From ddaa7bfe5f446ee4c7692a5ab3b0bb951a1c5e06 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 15 Jul 2021 14:40:50 -0500 Subject: [PATCH 1/3] first 10 --- .../endpoint/excessive_usage_of_net_app.yml | 23 ++++++++++++++++ .../excessive_usage_of_nslookup_app.yml | 16 +++++++++++- .../endpoint/excessive_usage_of_taskkill.yml | 23 ++++++++++++++++ ..._or_script_creation_in_suspicious_path.yml | 23 ++++++++++++++++ ...cute_javascript_with_jscript_com_clsid.yml | 26 +++++++++++++++++++ ...ution_of_file_with_multiple_extensions.yml | 23 ++++++++++++++++ .../endpoint/extract_sam_from_registry.yml | 23 ++++++++++++++++ .../endpoint/file_with_samsam_extension.yml | 22 ++++++++++++++++ .../first_time_seen_child_process_of_zoom.yml | 23 ++++++++++++++++ 9 files changed, 201 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/excessive_usage_of_net_app.yml b/detections/endpoint/excessive_usage_of_net_app.yml index 5a42e4f653..5c9038a57b 100644 --- a/detections/endpoint/excessive_usage_of_net_app.yml +++ b/detections/endpoint/excessive_usage_of_net_app.yml @@ -47,3 +47,26 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 40 + confidence: 70 + # (impact * confidence)/100 + risk_score: 28 + context: + - Source:Endpoint + - Scope:Local + - Stage:Execution + message: Excessive usage of net1.exe or net.exe within 1m, with command line $process$ has been detected on $dest$ by $user$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Endpoint + role: + - Victim + - name: process_name + type: Process Name + role: + - Process + - Attacker \ No newline at end of file diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml index ad992c7157..077e317e7d 100644 --- a/detections/endpoint/excessive_usage_of_nslookup_app.yml +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Stanislav Miskovic, Splunk type: batch datamodel: - Endpoint -description: this search is to detect potential DNS exfiltration using nslookup application. +description: This search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are @@ -50,3 +50,17 @@ tags: - process_name - EventCode security_domain: endpoint + impact: 40 + confidence: 70 + # (impact * confidence)/100 + risk_score: 28 + context: + - Source:Endpoint + - Scope:Local + - Stage:Exfiltration + message: Excessive usage of nslookup.exe has been detected on $Computer$. This detection is triggered as as it violates the dynamic threshold + observable: + - name: Computer + type: Endpoint + role: + - Victim diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml index 7af5a861e7..75067e81e8 100644 --- a/detections/endpoint/excessive_usage_of_taskkill.yml +++ b/detections/endpoint/excessive_usage_of_taskkill.yml @@ -45,3 +45,26 @@ tags: - Processes.process - Processes.process_id security_domain: endpoint + impact: 40 + confidence: 70 + # (impact * confidence)/100 + risk_score: 28 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: Excessive usage of taskkill.exe with process id $process_id$ (more than 10 within 1m) has been detected on $dest$ with a parent process of $parent_process_name$. + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: dest + type: Endpoint + role: + - Victim + - name: parent_process_name + type: Process Name + role: + - Parent Process + - Attacker + diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index b272b7f7b0..325e3c5aac 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -53,3 +53,26 @@ tags: - Filesystem.file_name - Filesystem.user security_domain: endpoint + impact: 80 + confidence: 70 + # (impact * confidence)/100 + risk_score: 56 + context: + - Source:Endpoint + - Stage:Execution + + message: Suspicious executable or scripts with file name $file_name$, $file_path$ and process_id $process_id$ executed in suspicious file path in Windows by $user$ + observable: + - name: user + type: User + role: + - Victim + - name: process_id + type: Process + role: + - Attacker + - name: file_name + type: File Name + role: + - Other + - Attacker diff --git a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml index 4d6a00cb40..a2db54ca4e 100644 --- a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml +++ b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml @@ -46,3 +46,29 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 80 + confidence: 70 + # (impact * confidence)/100 + risk_score: 56 + context: + - Source:Endpoint + - Stage:Execution + message: Suspicious process of cscript.exe with a parent process $parent_process_name$ where it tries to execute javascript using jscript.encode CLSID (COM OBJ), detected on $dest$ by $user$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Endpoint + role: + - Victim + - name: process_id + type: Process + role: + - Attacker + - name: parent_process_name + type: Process Name + role: + - Parent Process + - Attacker diff --git a/detections/endpoint/execution_of_file_with_multiple_extensions.yml b/detections/endpoint/execution_of_file_with_multiple_extensions.yml index 9595c3518c..8b19dd12e8 100644 --- a/detections/endpoint/execution_of_file_with_multiple_extensions.yml +++ b/detections/endpoint/execution_of_file_with_multiple_extensions.yml @@ -51,3 +51,26 @@ tags: - Processes.user - Processes.parent_process security_domain: endpoint + impact: 80 + confidence: 70 + # (impact * confidence)/100 + risk_score: 56 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: process $process$ have double extensions in the file name is executed on $dest$ by $user$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Endpoint + role: + - Victim + - name: process + type: Process + role: + - Parent Process + - Attacker + diff --git a/detections/endpoint/extract_sam_from_registry.yml b/detections/endpoint/extract_sam_from_registry.yml index cd9101f63c..1e585a5f33 100644 --- a/detections/endpoint/extract_sam_from_registry.yml +++ b/detections/endpoint/extract_sam_from_registry.yml @@ -50,3 +50,26 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 70 + # (impact * confidence)/100 + risk_score: 56 + context: + - Source:Endpoint + - Stage:Credential Access + - Stage:Execution + message: Suspicious use of `reg.exe` exporting Windows Registry hives containing credentials executed on $dest$ by user $user$, with a parent process of $parent_process_id$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Endpoint + role: + - Victim + - name: parent_process_id + type: Process + role: + - Parent Process + - Attacker \ No newline at end of file diff --git a/detections/endpoint/file_with_samsam_extension.yml b/detections/endpoint/file_with_samsam_extension.yml index 95afab45cc..54ef0ff5b7 100644 --- a/detections/endpoint/file_with_samsam_extension.yml +++ b/detections/endpoint/file_with_samsam_extension.yml @@ -47,3 +47,25 @@ tags: - Filesystem.file_path - Filesystem.file_name security_domain: endpoint + impact: 100 + confidence: 90 + # (impact * confidence)/100 + risk_score: 90 + context: + - Source:Endpoint + - Stage:Execution + message: File writes $file_name$ with extensions consistent with a SamSam ransomware attack seen on $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Endpoint + role: + - Victim + - name: file_name + type: File Name + role: + - Other + - Attacker diff --git a/detections/endpoint/first_time_seen_child_process_of_zoom.yml b/detections/endpoint/first_time_seen_child_process_of_zoom.yml index 60eac8677a..16de5811f6 100644 --- a/detections/endpoint/first_time_seen_child_process_of_zoom.yml +++ b/detections/endpoint/first_time_seen_child_process_of_zoom.yml @@ -62,3 +62,26 @@ tags: - Processes.process_id - Processes.dest security_domain: endpoint + impact: 80 + confidence: 80 + # (impact * confidence)/100 + risk_score: 64 + context: + - Source:Endpoint + - Stage:Execution + message: Child process $process_name$ with $process_id$ spawned by zoom.exe or zoom.us which has not been previously been seen on host $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Endpoint + role: + - Victim + - name: process_name + type: Process Name + role: + - Other + - Child Process + From 289be39888369296a8b811ba54b1166d41f7c926 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 15 Jul 2021 16:39:06 -0500 Subject: [PATCH 2/3] RBA support --- .../first_time_seen_child_process_of_zoom.yml | 4 +-- detections/endpoint/fodhelper_uac_bypass.yml | 22 +++++++++++++++ ...no_command_line_arguments_with_network.yml | 28 +++++++++++++++++++ .../hide_user_account_from_sign_in_screen.yml | 21 ++++++++++++++ ..._files_and_directories_with_attrib_exe.yml | 23 +++++++++++++++ .../endpoint/high_file_deletion_frequency.yml | 22 +++++++++++++++ 6 files changed, 118 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/first_time_seen_child_process_of_zoom.yml b/detections/endpoint/first_time_seen_child_process_of_zoom.yml index 16de5811f6..1fd612e024 100644 --- a/detections/endpoint/first_time_seen_child_process_of_zoom.yml +++ b/detections/endpoint/first_time_seen_child_process_of_zoom.yml @@ -69,7 +69,7 @@ tags: context: - Source:Endpoint - Stage:Execution - message: Child process $process_name$ with $process_id$ spawned by zoom.exe or zoom.us which has not been previously been seen on host $dest$ + message: Child process $process_name$ with $process_id$ spawned by zoom.exe or zoom.us which has not been previously on host $dest$ observable: - name: user type: User @@ -82,6 +82,6 @@ tags: - name: process_name type: Process Name role: - - Other + - Attacker - Child Process diff --git a/detections/endpoint/fodhelper_uac_bypass.yml b/detections/endpoint/fodhelper_uac_bypass.yml index fa26c3851e..780d7a6633 100644 --- a/detections/endpoint/fodhelper_uac_bypass.yml +++ b/detections/endpoint/fodhelper_uac_bypass.yml @@ -61,3 +61,25 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 90 + confidence: 90 + # (impact * confidence)/100 + risk_score: 81 + context: + - Source:Endpoint + - Stage:Privilege Escalation + message: Suspcious registy keys added by process fodhelper.exe (process_id- $process_id), with a parent_process of $parent_process_name$ that has been executed on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Endpoint + role: + - Victim + - name: parent_process_name + type: Process Name + role: + - Parent Process + - Attacker \ No newline at end of file diff --git a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml index f80c817bf7..16f97310e9 100644 --- a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml @@ -53,3 +53,31 @@ tags: - dest_port - process_path security_domain: endpoint + impact: 90 + confidence: 90 + # (impact * confidence)/100 + risk_score: 81 + context: + - Source:Endpoint + - Stage:Execution + - Stage:Command And Control + message: Process gpupdate.exe with parent_process $parent_process_name$ is executed on $dest$ by user $user$, followed by an outbound network connection to $connection_to_CNC$ on port $dest_port$. This behaviour is seen with cobaltstrike. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Endpoint + role: + - Victim + - name: parent_process_name + type: Process Name + role: + - Parent Process + - Attacker + - name: connection_to_CNC + type: IP Address + role: + - Other + diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml index a6f49eb071..f4c00f94de 100644 --- a/detections/endpoint/hide_user_account_from_sign_in_screen.yml +++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml @@ -48,3 +48,24 @@ tags: - Registry.registry_value_name - Registry.dest Registry.user security_domain: endpoint + impact: 90 + confidence: 80 + # (impact * confidence)/100 + risk_score: 72 + context: + - Source:Endpoint + - Stage:Execution + message: Suspicious registry modification ($registry_value_name$) which is used go hide a user account on the Windows Login screen detected on $dest$ executed by $user$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Endpoint + role: + - Victim + - name: registry_value_name + type: Other + role: + - Attacker \ No newline at end of file diff --git a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml index 072f27287d..a827fff236 100644 --- a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml +++ b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml @@ -51,3 +51,26 @@ tags: - Processes.user - Processes.dest security_domain: endpoint + impact: 90 + confidence: 80 + # (impact * confidence)/100 + risk_score: 72 + context: + - Source:Endpoint + - Stage:Defense Evasion + - Stage:Persistence + message: Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is detected. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Endpoint + role: + - Victim + - name: parent_process + type: Other + role: + - Attacker + - Parent Process \ No newline at end of file diff --git a/detections/endpoint/high_file_deletion_frequency.yml b/detections/endpoint/high_file_deletion_frequency.yml index 50aba144f0..cfb0f29f34 100644 --- a/detections/endpoint/high_file_deletion_frequency.yml +++ b/detections/endpoint/high_file_deletion_frequency.yml @@ -46,3 +46,25 @@ tags: - ProcessID - _time security_domain: endpoint + impact: 90 + confidence: 80 + # (impact * confidence)/100 + risk_score: 72 + context: + - Source:Endpoint + - Stage:Execution + message: High frequency file deletion activity detected on host $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Endpoint + role: + - Victim + - name: Image + type: Process + role: + - Attacker + - Child Process From bd87ece758325ce56dff557460e216a49e47b6e8 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 19 Jul 2021 11:36:10 -0700 Subject: [PATCH 3/3] final tags --- .../endpoint/high_file_deletion_frequency.yml | 9 ++++---- .../high_process_termination_frequency.yml | 17 ++++++++++++++ detections/endpoint/icacls_deny_command.yml | 17 ++++++++++++++ detections/endpoint/icacls_grant_command.yml | 17 ++++++++++++++ ...asting_spn_request_with_rc4_encryption.yml | 13 +++++++++++ .../known_services_killed_by_ransomware.yml | 17 ++++++++++++++ .../endpoint/mailsniper_invoke_functions.yml | 18 +++++++++++++++ ...cious_powershell_executed_as_a_service.yml | 17 ++++++++++++++ ...connect_to_internet_with_hidden_window.yml | 22 +++++++++++++++++++ 9 files changed, 142 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/high_file_deletion_frequency.yml b/detections/endpoint/high_file_deletion_frequency.yml index cfb0f29f34..7e768620e4 100644 --- a/detections/endpoint/high_file_deletion_frequency.yml +++ b/detections/endpoint/high_file_deletion_frequency.yml @@ -53,7 +53,7 @@ tags: context: - Source:Endpoint - Stage:Execution - message: High frequency file deletion activity detected on host $dest$ + message: High frequency file deletion activity detected on host $Computer$ observable: - name: user type: User @@ -63,8 +63,7 @@ tags: type: Endpoint role: - Victim - - name: Image - type: Process + - name: deleted_files + type: File Name role: - - Attacker - - Child Process + - Target \ No newline at end of file diff --git a/detections/endpoint/high_process_termination_frequency.yml b/detections/endpoint/high_process_termination_frequency.yml index 5784960f38..b796dfd518 100644 --- a/detections/endpoint/high_process_termination_frequency.yml +++ b/detections/endpoint/high_process_termination_frequency.yml @@ -42,3 +42,20 @@ tags: - _time - ProcessID security_domain: endpoint + impact: 90 + confidence: 80 + # (impact * confidence)/100 + risk_score: 72 + context: + - Source:Endpoint + - Stage:Execution + message: High frequency process termination (more than 15 processes within 3s) detected on host $Computer$ + observable: + - name: Computer + type: Endpoint + role: + - Victim + - name: proc_terminated + type: Process + role: + - Target diff --git a/detections/endpoint/icacls_deny_command.yml b/detections/endpoint/icacls_deny_command.yml index a65ce5d9e1..9c56904180 100644 --- a/detections/endpoint/icacls_deny_command.yml +++ b/detections/endpoint/icacls_deny_command.yml @@ -48,3 +48,20 @@ tags: - Processes.process_id - Processes.process security_domain: endpoint + impact: 90 + confidence: 80 + # (impact * confidence)/100 + risk_score: 72 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: Process name $process_name$ with deny argument executed by $user$ to change security permission of a specific file or directory on host $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/icacls_grant_command.yml b/detections/endpoint/icacls_grant_command.yml index 9b63e9eeb1..71cddf8eb7 100644 --- a/detections/endpoint/icacls_grant_command.yml +++ b/detections/endpoint/icacls_grant_command.yml @@ -48,3 +48,20 @@ tags: - Processes.process_id - Processes.process security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: Process name $process_name$ with grant argument executed by $user$ to change security permission of a specific file or directory on host $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim diff --git a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml index 2ccaa299d6..9e33b0d64f 100644 --- a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml +++ b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml @@ -47,3 +47,16 @@ tags: - service - service_id security_domain: endpoint + impact: 90 + confidence: 80 + # (impact * confidence)/100 + risk_score: 72 + context: + - Source:Endpoint + - Stage:Credential Access + message: Potential kerberoasting attack via service principal name requests detected on $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/known_services_killed_by_ransomware.yml b/detections/endpoint/known_services_killed_by_ransomware.yml index 52dd38f375..df4824e9c0 100644 --- a/detections/endpoint/known_services_killed_by_ransomware.yml +++ b/detections/endpoint/known_services_killed_by_ransomware.yml @@ -44,3 +44,20 @@ tags: - dest - Type security_domain: endpoint + impact: 90 + confidence: 80 + # (impact * confidence)/100 + risk_score: 72 + context: + - Source:Endpoint + - Stage:Execution + message: Known services $Message$ terminated by a potential ransomware on $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: Message + type: Other + role: + - Other diff --git a/detections/endpoint/mailsniper_invoke_functions.yml b/detections/endpoint/mailsniper_invoke_functions.yml index 8ea1b6d64b..f9f93fddc9 100644 --- a/detections/endpoint/mailsniper_invoke_functions.yml +++ b/detections/endpoint/mailsniper_invoke_functions.yml @@ -43,3 +43,21 @@ tags: - ComputerName - User security_domain: endpoint + impact: 90 + confidence: 80 + # (impact * confidence)/100 + risk_score: 72 + context: + - Source:Endpoint + - Stage:Exfiltration + message: mailsniper.ps1 functions $Message$ executed on a $ComputerName$ by user $user$. + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim + diff --git a/detections/endpoint/malicious_powershell_executed_as_a_service.yml b/detections/endpoint/malicious_powershell_executed_as_a_service.yml index aeb26bd70a..d864e6387d 100644 --- a/detections/endpoint/malicious_powershell_executed_as_a_service.yml +++ b/detections/endpoint/malicious_powershell_executed_as_a_service.yml @@ -47,3 +47,20 @@ tags: - Service_Account - user security_domain: endpoint + impact: 90 + confidence: 80 + # (impact * confidence)/100 + risk_score: 72 + context: + - Source:Endpoint + - Stage:Execution + message: Identifies the abuse the Windows SC.exe to execute malicious powerShell as a service $Service_File_Name$ by $user$ on $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml index ffebd2f670..f90d4db080 100644 --- a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml +++ b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml @@ -61,3 +61,25 @@ tags: - Processes.parent_process_name - Processes.dest security_domain: endpoint + impact: 90 + confidence: 90 + # (impact * confidence)/100 + risk_score: 81 + context: + - Source:Endpoint + - Stage:Execution + - Stage:Command And Control + message: PowerShell processes $process$ started with parameters to modify the execution policy of the run, run in a hidden window, and connect to the Internet on host $dest$ executed by user $user$. + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim + - name: process + type: Process + role: + - Attacker \ No newline at end of file