. The specific default - filepath for AppInstaller.exe should be in "C:\Program Files\WindowsApps\". -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_file_name="appinstaller.exe" - AND (NOT match(process_file_path, /(?i)\\program files\\windowsapps\\microsoft.desktopappinstaller_/)=true) - --finding_report--' -how_to_implement: To successfully implement this search, you must be ingesting logs - with the process name, command-line arguments, and parent processes from your endpoints. - Collect endpoint data such as Sysmon or Windows Events 4688. -known_false_positives: False positives may be present and filtering may be required. - Certain utilities will run from non-standard paths based on the third-party application - in use. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml -- https://attack.mitre.org/techniques/T1036/003/ -- https://lolbas-project.github.io/lolbas/Binaries/AppInstaller/ -tags: - analytic_story: - - Unusual Processes - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 20 - mitre_attack_id: - - T1036 - - T1036.003 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: A system process $process_name$ with path $process_path$ spawn in non-default - folder path on host $dest_device_id$ - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 14 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml deleted file mode 100644 index f534044967..0000000000 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml +++ /dev/null @@ -1,103 +0,0 @@ -name: Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard Path -id: 93862a89-abe0-4094-909a-08ec390aa5e3 -version: 5 -date: '2024-04-03' -author: Splunk Threat Research Bot, Lou Stella, Splunk -type: Anomaly -status: production -description: The following analytic identifies Appvlp.exe which is a native living - off the land binary or script (LOLBAS) within the Windows operating system that - may be abused by adversaries by moving it to a new directory. The list of binaries - was derived from the https://lolbas-project.github.io site. The specific default - filepath for Appvlp.exe should be "C:\Program Files\Microsoft Office\root\client". -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_file_name="appvlp.exe" - AND (NOT match(process_file_path, /(?i)\\program files(| \(x86\))\\microsoft office\\root\\client/)=true) - --finding_report--' -how_to_implement: To successfully implement this search, you must be ingesting logs - with the process name, command-line arguments, and parent processes from your endpoints. - Collect endpoint data such as Sysmon or Windows Events 4688. -known_false_positives: False positives may be present and filtering may be required. - Certain utilities will run from non-standard paths based on the third-party application - in use. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml -- https://attack.mitre.org/techniques/T1036/003/ -- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Appvlp/ -tags: - analytic_story: - - Unusual Processes - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 20 - mitre_attack_id: - - T1036 - - T1036.003 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: A system process $process_name$ with path $process_path$ spawn in non-default - folder path on host $dest_device_id$ - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 14 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml deleted file mode 100644 index d6f3eaeadc..0000000000 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml +++ /dev/null @@ -1,103 +0,0 @@ -name: Windows Rename System Utilities Aspnet compiler exe LOLBAS in Non Standard Path -id: d75cc561-3828-4d0a-92c4-0eb93bfe0929 -version: 5 -date: '2024-04-03' -author: Splunk Threat Research Bot, Lou Stella, Splunk -type: Anomaly -status: production -description: The following analytic identifies Aspnet_Compiler.exe which is a native - living off the land binary or script (LOLBAS) within the Windows operating system - that may be abused by adversaries by moving it to a new directory. The list of binaries - was derived from the https://lolbas-project.github.io site. The specific default - filepath for the Aspnet_compiler.exe should be in "C:\Windows\Microsoft.NET\Framework\". -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_file_name="aspnet_compiler.exe" - AND (NOT match(process_file_path, /(?i)\\windows\\microsoft.net\\(framework|framework64)\\v[0-9]+\.[0-9]+\.[0-9]+\\/)=true) - --finding_report--' -how_to_implement: To successfully implement this search, you must be ingesting logs - with the process name, command-line arguments, and parent processes from your endpoints. - Collect endpoint data such as Sysmon or Windows Events 4688. -known_false_positives: False positives may be present and filtering may be required. - Certain utilities will run from non-standard paths based on the third-party application - in use. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml -- https://attack.mitre.org/techniques/T1036/003/ -- https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/ -tags: - analytic_story: - - Unusual Processes - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 20 - mitre_attack_id: - - T1036 - - T1036.003 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: A system process $process_name$ with path $process_path$ spawn in non-default - folder path on host $dest_device_id$ - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 14 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml deleted file mode 100644 index b4033ba45b..0000000000 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml +++ /dev/null @@ -1,102 +0,0 @@ -name: Windows Rename System Utilities At exe LOLBAS in Non Standard Path -id: 6401d583-0052-4dc5-a713-68b510826d2b -version: 5 -date: '2024-04-03' -author: Splunk Threat Research Bot, Lou Stella, Splunk -type: Anomaly -status: production -description: The following analytic identifies At.exe which is a native living off - the land binary or script (LOLBAS) within the Windows operating system that may - be abused by adversaries by moving it to a new directory. The list of binaries was - derived from the https://lolbas-project.github.io site. The specific default filepath - should be either "C:\Windows\System32\" or "C:\Windows\SysWOW64\". -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_file_name="at.exe" AND - (NOT match(process_file_path, /(?i)\\windows\\(syswow64|system32)\\/)=true) --finding_report--' -how_to_implement: To successfully implement this search, you must be ingesting logs - with the process name, command-line arguments, and parent processes from your endpoints. - Collect endpoint data such as Sysmon or Windows Events 4688. -known_false_positives: False positives may be present and filtering may be required. - Certain utilities will run from non-standard paths based on the third-party application - in use. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml -- https://attack.mitre.org/techniques/T1036/003/ -- https://lolbas-project.github.io/lolbas/Binaries/At/ -tags: - analytic_story: - - Unusual Processes - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 20 - mitre_attack_id: - - T1036 - - T1036.003 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: A system process $process_name$ with path $process_path$ spawn in non-default - folder path on host $dest_device_id$ - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 14 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml deleted file mode 100644 index 529d7dfa2d..0000000000 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml +++ /dev/null @@ -1,103 +0,0 @@ -name: Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard Path -id: b8da7ea5-8c16-4eff-9787-54ec271159e0 -version: 5 -date: '2024-04-03' -author: Splunk Threat Research Bot, Lou Stella, Splunk -type: Anomaly -status: production -description: The following analytic identifies Atbroker.exe which is a native living - off the land binary or script (LOLBAS) within the Windows operating system that - may be abused by adversaries by moving it to a new directory. The list of binaries - was derived from the https://lolbas-project.github.io site. The specific default - filepath should be either "C:\Windows\System32\" or "C:\Windows\SysWOW64\". -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_file_name="atbroker.exe" - AND (NOT match(process_file_path, /(?i)\\windows\\(syswow64|system32)\\/)=true) - --finding_report--' -how_to_implement: To successfully implement this search, you must be ingesting logs - with the process name, command-line arguments, and parent processes from your endpoints. - Collect endpoint data such as Sysmon or Windows Events 4688. -known_false_positives: False positives may be present and filtering may be required. - Certain utilities will run from non-standard paths based on the third-party application - in use. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml -- https://attack.mitre.org/techniques/T1036/003/ -- https://lolbas-project.github.io/lolbas/Binaries/Atbroker/ -tags: - analytic_story: - - Unusual Processes - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 20 - mitre_attack_id: - - T1036 - - T1036.003 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: A system process $process_name$ with path $process_path$ spawn in non-default - folder path on host $dest_device_id$ - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 14 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml b/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml deleted file mode 100644 index 040f44c5cc..0000000000 --- a/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml +++ /dev/null @@ -1,99 +0,0 @@ -name: Windows Rundll32 Comsvcs Memory Dump -id: 76bb9e35-f314-4c3d-a385-83c72a13ce4e -version: 8 -date: '2022-04-14' -author: Jose Hernandez, Michael Haag, Splunk -type: TTP -status: production -description: The following analytic identifies memory dumping using comsvcs.dll with - the minidump function with `rundll32.exe`. This technique is common with adversaries - who would like to dump the memory of lsass.exe. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (match(process_cmd_line, /(?i)minidump/)=true - AND process_file_name="rundll32.exe") AND match(process_cmd_line, /(?i)comsvcs.dll/)=true - --finding_report--' -how_to_implement: You must be ingesting endpoint data that tracks process activity, - including Windows command line logging. You can see how we test this with [Event - Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a) - on the [attack_range](https://github.com/splunk/attack_range/blob/develop/ansible/roles/windows_common/tasks/windows-enable-4688-cmd-line-audit.yml). -known_false_positives: False positives should be limited, filter as needed. -references: -- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-3---dump-lsassexe-memory-using-comsvcsdll -tags: - analytic_story: - - Credential Dumping - - Suspicious Rundll32 Activity - asset_type: Endpoint - confidence: 100 - impact: 40 - mitre_attack_id: - - T1003.003 - - T1003 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: A dump of a process was attempted using comsvcs.dll with the minidump function - on endpoint $dest_device_id$ by user $dest_device_user$. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 40 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml b/ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml deleted file mode 100644 index 399dc6a549..0000000000 --- a/ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml +++ /dev/null @@ -1,106 +0,0 @@ -name: Windows Rundll32 Inline HTA Execution -id: 0caa1dd6-94f5-11ec-9786-acde48001122 -version: 4 -date: '2022-02-23' -author: Michael Haag, Splunk -type: TTP -status: production -description: The following analytic identifies "rundll32.exe" execution with inline - protocol handlers. "JavaScript", "VBScript", and "About" are the only supported - options when invoking HTA content directly on the command-line. This type of behavior - is commonly observed with fileless malware or application whitelisting bypass techniques. - The search will return the first time and last time these command-line arguments - were used for these executions, as well as the target system, the user, process - "rundll32.exe" and its parent process. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%about%" - OR process_cmd_line LIKE "%javascript%" OR process_cmd_line LIKE "%vbscript%") AND - process_file_name="rundll32.exe" --finding_report--' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Although unlikely, some legitimate applications may exhibit - this behavior, triggering a false positive. -references: -- https://github.com/redcanaryco/AtomicTestHarnesses -- https://redcanary.com/blog/introducing-atomictestharnesses/ -- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing -tags: - analytic_story: - - Suspicious MSHTA Activity - - NOBELIUM Group - - Living Off The Land - asset_type: Endpoint - confidence: 80 - impact: 70 - mitre_attack_id: - - T1218 - - T1218.005 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: Suspicious $process_name$ inline HTA execution on $dest_device_id$. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 56 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_screen_capture_via_powershell.yml b/ssa_detections/endpoint/ssa___windows_screen_capture_via_powershell.yml deleted file mode 100644 index 980cf04cfe..0000000000 --- a/ssa_detections/endpoint/ssa___windows_screen_capture_via_powershell.yml +++ /dev/null @@ -1,76 +0,0 @@ -name: Windows Screen Capture Via Powershell -id: 678ae7c6-0e63-44db-9881-03202c312f66 -version: 1 -date: '2024-02-01' -author: Teoderick Contreras, Splunk -type: TTP -status: production -description: The following analytic identifies a potential PowerShell script that - captures screen images on compromised or targeted hosts. This technique was observed - in the Winter-Vivern malware, which attempts to capture desktop screens using a - PowerShell script and send the images to its C2 server as part of its exfiltration - strategy. This TTP serves as a useful indicator that a PowerShell process may be - gathering desktop screenshots from a host system, potentially signaling malicious - activity. -data_source: -- Powershell 4104 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval device_hostname = device.hostname | eval process_file = process.file | eval - process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where match(process_cmd_line, /(?i).CopyFromScreen/)=true --finding_report--' -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: unknown -references: -- https://twitter.com/_CERT_UA/status/1620781684257091584 -- https://cert.gov.ua/article/3761104 -tags: - analytic_story: - - Winter Vivern - asset_type: Endpoint - confidence: 70 - impact: 70 - mitre_attack_id: - - T1113 - observable: - - name: device.hostname - type: Hostname - - name: process.file.path - type: File - - name: process.uid - type: Other - - name: process.cmd_line - type: Other - - name: actor.user.uid - type: Other - message: A PowerShell script was identified possibly performing screen captures - on $Computer$. - product: - - Splunk Behavioral Analytics - required_fields: - - device.hostname - - process.file.path - - process.uid - - process.cmd_line - - actor.user.uid - risk_score: 49 - security_domain: endpoint - mappings: - - ocsf: device.hostname - cim: dest - - ocsf: process.file.path - cim: process_path - - ocsf: process.uid - cim: process_id - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.uid - cim: user_id -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml b/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml deleted file mode 100644 index 7c671a067e..0000000000 --- a/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml +++ /dev/null @@ -1,104 +0,0 @@ -name: Windows Script Host Spawn MSBuild -id: 92886f1c-9b11-11ec-848a-acde48001122 -version: 4 -date: '2022-03-03' -author: Michael Haag, Splunk -type: TTP -status: production -description: This analytic is to detect a suspicious child process of MSBuild spawned - by Windows Script Host - cscript or wscript. This behavior or event are commonly - seen and used by malware or adversaries to execute malicious msbuild process using - malicious script in the compromised host. During triage, review parallel processes - and identify any file modifications. MSBuild may load a script from the same path - without having command-line arguments. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_file_name="msbuild.exe" - AND (match(actor_process_file_name, /(?i)cscript.exe/)=true OR match(actor_process_file_name, - /(?i)wscript.exe/)=true) --finding_report--' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited as developers do not spawn - MSBuild via a WSH. -references: -- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# -- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/Windows/TestHarnesses/T1127.001_MSBuild/InvokeMSBuild.ps1 -tags: - analytic_story: - - Trusted Developer Utilities Proxy Execution MSBuild - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 80 - mitre_attack_id: - - T1127.001 - - T1127 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 80 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/msbuild-windows-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml b/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml deleted file mode 100644 index 1ade53b6c4..0000000000 --- a/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml +++ /dev/null @@ -1,117 +0,0 @@ -name: Windows Service Create with TSCon -id: 6d16f079-0195-4fdc-a97d-7cfacb6b9b4d -version: 4 -date: '2022-02-23' -author: Michael Haag, Splunk -type: TTP -status: experimental -description: The following analytic detects potential RDP Hijacking attempts by monitoring - a series of actions taken by an attacker to gain unauthorized access to a remote - system. The attacker first runs the quser command to query the remote host for disconnected - user sessions. Upon identifying a disconnected session, they use the sc.exe command - to create a new Windows service with a binary path that launches tscon.exe. By specifying - the disconnected session ID and a destination ID, the attacker can transfer the - disconnected session to a new RDP session, effectively hijacking the user's session. - This analytic allows security teams to detect and respond to RDP Hijacking attempts, - mitigating potential risks and impacts on targeted systems. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where match(process_cmd_line, /(?i)/dest:rdp-tcp/)=true - AND process_file_name="sc.exe" --finding_report--' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may arise in the RDP Hijacking analytic when - legitimate administrators access remote sessions for maintenance or troubleshooting - purposes. These activities might resemble an attacker''s attempt to hijack a disconnected - session, leading to false alarms. To mitigate the risk of false positives and improve - the overall security posture, organizations can implement Group Policy to automatically - disconnect RDP sessions when they are complete. By enforcing this policy, administrators - ensure that disconnected sessions are promptly terminated, reducing the window of - opportunity for an attacker to hijack a session. Additionally, organizations can - also implement access control mechanisms and monitor the behavior of privileged - accounts to further enhance security and reduce the chances of false positives in - RDP Hijacking detection. -references: -- https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6 -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1563.002/T1563.002.md -tags: - analytic_story: - - Active Directory Lateral Movement - asset_type: Endpoint - confidence: 50 - impact: 80 - mitre_attack_id: - - T1563.002 - - T1563 - - T1543.003 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ attempting to hijack a RDP - session. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 40 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1563.002/rdphijack/4688_tscon_windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml deleted file mode 100644 index f6271dc52f..0000000000 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ /dev/null @@ -1,103 +0,0 @@ -name: Windows System Binary Proxy Execution Compiled HTML File Decompile -id: 11c32b19-05a6-48a8-ab28-18dbd9ec5d50 -version: 4 -date: '2022-09-02' -author: Michael Haag, Splunk -type: TTP -status: production -description: The following analytic identifies the decompile parameter with the HTML - Help application, HH.exe. This is a uncommon command to see ran and behavior. Most - recently this was seen in a APT41 campaign where a CHM file was delivered and a - script inside used a technique for running an arbitrary command in a CHM file via - an ActiveX object. This unpacks an HTML help file to a specified path for launching - the next stage. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_cmd_line LIKE "%-decompile%" - AND process_file_name="hh.exe" --finding_report--' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: False positives should be limited, filter as needed. -references: -- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/ -- https://redcanary.com/blog/introducing-atomictestharnesses/ -- https://attack.mitre.org/techniques/T1218/001/ -- https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa -tags: - analytic_story: - - Suspicious Compiled HTML Activity - - Living Off The Land - asset_type: Endpoint - confidence: 90 - impact: 100 - mitre_attack_id: - - T1218.001 - - T1218 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: $process_name$ has been identified using decompile against a CHM on $dest_device_id$ - under user $dest_user_id$. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 90 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log - source: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml deleted file mode 100644 index 42e59a4a99..0000000000 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml +++ /dev/null @@ -1,111 +0,0 @@ -name: Windows System Binary Proxy Execution Compiled HTML File URL In Command Line -id: 0fec631a-7c9b-4e4c-b28b-93260953e25f -version: 4 -date: '2022-09-02' -author: Michael Haag, Splunk -type: TTP -status: production -description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled - HTML Help (CHM) file from a remote url. This particular technique will load Windows - script code from a compiled help file. CHM files may contain nearly any file type - embedded, but only execute html/htm. Upon a successful execution, the following - script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, - JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe - upon execution. The "htm" and "html" file extensions were the only extensions observed - to be supported for the execution of Shortcut commands or WSH script code. During - investigation, identify script content origination. Review reputation of remote - IP and domain. Some instances, it is worth decompiling the .chm file to review its - original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%https://%" - OR process_cmd_line LIKE "%http://%") AND process_file_name="hh.exe" --finding_report--' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Although unlikely, some legitimate applications may retrieve - a CHM remotely, filter as needed. -references: -- https://attack.mitre.org/techniques/T1218/001/ -- https://www.kb.cert.org/vuls/id/851869 -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md -- https://lolbas-project.github.io/lolbas/Binaries/Hh/ -- https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7 -- https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ -tags: - analytic_story: - - Suspicious Compiled HTML Activity - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 90 - mitre_attack_id: - - T1218.001 - - T1218 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $process_name$ was identified on endpoint $dest_device_id$ - by user $dest_user_id$ contacting a remote destination. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 90 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/chm-wineventlog-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml deleted file mode 100644 index bb604ade9c..0000000000 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml +++ /dev/null @@ -1,114 +0,0 @@ -name: Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage - Handlers -id: ba0c2450-caea-4086-ac3a-a71e2659754b -version: 4 -date: '2022-09-02' -author: Michael Haag, Splunk -type: TTP -status: production -description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled - HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique - will load Windows script code from a compiled help file, using InfoTech Storage - Handlers. itss.dll will load upon execution. Three InfoTech Storage handlers are - supported - ms-its, its, mk:@MSITStore. ITSS may be used to launch a specific html/htm - file from within a CHM file. CHM files may contain nearly any file type embedded. - Upon a successful execution, the following script engines may be used for execution - - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may - identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" - and "html" file extensions were the only extensions observed to be supported for - the execution of Shortcut commands or WSH script code. During investigation, identify - script content origination. hh.exe is natively found in C:\Windows\system32 and - C:\Windows\syswow64. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%mk:@msitstore:%" - OR process_cmd_line LIKE "%its:%") AND process_file_name="hh.exe" --finding_report--' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: It is rare to see instances of InfoTech Storage Handlers being - used, but it does happen in some legitimate instances. Filter as needed. -references: -- https://attack.mitre.org/techniques/T1218/001/ -- https://www.kb.cert.org/vuls/id/851869 -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md -- https://lolbas-project.github.io/lolbas/Binaries/Hh/ -- https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7 -- https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ -tags: - analytic_story: - - Suspicious Compiled HTML Activity - - Living Off The Land - asset_type: Endpoint - confidence: 90 - impact: 80 - mitre_attack_id: - - T1218.001 - - T1218 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: $process_name$ has been identified using Infotech Storage Handlers to load - a specific file within a CHM on $dest_device_id$ under user $dest_user_id$. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 72 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/chm-wineventlog-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml deleted file mode 100644 index 81bb917cc4..0000000000 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml +++ /dev/null @@ -1,98 +0,0 @@ -name: Windows System Binary Proxy Execution MSIExec DLLRegisterServer -id: 8d1d5570-722c-49a3-996c-2e2cceef5163 -version: 4 -date: '2022-08-31' -author: Michael Haag, Splunk -type: TTP -status: production -description: The following analytic identifies the usage of msiexec.exe using the - /y switch parameter, which grants the ability for msiexec to load DLLRegisterServer. - Upon triage, review parent process and capture any artifacts for further review. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%-y %" - OR process_cmd_line LIKE "%/y %") AND process_file_name="msiexec.exe" --finding_report--' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: This analytic will need to be tuned for your environment based - on legitimate usage of msiexec.exe. Filter as needed. -references: -- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md -tags: - analytic_story: - - Windows System Binary Proxy Execution MSIExec - asset_type: Endpoint - confidence: 50 - impact: 70 - mitre_attack_id: - - T1218.007 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of spawning $process_name$ was identified on endpoint $dest_device_id$ - by user $dest_user_id$ attempting to register a file. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 35 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml deleted file mode 100644 index b52c0dbe81..0000000000 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml +++ /dev/null @@ -1,98 +0,0 @@ -name: Windows System Binary Proxy Execution MSIExec Remote Download -id: 92cbbf0f-9a6b-4e9d-8c35-cc9244a4e3d5 -version: 4 -date: '2022-08-31' -author: Michael Haag, Splunk -type: TTP -status: production -description: The following analytic identifies msiexec.exe with http in the command-line. - This procedure will utilize msiexec.exe to download a remote file and load it. During - triage, review parallel processes and capture any artifacts on disk for review. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%https://%" - OR process_cmd_line LIKE "%http://%") AND process_file_name="msiexec.exe" --finding_report--' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: False positives may be present, filter by destination or parent - process as needed. -references: -- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md -tags: - analytic_story: - - Windows System Binary Proxy Execution MSIExec - asset_type: Endpoint - confidence: 50 - impact: 70 - mitre_attack_id: - - T1218.007 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of spawning $process_name$ was identified on endpoint $dest_device_id$ - by user $dest_user_id$ attempting to download a file. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 35 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml deleted file mode 100644 index d988601b61..0000000000 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml +++ /dev/null @@ -1,98 +0,0 @@ -name: Windows System Binary Proxy Execution MSIExec Unregister DLL -id: df76a8d1-92e1-4ec9-b8f7-695b5838703e -version: 4 -date: '2022-08-31' -author: Michael Haag, Splunk -type: TTP -status: production -description: The following analytic identifies the usage of msiexec.exe using the - /z switch parameter, which grants the ability for msiexec to unload DLLRegisterServer. - Upon triage, review parent process and capture any artifacts for further review. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%-z %" - OR process_cmd_line LIKE "%/z %") AND process_file_name="msiexec.exe" --finding_report--' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: False positives may be present, filter by destination or parent - process as needed. -references: -- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md -tags: - analytic_story: - - Windows System Binary Proxy Execution MSIExec - asset_type: Endpoint - confidence: 50 - impact: 70 - mitre_attack_id: - - T1218.007 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of spawning $process_name$ was identified on endpoint $dest_device_id$ - by user $dest_user_id$ attempting to unregister a DLL. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 35 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog diff --git a/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml b/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml deleted file mode 100644 index 9ee99b3088..0000000000 --- a/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml +++ /dev/null @@ -1,104 +0,0 @@ -name: Windows WMIPrvse Spawn MSBuild -id: 76b3b290-9b31-11ec-a934-acde48001122 -version: 4 -date: '2022-03-03' -author: Michael Haag, Splunk -type: TTP -status: production -description: The following analytic identifies wmiprvse.exe spawning msbuild.exe. - This behavior is indicative of a COM object being utilized to spawn msbuild from - wmiprvse.exe. It is common for MSBuild.exe to be spawned from devenv.exe while using - Visual Studio. In this instance, there will be command line arguments and file paths. - In a malicious instance, MSBuild.exe will spawn from non-standard processes and - have no command line arguments. For example, MSBuild.exe spawning from explorer.exe, - powershell.exe is far less common and should be investigated. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = lower(process_file.name) | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where process_file_name="msbuild.exe" - AND match(actor_process_file_name, /(?i)wmiprvse.exe/)=true --finding_report--' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Although unlikely, some legitimate applications may exhibit - this behavior, triggering a false positive. -references: -- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md -tags: - analytic_story: - - Trusted Developer Utilities Proxy Execution MSBuild - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 80 - mitre_attack_id: - - T1127 - - T1127.001 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$. - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 80 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/msbuild-windows-security.log - source: WinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___windows_wsreset_uac_bypass.yml b/ssa_detections/endpoint/ssa___windows_wsreset_uac_bypass.yml deleted file mode 100644 index dd6ddcdbc1..0000000000 --- a/ssa_detections/endpoint/ssa___windows_wsreset_uac_bypass.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Windows WSReset UAC Bypass -id: 3118f0c2-90d9-11ec-b833-acde48001122 -version: 1 -date: '2022-02-18' -author: Lou Stella, Splunk -status: experimental -type: Anomaly -description: This analytic is built to detect a suspicious modification of the Windows - registry related to UAC bypass. This technique is to modify the registry in this - detection, create a registry value with the path of the payload and run WSreset.exe - to bypass User Account Control. -data_source: -- Sysmon Event ID 13 -search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels) - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)), - registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)), - registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string", - null)), registry_key_name=lower(ucast(map_get(input_event, "registry_key_name"), - "string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"), - "string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"), - "string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"), - "string", null)) | where registry_path IS NOT NULL AND registry_value_name IS NOT - NULL and like (registry_path, "%\\\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\\\Shell\\\\open\\\\command%") - AND (registry_value_name="(Default)" OR registry_value_name="DelegateExecute") | - eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)) | eval body=create_map(["registry_path", registry_path, "registry_hive", - registry_hive, "registry_value_name", registry_value_name, "registry_key_name", - registry_key_name, "registry_value_type", registry_value_type, "registry_value_data", - registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events(); ' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint_Registry` datamodel. -known_false_positives: Unknown at this point in time. -references: -- https://github.com/hfiref0x/UACME -- https://blog.morphisec.com/trickbot-uses-a-new-windows-10-uac-bypass -tags: - analytic_story: - - Living Off The Land - - Windows Defense Evasion Tactics - asset_type: Endpoint - confidence: 90 - impact: 70 - message: tbd - mitre_attack_id: - - T1548.002 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - registry_path - - registry_hive - - registry_value_name - - registry_key_name - - registry_value_type - - registry_value_data - - process_guid - kill_chain_phases: - - Exploitation - risk_score: 63 - security_domain: endpoint diff --git a/ssa_detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml b/ssa_detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml deleted file mode 100644 index 98b6bb0700..0000000000 --- a/ssa_detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml +++ /dev/null @@ -1,78 +0,0 @@ -name: TCP Command and Scripting Interpreter Outbound LDAP Traffic -id: 4d16a90c-d1a9-4d17-8156-d0db0c73c449 -version: 1 -date: '2022-02-17' -author: Jose Hernandez, Michael Haag, Splunk -status: experimental -type: Anomaly -description: Malicious actors often abuse misconfigured LDAP servers or applications - that use the LDAP servers in organizations. Outbound LDAP traffic should not be - allowed outbound through your perimeter firewall. This search will help determine - if you have any LDAP connections to IP addresses outside of private (RFC1918) address - space. -data_source: [] -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), dest_port=map_get(input_event, "dest_port"), event_id=ucast(map_get(input_event, - "event_id"), "string", null), dest_ip=ucast(map_get(input_event, "dest_device_ips"), - "collection", [])[0] | where dest_port=389 OR dest_port=1389 OR dest_port=636 - | where NOT (cidrmatch(ip: dest_ip, cidr_range: "10.0.0.0/8") OR cidrmatch(ip: dest_ip, - cidr_range: "192.168.0.0/16") OR cidrmatch(ip: dest_ip, cidr_range: "172.16.0.0/12")) - | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "dest_port", dest_port, - "dest_ip", dest_ip]) | into write_ssa_detected_events();' -how_to_implement: To successfully implement this search you need to be ingesting information - on network traffic, specifically data that populates the Network_Traffic datamodel. - To develop this analytic we used specifically Zeek/Bro conn.log and PAN Traffic - events. -known_false_positives: Unknown at this moment. Outbound LDAP traffic should not be - allowed outbound through your perimeter firewall. Please check those servers to - verify if the activity is legitimate. -references: -- https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/ -- https://www.splunk.com/en_us/blog/security/simulating-detecting-and-responding-to-log4shell-with-splunk.html -- https://www.cisa.gov/uscert/ncas/alerts/aa21-356a -tags: - analytic_story: - - Log4Shell CVE-2021-44228 - asset_type: endpoint - confidence: 70 - impact: 50 - message: An outbound LDAP connection from $src_ip$ in your infrastructure connecting - to dest ip $dest_ip$ - mitre_attack_id: - - T1059 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - cmd_line - kill_chain_phases: - - Exploitation - risk_score: 35 - security_domain: network -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.log - source: pan:traffic - sourcetype: pan:traffic diff --git a/ssa_detections/network/ssa___unusual_volume_of_data_download_from_internal_server_per_entity.yml b/ssa_detections/network/ssa___unusual_volume_of_data_download_from_internal_server_per_entity.yml deleted file mode 100644 index d3bb528f7e..0000000000 --- a/ssa_detections/network/ssa___unusual_volume_of_data_download_from_internal_server_per_entity.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Unusual Volume of Data Download from Internal Server Per Entity -id: cca028f4-77dd-11ec-bc09-acde48001122 -version: 1 -date: '2022-01-17' -author: Xiao Lin, Splunk -status: experimental -type: Anomaly -description: Insider might conduct information collection before data exfiltration, - and unusual volume of data download from internal server is an indicator of such - potential threat. This detection evaluates the total bytes downloaded from internal - servers at specific time window per entity level, and then flagged these that are - higher than 99.999% percentile as an anamaly. A behavior will be reported as long - as the downloaded byte volume is unusual even though that operation is benign, which - causes false positive. It is therefore advised to adjust threshold and time window - based on detection performance whenever necessary. It should be noted that seasonality - is not modeled in the current approach. -data_source: [] -search: '| from read_ssa_enriched_events() | eval sourcetype = ucast(map_get(input_event, - "sourcetype"), "string", null) | eval timestamp = parse_long(ucast(map_get(input_event, - "_time"), "string", null)) | where sourcetype == "pan:traffic" | eval src_device_scope - =ucast(map_get(input_event, "src_device_scope"), "string", null) | eval dest_device_scope=ucast(map_get(input_event, - "dest_device_scope"), "string", null) | where src_device_scope IS NOT NULL AND dest_device_scope - IS NOT NULL | eval dest_device = ucast(map_get(input_event, "dest_device_ips"), - "collection", [])[0] | where dest_device IS NOT NULL AND dest_device_scope - == "INTERNAL" | eval src_device = ucast(map_get(input_event, "src_device_ips"), - "collection", [])[0] | where src_device IS NOT NULL AND src_device_scope - == "INTERNAL" | eval bytes_in = ucast(map_get(input_event, "bytes_in"), "integer", - 0) | eval download_bytes = cast(bytes_in, "double") | eval tenant = ucast(map_get(input_event, - "_tenant"), "string", null) | eval event_id = ucast(map_get(input_event, "event_id"), - "string", null) | adaptive_threshold algorithm="quantile" value="download_bytes" - entity="dest_device" window=86400000L | where label AND quantile>0.99999 | eval - end_time = timestamp | eval start_time = end_time - 86400000 | eval body = create_map(["event_id", - event_id, "tenant", tenant]) | eval entities=mvappend(dest_device) | into write_ssa_detected_events();' -how_to_implement: Ingest PAN traffic logs -known_false_positives: Benign large volume data download might be flagged as (false) - positive. -references: -- https://github.com/twitter/AnomalyDetection -tags: - analytic_story: - - Insider Threat - asset_type: endpoint - confidence: 50 - impact: 50 - message: $src_device_ip downloaded unusually amount of data from internal server - within one day - mitre_attack_id: - - T1213 - - T1039 - observable: - - name: src_device_ip - type: IP Address - role: - - Other - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_scope - - bytes_in - - src_device_ips - kill_chain_phases: - - Weaponization - risk_score: 25 - security_domain: network -tests: -- name: True Positive Test - attack_data: - - data: https://github.com/splunk/attack_data/blob/master/datasets/suspicious_behaviour/unusual_data_download/unusual_volume_data_download.txt - source: PAN Traffic Log - sourcetype: pan:traffic diff --git a/stories/splunk_vulnerabilities.yml b/stories/splunk_vulnerabilities.yml deleted file mode 100644 index 83217c7bed..0000000000 --- a/stories/splunk_vulnerabilities.yml +++ /dev/null @@ -1,17 +0,0 @@ -name: Splunk Vulnerabilities -id: 5354df00-dce2-48ac-9a64-8adb48006828 -version: 1 -date: '2024-01-22' -author: Lou Stella,Rod Soto, Eric McGinnis, Splunk -description: Keeping your Splunk Enterprise deployment up to date is critical and will help you reduce the risk associated with vulnerabilities in the product. -narrative: This analytic story includes detections that focus on attacker behavior targeted at your Splunk environment directly. -references: -- https://www.splunk.com/en_us/product-security/announcements.html -tags: - category: - - Best Practices - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - usecase: Application Security