admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

onenote

Browse Source
This commit is contained in:
Michael Haag
2023-01-24 06:38:23 -07:00
parent d8245bebf1
commit 11ff0fa87d
17 changed files with 66 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/mshtml_module_load_in_office_product.yml
+4 -3
View File
@@ -1,7 +1,7 @@
name: MSHTML Module Load in Office Product
id: 5f1c168e-118b-11ec-84ff-acde48001122
version: 3
date: '2022-08-25'
version: 4
date: '2023-01-24'
author: Michael Haag, Mauricio Velazco, Splunk
type: TTP
datamodel:
@@ -11,7 +11,7 @@ description: The following detection identifies the module load of mshtml.dll in
malicious document will load ActiveX, which activates the MSHTML component. The
vulnerability resides in the MSHTML component. During triage, identify parallel
processes and capture any file modifications for analysis.
search: '`sysmon` EventID=7 parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe")
search: '`sysmon` EventID=7 parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe")
ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll")
| stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name,
ImageLoaded, OriginalFileName, ProcessGuid | rename Computer as dest | `security_content_ctime(firstTime)`
@@ -24,6 +24,7 @@ references:
- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
- https://strontic.github.io/xcyclopedia/index-dll
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
tags:
analytic_story:
- Spearphishing Attachments
detections/endpoint/office_application_drop_executable.yml
+4 -3
View File
@@ -1,7 +1,7 @@
name: Office Application Drop Executable
id: 73ce70c4-146d-11ec-9184-acde48001122
version: 1
date: '2021-09-13'
version: 2
date: '2023-01-24'
author: Teoderick Contreras, Michael Haag Splunk
type: TTP
datamodel:
@@ -13,7 +13,7 @@ description: This search is to detect a suspicious MS office application that dr
but still this behavior is reallly suspicious and not commonly seen in normal office
application
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe")
where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe")
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
@@ -34,6 +34,7 @@ references:
- https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation
- https://attack.mitre.org/groups/G0046/
- https://www.joesandbox.com/analysis/702680/0/html
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
tags:
analytic_story:
- FIN7
detections/endpoint/office_application_spawn_regsvr32_process.yml
+4 -3
View File
@@ -1,7 +1,7 @@
name: Office Application Spawn Regsvr32 process
id: 2d9fc90c-f11f-11eb-9300-acde48001122
version: 2
date: '2021-07-30'
version: 3
date: '2022-01-24'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
@@ -13,7 +13,7 @@ description: this detection was designed to identifies suspicious spawned proces
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name
= "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name
= "powerpnt.exe" OR Processes.parent_process_name = "outlook.exe") `process_regsvr32`
= "powerpnt.exe" OR Processes.parent_process_name = "outlook.exe" OR Processes.parent_process_name = "onenote.exe") `process_regsvr32`
by Processes.parent_process_name Processes.parent_process Processes.process_name
Processes.original_file_name Processes.process Processes.process_id Processes.process_guid
Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
@@ -26,6 +26,7 @@ how_to_implement: To successfully implement this search you need to be ingesting
known_false_positives: unknown
references:
- https://www.joesandbox.com/analysis/380662/0/html
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
tags:
analytic_story:
- IcedID
detections/endpoint/office_application_spawn_rundll32_process.yml
+4 -3
View File
@@ -1,7 +1,7 @@
name: Office Application Spawn rundll32 process
id: 958751e4-9c5f-11eb-b103-acde48001122
version: 2
date: '2021-04-13'
version: 3
date: '2023-01-23'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
@@ -12,7 +12,7 @@ description: This detection was designed to identify suspicious spawned processe
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name
= "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name
= "powerpnt.exe") AND `process_rundll32` by Processes.parent_process Processes.process_name
= "powerpnt.exe" OR Processes.parent_process_name= "onenote.exe") AND `process_rundll32` by Processes.parent_process Processes.process_name
Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest
| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
| `office_application_spawn_rundll32_process_filter`'
@@ -26,6 +26,7 @@ references:
- https://any.run/malware-trends/trickbot
- https://any.run/report/47561b4e949041eff0a0f4693c59c81726591779fe21183ae9185b5eb6a69847/aba3722a-b373-4dae-8273-8730fb40cdbe
- https://www.joesandbox.com/analysis/702680/0/html
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
tags:
analytic_story:
- Spearphishing Attachments
detections/endpoint/office_document_creating_schedule_task.yml
+4 -3
View File
@@ -1,7 +1,7 @@
name: Office Document Creating Schedule Task
id: cc8b7b74-9d0f-11eb-8342-acde48001122
version: 2
date: '2022-08-25'
version: 3
date: '2023-01-23'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
@@ -19,7 +19,7 @@ description: this search detects a potential malicious office document that crea
source. Was it schtasks.exe or via TaskService? Review the job created and the Command
to be executed. Capture any artifacts on disk and review. Identify any parallel
processes within the same timeframe to identify source.'
search: '`sysmon` EventCode=7 parent_process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE")
search: '`sysmon` EventCode=7 parent_process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE","onenote.exe")
ImageLoaded = "*\\taskschd.dll" | stats min(_time) as firstTime max(_time) as lastTime
values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image parent_process_name
ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
@@ -32,6 +32,7 @@ known_false_positives: unknown
references:
- https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/
- https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
tags:
analytic_story:
- Spearphishing Attachments
detections/endpoint/office_document_executing_macro_code.yml
+4 -3
View File
@@ -1,7 +1,7 @@
name: Office Document Executing Macro Code
id: b12c89bc-9d06-11eb-a592-acde48001122
version: 1
date: '2021-04-14'
version: 2
date: '2023-01-24'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
@@ -13,7 +13,7 @@ description: this detection was designed to identifies suspicious office documen
or other malware component. It is really good practice to disable macro by default
to avoid automatically execute macro code while opening or closing a office document
files.
search: '`sysmon` EventCode=7 parent_process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE")
search: '`sysmon` EventCode=7 parent_process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE","onenote.exe")
ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time)
as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count
by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)`
@@ -28,6 +28,7 @@ references:
- https://www.joesandbox.com/analysis/702680/0/html
- https://bazaar.abuse.ch/sample/02cbc1ab80695fc12ff8822b926957c3a600247b9ca412a137f69cb5716c8781/
- https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
tags:
analytic_story:
- Spearphishing Attachments
detections/endpoint/office_document_spawned_child_process_to_download.yml
+4 -3
View File
@@ -1,7 +1,7 @@
name: Office Document Spawned Child Process To Download
id: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3
version: 3
date: '2021-09-20'
version: 4
date: '2023-01-23'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
@@ -12,7 +12,7 @@ description: This search is to detect potential malicious office document execut
blend it to the normal noise in the infected machine to cover its track.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process
IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe") Processes.process
IN ("*http:*","*https:*") NOT (Processes.original_file_name IN("firefox.exe", "chrome.exe","iexplore.exe","msedge.exe")) by
Processes.dest Processes.user Processes.parent_process_name Processes.process_name
Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
@@ -26,6 +26,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
known_false_positives: Default browser not in the filter list.
references:
- https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
tags:
analytic_story:
- Spearphishing Attachments
detections/endpoint/office_product_spawn_cmd_process.yml
+4 -3
View File
@@ -1,7 +1,7 @@
name: Office Product Spawn CMD Process
id: b8b19420-e892-11eb-9244-acde48001122
version: 2
date: '2021-07-19'
version: 3
date: '2022-01-24'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
@@ -14,7 +14,7 @@ description: this search is to detect a suspicious office product process that s
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name
= "winword.exe" OR Processes.parent_process_name= "excel.exe" OR Processes.parent_process_name
= "powerpnt.exe") `process_cmd` by Processes.parent_process Processes.process_name
= "powerpnt.exe" OR Processes.parent_process_name= "onenote.exe") `process_cmd` by Processes.parent_process Processes.process_name
Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest
Processes.original_file_name | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
|`security_content_ctime(lastTime)` | `office_product_spawn_cmd_process_filter`'
@@ -29,6 +29,7 @@ references:
- https://twitter.com/cyb3rops/status/1416050325870587910?s=21
- https://bazaar.abuse.ch/sample/02cbc1ab80695fc12ff8822b926957c3a600247b9ca412a137f69cb5716c8781/
- https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
tags:
analytic_story:
- Trickbot
detections/endpoint/office_product_spawning_bitsadmin.yml
+4 -3
View File
@@ -1,7 +1,7 @@
name: Office Product Spawning BITSAdmin
id: e8c591f4-a6d7-11eb-8cf7-acde48001122
version: 2
date: '2021-04-26'
version: 3
date: '2023-01-24'
author: Michael Haag, Splunk
type: TTP
datamodel:
@@ -19,7 +19,7 @@ description: The following detection identifies the latest behavior utilized by
for further activity.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") `process_bitsadmin`
IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe") `process_bitsadmin`
by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
@@ -32,6 +32,7 @@ how_to_implement: To successfully implement this search you need to be ingesting
known_false_positives: No false positives known. Filter as needed.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
tags:
analytic_story:
- Spearphishing Attachments
detections/endpoint/office_product_spawning_certutil.yml
+4 -3
View File
@@ -1,7 +1,7 @@
name: Office Product Spawning CertUtil
id: 6925fe72-a6d5-11eb-9e17-acde48001122
version: 2
date: '2021-04-26'
version: 3
date: '2023-01-24'
author: Michael Haag, Splunk
type: TTP
datamodel:
@@ -18,7 +18,7 @@ description: The following detection identifies the latest behavior utilized by
for further activity.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") `process_certutil`
IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe") `process_certutil`
by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
@@ -32,6 +32,7 @@ known_false_positives: No false positives known. Filter as needed.
references:
- https://redcanary.com/threat-detection-report/threats/TA551/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
tags:
analytic_story:
- Spearphishing Attachments
detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: Office Product Spawning Rundll32 with no DLL
id: c661f6be-a38c-11eb-be57-acde48001122
version: 2
date: '2021-04-22'
version: 3
date: '2023-01-24'
author: Michael Haag, Splunk
type: TTP
datamodel:
@@ -18,7 +18,7 @@ description: The following detection identifies the latest behavior utilized by
additional parallel processes for further activity.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") `process_rundll32`
IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe") `process_rundll32`
(Processes.process!=*.dll*) by Processes.dest Processes.user Processes.parent_process
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
detections/endpoint/office_product_spawning_windows_script_host.yml
+4 -3
View File
@@ -1,7 +1,7 @@
name: Office Product Spawning Windows Script Host
id: b3628a5b-8d02-42fa-a891-eebf2351cbe1
version: 1
date: '2022-09-26'
version: 2
date: '2023-01-24'
author: Michael Haag, Splunk
type: TTP
datamodel:
@@ -9,7 +9,7 @@ datamodel:
description: The following analytic will identify a Windows Office Product spawning WScript.exe or CScript.exe. Tuning may be required based on legitimate application usage that may spawn scripts from an Office product.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process_name IN ("wscript.exe", "cscript.exe")
IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe") Processes.process_name IN ("wscript.exe", "cscript.exe")
by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
@@ -19,6 +19,7 @@ known_false_positives: False positives may be present based on macro based appro
references:
- https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/
- https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
tags:
analytic_story:
- Spearphishing Attachments
detections/endpoint/office_product_spawning_wmic.yml
+4 -3
View File
@@ -1,7 +1,7 @@
name: Office Product Spawning Wmic
id: ffc236d6-a6c9-11eb-95f1-acde48001122
version: 3
date: '2021-09-16'
version: 4
date: '2023-01-24'
author: Michael Haag, Splunk
type: TTP
datamodel:
@@ -18,7 +18,7 @@ description: The following detection identifies the latest behavior utilized by
activity.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") `process_wmic`
IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe") `process_wmic`
by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
@@ -33,6 +33,7 @@ references:
- https://app.any.run/tasks/fb894ab8-a966-4b72-920b-935f41756afd/
- https://attack.mitre.org/techniques/T1047/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.md
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
tags:
analytic_story:
- Spearphishing Attachments
detections/endpoint/office_product_writing_cab_or_inf.yml
+4 -3
View File
@@ -1,7 +1,7 @@
name: Office Product Writing cab or inf
id: f48cd1d4-125a-11ec-a447-acde48001122
version: 2
date: '2022-07-07'
version: 3
date: '2023-01-23'
author: Michael Haag, Splunk
type: TTP
datamodel:
@@ -11,7 +11,7 @@ description: The following analytic identifies behavior related to CVE-2021-4044
(.inf, .cab). During triage, review parallel processes and further activity on endpoint
to identify additional patterns. Retrieve the file modifications and analyze further.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe")
where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe")
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid
| `drop_dm_object_name(Processes)`
|rename process_guid as proc_guid
@@ -37,6 +37,7 @@ references:
- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
- https://twitter.com/RonnyTNL/status/1436334640617373699?s=20
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
tags:
analytic_story:
- Spearphishing Attachments
detections/endpoint/office_spawning_control.yml
+4 -3
View File
@@ -1,7 +1,7 @@
name: Office Spawning Control
id: 053e027c-10c7-11ec-8437-acde48001122
version: 1
date: '2021-09-08'
version: 2
date: '2023-01-23'
author: Michael Haag, Splunk
type: TTP
datamodel:
@@ -15,7 +15,7 @@ description: The following detection identifies control.exe spawning from an off
identify further suspicious behavior
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe")
IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe")
Processes.process_name=control.exe by Processes.dest Processes.user Processes.parent_process
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
@@ -33,6 +33,7 @@ references:
- https://www.echotrail.io/insights/search/control.exe/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
tags:
analytic_story:
- Spearphishing Attachments
detections/endpoint/windows_office_product_spawning_msdt.yml
+4 -3
View File
@@ -1,7 +1,7 @@
name: Windows Office Product Spawning MSDT
id: 127eba64-c981-40bf-8589-1830638864a7
version: 1
date: '2022-05-30'
version: 2
date: '2023-01-23'
author: Michael Haag, Teoderick Contreras, Splunk
type: TTP
datamodel:
@@ -14,7 +14,7 @@ description: The following analytic identifies a Microsoft Office product spawni
processes including PowerShell and CertUtil.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
IN ("winword.exe","excel.exe","powerpnt.exe","outlook.exe","mspub.exe","visio.exe")
IN ("winword.exe","excel.exe","powerpnt.exe","outlook.exe","mspub.exe","visio.exe","onenote.exe")
Processes.process_name=msdt.exe by Processes.dest Processes.user Processes.parent_process
Processes.process_name Processes.original_file_name Processes.process Processes.process_id
Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
@@ -32,6 +32,7 @@ references:
- https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
- https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection
- https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
tags:
analytic_story:
- Spearphishing Attachments
detections/web/proxyshell_proxynotshell_behavior_detected.yml
+3 -7
View File
@@ -6,13 +6,9 @@ author: Michael Haag, Splunk
type: Correlation
datamodel:
- Risk
description: The following correlation will identify activity related to Windows Exchange being actively exploited by adversaries related to ProxyShell or ProxyNotShell. In addition, the analytic correlates post-exploitation Cobalt Strike analytic story. Common post-exploitation behavior has been seen in the wild includes adversaries running nltest, Cobalt Strike, Mimikatz and adding a new user. The correlation specifically looks for 5 distict analyticstories to trigger, modify or tune as needed for your organization.
5 analytic stories is an arbitrary number but was chosen to reduce the amount of noise but also require the 3 analytic stories to fire. Adversaries will exploit the vulnerable Exchange server, abuse SSRF, drop a web shell, utilize the PowerShell Exchange modules and begin post-exploitation.
search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.analyticstories) as analyticstories values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count dc(All_Risk.analyticstories) as dc_analyticstories from datamodel=Risk.All_Risk where All_Risk.analyticstories IN ("ProxyNotShell","ProxyShell", "Cobalt Strike") All_Risk.risk_object_type="system" by _time span=1h All_Risk.risk_object All_Risk.risk_object_type
| `drop_dm_object_name(All_Risk)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| where dc_analyticstories >= 5
description: The following correlation will identify activity related to Windows Exchange being actively exploited by adversaries related to ProxyShell or ProxyNotShell. In addition, the analytic correlates post-exploitation Cobalt Strike analytic story. Common post-exploitation behavior has been seen in the wild includes adversaries running nltest, Cobalt Strike, Mimikatz and adding a new user. The correlation specifically looks for 5 distinct analyticstories to trigger. Modify or tune as needed for your organization.
5 analytics is an arbitrary number but was chosen to reduce the amount of noise but also require the 2 analytic stories or a ProxyShell and CobaltStrike to fire. Adversaries will exploit the vulnerable Exchange server, abuse SSRF, drop a web shell, utilize the PowerShell Exchange modules and begin post-exploitation.
search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.analyticstories) as analyticstories values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count dc(All_Risk.analyticstories) as dc_analyticstories from datamodel=Risk.All_Risk where All_Risk.analyticstories IN ("ProxyNotShell","ProxyShell") OR (All_Risk.analyticstories IN ("ProxyNotShell","ProxyShell") AND All_Risk.analyticstories="Cobalt Strike") All_Risk.risk_object_type="system" by _time span=1h All_Risk.risk_object All_Risk.risk_object_type | `drop_dm_object_name(All_Risk)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| where source_count >=5
| `proxyshell_proxynotshell_behavior_detected_filter`'
how_to_implement: To implement this correlation, you will need to enable ProxyShell, ProxyNotShell and Cobalt Strike analytic stories (the anaytics themselves) and ensure proper data is being collected for Web and Endpoint datamodels. Run the correlation rule seperately to validate it is not triggering too much or generating incorrectly. Validate by running ProxyShell POC code and Cobalt Strike behavior.
known_false_positives: False positives will be limited, however tune or modify the query as needed.