brute-ratel-1

detections/endpoint/windows_service_created_in_uncommon_service_path.yml

@@ -0,0 +1,69 @@
+name: Windows Service Created In Uncommon Service Path
+id: 429141be-8311-11eb-adb6-acde48001122
+version: 2
+date: '2021-11-22'
+author: Teoderick Contreras, Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytics uses Windows Event Id 7045, `New Service Was Installed`,
+  to identify the creation of a Windows Service where the service binary path path
+  is located in a non-common Service folder in Windows. Red Teams and adversaries
+  alike may create malicious Services for lateral movement or remote code execution
+  as well as persistence and execution. The Clop ransomware has also been seen in
+  the wild abusing Windows services.
+search: ' `wineventlog_system` EventCode=7045  Service_File_Name = "*\.exe" NOT (Service_File_Name
+  IN ("C:\\Windows\\*", "C:\\Program File*", "C:\\Programdata\\*", "%systemroot%\\*"))
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name
+  Service_Name Service_Start_Type Service_Type | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_service_created_in_uncommon_service_path_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the Service name, Service File Name Service Start type, and Service Type
+  from your endpoints.
+known_false_positives: Legitimate applications may install services with uncommon
+  services paths.
+references:
+- https://www.mandiant.com/resources/fin11-email-campaigns-precursor-for-ransomware-data-theft
+- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
+tags:
+  analytic_story:
+  - Clop Ransomware
+  - Active Directory Lateral Movement
+  - Brute Ratel C4
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  - Stage:Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-system.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: A service $Service_File_Name$ was created from a non-standard path using
+    $Service_Name$
+  mitre_attack_id:
+  - T1569
+  - T1569.002
+  observable:
+  - name: Service_File_Name
+    type: Other
+    role:
+    - Other
+  - name: Service_Name
+    type: Other
+    role:
+    - Other
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - EventCode
+  - Service_File_Name
+  - Service_Type
+  - _time
+  - Service_Name
+  - Service_Start_Type
+  risk_score: 56
+  security_domain: endpoint
+  asset_type: Endpoint

tests/endpoint/windows_service_created_in_uncommon_service_path.test.yml

@@ -0,0 +1,12 @@
+name: Windows Service Created In Uncommon Service Path Unit Test
+tests:
+- name: Windows Service Created In Uncommon Service Path
+  file: endpoint/windows_service_created_in_uncommon_service_path.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-system.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-system.log
+    source: WinEventLog:System
+    sourcetype: WinEventLog