diff --git a/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml b/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml new file mode 100644 index 0000000000..89f4216af9 --- /dev/null +++ b/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml @@ -0,0 +1,69 @@ +name: Windows Modify Registry Disable Toast Notifications +id: ed4eeacb-8d5a-488e-bc97-1ce6ded63b84 +version: 1 +date: '2022-06-22' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic is to identify a modification in the Windows registry + to disable toast notifications. This Windows Operating System feature is responsible for alerting or notifying + user if application or OS need some updates. Adversaries and malwares like Azorult abuse this technique to disable important + update notification in compromised host. This anomaly detection is a good pivot to look for further events related to defense evasion + and execution. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PushNotifications\\ToastEnabled*" Registry.registry_value_data="0x00000000" + by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_modify_registry_disable_toast_notifications_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: administrators may enable or disable this feature that may cause some false positive. +references: +- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp +- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ +tags: + analytic_story: + - Azorult + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: the registry for DisallowRun settings was modified to enable in $dest$ + mitre_attack_id: + - T1112 + nist: + - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + risk_score: 49 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml b/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml new file mode 100644 index 0000000000..40838cefad --- /dev/null +++ b/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml @@ -0,0 +1,69 @@ +name: Windows Modify Registry Disable Windows Security Center Notif +id: 27ed3e79-6d86-44dd-b9ab-524451c97a7b +version: 1 +date: '2022-06-22' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic is to identify a modification in the Windows registry + to disable windows center notifications. This Windows Operating System feature is responsible for alerting or notifying + user if application or OS need some updates. Adversaries and malwares like Azorult abuse this technique to disable important + update notification in compromised host. This anomaly detection is a good pivot to look for further events related to defense evasion + and execution. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path= "*\\Windows\\CurrentVersion\\ImmersiveShell\\UseActionCenterExperience*" Registry.registry_value_data="0x00000000" + by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_modify_registry_disable_windows_security_center_notif_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: administrators may enable or disable this feature that may cause some false positive. +references: +- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp +- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ +tags: + analytic_story: + - Azorult + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: the registry for security center notification settings was modified to disable mode in $dest$ + mitre_attack_id: + - T1112 + nist: + - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + risk_score: 49 + security_domain: endpoint diff --git a/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml b/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml new file mode 100644 index 0000000000..9f431cf99b --- /dev/null +++ b/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml @@ -0,0 +1,68 @@ +name: Windows Modify Registry Suppress Win Defender Notif +id: e3b42daf-fff4-429d-bec8-2a199468cea9 +version: 1 +date: '2022-06-22' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic is to identify a modification in the Windows registry + to suppress windows defender notification. This technique was abuse by adversaries and threat actor to bypassed windows defender + on the targeted host. Azorult malware is one of the malware use this technique that also disable toast notification and other windows features + as part of its malicious behavior. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path= "*\\Windows Defender\\UX Configuration\\Notification_Suppress*" Registry.registry_value_data="0x00000001" + by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_modify_registry_suppress_win_defender_notif_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: administrators may enable or disable this feature that may cause some false positive. +references: +- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp +- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ +tags: + analytic_story: + - Azorult + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: the registry for suppresing windows fdefender notification settings was modified to disabled in $dest$ + mitre_attack_id: + - T1112 + nist: + - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + risk_score: 49 + security_domain: endpoint diff --git a/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml b/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml new file mode 100644 index 0000000000..d17c147471 --- /dev/null +++ b/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml @@ -0,0 +1,74 @@ +name: Windows Remote Services Allow Rdp In Firewall +id: 9170cb54-ea15-41e1-9dfc-9f3363ce9b02 +version: 1 +date: '2022-06-21' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic is to identify a modification in the Windows firewall + to enable remote desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer + to remotely access the compromised or targeted host by allowing this protocol in firewall. Even this protocol might be allowed in some + production environment, This TTP behavior is a good pivot to check who and why the user want to enable this feature through firewall which is also common traits + of attack to start lateral movement. +search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline + values(Processes.parent_process_name) as parent_process values(Processes.process_name) + count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name = "netsh.exe" OR Processes.original_file_name= "netsh.exe") AND Processes.process = "*firewall*" AND Processes.process = "*add*" AND Processes.process = "*protocol=TCP*" + AND Processes.process = "*localport=3389*" AND Processes.process = "*action=allow*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_remote_services_allow_rdp_in_firewall_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records process activity from your hosts to populate the endpoint data model + in the processes node. If you are using Sysmon, you must have at least version 6.0.4 + of the Sysmon TA. +known_false_positives: administrators may enable or disable this feature that may cause some false positive. +references: +- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ +tags: + analytic_story: + - Azorult + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Lateral Movement + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: new firewall rules was added to allow rdp connection to $dest$ + mitre_attack_id: + - T1021.001 + - T1021 + nist: + - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_id + - Processes.parent_process_id + - Processes.dest + - Processes.user + risk_score: 49 + security_domain: endpoint diff --git a/detections/endpoint/windows_remote_services_allow_remote_assistance.yml b/detections/endpoint/windows_remote_services_allow_remote_assistance.yml new file mode 100644 index 0000000000..fa07ebad2d --- /dev/null +++ b/detections/endpoint/windows_remote_services_allow_remote_assistance.yml @@ -0,0 +1,70 @@ +name: Windows Remote Services Allow Remote Assistance +id: 9bce3a97-bc97-4e89-a1aa-ead151c82fbb +version: 1 +date: '2022-06-21' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic is to identify a modification in the Windows registry + to enable remote desktop assistance on a targeted machine. This technique was seen in several adversaries, malware or red teamer + like azorult to remotely access the compromised or targeted host by enabling this protocol in registry. Even this protocol might be allowed in some + production environment, This Anomaly behavior is a good pivot to check who and why the user want to enable this feature through registry which is un-common. + And as per stated in microsoft documentation the default value of this registry is false that makes this a good indicator of suspicious behavior. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path= "*\\Control\\Terminal Server\\fAllowToGetHelp*" Registry.registry_value_data="0x00000001" + by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_remote_services_allow_remote_assistance_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: administrators may enable or disable this feature that may cause some false positive. +references: +- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp +- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ +tags: + analytic_story: + - Azorult + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Lateral Movement + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: the registry for rdp protocol was modified to enable in $dest$ + mitre_attack_id: + - T1021.001 + - T1021 + nist: + - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + risk_score: 49 + security_domain: endpoint diff --git a/detections/endpoint/windows_remote_services_rdp_enable.yml b/detections/endpoint/windows_remote_services_rdp_enable.yml new file mode 100644 index 0000000000..bda36548db --- /dev/null +++ b/detections/endpoint/windows_remote_services_rdp_enable.yml @@ -0,0 +1,68 @@ +name: Windows Remote Services Rdp Enable +id: 8fbd2e88-4ea5-40b9-9217-fd0855e08cc0 +version: 1 +date: '2022-06-21' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic is to identify a modification in the Windows registry + to enable remote desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer + to remotely access the compromised or targeted host by enabling this protocol in registry. Even this protocol might be allowed in some + production environment, This TTP behavior is a good pivot to check who and why the user want to enable this feature through registry which is un-common. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path= "*\\Control\\Terminal Server\\fDenyTSConnections*" Registry.registry_value_data="0x00000000" + by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_remote_services_rdp_enable_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: administrators may enable or disable this feature that may cause some false positive. +references: +- https://www.hybrid-analysis.com/sample/9d6611c2779316f1ef4b4a6edcfdfb5e770fe32b31ec2200df268c3bd236ed75?environmentId=100 +tags: + analytic_story: + - Azorult + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Lateral Movement + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: the registry for rdp protocol was modified to enable in $dest$ + mitre_attack_id: + - T1021.001 + - T1021 + nist: + - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + risk_score: 49 + security_domain: endpoint diff --git a/detections/endpoint/windows_service_stop_by_deletion.yml b/detections/endpoint/windows_service_stop_by_deletion.yml new file mode 100644 index 0000000000..f63fa31cd7 --- /dev/null +++ b/detections/endpoint/windows_service_stop_by_deletion.yml @@ -0,0 +1,75 @@ +name: Windows Service Stop By Deletion +id: 196ff536-58d9-4d1b-9686-b176b04e430b +version: 1 +date: '2022-06-21' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies Windows Service Control, `sc.exe`, + attempting to delete a service. This is typically identified in parallel with other + instances of service enumeration of attempts to stop a service and then delete it. + Adversaries utilize this technique to terminate security services or other related + services to continue there objective and evade detections. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name = sc.exe OR Processes.original_file_name = sc.exe) Processes.process="* delete *" by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_service_stop_by_deletion_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: It is possible administrative scripts may start/stop/delete + services. Filter as needed. +references: +- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md +tags: + analytic_story: + - Azorult + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ attempting to delete a service. + mitre_attack_id: + - T1489 + nist: + - DE.CM + observable: + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_id + - Processes.parent_process_id + - Processes.dest + - Processes.user + risk_score: 49 + security_domain: endpoint diff --git a/tests/endpoint/windows_modify_registry_disable_toast_notifications.test.yml b/tests/endpoint/windows_modify_registry_disable_toast_notifications.test.yml new file mode 100644 index 0000000000..4f9498025a --- /dev/null +++ b/tests/endpoint/windows_modify_registry_disable_toast_notifications.test.yml @@ -0,0 +1,13 @@ +name: Windows Modify Registry Disable Toast Notifications Unit Test +tests: +- name: Windows Modify Registry Disable Toast Notifications + file: endpoint/windows_modify_registry_disable_toast_notifications.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_modify_registry_disable_windows_security_center_notif.test.yml b/tests/endpoint/windows_modify_registry_disable_windows_security_center_notif.test.yml new file mode 100644 index 0000000000..352e602392 --- /dev/null +++ b/tests/endpoint/windows_modify_registry_disable_windows_security_center_notif.test.yml @@ -0,0 +1,13 @@ +name: Windows Modify Registry Disable Windows Security Center Notif Unit Test +tests: +- name: Windows Modify Registry Disable Windows Security Center Notif + file: endpoint/windows_modify_registry_disable_windows_security_center_notif.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_modify_registry_suppress_win_defender_notif.test.yml b/tests/endpoint/windows_modify_registry_suppress_win_defender_notif.test.yml new file mode 100644 index 0000000000..4644a4dd4b --- /dev/null +++ b/tests/endpoint/windows_modify_registry_suppress_win_defender_notif.test.yml @@ -0,0 +1,13 @@ +name: Windows Modify Registry Suppress Win Defender Notif Unit Test +tests: +- name: Windows Modify Registry Suppress Win Defender Notif + file: endpoint/windows_modify_registry_suppress_win_defender_notif.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_remote_services_allow_rdp_in_firewall.test.yml b/tests/endpoint/windows_remote_services_allow_rdp_in_firewall.test.yml new file mode 100644 index 0000000000..b6dd69acc2 --- /dev/null +++ b/tests/endpoint/windows_remote_services_allow_rdp_in_firewall.test.yml @@ -0,0 +1,13 @@ +name: Windows Remote Services Allow Rdp In Firewall Unit Test +tests: +- name: Windows Remote Services Allow Rdp In Firewall + file: endpoint/windows_remote_services_allow_rdp_in_firewall.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_remote_services_allow_remote_assistance.test.yml b/tests/endpoint/windows_remote_services_allow_remote_assistance.test.yml new file mode 100644 index 0000000000..478063376a --- /dev/null +++ b/tests/endpoint/windows_remote_services_allow_remote_assistance.test.yml @@ -0,0 +1,13 @@ +name: Windows Remote Services Allow Remote Assistance Unit Test +tests: +- name: Windows Remote Services Allow Remote Assistance + file: endpoint/windows_remote_services_allow_remote_assistance.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_remote_services_rdp_enable.test.yml b/tests/endpoint/windows_remote_services_rdp_enable.test.yml new file mode 100644 index 0000000000..6140a7f3e4 --- /dev/null +++ b/tests/endpoint/windows_remote_services_rdp_enable.test.yml @@ -0,0 +1,13 @@ +name: Windows Remote Services Rdp Enable Unit Test +tests: +- name: Windows Remote Services Rdp Enable + file: endpoint/windows_remote_services_rdp_enable.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_service_stop_by_deletion.test.yml b/tests/endpoint/windows_service_stop_by_deletion.test.yml new file mode 100644 index 0000000000..d969ad82ee --- /dev/null +++ b/tests/endpoint/windows_service_stop_by_deletion.test.yml @@ -0,0 +1,13 @@ +name: Windows Service Stop By Deletion Unit Test +tests: +- name: Windows Service Stop By Deletion + file: endpoint/windows_service_stop_by_deletion.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true