Branch was auto-updated.

detections/endpoint/control_loading_from_world_writable_directory.yml

@@ -0,0 +1,85 @@
+name: Control Loading from World Writable Directory
+id: 10423ac4-10c9-11ec-8dc4-acde48001122
+version: 1
+date: '2021-09-08'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following detection identifies control.exe loading either a .cpl
+  or .inf from a writable directory. This is related to CVE-2021-40444. During triage,
+  review parallel processes, parent and child, for further suspicious behaviors. In
+  addition, capture file modifications and analyze.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=control.exe
+  OR Processes.original_file_name=CONTROL.EXE) AND Processes.process IN ("*\\appdata\\*",
+  "*\\windows\\temp\\*", "*\\programdata\\*") by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `control_loading_from_world_writable_directory_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Limited false positives will be present as control.exe does
+  not natively load from writable paths as defined. One may add .cpl or .inf to the
+  command-line if there is any false positives. Tune as needed.
+references:
+- https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html
+- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
+- https://attack.mitre.org/techniques/T1218/011/
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
+tags:
+  analytic_story:
+  - Microsoft MSHTML Remote Code Execution CVE-2021-40444
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  automated_detection_testing: passed

detections/endpoint/mshtml_module_load_in_office_product.yml

@@ -0,0 +1,70 @@
+name: MSHTML Module Load in Office Product
+id: 5f1c168e-118b-11ec-84ff-acde48001122
+version: 1
+date: '2021-09-09'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following detection identifies the module load of mshtml.dll into
+  an Office product. This behavior has been related to CVE-2021-40444, whereas the
+  malicious document will load ActiveX, which activates the MSHTML component. The
+  vulnerability resides in the MSHTML component. During triage, identify parallel
+  processes and capture any file modifications for analysis.
+search: '`sysmon` EventID=7  process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe")
+  ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll")
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name,
+  ImageLoaded, OriginalFileName, process_id | rename Computer as dest | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `mshtml_module_load_in_office_product_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process names and image loads from your endpoints. If you are using
+  Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: Limited false positives will be present, however, tune as necessary.
+references:
+- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
+- https://strontic.github.io/xcyclopedia/index-dll
+tags:
+  analytic_story:
+  - Spearphishing Attachments
+  - Microsoft MSHTML Remote Code Execution CVE-2021-40444
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_mshtml.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1566.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - ImageLoaded
+  - process_name
+  - OriginalFileName
+  - process_id
+  - dest
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $process_name$ was identified on endpoint $dest$ loading
+    mshtml.dll.
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  automated_detection_testing: passed

detections/endpoint/office_spawning_control.yml

@@ -0,0 +1,83 @@
+name: Office Spawning Control
+id: 053e027c-10c7-11ec-8437-acde48001122
+version: 1
+date: '2021-09-08'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following detection identifies control.exe spawning from an office
+  product. This detection identifies any Windows Office Product spawning `control.exe`.
+  In malicious instances, the command-line of `control.exe` will contain a file path
+  to a .cpl or .inf, related to CVE-2021-40444. In this instance, we narrow our detection
+  down to the Office suite as a parent process. During triage, review all file modifications.
+  Capture and analyze any artifacts on disk. review parallel and child processes to
+  identify further suspicious behavior
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
+  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") Processes.process_name=control.exe
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `office_spawning_control_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Limited false positives should be present.
+references:
+- https://strontic.github.io/xcyclopedia/library/control.exe-1F13E714A0FEA8887707DFF49287996F.html
+- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
+- https://attack.mitre.org/techniques/T1218/011/
+- https://www.echotrail.io/insights/search/control.exe
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
+tags:
+  analytic_story:
+  - Spearphishing Attachments
+  - Microsoft MSHTML Remote Code Execution CVE-2021-40444
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_control.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1566.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ clicking a suspicious attachment.
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  automated_detection_testing: passed

detections/endpoint/rundll32_control_rundll_hunt.yml

@@ -0,0 +1,88 @@
+name: Rundll32 Control RunDLL Hunt
+id: c8e7ced0-10c5-11ec-8b03-acde48001122
+version: 1
+date: '2021-09-08'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following hunting detection identifies rundll32.exe with `control_rundll`
+  within the command-line, loading a .cpl or another file type. Developed in relation
+  to CVE-2021-40444. Rundll32.exe can also be used to execute Control Panel Item files
+  (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser.
+  Double-clicking a .cpl file also causes rundll32.exe to execute. \ This is written
+  to be a bit more broad by not including .cpl. \ During triage, review parallel processes
+  to identify any further suspicious behavior.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=rundll32.exe
+  OR Processes.original_file_name=RUNDLL32.EXE) Processes.process=*Control_RunDLL*  by
+  Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `rundll32_control_rundll_hunt_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: This is a hunting detection, meant to provide a understanding
+  of how voluminous control_rundll is within the environment.
+references:
+- https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html
+- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
+- https://attack.mitre.org/techniques/T1218/011/
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
+tags:
+  analytic_story:
+  - Suspicious Rundll32 Activity
+  - Microsoft MSHTML Remote Code Execution CVE-2021-40444
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.011
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 30
+  confidence: 50
+  risk_score: 15
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  automated_detection_testing: passed

detections/endpoint/rundll32_control_rundll_world_writable_directory.yml

@@ -0,0 +1,90 @@
+name: Rundll32 Control RunDLL World Writable Directory
+id: 1adffe86-10c3-11ec-8ce6-acde48001122
+version: 1
+date: '2021-09-08'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following detection identifies rundll32.exe with `control_rundll`
+  within the command-line, loading a .cpl or another file type from windows\temp,
+  programdata, or appdata. Developed in relation to CVE-2021-40444. Rundll32.exe can
+  also be used to execute Control Panel Item files (.cpl) through the undocumented
+  shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a
+  .cpl file also causes rundll32.exe to execute. This is written to be a bit more
+  broad by not including .cpl. The paths are specified, add more as needed. During
+  triage, review parallel processes to identify any further suspicious behavior.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=rundll32.exe
+  OR Processes.original_file_name=RUNDLL32.EXE) Processes.process=*Control_RunDLL*
+  AND Processes.process IN ("*\\appdata\\*", "*\\windows\\temp\\*", "*\\programdata\\*")  by
+  Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `rundll32_control_rundll_world_writable_directory_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: This may be tuned, or a new one related, by adding .cpl to
+  command-line. However, it's important to look for both. Tune/filter as needed.
+references:
+- https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html
+- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
+- https://attack.mitre.org/techniques/T1218/011/
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
+tags:
+  analytic_story:
+  - Suspicious Rundll32 Activity
+  - Microsoft MSHTML Remote Code Execution CVE-2021-40444
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.011
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  automated_detection_testing: passed

stories/microsoft_mshtml_remote_code_execution_cve_2021_40444.yml

@@ -0,0 +1,26 @@
+name: Microsoft MSHTML Remote Code Execution CVE-2021-40444
+id: 4ad4253e-10ca-11ec-8235-acde48001122
+version: 1
+date: '2021-09-08'
+author: Michael Haag, Splunk
+description: CVE-2021-40444 is a remote code execution vulnerability in MSHTML, recently used to delivery targeted spearphishing documents.
+narrative: 'Microsoft is aware of targeted attacks that attempt to exploit this vulnerability, CVE-2021-40444 by using specially-crafted Microsoft Office documents. MSHTML is a software component used to render web pages on Windows. Although it’s most commonly associated with Internet Explorer, it is also used in other software.  CVE-2021-40444 received a CVSS score of 8.8 out of 10. MSHTML is the beating heart of Internet Explorer, the vulnerability also exists in that browser. Although given its limited use, there is little risk of infection by that vector. Microsoft Office applications use the MSHTML component to display web content in Office documents. The attack depends on MSHTML loading a specially crafted ActiveX control when the target opens a malicious Office document. The loaded ActiveX control can then run arbitrary code to infect the system with more malware. \
+  At the moment all supported Windows versions are vulnerable. Since there is no patch available yet, Microsoft proposes a few methods to block these attacks. \
+
+  1. Disable the installation of all ActiveX controls in Internet Explorer via the registry. Previously-installed ActiveX controls will still run, but no new ones will be added, including malicious ones. \
+
+  1. Open documents from the Internet in Protected View or Application Guard for Office, both of which prevent the current attack. This is a default setting but it may have been changed.'
+references:
+  - https://blog.malwarebytes.com/exploits-and-vulnerabilities/2021/09/windows-mshtml-zero-day-actively-exploited-mitigations-required/
+  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
+  - https://www.echotrail.io/insights/search/control.exe
+tags:
+  analytic_story:
+  - Microsoft MSHTML Remote Code Execution CVE-2021-40444
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

tests/endpoint/control_loading_from_world_writable_directory.test.yml

@@ -0,0 +1,12 @@
+name: Control Loading from World Writable Directory Unit Test
+tests:
+- name: Control Loading from World Writable Directory
+  file: endpoint/control_loading_from_world_writable_directory.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/mshtml_module_load_in_office_product.test.yml

@@ -0,0 +1,12 @@
+name: MSHTML Module Load in Office Product Unit Test
+tests:
+- name: MSHTML Module Load in Office Product
+  file: endpoint/mshtml_module_load_in_office_product.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon_mshtml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_mshtml.log
+    source:  XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/office_spawning_control.test.yml

@@ -0,0 +1,12 @@
+name: Office Spawning Control Unit Test
+tests:
+- name: Office Spawning Control
+  file: endpoint/office_spawning_control.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon_control.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_control.log
+    source:  XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/rundll32_control_rundll_hunt.test.yml

@@ -0,0 +1,12 @@
+name: Rundll32 Control_RunDLL Hunt Unit Test
+tests:
+- name: Rundll32 Control_RunDLL Hunt
+  file: endpoint/rundll32_control_rundll_hunt.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/rundll32_control_rundll_world_writable_directory.test.yml

@@ -0,0 +1,12 @@
+name: Rundll32 Control_RunDLL World Writable Directory Unit Test
+tests:
+- name: Rundll32 Control_RunDLL World Writable Directory
+  file: endpoint/rundll32_control_rundll_world_writable_directory.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog