Branch was auto-updated.

detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml

@@ -1,7 +1,7 @@
 name: Detect Outlook exe writing a zip file
 id: a51bfe1a-94f0-4822-b1e4-16ae10145893
-version: 7
-date: '2024-10-17'
+version: 8
+date: '2024-11-28'
 author: Bhavin Patel, Splunk
 status: experimental
 type: TTP
@@ -18,6 +18,7 @@ tags:
   - Amadey
   - Remcos
   - PXA Stealer
+  - Meduza Stealer
   asset_type: Endpoint
   confidence: 50
   impact: 50

detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

@@ -1,14 +1,21 @@
 name: Executables Or Script Creation In Suspicious Path
 id: a7e3f0f0-ae42-11eb-b245-acde48001122
-version: 4
-date: '2024-09-30'
+version: 5
+date: '2024-11-28'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
 description: The following analytic identifies the creation of executables or scripts in suspicious file paths on Windows systems. It leverages the Endpoint.Filesystem data model to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in uncommon directories (e.g., \windows\fonts\, \users\public\). This activity is significant as adversaries often use these paths to evade detection and maintain persistence. If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.
 data_source:
 - Sysmon EventID 11
-search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where (Filesystem.file_name = *.exe OR Filesystem.file_name = *.dll OR Filesystem.file_name = *.sys OR Filesystem.file_name = *.com OR Filesystem.file_name = *.vbs OR Filesystem.file_name = *.vbe OR Filesystem.file_name = *.js OR Filesystem.file_name = *.ps1 OR Filesystem.file_name = *.bat OR Filesystem.file_name = *.cmd OR Filesystem.file_name = *.pif) AND ( Filesystem.file_path = *\\windows\\fonts\\* OR Filesystem.file_path = *\\windows\\temp\\* OR Filesystem.file_path = *\\users\\public\\* OR Filesystem.file_path = *\\windows\\debug\\* OR Filesystem.file_path = *\\Users\\Administrator\\Music\\* OR Filesystem.file_path = *\\Windows\\servicing\\* OR Filesystem.file_path = *\\Users\\Default\\* OR Filesystem.file_path = *Recycle.bin* OR Filesystem.file_path = *\\Windows\\Media\\* OR Filesystem.file_path = *\\Windows\\repair\\* OR Filesystem.file_path = *\\AppData\\Local\\Temp* OR Filesystem.file_path = *\\PerfLogs\\*) by Filesystem.file_create_time Filesystem.process_id  Filesystem.file_name Filesystem.user | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `executables_or_script_creation_in_suspicious_path_filter`'
+search: '| tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where 
+  Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.ps1", "*.bat", "*.cmd", "*.pif") AND 
+  Filesystem.file_path IN ("*\\windows\\fonts\\*", "*\\windows\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", "*\\Windows\\repair\\*", "*\\AppData\\Local\\Temp*", "*\\PerfLogs\\*", "*:\\temp\\*") 
+  by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user 
+  | `drop_dm_object_name(Filesystem)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `executables_or_script_creation_in_suspicious_path_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
 known_false_positives: Administrators may allow creation of script or exe in the paths specified. Filter as needed.
 references:
@@ -61,6 +68,7 @@ tags:
   - Handala Wiper
   - MoonPeak
   - ValleyRAT
+  - Meduza Stealer
   asset_type: Endpoint
   confidence: 50
   impact: 40

detections/endpoint/ping_sleep_batch_command.yml

@@ -1,7 +1,7 @@
 name: Ping Sleep Batch Command
 id: ce058d6c-79f2-11ec-b476-acde48001122
-version: 3
-date: '2024-09-30'
+version: 4
+date: '2024-11-28'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -30,6 +30,7 @@ tags:
   - WhisperGate
   - BlackByte Ransomware
   - Warzone RAT
+  - Meduza Stealer
   asset_type: Endpoint
   confidence: 60
   impact: 60

detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml

@@ -1,7 +1,7 @@
 name: Suspicious Process DNS Query Known Abuse Web Services
 id: 3cf0dc36-484d-11ec-a6bc-acde48001122
-version: 6
-date: '2024-09-30'
+version: 7
+date: '2024-11-28'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -31,6 +31,7 @@ tags:
   - Phemedrone Stealer
   - Snake Keylogger
   - PXA Stealer
+  - Meduza Stealer
   asset_type: Endpoint
   confidence: 80
   impact: 80

detections/endpoint/suspicious_process_file_path.yml

@@ -1,7 +1,7 @@
 name: Suspicious Process File Path
 id: 9be25988-ad82-11eb-a14f-acde48001122
-version: 4
-date: '2024-09-30'
+version: 5
+date: '2024-11-28'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -63,6 +63,7 @@ tags:
   - Handala Wiper
   - MoonPeak
   - ValleyRAT
+  - Meduza Stealer
   asset_type: Endpoint
   confidence: 50
   impact: 70

detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml

@@ -1,7 +1,7 @@
 name: Windows Access Token Manipulation SeDebugPrivilege
 id: 6ece9ed0-5f92-4315-889d-48560472b188
-version: 4
-date: '2024-09-30'
+version: 5
+date: '2024-11-28'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -34,6 +34,7 @@ tags:
   - CISA AA23-347A
   - PlugX
   - ValleyRAT
+  - Meduza Stealer
   asset_type: Endpoint
   confidence: 60
   impact: 60

detections/endpoint/windows_credential_access_from_browser_password_store.yml

@@ -1,7 +1,7 @@
 name: Windows Credential Access From Browser Password Store
 id: 72013a8e-5cea-408a-9d51-5585386b4d69
-version: 4
-date: '2024-09-30'
+version: 5
+date: '2024-11-28'
 author: Teoderick Contreras, Bhavin Patel Splunk
 data_source:
 - Windows Event Log Security 4663
@@ -29,6 +29,7 @@ tags:
   - MoonPeak
   - Braodo Stealer
   - PXA Stealer
+  - Meduza Stealer
   asset_type: Endpoint
   confidence: 50
   impact: 50

detections/endpoint/windows_credentials_access_via_vaultcli_module.yml

@@ -0,0 +1,69 @@
+name: Windows Credentials Access via VaultCli Module
+id: c0d89118-3f89-4cd7-8140-1f39e7210681
+version: 1
+date: '2024-11-29'
+author: Teoderick Contreras, Splunk
+data_sources:
+- Sysmon Event ID 7
+type: Anomaly
+status: production
+description: The following analytic detects potentially abnormal interactions with VaultCLI.dll, particularly those initiated by processes located in publicly writable Windows folder paths. The VaultCLI.dll module allows processes to extract credentials from the Windows Credential Vault. It was seen being abused by information stealers such as Meduza. The analytic monitors suspicious API calls, unauthorized credential access patterns, and anomalous process behaviors indicative of malicious activity. By leveraging a combination of signature-based detection and behavioral analysis, it effectively flags attempts to misuse the vault for credential theft, enabling swift response to protect sensitive user data and ensure system security.
+search: '`sysmon` EventCode=7  ImageLoaded ="*\\vaultcli.dll" process_path IN("*\\windows\\fonts\\*", "*\\windows\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", "\\Windows\\repair\\*", "*\\appdata\\local\\temp\\*", "*\\PerfLogs\\*", "*:\\temp\\*") 
+  | stats count min(_time) as firstTime max(_time) as lastTime by dest Image ImageLoaded process_name EventCode Signed ProcessId 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_credentials_access_via_vaultcli_module_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: Third party software might leverage this DLL in order to make use of the Credential Manager feature via the provided exports. Typically the vaultcli.dll module is loaded by the vaultcmd.exe Windows Utility to interact with the Windows Credential Manager for secure storage and retrieval of credentials.
+references:
+- https://hijacklibs.net/entries/microsoft/built-in/vaultcli.html
+- https://www.fortinet.com/blog/threat-research/exploiting-cve-2024-21412-stealer-campaign-unleashed
+- https://cert.gov.ua/article/6276652
+- https://cert.gov.ua/article/6281018
+- https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-meduza-f1bbd2efb84f
+drilldown_searches:
+- name: View the detection results for - "$dest$"
+  search: '%original_detection_search% | search  dest = "$dest$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$dest$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+tags:
+  analytic_story:
+  - Meduza Stealer
+  asset_type: Endpoint
+  confidence: 80
+  impact: 80
+  message: An instance of process name [$process_name$] loading a file [$ImageLoaded$] was identified on endpoint- [$dest$] to potentially capture credentials in memory.
+  mitre_attack_id:
+  - T1555.004
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - process_path
+  - ImageLoaded
+  - Signed 
+  - ProcessId 
+  risk_score: 64
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555.004/vaultcli_creds/vaultcli.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: XmlWinEventLog

detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml

@@ -1,7 +1,7 @@
 name: Windows Credentials from Password Stores Chrome Extension Access
 id: 2e65afe0-9a75-4487-bd87-ada9a9f1b9af
-version: 3
-date: '2024-09-30'
+version: 4
+date: '2024-11-28'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -36,6 +36,7 @@ tags:
   - Phemedrone Stealer
   - MoonPeak
   - Braodo Stealer
+  - Meduza Stealer
   asset_type: Endpoint
   confidence: 50
   impact: 50

detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml

@@ -1,7 +1,7 @@
 name: Windows Credentials from Password Stores Chrome LocalState Access
 id: 3b1d09a8-a26f-473e-a510-6c6613573657
-version: 4
-date: '2024-09-30'
+version: 5
+date: '2024-11-28'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -39,6 +39,7 @@ tags:
   - MoonPeak
   - Braodo Stealer
   - PXA Stealer
+  - Meduza Stealer
   asset_type: Endpoint
   confidence: 50
   impact: 50

detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml

@@ -1,7 +1,7 @@
 name: Windows Credentials from Password Stores Chrome Login Data Access
 id: 0d32ba37-80fc-4429-809c-0ba15801aeaf
-version: 4
-date: '2024-09-30'
+version: 5
+date: '2024-11-28'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -39,6 +39,7 @@ tags:
   - MoonPeak
   - Braodo Stealer
   - PXA Stealer
+  - Meduza Stealer
   asset_type: Endpoint
   confidence: 70
   impact: 70

detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml

@@ -1,7 +1,7 @@
 name: Windows Gather Victim Network Info Through Ip Check Web Services
 id: 70f7c952-0758-46d6-9148-d8969c4481d1
-version: 6
-date: '2024-10-17'
+version: 7
+date: '2024-11-28'
 author: Teoderick Contreras, Splunk
 status: production
 type: Hunting
@@ -21,6 +21,7 @@ tags:
   - Snake Keylogger
   - Handala Wiper
   - PXA Stealer
+  - Meduza Stealer
   asset_type: Endpoint
   confidence: 50
   impact: 50

detections/endpoint/windows_query_registry_uninstall_program_list.yml

@@ -1,16 +1,16 @@
 name: Windows Query Registry UnInstall Program List
 id: 535fd4fc-7151-4062-9d7e-e896bea77bf6
-version: 3
-date: '2024-09-30'
+version: 4
+date: '2024-11-28'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
 data_source:
 - Windows Event Log Security 4663
-description: The following analytic detects a suspicious query on the uninstall application list in the Windows OS registry. It leverages Windows Security Event logs, specifically event code 4663, to identify access to the "Uninstall" registry key. This activity is significant because adversaries or malware can exploit this key to gather information about installed applications, aiding in further attacks. If confirmed malicious, this behavior could allow attackers to map out installed software, potentially identifying vulnerabilities or software to exploit, leading to further system compromise.
-search: '`wineventlog_security` EventCode=4663 object_file_path="\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*" | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path  process_id EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_query_registry_uninstall_program_list_filter`'
-how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
-known_false_positives: Uninstall application may access this registry to remove the entry of the target application. Filter is needed.
+description: The following analytic detects an access request on the uninstall registry key. It leverages Windows Security Event logs, specifically event code 4663. This activity is significant because adversaries or malware can exploit this key to gather information about installed applications, aiding in further attacks. If confirmed malicious, this behavior could allow attackers to map out installed software, potentially identifying vulnerabilities or software to exploit, leading to further system compromise.
+search: '`wineventlog_security` EventCode=4663 object_file_path="*\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*" | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path  process_id EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_query_registry_uninstall_program_list_filter`'
+how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For Event code 4663, enable the "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
+known_false_positives: Uninstallers may access this registry to remove the entry of the target application. Filter as needed.
 references:
 - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
 drilldown_searches:
@@ -25,6 +25,7 @@ drilldown_searches:
 tags:
   analytic_story:
   - RedLine Stealer
+  - Meduza Stealer
   asset_type: Endpoint
   confidence: 50
   impact: 50

detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml

@@ -1,7 +1,7 @@
 name: Windows Unsecured Outlook Credentials Access In Registry
 id: 36334123-077d-47a2-b70c-6c7b3cc85049
-version: 3
-date: '2024-09-30'
+version: 4
+date: '2024-11-28'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -26,6 +26,7 @@ drilldown_searches:
 tags:
   analytic_story:
   - Snake Keylogger
+  - Meduza Stealer
   asset_type: Endpoint
   confidence: 70
   impact: 70

stories/meduza_stealer.yml

@@ -0,0 +1,20 @@
+name: Meduza Stealer
+id: c3328a8a-565b-435e-b9cc-5410e34b821b
+version: 1
+date: '2024-11-28'
+author: Teoderick Contreras, Splunk
+description: Meduza Stealer is a sophisticated and rapidly evolving malware designed to extract sensitive data from compromised systems. Detected primarily through anomalous network activities, its behavior often involves outbound connections to command-and-control (C2) servers, encrypting and exfiltrating stolen credentials, financial data, and other personal information. Analysts have identified Meduza Stealer leveraging advanced evasion techniques, including dynamic obfuscation, anti-analysis methods, and the use of polymorphic code to bypass detection by traditional antivirus systems. Once deployed, it scans for browser-stored passwords, cryptocurrency wallets, and keylogging opportunities, potentially exploiting unpatched software vulnerabilities. Security tools flag it through heuristic detections, anomalous process executions, or unusual registry modifications. Meduza Stealer's malicious payloads are often distributed via phishing emails, malicious attachments, or trojanized software downloads. Effective defense requires a multi-layered security approach, regular software updates, and employee training to minimize risks posed by this potent cyber threat.
+narrative: Meduza Stealer is a relatively new entrant in the cybercrime landscape, first identified in early 2023. It quickly gained notoriety among threat actors for its effectiveness and adaptability. Designed as a data-stealing malware, it targets sensitive information such as login credentials, financial details, and cryptocurrency wallets. Its developers market it on underground forums, often touting its advanced features like dynamic obfuscation and anti-analysis mechanisms, making it difficult for traditional antivirus solutions to detect. Meduza Stealer typically spreads through phishing campaigns, malicious email attachments, and trojanized software downloads. Once executed, it infiltrates systems silently, harvesting data from web browsers, password managers, and clipboard activities. It then transmits the stolen information to its command-and-control (C2) servers using encrypted communication channels, further complicating detection and analysis. Security researchers have noted its use of polymorphic code, enabling it to modify its structure with each infection to evade heuristic and signature-based detection methods.Meduza Stealer highlights a growing trend in sophisticated, modular malware that appeals to cybercriminals due to its efficiency and ease of deployment. Effective mitigation strategies include adopting behavioral analysis tools, implementing robust endpoint security solutions, and maintaining user awareness through regular cybersecurity training. Proactive measures are essential to combat the escalating threat posed by this advanced malware.
+references:
+- https://www.fortinet.com/blog/threat-research/exploiting-cve-2024-21412-stealer-campaign-unleashed
+- https://cert.gov.ua/article/6276652
+- https://cert.gov.ua/article/6281018
+- https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-meduza-f1bbd2efb84f
+tags:
+  category:
+  - Malware
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection