From 00cb3cd69d9d17d7d536d9b9b9c293085f818dfd Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 27 Sep 2021 14:04:21 -0700 Subject: [PATCH 01/10] adding default --- .../remcos_client_registry_install_entry.yml | 49 +++++++++++++++++++ ...cos_client_registry_install_entry.test.yml | 12 +++++ 2 files changed, 61 insertions(+) create mode 100644 detections/endpoint/remcos_client_registry_install_entry.yml create mode 100644 tests/endpoint/remcos_client_registry_install_entry.test.yml diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml new file mode 100644 index 0000000000..fdb4ca0e23 --- /dev/null +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -0,0 +1,49 @@ +name: Remcos client registry install entry +id: f2a1615a-1d63-11ec-97d2-acde48001122 +version: 1 +date: '2021-09-24' +author: Rod Soto +type: TTP +datamodel: +- Endpoint +description: This search detects registry key license at host where Remcos RAT agent is installed. +search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) + as registry_key_name values(Registry.registry_path) as registry_path min(_time) + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\Software\\Remcos*)| + `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `remcos_client_registry_install_entry_filter`' +how_to_implement: In order to successfully implement this search, you need to be ingesting + logs with the TargetObject registry key, registry Details from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: unknown +references: +- https://attack.mitre.org/software/S0332/ +tags: + analytic_story: + - Remcos + dataset: + - https://github.com/splunk/attack_data/blob/master/datasets/malware/remcos/remcos_panel_client/agent_license.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1112 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_path + - Registry.registry_key_name + security_domain: endpoint + impact: 90 + confidence: 100 + # (impact * confidence)/100 + risk_score: 90 + context: + message: A registry entry $registry_path$ with registry value $registry_key_name$ + related to Remcos RAT in host $dest$ + observable: + name: dest + type: Hostname + role: + - Victim diff --git a/tests/endpoint/remcos_client_registry_install_entry.test.yml b/tests/endpoint/remcos_client_registry_install_entry.test.yml new file mode 100644 index 0000000000..03b12c0bae --- /dev/null +++ b/tests/endpoint/remcos_client_registry_install_entry.test.yml @@ -0,0 +1,12 @@ +name: Remcos client registry install entry Unit Test +tests: +- name: Remcos client registry install entry + file: endpoint/remcos_client_registry_install_entry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-15d' + latest_time: 'now' + attack_data: + - file_name: agent_license.log + data: https://github.com/splunk/attack_data/blob/master/datasets/malware/remcos/remcos_panel_client/agent_license.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From f3e47ca5550026006441bb720f10a73f9801c5fa Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 27 Sep 2021 14:43:28 -0700 Subject: [PATCH 02/10] minor --- .../endpoint/remcos_client_registry_install_entry.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index fdb4ca0e23..315e1c2600 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -2,7 +2,7 @@ name: Remcos client registry install entry id: f2a1615a-1d63-11ec-97d2-acde48001122 version: 1 date: '2021-09-24' -author: Rod Soto +author: Bhavin Patel, Rod Soto, Splunk type: TTP datamodel: - Endpoint @@ -11,9 +11,10 @@ search: '| tstats `security_content_summariesonly` count values(Registry.registr as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\Software\\Remcos*)| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `remcos_client_registry_install_entry_filter`' -how_to_implement: In order to successfully implement this search, you need to be ingesting - logs with the TargetObject registry key, registry Details from your endpoints. - If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. known_false_positives: unknown references: - https://attack.mitre.org/software/S0332/ @@ -40,6 +41,8 @@ tags: # (impact * confidence)/100 risk_score: 90 context: + - Source:Endpoint + - Stage:Credential Access message: A registry entry $registry_path$ with registry value $registry_key_name$ related to Remcos RAT in host $dest$ observable: From 1641e15810f6befe6b2e530548d38836e30817b5 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 27 Sep 2021 15:33:28 -0700 Subject: [PATCH 03/10] yml changes --- .../endpoint/remcos_client_registry_install_entry.yml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index 315e1c2600..b50d5670b1 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -41,12 +41,11 @@ tags: # (impact * confidence)/100 risk_score: 90 context: - - Source:Endpoint - - Stage:Credential Access - message: A registry entry $registry_path$ with registry value $registry_key_name$ - related to Remcos RAT in host $dest$ + - Source:Endpoint + - Stage:Credential Access + message: A registry entry $registry_path$ with registry value $registry_key_name$ related to Remcos RAT in host $dest$ observable: - name: dest + - name: dest type: Hostname role: - Victim From 05702a61bf2c0cac1bcd4ad4ae56111ec6561a29 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 27 Sep 2021 16:09:04 -0700 Subject: [PATCH 04/10] search update --- .../remcos_client_registry_install_entry.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index b50d5670b1..af7090a0ad 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -7,10 +7,8 @@ type: TTP datamodel: - Endpoint description: This search detects registry key license at host where Remcos RAT agent is installed. -search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) - as registry_key_name values(Registry.registry_path) as registry_path min(_time) - as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\Software\\Remcos*)| - `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `remcos_client_registry_install_entry_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) + as firstTime max(_time) as lastTime values(Registry.registry_path) as registry_path FROM datamodel=Endpoint.Registry where (Registry.registry_key_name=*\\Software\\Remcos*) by Registry.dest Registry.user Registry.registry_key_name Registry.process_id| `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`| `remcos_client_registry_install_entry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure @@ -35,6 +33,9 @@ tags: - _time - Registry.registry_path - Registry.registry_key_name + - Registry.process_id + - Registry.dest + - Registry.user security_domain: endpoint impact: 90 confidence: 100 @@ -42,8 +43,7 @@ tags: risk_score: 90 context: - Source:Endpoint - - Stage:Credential Access - message: A registry entry $registry_path$ with registry value $registry_key_name$ related to Remcos RAT in host $dest$ + message: A registry entry $registry_path$ with registry keyname $registry_key_name$ related to Remcos RAT in host $dest$ observable: - name: dest type: Hostname From 1026e7430f276dfbac3e5442e3c8d20f9af896da Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 28 Sep 2021 10:49:53 -0700 Subject: [PATCH 05/10] remove macro --- detections/endpoint/remcos_client_registry_install_entry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index af7090a0ad..91913966d2 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -8,7 +8,7 @@ datamodel: - Endpoint description: This search detects registry key license at host where Remcos RAT agent is installed. search: '| tstats `security_content_summariesonly` count min(_time) - as firstTime max(_time) as lastTime values(Registry.registry_path) as registry_path FROM datamodel=Endpoint.Registry where (Registry.registry_key_name=*\\Software\\Remcos*) by Registry.dest Registry.user Registry.registry_key_name Registry.process_id| `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`| `remcos_client_registry_install_entry_filter`' + as firstTime max(_time) as lastTime values(Registry.registry_path) as registry_path FROM datamodel=Endpoint.Registry where (Registry.registry_key_name=*\\Software\\Remcos*) by Registry.dest Registry.user Registry.registry_key_name Registry.process_id| `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure From fd2a7f0adc6c187397dbd5744084a6de810e26a6 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 28 Sep 2021 11:09:14 -0700 Subject: [PATCH 06/10] macro --- detections/endpoint/remcos_client_registry_install_entry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index 91913966d2..af7090a0ad 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -8,7 +8,7 @@ datamodel: - Endpoint description: This search detects registry key license at host where Remcos RAT agent is installed. search: '| tstats `security_content_summariesonly` count min(_time) - as firstTime max(_time) as lastTime values(Registry.registry_path) as registry_path FROM datamodel=Endpoint.Registry where (Registry.registry_key_name=*\\Software\\Remcos*) by Registry.dest Registry.user Registry.registry_key_name Registry.process_id| `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`' + as firstTime max(_time) as lastTime values(Registry.registry_path) as registry_path FROM datamodel=Endpoint.Registry where (Registry.registry_key_name=*\\Software\\Remcos*) by Registry.dest Registry.user Registry.registry_key_name Registry.process_id| `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`| `remcos_client_registry_install_entry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure From d3b5b06be7bb91cf9a86cd95aa56f72ed0cb0f52 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 28 Sep 2021 11:13:40 -0700 Subject: [PATCH 07/10] time updates --- tests/endpoint/remcos_client_registry_install_entry.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/remcos_client_registry_install_entry.test.yml b/tests/endpoint/remcos_client_registry_install_entry.test.yml index 03b12c0bae..7a47bedd43 100644 --- a/tests/endpoint/remcos_client_registry_install_entry.test.yml +++ b/tests/endpoint/remcos_client_registry_install_entry.test.yml @@ -3,7 +3,7 @@ tests: - name: Remcos client registry install entry file: endpoint/remcos_client_registry_install_entry.yml pass_condition: '| stats count | where count > 0' - earliest_time: '-15d' + earliest_time: '-30d' latest_time: 'now' attack_data: - file_name: agent_license.log From 0216feb54250c3cde4471fff9b9886bc47fe7ba9 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 28 Sep 2021 14:31:34 -0700 Subject: [PATCH 08/10] trail --- detections/endpoint/remcos_client_registry_install_entry.yml | 2 +- tests/endpoint/remcos_client_registry_install_entry.test.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index af7090a0ad..91913966d2 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -8,7 +8,7 @@ datamodel: - Endpoint description: This search detects registry key license at host where Remcos RAT agent is installed. search: '| tstats `security_content_summariesonly` count min(_time) - as firstTime max(_time) as lastTime values(Registry.registry_path) as registry_path FROM datamodel=Endpoint.Registry where (Registry.registry_key_name=*\\Software\\Remcos*) by Registry.dest Registry.user Registry.registry_key_name Registry.process_id| `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`| `remcos_client_registry_install_entry_filter`' + as firstTime max(_time) as lastTime values(Registry.registry_path) as registry_path FROM datamodel=Endpoint.Registry where (Registry.registry_key_name=*\\Software\\Remcos*) by Registry.dest Registry.user Registry.registry_key_name Registry.process_id| `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure diff --git a/tests/endpoint/remcos_client_registry_install_entry.test.yml b/tests/endpoint/remcos_client_registry_install_entry.test.yml index 7a47bedd43..03b12c0bae 100644 --- a/tests/endpoint/remcos_client_registry_install_entry.test.yml +++ b/tests/endpoint/remcos_client_registry_install_entry.test.yml @@ -3,7 +3,7 @@ tests: - name: Remcos client registry install entry file: endpoint/remcos_client_registry_install_entry.yml pass_condition: '| stats count | where count > 0' - earliest_time: '-30d' + earliest_time: '-15d' latest_time: 'now' attack_data: - file_name: agent_license.log From a3d731d5edcb8cffe1f70a79218f75b98a8261b8 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 29 Sep 2021 11:07:22 -0700 Subject: [PATCH 09/10] success on AR --- detections/endpoint/remcos_client_registry_install_entry.yml | 4 ++-- tests/endpoint/remcos_client_registry_install_entry.test.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index 91913966d2..94eb0f1479 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -8,7 +8,7 @@ datamodel: - Endpoint description: This search detects registry key license at host where Remcos RAT agent is installed. search: '| tstats `security_content_summariesonly` count min(_time) - as firstTime max(_time) as lastTime values(Registry.registry_path) as registry_path FROM datamodel=Endpoint.Registry where (Registry.registry_key_name=*\\Software\\Remcos*) by Registry.dest Registry.user Registry.registry_key_name Registry.process_id| `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`' + as firstTime max(_time) as lastTime values(Registry.registry_path) as registry_path FROM datamodel=Endpoint.Registry where (Registry.registry_key_name=*\\Software\\Remcos*) by Registry.dest Registry.user Registry.registry_key_name Registry.process_id| `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`|`remcos_client_registry_install_entry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure @@ -20,7 +20,7 @@ tags: analytic_story: - Remcos dataset: - - https://github.com/splunk/attack_data/blob/master/datasets/malware/remcos/remcos_panel_client/agent_license.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_panel_client/remcos_registry_entry.log kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/tests/endpoint/remcos_client_registry_install_entry.test.yml b/tests/endpoint/remcos_client_registry_install_entry.test.yml index 03b12c0bae..241d221d2e 100644 --- a/tests/endpoint/remcos_client_registry_install_entry.test.yml +++ b/tests/endpoint/remcos_client_registry_install_entry.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-15d' latest_time: 'now' attack_data: - - file_name: agent_license.log - data: https://github.com/splunk/attack_data/blob/master/datasets/malware/remcos/remcos_panel_client/agent_license.log + - file_name: remcos_registry_entry.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_panel_client/remcos_registry_entry.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog \ No newline at end of file From 18c89103a9219380908c260cc14229a51aded963 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 29 Sep 2021 18:26:30 +0000 Subject: [PATCH 10/10] Added detection testing service results inRemcos client registry install entry --- .../remcos_client_registry_install_entry.yml | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index 94eb0f1479..412b01e85e 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -6,16 +6,20 @@ author: Bhavin Patel, Rod Soto, Splunk type: TTP datamodel: - Endpoint -description: This search detects registry key license at host where Remcos RAT agent is installed. -search: '| tstats `security_content_summariesonly` count min(_time) - as firstTime max(_time) as lastTime values(Registry.registry_path) as registry_path FROM datamodel=Endpoint.Registry where (Registry.registry_key_name=*\\Software\\Remcos*) by Registry.dest Registry.user Registry.registry_key_name Registry.process_id| `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`|`remcos_client_registry_install_entry_filter`' +description: This search detects registry key license at host where Remcos RAT agent + is installed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime values(Registry.registry_path) as registry_path FROM datamodel=Endpoint.Registry + where (Registry.registry_key_name=*\\Software\\Remcos*) by Registry.dest Registry.user + Registry.registry_key_name Registry.process_id| `drop_dm_object_name(Registry)` + | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`|`remcos_client_registry_install_entry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. known_false_positives: unknown references: -- https://attack.mitre.org/software/S0332/ +- https://attack.mitre.org/software/S0332/ tags: analytic_story: - Remcos @@ -39,13 +43,14 @@ tags: security_domain: endpoint impact: 90 confidence: 100 - # (impact * confidence)/100 risk_score: 90 context: - Source:Endpoint - message: A registry entry $registry_path$ with registry keyname $registry_key_name$ related to Remcos RAT in host $dest$ + message: A registry entry $registry_path$ with registry keyname $registry_key_name$ + related to Remcos RAT in host $dest$ observable: - name: dest type: Hostname role: - Victim + automated_detection_testing: passed