From d9cfd940d1433b580b44afac64beff28996c8178 Mon Sep 17 00:00:00 2001 From: tcontreras Date: Wed, 5 May 2021 21:28:00 +0200 Subject: [PATCH 1/3] fix_typo --- ...edule_task_with_http_command_arguments.yml | 56 ------------------- ..._task_with_http_command_arguments.test.yml | 15 ----- 2 files changed, 71 deletions(-) delete mode 100644 detections/endpoint/shedule_task_with_http_command_arguments.yml delete mode 100644 tests/endpoint/shedule_task_with_http_command_arguments.test.yml diff --git a/detections/endpoint/shedule_task_with_http_command_arguments.yml b/detections/endpoint/shedule_task_with_http_command_arguments.yml deleted file mode 100644 index 751030b94a..0000000000 --- a/detections/endpoint/shedule_task_with_http_command_arguments.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Shedule Task with HTTP Command Arguments -id: 523c2684-a101-11eb-916b-acde48001122 -version: 1 -date: '2021-04-19' -author: Teoderick Contreras, Splunk -type: batch -datamodel: -- Endpoint -description: The following query utilizes Windows Security EventCode 4698, `A scheduled - task was created`, to identify suspicious tasks registered on Windows either via - schtasks.exe OR TaskService with an arguments "HTTP" string that are unique entry - of malware or attack that uses lolbin to download other file or payload to the infected - machine.\ The search will return the first time and last time the task was registered, - as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether - it is `Hidden` or not.\ schtasks.exe is natively found in `C:\Windows\system32` - and `C:\Windows\syswow64`.\ The following DLL(s) are loaded when schtasks.exe or - TaskService is launched -`taskschd.dll`. If found loaded by another process, it - is possible a scheduled task is being registered within that process context in - memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or - via TaskService? Review the job created and the Command to be executed. Capture - any artifacts on disk and review. Identify any parallel processes within the same - timeframe to identify source.' -search: '`wineventlog_security` EventCode=4698 | xmlkv Message| search Arguments IN - ("*http*") | stats count min(_time) as firstTime max(_time) as lastTime by dest, - Task_Name, Command, Author, Enabled, Hidden, Arguments | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `shedule_task_with_http_command_arguments_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and - filter known instances of Task schedule used in your environment. -known_false_positives: unknown -references: -- https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/ -tags: - analytic_story: - - Windows Persistence Techniques - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/tasksched/windows-security.log - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1053 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - dest - - Task_Name - - Command - - Author - - Enabled - - Hidden - - Arguments - security_domain: endpoint diff --git a/tests/endpoint/shedule_task_with_http_command_arguments.test.yml b/tests/endpoint/shedule_task_with_http_command_arguments.test.yml deleted file mode 100644 index cedd314f01..0000000000 --- a/tests/endpoint/shedule_task_with_http_command_arguments.test.yml +++ /dev/null @@ -1,15 +0,0 @@ -name: Shedule Task with HTTP Command Arguments Unit Test -tests: -- name: Shedule Task with HTTP Command Arguments - file: endpoint/shedule_task_with_http_command_arguments.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/tasksched/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog - - - \ No newline at end of file From 03c05248ac529ff0ca58461d2607bced73babc9f Mon Sep 17 00:00:00 2001 From: tcontreras Date: Wed, 5 May 2021 21:34:02 +0200 Subject: [PATCH 2/3] fix_typos --- ...edule_task_with_http_command_arguments.yml | 56 +++++++++++++++++++ ..._task_with_http_command_arguments.test.yml | 15 +++++ 2 files changed, 71 insertions(+) create mode 100644 detections/endpoint/schedule_task_with_http_command_arguments.yml create mode 100644 tests/endpoint/schedule_task_with_http_command_arguments.test.yml diff --git a/detections/endpoint/schedule_task_with_http_command_arguments.yml b/detections/endpoint/schedule_task_with_http_command_arguments.yml new file mode 100644 index 0000000000..16d640dbc5 --- /dev/null +++ b/detections/endpoint/schedule_task_with_http_command_arguments.yml @@ -0,0 +1,56 @@ +name: Schedule Task with HTTP Command Arguments +id: 523c2684-a101-11eb-916b-acde48001122 +version: 1 +date: '2021-04-19' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: The following query utilizes Windows Security EventCode 4698, `A scheduled + task was created`, to identify suspicious tasks registered on Windows either via + schtasks.exe OR TaskService with an arguments "HTTP" string that are unique entry + of malware or attack that uses lolbin to download other file or payload to the infected + machine. The search will return the first time and last time the task was registered, + as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether + it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` + and `C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or + TaskService is launched -`taskschd.dll`. If found loaded by another process, it + is possible a scheduled task is being registered within that process context in + memory. Upon triage, identify the task scheduled source. Was it schtasks.exe or + via TaskService? Review the job created and the Command to be executed. Capture + any artifacts on disk and review. Identify any parallel processes within the same + timeframe to identify source.' +search: '`wineventlog_security` EventCode=4698 | xmlkv Message| search Arguments IN + ("*http*") | stats count min(_time) as firstTime max(_time) as lastTime by dest, + Task_Name, Command, Author, Enabled, Hidden, Arguments | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `schedule_task_with_http_command_arguments_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and + filter known instances of Task schedule used in your environment. +known_false_positives: unknown +references: +- https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/ +tags: + analytic_story: + - Windows Persistence Techniques + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/tasksched/windows-security.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1053 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - Task_Name + - Command + - Author + - Enabled + - Hidden + - Arguments + security_domain: endpoint diff --git a/tests/endpoint/schedule_task_with_http_command_arguments.test.yml b/tests/endpoint/schedule_task_with_http_command_arguments.test.yml new file mode 100644 index 0000000000..7a0dedb3c1 --- /dev/null +++ b/tests/endpoint/schedule_task_with_http_command_arguments.test.yml @@ -0,0 +1,15 @@ +name: Schedule Task with HTTP Command Arguments Unit Test +tests: +- name: Schedule Task with HTTP Command Arguments + file: endpoint/schedule_task_with_http_command_arguments.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/tasksched/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog + + + \ No newline at end of file From af1503d1cd021ca5e531ac1f88e16a3d7b724434 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 5 May 2021 20:00:43 +0000 Subject: [PATCH 3/3] Added detection testing service results inSchedule Task with HTTP Command Arguments --- ...schedule_task_with_http_command_arguments.yml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/schedule_task_with_http_command_arguments.yml b/detections/endpoint/schedule_task_with_http_command_arguments.yml index 16d640dbc5..779e75f541 100644 --- a/detections/endpoint/schedule_task_with_http_command_arguments.yml +++ b/detections/endpoint/schedule_task_with_http_command_arguments.yml @@ -12,14 +12,14 @@ description: The following query utilizes Windows Security EventCode 4698, `A sc of malware or attack that uses lolbin to download other file or payload to the infected machine. The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether - it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` - and `C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or - TaskService is launched -`taskschd.dll`. If found loaded by another process, it - is possible a scheduled task is being registered within that process context in - memory. Upon triage, identify the task scheduled source. Was it schtasks.exe or - via TaskService? Review the job created and the Command to be executed. Capture - any artifacts on disk and review. Identify any parallel processes within the same - timeframe to identify source.' + it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` and + `C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService + is launched -`taskschd.dll`. If found loaded by another process, it is possible + a scheduled task is being registered within that process context in memory. Upon + triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? + Review the job created and the Command to be executed. Capture any artifacts on + disk and review. Identify any parallel processes within the same timeframe to identify + source.' search: '`wineventlog_security` EventCode=4698 | xmlkv Message| search Arguments IN ("*http*") | stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden, Arguments | `security_content_ctime(firstTime)`