diff --git a/detections/endpoint/windows_gather_victim_identity_sam_info.yml b/detections/endpoint/windows_gather_victim_identity_sam_info.yml new file mode 100644 index 0000000000..60243af3a9 --- /dev/null +++ b/detections/endpoint/windows_gather_victim_identity_sam_info.yml @@ -0,0 +1,66 @@ +name: Windows Gather Victim Identity SAM Info +id: a18e85d7-8b98-4399-820c-d46a1ca3516f +version: 1 +date: '2022-08-24' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: The following analytic identifies a process that loads the samlib.dll module. + This module is being abused by adversaries, threat actors and red teamers to access information of SAM objects or access credentials information in DC. + This hunting query can be a good indicator that a process is capable of accessing the SAM object. +search: '`sysmon` EventCode=7 ImageLoaded = "*\\samlib.dll" AND OriginalFileName = "samlib.dll" AND NOT (Image IN("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*")) + | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_gather_victim_identity_sam_info_filter`' +how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will + add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products. +known_false_positives: this module can be loaded by a third party application. Filter is needed. +references: +- https://redcanary.com/blog/active-breach-evading-defenses/ +- https://strontic.github.io/xcyclopedia/library/samlib.dll-0BDF6351009F6EBA5BA7E886F23263B1.html +tags: + analytic_story: + - Brute Ratel C4 + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 30 + context: + - Source:Endpoint + - Stage:Persistence + - Stage:Privilege Escalation + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/loading_samlib/sysmon.log + impact: 30 + kill_chain_phases: + - Exploitation + message: An instance of $Computer$ that loads $ImageLoaded$ that are related to accessing to SAM object information. + mitre_attack_id: + - T1589.001 + - T1589 + nist: + - DE.CM + observable: + - name: Computer + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - ImageLoaded + - Computer + - EventCode + - Signed + - ProcessId + risk_score: 6 + security_domain: endpoint diff --git a/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml b/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml new file mode 100644 index 0000000000..1bcb2085d2 --- /dev/null +++ b/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml @@ -0,0 +1,70 @@ +name: Windows Input Capture Using Credential UI Dll +id: 406c21d6-6c75-4e9f-9ca9-48049a1dd90e +version: 1 +date: '2022-08-24' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: The following analytic identifies a process that loads the credui.dll module. + This legitimate module is typically abused by adversaries, threat actors and red teamers to create a credential UI prompt + dialog box to lure users for possible credential theft or can be used to dump the credentials of a targeted host. + This hunting query is a good pivot to check why the process loaded this dll and if it is a legitimate file. + This hunting query may hit false positive for a third party application that uses a credential login UI for user login. +search: '`sysmon` EventCode=7 (ImageLoaded = "*\\credui.dll" AND OriginalFileName = "credui.dll") OR (ImageLoaded = "*\\wincredui.dll" AND OriginalFileName = "wincredui.dll") + AND NOT(Image IN("*\\windows\\explorer.exe", "*\\windows\\system32\\*", "*\\windows\\sysWow64\\*", "*:\\program files*")) + | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded OriginalFileName Computer EventCode Signed ProcessId ProcessGuid + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_input_capture_using_credential_ui_dll_filter`' +how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will + add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products. +known_false_positives: this module can be loaded by a third party application. Filter is needed. +references: +- https://docs.microsoft.com/en-us/windows/win32/api/wincred/nf-wincred-creduipromptforcredentialsa +- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.002/T1056.002.md#atomic-test-2---powershell---prompt-user-for-password +tags: + analytic_story: + - Brute Ratel C4 + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 30 + context: + - Source:Endpoint + - Stage:Persistence + - Stage:Privilege Escalation + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log + impact: 30 + kill_chain_phases: + - Exploitation + message: a process $Image$ loaded $ImageLoaded$ in $Computer$ + mitre_attack_id: + - T1056.002 + - T1056 + nist: + - DE.CM + observable: + - name: Computer + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - ImageLoaded + - process_name + - Computer + - EventCode + - Signed + - ProcessId + risk_score: 6 + security_domain: endpoint diff --git a/tests/endpoint/windows_gather_victim_identity_sam_info.test.yml b/tests/endpoint/windows_gather_victim_identity_sam_info.test.yml new file mode 100644 index 0000000000..d5d0ca38df --- /dev/null +++ b/tests/endpoint/windows_gather_victim_identity_sam_info.test.yml @@ -0,0 +1,13 @@ +name: Windows Gather Victim Identity SAM Info Unit Test +tests: +- name: Windows Gather Victim Identity SAM Info + file: endpoint/windows_gather_victim_identity_sam_info.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/loading_samlib/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_input_capture_using_credential_ui_dll.test.yml b/tests/endpoint/windows_input_capture_using_credential_ui_dll.test.yml new file mode 100644 index 0000000000..be9b725986 --- /dev/null +++ b/tests/endpoint/windows_input_capture_using_credential_ui_dll.test.yml @@ -0,0 +1,13 @@ +name: Windows Input Capture Using Credential UI Dll Unit Test +tests: +- name: Windows Input Capture Using Credential UI Dll + file: endpoint/windows_input_capture_using_credential_ui_dll.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true