admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Converted ssa detections

Browse Source
This commit is contained in:
P4T12ICK
2022-12-19 14:43:15 +01:00
parent 483d0d01b1
commit 1f9615e785
85 changed files with 5321 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ba_detections/deprecated/ssa_credential_extractionfgdump_and_cachedump.yml
+53
View File
@@ -0,0 +1,53 @@
name: Credential ExtractionFGDump and CacheDump
id: 3c40b0ef-a03f-460a-9484-e4b9117cbb38
version: 2
date: '2021-11-29'
author: Stanislav Miskovic, Splunk
status: deprecated
type: TTP
description: The following analytic identifies the use of CacheDump with the `-v`
parameter to dump cached credentials on the associated endpoint. Adversaries use
Cachedump as it is a publicly-available tool that extracts cached password hashes
from a system's registry.
data_source: []
search: ' | from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line != null AND process_name != null AND process_path != null AND match_regex(process_name,
/(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path, /(?i)\\Temp/)=true
AND match_regex(cmd_line, /(?i)\-v/)=true
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: False positives will be limited as this analytic targets specific
credential dumping process names. Filter as needed.
references: []
tags:
analytic_story:
- Unusual Processes
- Credential Dumping
asset_type: Windows
atomic_guid: []
confidence: 90
drilldown_search: []
impact: 70
message: Malicious actor is accessing stored credentials via FGDump or CacheDump
tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via process $process_name$
mitre_attack_id:
- T1003
- T1003.002
product:
- Splunk Behavioral Analytics
risk_score: 63
security_domain: endpoint
tests: []
ba_detections/deprecated/ssa_potential_pass_the_token_or_hash_observed_at_the_destination_device.yml
+68
View File
@@ -0,0 +1,68 @@
name: Potential Pass the Token or Hash Observed at the Destination Device
id: 82e76b80-5cdb-4899-9b43-85dbe777b36d
version: 3
date: '2021-11-30'
author: Stanislav Miskovic, Splunk
status: deprecated
type: TTP
description: This detection identifies potential Pass the Token or Pass the Hash credential
stealing. We detect the main side effect of these attacks, which is a transition
from the dominant Kerberos logins to rare NTLM logins for a given user, as reported
by a detination device.
data_source: []
search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
dest_user=lower(ucast(map_get(input_event, "dest_user_primary_artifact"), "string",
null)), dest_user_id= ucast(map_get(input_event, "dest_user_id"), "string", null),
dest_device_id= ucast(map_get(input_event, "dest_device_id"), "string", null),
signature_id= lower(ucast(map_get(input_event, "signature_id"), "string", null)),
authentication_method= lower(ucast(map_get(input_event, "authentication_method"),
"string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos")
AND dest_user_id != null AND dest_device_id != null
| eval isKerberos=if(authentication_method == "kerberos", 1, 0), isNtlm=if(authentication_method
== "ntlmssp", 1, 0), timeNTLM=if(isNtlm > 0, timestamp, null)
| stats sum(isKerberos) as totalKerberos, sum(isNtlm) as totalNtlm, min(timestamp) as
startTime, min(timeNTLM) as startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as
endNTLMTime by dest_user_id, dest_user, dest_device_id, span(timestamp, 86400s)
| where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime -
startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND
(endTime - startTime) > 3 * (endNTLMTime - startNTLMTime)
| eval start_time=ucast(startNTLMTime, "long", null), end_time=ucast(endNTLMTime,
"long", null), entities=mvappend(dest_user_id, dest_device_id), body=create_map(["event_id",
event_id, "total_kerberos", totalKerberos, "total_ntlm", totalNtlm, "analysis_start_time",
startTime, "analysis_end_time", endTime, "pth_start_time", startNTLMTime, "pth_end_time",
endNTLMTime])
| into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from endpoint devices,
i.e., destinations of interest. Please make sure that event ID 4624 is being logged.
known_false_positives: Environments in which NTLM is used extremely rarely and for
benign purposes (such as a rare use of SMB shares).
references:
- https://attack.mitre.org/techniques/T1550/002/
- https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/
tags:
analytic_story:
- Active Directory Lateral Movement
asset_type: Windows
atomic_guid: []
confidence: 90
drilldown_search: []
impact: 80
message: Potential lateral movement and credential stealing via Pass the Token or
Pass the Hash techniques. Operation is performed via credentials of the account
$dest_user_id$ and observed by the destination device $dest_device_id$
mitre_attack_id:
- T1550
- T1550.002
product:
- Splunk Behavioral Analytics
risk_score: 72
security_domain: endpoint
tests: []
ba_detections/deprecated/ssa_potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml
+69
View File
@@ -0,0 +1,69 @@
name: Potential Pass the Token or Hash Observed by an Event Collecting Device
id: 1058ba3e-a698-49bc-a1e5-7cedece4ea87
version: 2
date: '2021-11-05'
author: Stanislav Miskovic, Splunk
status: deprecated
type: TTP
description: This detection identifies potential Pass the Token or Pass the Hash credential
stealing. We detect the main side effect of these attacks, which is a transition
from the dominant Kerberos logins to rare NTLM logins for a given user, as reported
by an event-collecting device (i.e., a specific domain controller or an endpoint
destination).
data_source: []
search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"),
"string", null)), dest_user_id= ucast(map_get(input_event, "dest_user_id"), "string",
null), origin_device_id= ucast(map_get(input_event, "origin_device_id"), "string",
null), signature_id= lower(ucast(map_get(input_event, "signature_id"), "string",
null)), authentication_method= lower(ucast(map_get(input_event, "authentication_method"),
"string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos")
AND dest_user_id != null AND origin_device_id != null
| eval isKerberos=if(authentication_method == "kerberos", 1, 0), isNtlm=if(authentication_method
== "ntlmssp", 1, 0), timeNTLM=if(isNtlm > 0, timestamp, null)
| stats sum(isKerberos) as totalKerberos, sum(isNtlm) as totalNtlm, min(timestamp) as
startTime, min(timeNTLM) as startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as
endNTLMTime by dest_user_id, dest_user, origin_device_id, span(timestamp, 86400s)
| where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime -
startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND
(endTime - startTime) > 3 * (endNTLMTime - startNTLMTime)
| eval start_time=startNTLMTime, end_time=endNTLMTime, entities=mvappend(dest_user_id,
origin_device_id), body=create_map(["event_id", event_id, "total_kerberos", totalKerberos,
"total_ntlm", totalNtlm, "analysis_start_time", startTime, "analysis_end_time",
endTime, "detection_start_time", startNTLMTime, "detection_end_time", endNTLMTime])
| into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest
- at least from domain controllers. Please make sure that event ID 4624 is being
logged.
known_false_positives: Environments in which NTLM is used extremely rarely and for
benign purposes (such as a rare use of SMB shares).
references:
- https://attack.mitre.org/techniques/T1550/002/
- https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/
tags:
analytic_story:
- Active Directory Lateral Movement
asset_type: Windows
atomic_guid: []
confidence: 80
drilldown_search: []
impact: 80
message: Potential lateral movement and credential stealing via Pass the Token or
Pass the Hash techniques. Operation is performed via credentials of the account
$dest_user_id$ and observed by the logging device $origin_device_id$
mitre_attack_id:
- T1550
- T1550.002
product:
- Splunk Behavioral Analytics
risk_score: 64
security_domain: endpoint
tests: []
ba_detections/deprecated/ssa_unusual_lolbas_in_short_period_of_time.yml
+71
View File
@@ -0,0 +1,71 @@
name: Unusual LOLBAS in short period of time
id: 59c0dd70-169c-4900-9a1f-bfcf13302f93
version: 2
date: '2020-08-25'
author: Ignacio Bermudez Corrales, Splunk
status: deprecated
type: Anomaly
description: Attacker activity may compromise executing several LOLBAS applications
in conjunction to accomplish their objectives. We are looking for more than usual
LOLBAS applications over a window of time, by building profiles per machine.
data_source: []
search: ' | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
"dest_device_id"), "string", null), process_name=lower(ucast(map_get(input_event,
"process_name"), "string", null)), timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)) | where process_name=="regsvcs.exe" OR process_name=="ftp.exe"
OR process_name=="dfsvc.exe" OR process_name=="rasautou.exe" OR process_name=="schtasks.exe"
OR process_name=="xwizard.exe" OR process_name=="findstr.exe" OR process_name=="esentutl.exe"
OR process_name=="cscript.exe" OR process_name=="reg.exe" OR process_name=="csc.exe"
OR process_name=="atbroker.exe" OR process_name=="print.exe" OR process_name=="pcwrun.exe"
OR process_name=="vbc.exe" OR process_name=="rpcping.exe" OR process_name=="wsreset.exe"
OR process_name=="ilasm.exe" OR process_name=="certutil.exe" OR process_name=="replace.exe"
OR process_name=="mshta.exe" OR process_name=="bitsadmin.exe" OR process_name=="wscript.exe"
OR process_name=="ieexec.exe" OR process_name=="cmd.exe" OR process_name=="microsoft.workflow.compiler.exe"
OR process_name=="runscripthelper.exe" OR process_name=="makecab.exe" OR process_name=="forfiles.exe"
OR process_name=="desktopimgdownldr.exe" OR process_name=="control.exe" OR process_name=="msbuild.exe"
OR process_name=="register-cimprovider.exe" OR process_name=="tttracer.exe" OR process_name=="ie4uinit.exe"
OR process_name=="sc.exe" OR process_name=="bash.exe" OR process_name=="hh.exe"
OR process_name=="cmstp.exe" OR process_name=="mmc.exe" OR process_name=="jsc.exe"
OR process_name=="scriptrunner.exe" OR process_name=="odbcconf.exe" OR process_name=="extexport.exe"
OR process_name=="msdt.exe" OR process_name=="diskshadow.exe" OR process_name=="extrac32.exe"
OR process_name=="eventvwr.exe" OR process_name=="mavinject.exe" OR process_name=="regasm.exe"
OR process_name=="gpscript.exe" OR process_name=="rundll32.exe" OR process_name=="regsvr32.exe"
OR process_name=="regedit.exe" OR process_name=="msiexec.exe" OR process_name=="gfxdownloadwrapper.exe"
OR process_name=="presentationhost.exe" OR process_name=="regini.exe" OR process_name=="wmic.exe"
OR process_name=="runonce.exe" OR process_name=="syncappvpublishingserver.exe" OR
process_name=="verclsid.exe" OR process_name=="psr.exe" OR process_name=="infdefaultinstall.exe"
OR process_name=="explorer.exe" OR process_name=="expand.exe" OR process_name=="installutil.exe"
OR process_name=="netsh.exe" OR process_name=="wab.exe" OR process_name=="dnscmd.exe"
OR process_name=="at.exe" OR process_name=="pcalua.exe" OR process_name=="cmdkey.exe"
OR process_name=="msconfig.exe" | stats count(process_name) as lolbas_counter by
device,span(timestamp, 300s) | eval lolbas_counter=lolbas_counter*1.0 | rename window_end
as timestamp | adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device"
window=2419200000L | where label AND quantile>0.99 | eval start_time = window_start,
end_time = timestamp, entities = mvappend(device), body=create_map(["lolbas_counter",
lolbas_counter, "quantile", quantile, "device", device]) | into write_ssa_detected_events();'
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
known_false_positives: 'Some administrative tasks may involve multiple use of LOLBAS
applications in a short period of time. This might trigger false positives at the
beginning when it hasn''t collected yet enough data to construct the baseline.
'
references:
- https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
tags:
analytic_story:
- Unusual Processes
asset_type: Endpoint
atomic_guid: []
confidence: 50
drilldown_search: []
impact: 50
message: A system process $process_name$ with commandline $cmd_line$ spawn iin short
period of time in host $dest_device_id$
mitre_attack_id:
- T1059
- T1053
product:
- Splunk Behavioral Analytics
risk_score: 25
security_domain: endpoint
tests: []
ba_detections/deprecated/ssa_unusually_long_command_line.yml
+50
View File
@@ -0,0 +1,50 @@
name: Unusually Long Command Line
id: 58f43aba-1775-445e-b19c-be2b87d83ae3
version: 1
date: '2020-10-06'
author: Ignacio Bermudez Corrales, Splunk
status: deprecated
type: Anomaly
description: Command lines that are extremely long may be indicative of malicious
activity on your hosts. This search leverages the Splunk Streaming ML DSP plugin
to help identify command lines with lengths that are unusual for a given user. This
detection is inspired on Unusually Long Command Line authored by Rico Valdez.
data_source: []
search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)) | eval cmd_line=ucast(map_get(input_event, "process"),
"string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
process_name=ucast(map_get(input_event, "process_name"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line!=null and dest_user_id!=null | eval
cmd_line_norm=replace(cast(cmd_line, "string"), /\s(--?\w+)|(\/\w+)/, " ARG"), cmd_line_norm=replace(cmd_line_norm,
/\w:\\[^\s]+/, "PATH"), cmd_line_norm=replace(cmd_line_norm, /\d+/, "N"), input=parse_double(len(coalesce(cmd_line_norm,
""))) | select timestamp, process_name, dest_device_id, dest_user_id, cmd_line,
input | adaptive_threshold algorithm="quantile" entity="process_name" window=60480000
| where label AND quantile>0.99 | first_time_event input_columns=["dest_device_id",
"cmd_line"] | where first_time_dest_device_id_cmd_line | eval start_time = timestamp,
end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map(["event_id",
event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting sysmon endpoint data that monitors command
lines.
known_false_positives: This detection may flag suspiciously long command lines when
there is not sufficient evidence (samples) for a given process that this detection
is tracking; or when there is high variability in the length of the command line
for the tracked process. Also, some legitimate applications may use long command
lines. Such is the case of Ansible, that encodes Powershell scripts using long base64.
Attackers may use this technique to obfuscate their payloads.
references: []
tags:
analytic_story:
- Unusual Processes
asset_type: Endpoint
atomic_guid: []
confidence: 40
drilldown_search: []
impact: 30
message: A process $process_name$ with a long commandline $cmd_line$ executed in
host $dest_device_id$
product:
- Splunk Behavioral Analytics
risk_score: 12
security_domain: endpoint
tests: []
ba_detections/endpoint/ssa_anomalous_usage_of_account_credentials.yml
+44
View File
@@ -0,0 +1,44 @@
name: Anomalous Usage of Account Credentials
id: 629cbf9e-5785-11ec-9611-acde48001122
version: 1
date: '2021-12-07'
author: Lou Stella, Splunk
status: experimental
type: Anomaly
description: This is an anomaly generating detection looking for multiple interactive
logins within a specific time period. An insider threat may attempt to steal colleagues
credentials in low tech, undetectable methods, in order to gain access to additional
information or to hide their own behavior. This should capture their attempted use
of those credentials on a workstation.
data_source: []
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
"dest_device_id"), "string", null), auth_type=ucast(map_get(input_event, "authentication_type"),
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
null)), src_user=ucast(map_get(input_event, "dest_user_original_artifact"), "string",
null), signature_id=ucast(map_get(input_event, "EventCode"), "string", null) | where
signature_id="4624" | where auth_type="2" OR auth_type="11" | where NOT (src_user="SYSTEM")
AND NOT (src_user="ANONYMOUS LOGON") | stats estdc(src_user) AS user_counter by
device, span(timestamp, 600s, 300s) | where user_counter>=2 | rename window_end
AS timestamp | eval start_time=window_start, end_time=timestamp, entities=mvappend(device),
body=create_map(["user_counter", user_counter, "device", device]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this detection, you need to be ingesting
logon events from workstations.
known_false_positives: Shared workstations can cause false positives
references:
- https://attack.mitre.org/techniques/T1078/002/
tags:
analytic_story:
- Insider Threat
asset_type: Endpoint
atomic_guid: []
confidence: 30
drilldown_search: []
impact: 20
message: Multiple interactive logins detected on $device$
mitre_attack_id:
- T1078.002
product:
- Splunk Behavioral Analytics
risk_score: 6
security_domain: access
tests: []
ba_detections/endpoint/ssa_anomalous_usage_of_archive_tools.yml
+56
View File
@@ -0,0 +1,56 @@
name: Anomalous usage of Archive Tools
id: 63614a58-10e2-4c6c-ae81-ea1113681439
version: 1
date: '2021-11-22'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following detection identifies the usage of archive tools from the
command line.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"),
"string", null)), process=lower(ucast(map_get(input_event, "process"), "string",
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), process_path=ucast(map_get(input_event, "process_path"), "string", null),
parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), parent_process=ucast(map_get(input_event, "parent_process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process_name
IS NOT NULL AND parent_process_name IS NOT NULL | where like(process_name, "7z%")
OR process_name="WinRAR.exe" OR like(process_name, "winzip%") | where like(parent_process_name,
"%cmd.exe") OR like(parent_process_name, "%powershell.exe") | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["event_id", event_id, "process_name", process_name, "parent_process_name",
parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
known_false_positives: False positives can be ligitmate usage of archive tools from
the command line.
references:
- https://attack.mitre.org/techniques/T1560/001/
tags:
analytic_story:
- Cobalt Strike
- NOBELIUM Group
- Insider Threat
asset_type: Endpoint
atomic_guid: []
confidence: 60
drilldown_search: []
impact: 70
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading
of 7zip.
mitre_attack_id:
- T1560.001
- T1560
product:
- Splunk Behavioral Analytics
risk_score: 42
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_tools/windows-security.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_attempt_to_delete_services.yml
+58
View File
@@ -0,0 +1,58 @@
name: Attempt To Delete Services
id: a0c8c292-d01a-11eb-aa18-acde48001122
version: 3
date: '2021-11-24'
author: Teoderick Contreras, splunk
status: production
type: TTP
description: The following analytic identifies Windows Service Control, `sc.exe`,
attempting to delete a service. This is typically identified in parallel with other
instances of service enumeration of attempts to stop a service and then delete it.
Adversaries utilize this technique to terminate security services or other related
services to continue there objective and evade detections.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND like(cmd_line, "%delete%") AND process_name = "sc.exe"
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: It is possible administrative scripts may start/stop/delete
services. Filter as needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md
tags:
analytic_story:
- XMRig
- Ransomware
asset_type: Endpoint
atomic_guid: []
confidence: 60
drilldown_search: []
impact: 60
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a service.
mitre_attack_id:
- T1489
- T1543
- T1543.003
product:
- Splunk Behavioral Analytics
risk_score: 36
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_del.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_attempt_to_disable_services.yml
+58
View File
@@ -0,0 +1,58 @@
name: Attempt To Disable Services
id: afb31de4-d023-11eb-98d5-acde48001122
version: 3
date: '2021-11-24'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic identifies Windows Service Control, `sc.exe`,
attempting to disable a service. This is typically identified in parallel with other
instances of service enumeration of attempts to stop a service and then disable
it. Adversaries utilize this technique to terminate security services or other related
services to continue there objective and evade detections.
data_source: []
search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(input_event,
"_datamodels"), "collection<string>", []), body={} | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND like(cmd_line, "%disabled%") AND like(cmd_line, "%config%")
AND process_name="sc.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: It is possible administrative scripts may start/stop/delete
services. Filter as needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service
tags:
analytic_story:
- XMRig
- Ransomware
asset_type: Endpoint
atomic_guid: []
confidence: 60
drilldown_search: []
impact: 60
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable a service.
mitre_attack_id:
- T1489
product:
- Splunk Behavioral Analytics
risk_score: 36
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_disable.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_attempted_credential_dump_from_registry_via_reg_exe.yml
+55
View File
@@ -0,0 +1,55 @@
name: Attempted Credential Dump From Registry via Reg exe
id: 14038953-e5f2-4daf-acff-5452062baf03
version: 2
date: '2021-11-29'
author: Jose Hernandez, Splunk
status: production
type: TTP
description: The following analytic identifies the use of `reg.exe` attempting to
export Windows registry keys that contain hashed credentials. Adversaries will utilize
this technique to capture and perform offline password cracking.
data_source: []
search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)) | eval process_name=lower(ucast(map_get(input_event,
"process_name"), "string", null)), cmd_line=ucast(map_get(input_event, "process"),
"string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process_name="cmd.exe"
OR process_name="reg.exe" | where cmd_line != null AND match_regex(cmd_line, /(?i)save\s+/)=true
AND ( match_regex(cmd_line, /(?i)HKLM\\Security/)=true OR match_regex(cmd_line,
/(?i)HKLM\\SAM/)=true OR match_regex(cmd_line, /(?i)HKLM\\System/)=true OR match_regex(cmd_line,
/(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true
OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true ) | eval start_time
= timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name])
| into write_ssa_detected_events(); '
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: None identified.
references:
- https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets
tags:
analytic_story:
- Credential Dumping
asset_type: Endpoint
atomic_guid: []
confidence: 90
drilldown_search: []
impact: 70
message: An attempt to save registry keys storing credentials has been performed
on $dest_device_id$ by $dest_user_id$ via process $process_name$.
mitre_attack_id:
- T1003
- T1003.002
product:
- Splunk Behavioral Analytics
risk_score: 63
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-security.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_bcdedit_failure_recovery_modification.yml
+56
View File
@@ -0,0 +1,56 @@
name: BCDEdit Failure Recovery Modification
id: 76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13
version: 1
date: '2021-12-07'
author: Michael Haag, Splunk
status: production
type: TTP
description: This search looks for flags passed to bcdedit.exe modifications to the
built-in Windows error recovery boot configurations. This is typically used by ransomware
to prevent recovery.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bcdedit.exe"
AND (like (cmd_line, "%recoveryenabled%") AND like (cmd_line, "%no%")) | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
known_false_positives: Administrators may modify the boot configuration.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair
tags:
analytic_story:
- Ryuk Ransomware
- Ransomware
- Information Sabotage
asset_type: Endpoint
atomic_guid: []
confidence: 80
drilldown_search: []
impact: 100
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting disable the ability
to recover the endpoint.
mitre_attack_id:
- T1490
product:
- Splunk Behavioral Analytics
risk_score: 80
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
update_timestamp: true
ba_detections/endpoint/ssa_clear_unallocated_sector_using_cipher_app.yml
+55
View File
@@ -0,0 +1,55 @@
name: Clear Unallocated Sector Using Cipher App
id: 8f907d90-6173-11ec-9c23-acde48001122
version: 1
date: '2021-12-20'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: this search is to detect execution of `cipher.exe` to clear the unallocated
sectors of a specific disk. This technique was seen in some ransomware to make it
impossible to forensically recover deleted files.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND like(cmd_line, "%/w:%") AND process_name="cipher.exe" |
eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
known_false_positives: administrator may execute this app to manage disk
references:
- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/
- https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf
tags:
analytic_story:
- Ransomware
- Information Sabotage
asset_type: Endpoint
atomic_guid: []
confidence: 100
drilldown_search: []
impact: 90
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors
of a specific disk.
mitre_attack_id:
- T1070.004
- T1070
product:
- Splunk Behavioral Analytics
risk_score: 90
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
ba_detections/endpoint/ssa_delete_a_net_user.yml
+59
View File
@@ -0,0 +1,59 @@
name: Delete A Net User
id: 8776d79c-d26e-11eb-9a56-acde48001122
version: 4
date: '2022-03-17'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: This analytic will detect a suspicious net.exe/net1.exe command-line
to delete a user on a system. This technique may be use by an administrator for
legitimate purposes, however this behavior has been used in the wild to impair some
user or deleting adversaries tracks created during its lateral movement additional
systems. During triage, review parallel processes for additional behavior. Identify
any other user accounts created before or after.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), process=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",null),
parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process
IS NOT NULL AND like(process, "%/delete%") AND like(process, "%user%") AND (process_name="net1.exe"
OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "process", process, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed net.exe may be used.
known_false_positives: System administrators or scripts may delete user accounts via
this technique. Filter as needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
tags:
analytic_story:
- XMRig
- Ransomware
asset_type: Endpoint
atomic_guid: []
confidence: 70
drilldown_search: []
impact: 70
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a user
account.
mitre_attack_id:
- T1531
product:
- Splunk Behavioral Analytics
risk_score: 49
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_del.log
source: WinEventLog:Security
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/atomic_red_team/security.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_deny_permission_using_cacls_utility.yml
+54
View File
@@ -0,0 +1,54 @@
name: Deny Permission using Cacls Utility
id: b76eae28-cd25-11eb-9c92-acde48001122
version: 3
date: '2021-11-29'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic identifies the use of `cacls.exe`, `icacls.exe`
or `xcacls.exe` placing the deny permission on a file or directory. Adversaries
perform this behavior to prevent responders from reviewing or gaining access to
adversary files on disk.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
"parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
"string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)deny/)=true
AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe")
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
known_false_positives: System administrators may use cacls utilities but this is not
a common practice. Filter as needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
tags:
analytic_story:
- XMRig
- Information Sabotage
asset_type: Endpoint
atomic_guid: []
confidence: 70
drilldown_search: []
impact: 50
message: A cacls process $process_name$ with commandline $cmd_line$ try to deny
a permission of a file or directory in host $dest_device_id$
mitre_attack_id:
- T1222
product:
- Splunk Behavioral Analytics
risk_score: 35
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_detect_kerberoasting.yml
+50
View File
@@ -0,0 +1,50 @@
name: Detect Kerberoasting
id: dabdd6d7-3e10-42be-8711-4e124f7a3850
version: 2
date: '2020-10-21'
author: Xiao Lin, Splunk
status: experimental
type: TTP
description: This search detects a potential kerberoasting attack via service principal
name requests
data_source: []
search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_time"),
EventCode=map_get(input_event, "event_code"), TicketOptions=map_get(input_event,
"ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"),
ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event,
"service_id"), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where EventCode="4769"
AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" | first_time_event
input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"]
| where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID
| eval start_time=_time, end_time=_time | eval body=create_map(["event_id", event_id,
"EventCode", EventCode, "ServiceName", ServiceName, "TicketOptions", TicketOptions,
"TicketEncryptionType", TicketEncryptionType]), entities = mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)) | select start_time, end_time, entities, body | into write_ssa_detected_events();'
how_to_implement: The test data is converted from Windows Security Event logs generated
from Attach Range simulation and used in SPL search and extended to SPL2
known_false_positives: Older systems that support kerberos RC4 by default NetApp may
generate false positives
references:
- Initial ESCU implementation by Jose Hernandez and Patrick Bareiss
tags:
analytic_story:
- Credential Dumping
asset_type: Endpoint
atomic_guid: []
confidence: 20
drilldown_search: []
impact: 70
message: Kerberoasting malware is potentially applying stolen credentials. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
command $cmd_line$
mitre_attack_id:
- T1558.003
- T1558
product:
- Splunk Behavioral Analytics
risk_score: 14
security_domain: endpoint
tests: []
ba_detections/endpoint/ssa_detect_prohibited_applications_spawning_cmd_exe.yml
+61
View File
@@ -0,0 +1,61 @@
name: Detect Prohibited Applications Spawning cmd exe
id: c10a18cb-fd80-4ffa-a844-25026e0a0c94
version: 3
date: '2022-03-01'
author: Ignacio Bermudez Corrales, Splunk
status: production
type: Anomaly
description: The following analytic identifies parent processes, browsers, Windows
terminal applications, Office Products and Java spawning cmd.exe. By its very nature,
many applications spawn cmd.exe natively or built into macros. Much of this will
need to be tuned to further enhance the risk.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)) | eval process_name = ucast(map_get(input_event, "process_name"),
"string", null), parent_process_name = lower(ucast(input_event.parent_process_name,
"string", null)), cmd_line = lower(ucast(map_get(input_event, "process"),"string",
null)), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null),
dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), event_id=ucast(map_get(input_event,"event_id"),
"string", null) | where process_name="cmd.exe" | rex field=parent_process_name "(?<ParentBaseFileName>[^\\\\]+)$"
| where ParentBaseFileName="winword.exe" OR ParentBaseFileName="excel.exe" OR ParentBaseFileName="outlook.exe"
OR ParentBaseFileName="powerpnt.exe" OR ParentBaseFileName="visio.exe" OR ParentBaseFileName="mspub.exe"
OR ParentBaseFileName="acrobat.exe" OR ParentBaseFileName="acrord32.exe" OR ParentBaseFileName="iexplore.exe"
OR ParentBaseFileName="opera.exe" OR ParentBaseFileName="firefox.exe" OR (ParentBaseFileName="java.exe"
AND (parent_process_name IS NOT NULL AND match_regex(parent_process_name, /(?i)patch1-Hotfix1a/)=false))
OR ParentBaseFileName="powershell.exe" OR (ParentBaseFileName="chrome.exe" AND (cmd_line
IS NULL OR (cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)chrome-extension/)=false)))
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
dest_user_id), body=create_map(["event_id", event_id, "process_name", process_name,
"parent_process_name", parent_process_name, "cmd_line", cmd_line, "ParentBaseFileName",
ParentBaseFileName]) | into write_ssa_detected_events()'
how_to_implement: In order to successfully implement this analytic, you will need
endpoint process data from a EDR product or Sysmon. This search has been modified
to process raw sysmon data from attack_range's nxlogs on DSP.
known_false_positives: There are circumstances where an application may legitimately
execute and interact with the Windows command-line interface.
references:
- https://attack.mitre.org/techniques/T1059/
tags:
analytic_story:
- Suspicious Command-Line Executions
- Insider Threat
asset_type: Endpoint
atomic_guid: []
confidence: 50
drilldown_search: []
impact: 70
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event
that warrants investigating.
mitre_attack_id:
- T1059
product:
- Splunk Behavioral Analytics
risk_score: 35
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
ba_detections/endpoint/ssa_detect_rclone_command_line_usage.yml
+67
View File
@@ -0,0 +1,67 @@
name: Detect RClone Command-Line Usage
id: e8b74268-5454-11ec-a799-acde48001122
version: 1
date: '2021-12-03'
author: Michael Haag, Splunk
status: production
type: TTP
description: This analytic identifies commonly used command-line arguments used by
`rclone.exe` to initiate a file transfer. Some arguments were negated as they are
specific to the configuration used by adversaries. In particular, an adversary may
list the files or directories of the remote file share using `ls` or `lsd`, which
is not indicative of malicious behavior. During triage, at this stage of a ransomware
event, exfiltration is about to occur or has already. Isolate the endpoint and continue
investigating by review file modifications and parallel processes.
data_source: []
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="rclone.exe"
AND (like (cmd_line, "%copy%") OR like (cmd_line, "%mega%")OR like (cmd_line, "%pcloud%")
OR like (cmd_line, "%ftp%") OR like (cmd_line, "%--config%") OR like (cmd_line,
"%--progress%") OR like (cmd_line, "%--no-check-certificate%") OR like (cmd_line,
"%--ignore-existing%") OR like (cmd_line, "%--auto-confirm%") OR like (cmd_line,
"%--transfers%") OR like (cmd_line, "%--multi-thread-streams%")) | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
| eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
known_false_positives: False positives should be limited as this is restricted to
the Rclone process name. Filter or tune the analytic as needed.
references:
- https://redcanary.com/blog/rclone-mega-extortion/
- https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations
- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
- https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/
tags:
analytic_story:
- DarkSide Ransomware
- Ransomware
- Insider Threat
asset_type: Endpoint
atomic_guid: []
confidence: 70
drilldown_search: []
impact: 50
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to connect to a
remote cloud service to move files or folders.
mitre_attack_id:
- T1020
product:
- Splunk Behavioral Analytics
risk_score: 35
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
ba_detections/endpoint/ssa_disable_defender_antivirus_registry.yml
+54
View File
@@ -0,0 +1,54 @@
name: Disable Defender AntiVirus Registry
id: aa4f115a-3024-11ec-9987-acde48001122
version: 1
date: '2021-12-08'
author: Bhavin Patel, Splunk
status: experimental
type: TTP
description: This particular behavior is typically executed when an adversaries or
malware gains access to an endpoint and beings to perform execution and to evade
detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled
task modifications will occur. During triage, review parallel processes and identify
any further file modifications. Endpoint should be isolated.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"),
"string", null)), registry_path=lower(ucast(map_get(input_event, "registry_path"),
"string", null)), registry_key_name=lower(ucast(map_get(input_event, "registry_key_name"),
"string", null)), registry_value_data=ucast(map_get(input_event, "registry_value_data"),
"string", null), process_guid=ucast(map_get(input_event, "process_guid"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
like(registry_path, "%\\Policies\\Microsoft\\Windows Defender%") AND registry_key_name="DisableAntiVirus"
AND registry_value_data="(0x00000001)" | eval start_time=timestamp, end_time=timestamp,
entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
"dest_device_id"), "string", null)), body=create_map( [ "event_id", event_id, "registry_path",
registry_path, "registry_key_name", registry_key_name, "process_guid", process_guid,"registry_value_data",registry_value_data])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: Admin or user may choose to disable windows defender product
references:
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
tags:
analytic_story:
- IcedID
asset_type: Endpoint
atomic_guid: []
confidence: 70
drilldown_search: []
impact: 70
message: Modified/added/deleted registry entry $registry_path$ in $dest$
mitre_attack_id:
- T1562.001
- T1562
product:
- Splunk Behavioral Analytics
risk_score: 49
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
ba_detections/endpoint/ssa_disable_net_user_account.yml
+57
View File
@@ -0,0 +1,57 @@
name: Disable Net User Account
id: ba858b08-d26c-11eb-af9b-acde48001122
version: 3
date: '2021-11-30'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: This analytic will identify a suspicious command-line that disables a
user account using the native `net.exe` or `net1.exe` utility to Windows. This technique
may used by the adversaries to interrupt availability of accounts and continue the
impact against the organization.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND like(cmd_line, "%user%")
AND (process_name="net1.exe" OR process_name="net.exe") | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be
used.
known_false_positives: System administrators or automated scripts may disable an account
but not a common practice. Filter as needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
tags:
analytic_story:
- XMRig
- Ransomware
asset_type: Endpoint
atomic_guid: []
confidence: 70
drilldown_search: []
impact: 70
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable accounts.
mitre_attack_id:
- T1489
- T1078
product:
- Splunk Behavioral Analytics
risk_score: 49
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_dis.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_dns_exfiltration_using_nslookup_app.yml
+63
View File
@@ -0,0 +1,63 @@
name: DNS Exfiltration Using Nslookup App
id: 2452e632-9e0d-11eb-34ba-acde48001122
version: 1
date: '2021-12-07'
author: Michael Haag, Splunk
status: production
type: TTP
description: This search is to detect potential DNS exfiltration using nslookup application.
This technique are seen in couple of malware and APT group to exfiltrated collected
data in a infected machine or infected network. This detection is looking for unique
use of nslookup where it tries to use specific record type, TXT, A, AAAA, that are
commonly used by attacker and also the retry parameter which is designed to query
C2 DNS multiple tries.
data_source: []
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="nslookup.exe"
AND (like (cmd_line, "%-querytype=%") OR like (cmd_line, "%-qt=%") OR like (cmd_line,
"%-q=%") OR like (cmd_line, "%-type=%") OR like (cmd_line, "%-retry=%")) | eval
start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
"process_name", process_name, "parent_process_name", parent_process_name, "process_path",
process_path]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
known_false_positives: It is possible for some legitimate administrative utilities
to use similar cmd_line parameters. Filter as needed.
references:
- https://www.mandiant.com/resources/fin7-spear-phishing-campaign-targets-personnel-involved-sec-filings
- https://www.varonis.com/blog/dns-tunneling
- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
tags:
analytic_story:
- Suspicious DNS Traffic
- Dynamic DNS
- Data Exfiltration
- Command and Control
asset_type: Endpoint
atomic_guid: []
confidence: 80
drilldown_search: []
impact: 90
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ performing activity related
to DNS exfiltration.
mitre_attack_id:
- T1048
product:
- Splunk Behavioral Analytics
risk_score: 72
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
ba_detections/endpoint/ssa_excessive_number_of_office_files_copied.yml
+42
View File
@@ -0,0 +1,42 @@
name: Excessive Number of Office Files Copied
id: 3c6594a9-8df6-45a1-9357-d73b62083c63
version: 1
date: '2021-12-07'
author: Patrick Bareiss, Splunk
status: experimental
type: Anomaly
description: This detection detects a high amount of office file copied. This can
be an indicator for a malicious insider.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)) | eval action=ucast(map_get(input_event, "action"), "string",
null), process=ucast(map_get(input_event, "process"), "string", null), file_name=ucast(map_get(input_event,
"file_name"), "string", null), file_path=ucast(map_get(input_event, "file_path"),
"string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null)
| where "Endpoint_Filesystem" IN(_datamodels) | where action="created" | where like(file_name,
"%.doc%") OR like(file_name, "%.xls%") OR like(file_name, "%.ppt%") | stats count(file_name)
AS count BY dest_user_id, dest_device_id, span(timestamp, 10m) | where count > 20
| eval start_time=window_start, end_time=window_end, entities=mvappend(dest_user_id,
dest_device_id), body=create_map(["count", count]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Filesytem` node.
known_false_positives: user may copy a lot of office fies from one folder to another
references: []
tags:
analytic_story:
- Insider Threat
asset_type: Endpoint
atomic_guid: []
confidence: 80
drilldown_search: []
impact: 90
message: High number of files copied
mitre_attack_id:
- T1048.003
product:
- Splunk Behavioral Analytics
risk_score: 72
security_domain: endpoint
tests: []
ba_detections/endpoint/ssa_first_time_seen_command_line_argument.yml
+59
View File
@@ -0,0 +1,59 @@
name: First time seen command line argument
id: fc0edc95-ff2b-48b0-9f6f-63da3789fd23
version: 4
date: '2021-11-30'
author: Ignacio Bermudez Corrales, Splunk
status: experimental
type: Anomaly
description: This search looks for command-line arguments that use a `/c` parameter
to execute a command that has not previously been seen. This is an implementation
on SPL2 of the rule `First time seen command line argument` by @bpatel. 'The following
analytic identifies first time seen command-line arguments on a single endpoint.
The analytic looks for arguments instantiated by `cmd.exe /c` and the associated
command-line. Adversaries automate or spawn multiple processes using this method,
this analytic may assist with identifying the first time it's been found on this
endpoint.'
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)) | eval dest_user_id=ucast(map_get(input_event, "dest_user_id"),
"string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string",
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
cmd_line=ucast(map_get(input_event, "process"), "string", null), cmd_line_norm=lower(cmd_line),
cmd_line_norm=replace(cmd_line_norm, /[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/,
"GUID"), cmd_line_norm=replace(cmd_line_norm, /(?<=\s)+\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/,
"\\PATH"), /* replaces " \\Something\\Something\\command.ext" => "PATH\\command.ext"
*/ cmd_line_norm=replace(cmd_line_norm, /\w:\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/, "\\PATH"),
/* replaces "C:\\Something\\Something\\command.ext" => "PATH\\command.ext" */ cmd_line_norm=replace(cmd_line_norm,
/\d+/, "N"), event_id=ucast(map_get(input_event, "event_id"), "string", null) |
where process_name="cmd.exe" AND match_regex(ucast(cmd_line, "string", ""), /.*
\/[cC] .*/)=true | select process_name, cmd_line, cmd_line_norm, timestamp, dest_device_id,
dest_user_id | first_time_event input_columns=["cmd_line_norm"] | where first_time_cmd_line_norm
| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id,
dest_user_id), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: Legitimate programs use command-line arguments to execute.
Verify the command-line arguments to check what command/program is being executed.
Filtering will be needed.
references: []
tags:
analytic_story:
- Unusual Processes
asset_type: Endpoint
atomic_guid: []
confidence: 60
drilldown_search: []
impact: 50
message: A process $process_name$ ha been identified in the environment with a command-line
$cmd_line$ not previously seen before on host $dest_device_id$
mitre_attack_id:
- T1059
- T1202
product:
- Splunk Behavioral Analytics
risk_score: 30
security_domain: endpoint
tests: []
ba_detections/endpoint/ssa_fsutil_zeroing_file.yml
+57
View File
@@ -0,0 +1,57 @@
name: Fsutil Zeroing File
id: f792cdc9-43ee-4429-a3c0-ffce4fed1a85
version: 1
date: '2021-12-07'
author: Michael Haag, Splunk
status: production
type: TTP
description: This search is to detect a suspicious fsutil process to zeroing a target
file. This technique was seen in lockbit ransomware where it tries to zero out its
malware path as part of its defense evasion after encrypting the compromised host.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="fsutil.exe"
AND (like (cmd_line, "%setzerodata%")) | eval start_time=timestamp, end_time=timestamp,
entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
"dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
"process_path", process_path]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed net.exe may be used.
known_false_positives: System administrators or scripts may delete user accounts via
this technique. Filter as needed.
references:
- https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file
tags:
analytic_story:
- Ransomware
- Insider Threat
- Information Sabotage
asset_type: Endpoint
atomic_guid: []
confidence: 90
drilldown_search: []
impact: 60
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ atempting to perform file
deletion.
mitre_attack_id:
- T1070
product:
- Splunk Behavioral Analytics
risk_score: 54
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
ba_detections/endpoint/ssa_grant_permission_using_cacls_utility.yml
+54
View File
@@ -0,0 +1,54 @@
name: Grant Permission Using Cacls Utility
id: c6da561a-cd29-11eb-ae65-acde48001122
version: 3
date: '2021-11-30'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic identifies the use of `cacls.exe`, `icacls.exe`
or `xcacls.exe` placing the grant permission on a file or directory. Adversaries
perform this behavior to allow components of their files to run, however it allows
responders to review or gaining access to adversary files on disk.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
"parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
"string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)grant/)=true
AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe")
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
known_false_positives: System administrators may use cacls utilities but this is not
a common practice. Filter as needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
tags:
analytic_story:
- XMRig
- Insider Threat
asset_type: Endpoint
atomic_guid: []
confidence: 70
drilldown_search: []
impact: 50
message: A cacls process $process_name$ with commandline $cmd_line$ try to grant
user a permission to a file or directory in host $dest_device_id$
mitre_attack_id:
- T1222
product:
- Splunk Behavioral Analytics
risk_score: 35
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_hiding_files_and_directories_with_attrib_exe.yml
+58
View File
@@ -0,0 +1,58 @@
name: Hiding Files And Directories With Attrib exe
id: 028e4406-6176-11ec-aec2-acde48001122
version: 1
date: '2021-12-20'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: Attackers leverage an existing Windows binary, attrib.exe, to mark specific
as hidden by using specific flags so that the victim does not see the file. The
search looks for specific command-line arguments to detect the use of attrib.exe
to hide files.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND match_regex(cmd_line, /\+h/)=true AND process_name="attrib.exe"
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
The command-line arguments are mapped to the "process" field in the Endpoint data
model.
known_false_positives: 'Some applications and users may legitimately use attrib.exe
to interact with the files. '
references:
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/attrib
tags:
analytic_story:
- Windows Defense Evasion Tactics
- Windows Persistence Techniques
- Information Sabotage
- Insider Threat
asset_type: Endpoint
atomic_guid: []
confidence: 90
drilldown_search: []
impact: 80
message: Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is detected.
mitre_attack_id:
- T1222.001
- T1222
product:
- Splunk Behavioral Analytics
risk_score: 72
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
ba_detections/endpoint/ssa_high_file_deletion_frequency.yml
+50
View File
@@ -0,0 +1,50 @@
name: High File Deletion Frequency
id: b6200efd-13bd-4336-920a-057b25bbcfaf
version: 1
date: '2021-12-07'
author: Patrick Bareiss, Splunk
status: experimental
type: Anomaly
description: This detection detects a high amount of file deletions in a short time
for specific file types. This can be an indicator for a malicious insider.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)) | eval action=ucast(map_get(input_event, "action"), "string",
null), process=ucast(map_get(input_event, "process"), "string", null), file_name=ucast(map_get(input_event,
"file_name"), "string", null), file_path=ucast(map_get(input_event, "file_path"),
"string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null)
| where "Endpoint_Filesystem" IN(_datamodels) | where action="deleted" | where like(file_name,
"%.cmd") OR like(file_name, "%.ini") OR like(file_name, "%.gif") OR like(file_name,
"%.jpg") OR like(file_name, "%.jpeg") OR like(file_name, "%.db") OR like(file_name,
"%.doc%") OR like(file_name, "%.ps1") OR like(file_name, "%.xls%") OR like(file_name,
"%.ppt%") OR like(file_name, "%.bmp") OR like(file_name, "%.zip") OR like(file_name,
"%.rar") OR like(file_name, "%.7z") OR like(file_name, "%.chm") OR like(file_name,
"%.png") OR like(file_name, "%.log") OR like(file_name, "%.vbs") OR like(file_name,
"%.js") | stats count(file_name) AS count BY dest_user_id, dest_device_id, span(timestamp,
10m) | where count > 20 | eval start_time=window_start, end_time=window_end, entities=mvappend(dest_user_id,
dest_device_id), body=create_map(["count", count]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Filesytem` node.
known_false_positives: user may delete bunch of pictures or files in a folder.
references:
- https://www.mandiant.com/resources/fin11-email-campaigns-precursor-for-ransomware-data-theft
- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
tags:
analytic_story:
- Clop Ransomware
- Insider Threat
asset_type: Endpoint
atomic_guid: []
confidence: 80
drilldown_search: []
impact: 90
message: High frequency file deletion activity detected on host $Computer$
mitre_attack_id:
- T1485
product:
- Splunk Behavioral Analytics
risk_score: 72
security_domain: endpoint
tests: []
ba_detections/endpoint/ssa_modify_acls_permission_of_files_or_folders.yml
+57
View File
@@ -0,0 +1,57 @@
name: Modify ACLs Permission Of Files Or Folders
id: 9ae9a48a-cdbe-11eb-875a-acde48001122
version: 3
date: '2022-03-17'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: This analytic identifies suspicious modification of ACL permission to
a files or folder to make it available to everyone or to a specific user. This technique
may be used by the adversary to evade ACLs or protected files access. This changes
is commonly configured by the file or directory owner with appropriate permission.
This behavior raises suspicion if this command is seen on an endpoint utilized by
an account with no permission to do so.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), process=ucast(map_get(input_event, "process"), "string",
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
"parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
"string", null) | where process IS NOT NULL AND NOT like(process, "%:\\Windows\\QG\\ServiceNow%")
AND like(process, "%/g%") | where (match_regex(process, /(?i)everyone:/)=true OR
match_regex(process, /(?i)SYSTEM:/)=true OR match_regex(process, /(?i)S-1-1-0:/)=true)
| where (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe")
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "process", process, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used.
known_false_positives: System administrators may use this windows utility. filter
is needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
tags:
analytic_story:
- XMRig
asset_type: Endpoint
atomic_guid: []
confidence: 70
drilldown_search: []
impact: 50
message: A cacls process $process_name$ with commandline $cmd_line$ try to modify
a permission of a file or directory in host $dest_device_id$
mitre_attack_id:
- T1222
product:
- Splunk Behavioral Analytics
risk_score: 35
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_office_product_spawning_windows_script_host.yml
+58
View File
@@ -0,0 +1,58 @@
name: Office Product Spawning Windows Script Host
id: 3ea3851a-8736-41a0-bc09-7e4485b48fa6
version: 1
date: '2022-10-12'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic will identify a Windows Office Product spawning
WScript.exe or CScript.exe. Tuning may be required based on legitimate application
usage that may spawn scripts from an Office product.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=lower(ucast(map_get(input_event, "parent_process_name"),
"string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name
IS NOT NULL | where (like(parent_process_name, "%\\\\winword.exe") OR like(parent_process_name,
"%\\\\excel.exe") OR like(parent_process_name, "%\\\\powerpnt.exe") OR like(parent_process_name,
"%\\\\mspub.exe") OR like(parent_process_name, "%\\\\visio.exe")) AND (process_name="wscript.exe"
OR process_name="cscript.exe") | eval start_time=timestamp, end_time=timestamp,
entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
"dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
"process_path", process_path]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: False positives may be present based on macro based approved
documents in the organization. Filtering may be needed.
references:
- https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/
tags:
analytic_story:
- Spearphishing Attachments
asset_type: Endpoint
atomic_guid: []
confidence: 90
drilldown_search: []
impact: 70
message: A Microsoft office parent process $parent_process_name$ has spawned a suspicious
child process $process_name$ on host $dest$.
mitre_attack_id:
- T1566
- T1566.001
product:
- Splunk Behavioral Analytics
risk_score: 63
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
update_timestamp: true
ba_detections/endpoint/ssa_rare_parent_child_process_relationship.yml
+78
View File
@@ -0,0 +1,78 @@
name: Rare Parent-Child Process Relationship
id: cf090c78-bcc6-11eb-8529-0242ac130003
version: 2
date: '2021-11-30'
author: Peter Gael, Splunk; Ignacio Bermudez Corrales, Splunk
status: experimental
type: Anomaly
description: An attacker may use LOLBAS tools spawned from vulnerable applications
not typically used by system administrators. This analytic leverages the Splunk
Streaming ML DSP plugin to find rare parent/child relationships. The list of application
has been extracted from https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)) | eval parent_process=lower(ucast(map_get(input_event,
"parent_process_name"), "string", null)), parent_process_name=mvindex(split(parent_process,
"\\"), -1), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), dest_user_id=ucast(map_get(input_event,
"dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where parent_process_name!=null | select parent_process_name, process_name, cmd_line,
timestamp, dest_device_id, dest_user_id | conditional_anomaly conditional="parent_process_name"
target="process_name" | where (process_name="powershell.exe" OR process_name="regsvcs.exe"
OR process_name="ftp.exe" OR process_name="dfsvc.exe" OR process_name="rasautou.exe"
OR process_name="schtasks.exe" OR process_name="xwizard.exe" OR process_name="findstr.exe"
OR process_name="esentutl.exe" OR process_name="cscript.exe" OR process_name="reg.exe"
OR process_name="csc.exe" OR process_name="atbroker.exe" OR process_name="print.exe"
OR process_name="pcwrun.exe" OR process_name="vbc.exe" OR process_name="rpcping.exe"
OR process_name="wsreset.exe" OR process_name="ilasm.exe" OR process_name="certutil.exe"
OR process_name="replace.exe" OR process_name="mshta.exe" OR process_name="bitsadmin.exe"
OR process_name="wscript.exe" OR process_name="ieexec.exe" OR process_name="cmd.exe"
OR process_name="microsoft.workflow.compiler.exe" OR process_name="runscripthelper.exe"
OR process_name="makecab.exe" OR process_name="forfiles.exe" OR process_name="desktopimgdownldr.exe"
OR process_name="control.exe" OR process_name="msbuild.exe" OR process_name="register-cimprovider.exe"
OR process_name="tttracer.exe" OR process_name="ie4uinit.exe" OR process_name="sc.exe"
OR process_name="bash.exe" OR process_name="hh.exe" OR process_name="cmstp.exe"
OR process_name="mmc.exe" OR process_name="jsc.exe" OR process_name="scriptrunner.exe"
OR process_name="odbcconf.exe" OR process_name="extexport.exe" OR process_name="msdt.exe"
OR process_name="diskshadow.exe" OR process_name="extrac32.exe" OR process_name="eventvwr.exe"
OR process_name="mavinject.exe" OR process_name="regasm.exe" OR process_name="gpscript.exe"
OR process_name="rundll32.exe" OR process_name="regsvr32.exe" OR process_name="regedit.exe"
OR process_name="msiexec.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="presentationhost.exe"
OR process_name="regini.exe" OR process_name="wmic.exe" OR process_name="runonce.exe"
OR process_name="syncappvpublishingserver.exe" OR process_name="verclsid.exe" OR
process_name="psr.exe" OR process_name="infdefaultinstall.exe" OR process_name="explorer.exe"
OR process_name="expand.exe" OR process_name="installutil.exe" OR process_name="netsh.exe"
OR process_name="wab.exe" OR process_name="dnscmd.exe" OR process_name="at.exe"
OR process_name="pcalua.exe" OR process_name="cmdkey.exe" OR process_name="msconfig.exe")
| eval input = (-1)*log(output) | adaptive_threshold algorithm="gaussian" threshold=0.001
window=604800000L | where label AND input > mean | eval start_time = timestamp,
end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body =
create_map(["process_name", process_name, "parent_process_name", parent_process_name,
"input", input, "mean", mean, "variance", variance, "output", output, "cmd_line",
cmd_line]) | into write_ssa_detected_events();'
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
known_false_positives: Some custom tools used by administrators could be used rarely
to launch remotely applications. This might trigger false positives at the beginning
when it has not collected yet enough data to construct the baseline.
references:
- https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
tags:
analytic_story:
- Unusual Processes
asset_type: Endpoint
atomic_guid: []
confidence: 50
drilldown_search: []
impact: 50
message: Rare Parent-Child Process Relationship
mitre_attack_id:
- T1203
- T1059
- T1053
- T1072
product:
- Splunk Behavioral Analytics
risk_score: 25
security_domain: endpoint
tests: []
ba_detections/endpoint/ssa_resize_shadowstorage_volume.yml
+57
View File
@@ -0,0 +1,57 @@
name: Resize Shadowstorage Volume
id: dbc30554-d27e-11eb-9e5e-acde48001122
version: 3
date: '2021-11-30'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic identifies the resizing of shadowstorage using
vssadmin.exe to avoid the shadow volumes being made again. This technique is typically
found used by adversaries during a ransomware event and a precursor to deleting
the shadowstorage.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND like(cmd_line, "%resize%") AND like(cmd_line, "%shadowstorage%")
AND like(cmd_line, "%maxsize%") AND process_name="vssadmin.exe" | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: System administrators may resize the shadowstorage for valid
purposes. Filter as needed.
references:
- https://www.mandiant.com/resources/fin11-email-campaigns-precursor-for-ransomware-data-theft
- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
tags:
analytic_story:
- Clop Ransomware
- Ransomware
asset_type: Endpoint
atomic_guid: []
confidence: 80
drilldown_search: []
impact: 80
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to create a shadow
copy to perform offline password cracking.
mitre_attack_id:
- T1489
product:
- Splunk Behavioral Analytics
risk_score: 64
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/windows-security.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_sdelete_application_execution.yml
+69
View File
@@ -0,0 +1,69 @@
name: Sdelete Application Execution
id: fcc52b9a-4616-11ec-8454-acde48001122
version: 1
date: '2021-11-15'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: This analytic will detect the execution of sdelete.exe attempting to
delete potentially important files that may related to adversary or insider threats
to destroy evidence or information sabotage. Sdelete is a SysInternals utility meant
to securely delete files on disk. This tool is commonly used to clear tracks and
artifact on the targeted host.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"),
"string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string",
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), process_path=ucast(map_get(input_event, "process_path"), "string", null),
parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), parent_cmd_line=ucast(map_get(input_event, "parent_process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
IS NOT NULL AND process_name IS NOT NULL AND like(process_name, "%sdelete%") AND
(like (cmd_line, "%-c %") OR like (cmd_line, "%-f %")OR like (cmd_line, "%-p %")
OR like (cmd_line, "%-r %") OR like (cmd_line, "%-q %") OR like (cmd_line, "%-s
%") OR like (cmd_line, "%-z %") OR like (cmd_line, "%/accepteula%") OR like (cmd_line,
"%-nobanner%")OR like (cmd_line, "%.doc%")OR like (cmd_line, "%.xls%") OR like (cmd_line,
"%.ppt%")OR like (cmd_line, "%.rtf%") OR like (cmd_line, "%.pdf%") OR like (cmd_line,
"%.key%")OR like (cmd_line, "%.log%") OR like (cmd_line, "%.txt%") OR like (cmd_line,
"%.jpg%") OR like (cmd_line, "%.png%") OR like (cmd_line, "%.gif%") OR like (cmd_line,
"%.bmp%") OR like (cmd_line, "%.7z%") OR like (cmd_line, "%.zip%") OR like (cmd_line,
"%.rar%") OR like (cmd_line, "%.tar%") OR like (cmd_line, "%.gz%") OR like (cmd_line,
"%.xls%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "process_path", process_path, "parent_process_name", parent_process_name,
"parent_cmd_line", parent_cmd_line]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: False positives should be limited, filter as needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md
tags:
analytic_story:
- Information Sabotage
- Insider Threat
asset_type: Endpoint
atomic_guid: []
confidence: 70
drilldown_search: []
impact: 60
message: Sdelete process $process_name$ executed on $dest_device_id$ attempting
to permanently delete files by $dest_user_id$.
mitre_attack_id:
- T1485
- T1070.004
- T1070
product:
- Splunk Behavioral Analytics
risk_score: 42
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
ba_detections/endpoint/ssa_system_process_running_from_unexpected_location.yml
+256
View File
@@ -0,0 +1,256 @@
name: System Process Running from Unexpected Location
id: 28179107-099a-464a-94d3-08301e6c055f
version: 4
date: '2022-03-24'
author: Jose Hernadnez, Ignacio Bermudez Corrales, Splunk
status: production
type: Anomaly
description: An attacker tries might try to use different version of a system command
without overriding original, or they might try to avoid some detection running the
process from a different folder. This detection checks that a list of system processes
run inside C:\\Windows\System32 or C:\\Windows\SysWOW64 The list of system processes
has been extracted from https://github.com/splunk/security_content/blob/develop/lookups/is_windows_system_file.csv
and the original detection https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml
data_source: []
search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null);
$cond_1 = | from $ssa_input | where process_name="arp.exe" OR process_name="adaptertroubleshooter.exe"
OR process_name="applicationframehost.exe" OR process_name="atbroker.exe" OR process_name="authhost.exe"
OR process_name="autoworkplace.exe" OR process_name="axinstui.exe" OR process_name="backgroundtransferhost.exe"
OR process_name="bdehdcfg.exe" OR process_name="bdeuisrv.exe" OR process_name="bdeunlockwizard.exe"
OR process_name="bitlockerdeviceencryption.exe" OR process_name="bitlockerwizard.exe"
OR process_name="bitlockerwizardelev.exe" OR process_name="bytecodegenerator.exe"
OR process_name="camerasettingsuihost.exe" OR process_name="castsrv.exe" OR process_name="certenrollctrl.exe"
OR process_name="checknetisolation.exe" OR process_name="clipup.exe" OR process_name="cloudexperiencehostbroker.exe"
OR process_name="cloudnotifications.exe" OR process_name="cloudstoragewizard.exe"
OR process_name="compmgmtlauncher.exe" OR process_name="compattelrunner.exe" OR
process_name="computerdefaults.exe" OR process_name="credentialuibroker.exe" OR
process_name="dfdwiz.exe" OR process_name="dwwin.exe" OR process_name="dataexchangehost.exe"
OR process_name="defrag.exe" OR process_name="devicedisplayobjectprovider.exe" OR
process_name="deviceeject.exe" OR process_name="deviceenroller.exe" OR process_name="devicepairingwizard.exe"
OR process_name="deviceproperties.exe" OR process_name="disksnapshot.exe" OR process_name="dism.exe"
OR process_name="displayswitch.exe" OR process_name="dmnotificationbroker.exe" OR
process_name="dmomacpmo.exe" OR process_name="dpiscaling.exe" OR process_name="dsmusertask.exe"
OR process_name="dxpserver.exe" OR process_name="edpcleanup.exe" OR process_name="eosnotify.exe"
OR process_name="eap3host.exe" OR process_name="easpoliciesbrokerhost.exe" OR process_name="easeofaccessdialog.exe"
OR process_name="ehstorauthn.exe" OR process_name="fxscover.exe" OR process_name="fxssvc.exe"
OR process_name="fxsunatd.exe" OR process_name="filehistory.exe" OR process_name="fondue.exe"
OR process_name="gamepanel.exe" OR process_name="genvalobj.exe" OR process_name="gettingstarted.exe"
OR process_name="hostname.exe" OR process_name="icsentitlementhost.exe" OR process_name="infdefaultinstall.exe"
OR process_name="installagent.exe" OR process_name="languagecomponentsinstallercomhandler.exe"
OR process_name="launchtm.exe" OR process_name="launchwinapp.exe" OR process_name="legacynetuxhost.exe"
OR process_name="licensemanagershellext.exe" OR process_name="licensingui.exe" OR
process_name="locationnotificationwindows.exe" OR process_name="locationnotifications.exe"
OR process_name="locator.exe" OR process_name="lockapphost.exe" OR process_name="lockscreencontentserver.exe"
OR process_name="logonui.exe" OR process_name="lsaiso.exe" OR process_name="mdeserver.exe"
OR process_name="mdmagent.exe" OR process_name="mdmappinstaller.exe" OR process_name="mrinfo.exe"
OR process_name="mrt.exe" OR process_name="mschedexe.exe" OR process_name="magnify.exe"
OR process_name="mbaeparsertask.exe" OR process_name="mdres.exe" OR process_name="mdsched.exe"
OR process_name="migautoplay.exe" OR process_name="mpsigstub.exe" OR process_name="msspellcheckinghost.exe"
OR process_name="muiunattend.exe" OR process_name="multidigimon.exe" OR process_name="musnotification.exe"
OR process_name="musnotificationux.exe" OR process_name="napstat.exe" OR process_name="netstat.exe"
OR process_name="narrator.exe" OR process_name="netcfgnotifyobjecthost.exe" OR process_name="netevtfwdr.exe"
OR process_name="netproj.exe" OR process_name="netplwiz.exe" OR process_name="networkuxbroker.exe";
$cond_2 = | from $ssa_input | where process_name="openwith.exe" OR process_name="optionalfeatures.exe"
OR process_name="pathping.exe" OR process_name="ping.exe" OR process_name="passwordonwakesettingflyout.exe"
OR process_name="pickerhost.exe" OR process_name="pkgmgr.exe" OR process_name="pnpunattend.exe"
OR process_name="pnputil.exe" OR process_name="presentationhost.exe" OR process_name="presentationsettings.exe"
OR process_name="printbrmui.exe" OR process_name="printdialoghost.exe" OR process_name="printdialoghost3d.exe"
OR process_name="printisolationhost.exe" OR process_name="proximityuxhost.exe" OR
process_name="rdspnf.exe" OR process_name="rmactivate.exe" OR process_name="rmactivate_isv.exe"
OR process_name="rmactivate_ssp.exe" OR process_name="rmactivate_ssp_isv.exe" OR
process_name="route.exe" OR process_name="rdpsa.exe" OR process_name="rdpsaproxy.exe"
OR process_name="rdpsauachelper.exe" OR process_name="reagentc.exe" OR process_name="recoverydrive.exe"
OR process_name="register-cimprovider.exe" OR process_name="registeriepkeys.exe"
OR process_name="relpost.exe" OR process_name="remoteposworker.exe" OR process_name="rmclient.exe"
OR process_name="rpcping.exe" OR process_name="runlegacycplelevated.exe" OR process_name="runtimebroker.exe"
OR process_name="sihclient.exe" OR process_name="searchfilterhost.exe" OR process_name="searchindexer.exe"
OR process_name="searchprotocolhost.exe" OR process_name="secedit.exe" OR process_name="sensordataservice.exe"
OR process_name="setieinstalleddate.exe" OR process_name="settingsynchost.exe" OR
process_name="slidetoshutdown.exe" OR process_name="smartscreensettings.exe" OR
process_name="sndvol.exe" OR process_name="snippingtool.exe" OR process_name="soundrecorder.exe"
OR process_name="spaceagent.exe" OR process_name="sppextcomobj.exe" OR process_name="srtasks.exe"
OR process_name="stikynot.exe" OR process_name="synchost.exe" OR process_name="sysreseterr.exe"
OR process_name="systempropertiesadvanced.exe" OR process_name="systempropertiescomputername.exe"
OR process_name="systempropertiesdataexecutionprevention.exe" OR process_name="systempropertieshardware.exe"
OR process_name="systempropertiesperformance.exe" OR process_name="systempropertiesprotection.exe"
OR process_name="systempropertiesremote.exe" OR process_name="systemsettingsadminflows.exe"
OR process_name="systemsettingsbroker.exe" OR process_name="systemsettingsremovedevice.exe"
OR process_name="tcpsvcs.exe" OR process_name="tracert.exe" OR process_name="tstheme.exe"
OR process_name="tswbprxy.exe" OR process_name="tapiunattend.exe" OR process_name="taskmgr.exe"
OR process_name="thumbnailextractionhost.exe" OR process_name="tokenbrokercookies.exe"
OR process_name="tpminit.exe" OR process_name="tswpfwrp.exe" OR process_name="ui0detect.exe"
OR process_name="upgraderesultsui.exe" OR process_name="useraccountbroker.exe" OR
process_name="useraccountcontrolsettings.exe" OR process_name="usoclient.exe" OR
process_name="utilman.exe" OR process_name="vssvc.exe" OR process_name="vaultcmd.exe"
OR process_name="vaultsysui.exe" OR process_name="wfs.exe" OR process_name="wmpdmc.exe"
OR process_name="wpdshextautoplay.exe" OR process_name="wscollect.exe" OR process_name="wsmanhttpconfig.exe"
OR process_name="wsreset.exe" OR process_name="wudfhost.exe" OR process_name="wwahost.exe"
OR process_name="wallpaperhost.exe" OR process_name="webcache.exe" OR process_name="werfault.exe"
OR process_name="werfaultsecure.exe" OR process_name="winsat.exe" OR process_name="windows.media.backgroundplayback.exe"
OR process_name="windowsactiondialog.exe" OR process_name="windowsanytimeupgrade.exe"
OR process_name="windowsanytimeupgraderesults.exe";
$cond_3 = | from $ssa_input | where process_name="windowsanytimeupgradeui.exe" OR
process_name="windowsupdateelevatedinstaller.exe" OR process_name="workfolders.exe"
OR process_name="wpcmon.exe" OR process_name="acu.exe" OR process_name="aitagent.exe"
OR process_name="aitstatic.exe" OR process_name="alg.exe" OR process_name="appidcertstorecheck.exe"
OR process_name="appidpolicyconverter.exe" OR process_name="at.exe" OR process_name="attrib.exe"
OR process_name="audiodg.exe" OR process_name="auditpol.exe" OR process_name="autochk.exe"
OR process_name="autoconv.exe" OR process_name="autofmt.exe" OR process_name="baaupdate.exe"
OR process_name="backgroundtaskhost.exe" OR process_name="bcastdvr.exe" OR process_name="bcdboot.exe"
OR process_name="bcdedit.exe" OR process_name="bdechangepin.exe" OR process_name="bdeunlock.exe"
OR process_name="bitsadmin.exe" OR process_name="bootcfg.exe" OR process_name="bootim.exe"
OR process_name="bootsect.exe" OR process_name="bridgeunattend.exe" OR process_name="browser_broker.exe"
OR process_name="bthudtask.exe" OR process_name="cacls.exe" OR process_name="calc.exe"
OR process_name="cdpreference.exe" OR process_name="certreq.exe" OR process_name="certutil.exe"
OR process_name="change.exe" OR process_name="changepk.exe" OR process_name="charmap.exe"
OR process_name="chglogon.exe" OR process_name="chgport.exe" OR process_name="chgusr.exe"
OR process_name="chkdsk.exe" OR process_name="chkntfs.exe" OR process_name="choice.exe"
OR process_name="cipher.exe" OR process_name="cleanmgr.exe" OR process_name="cliconfg.exe"
OR process_name="clip.exe" OR process_name="cmd.exe" OR process_name="cmdkey.exe"
OR process_name="cmdl32.exe" OR process_name="cmmon32.exe" OR process_name="cmstp.exe"
OR process_name="cofire.exe" OR process_name="colorcpl.exe" OR process_name="comp.exe"
OR process_name="compact.exe" OR process_name="conhost.exe" OR process_name="consent.exe"
OR process_name="control.exe" OR process_name="convert.exe" OR process_name="credwiz.exe"
OR process_name="cscript.exe" OR process_name="csrss.exe" OR process_name="ctfmon.exe"
OR process_name="cttune.exe" OR process_name="cttunesvr.exe" OR process_name="dashost.exe"
OR process_name="dccw.exe" OR process_name="dcomcnfg.exe" OR process_name="ddodiag.exe"
OR process_name="dfrgui.exe" OR process_name="dialer.exe" OR process_name="diantz.exe"
OR process_name="dinotify.exe" OR process_name="diskpart.exe" OR process_name="diskperf.exe"
OR process_name="diskraid.exe" OR process_name="dispdiag.exe" OR process_name="djoin.exe"
OR process_name="dllhost.exe" OR process_name="dllhst3g.exe" OR process_name="dmcertinst.exe"
OR process_name="dmcfghost.exe" OR process_name="dmclient.exe" OR process_name="dnscacheugc.exe"
OR process_name="doskey.exe" OR process_name="dpapimig.exe" OR process_name="dpnsvr.exe"
OR process_name="driverquery.exe" OR process_name="drvcfg.exe" OR process_name="drvinst.exe"
OR process_name="dsregcmd.exe" OR process_name="dstokenclean.exe" OR process_name="dvdplay.exe"
OR process_name="dvdupgrd.exe" OR process_name="dwm.exe" OR process_name="dxdiag.exe"
OR process_name="easinvoker.exe" OR process_name="efsui.exe";
$cond_4 = | from $ssa_input | where process_name="embeddedapplauncher.exe" OR process_name="esentutl.exe"
OR process_name="eudcedit.exe" OR process_name="eventcreate.exe" OR process_name="eventvwr.exe"
OR process_name="expand.exe" OR process_name="extrac32.exe" OR process_name="fc.exe"
OR process_name="fhmanagew.exe" OR process_name="find.exe" OR process_name="findstr.exe"
OR process_name="finger.exe" OR process_name="fixmapi.exe" OR process_name="fltmc.exe"
OR process_name="fodhelper.exe" OR process_name="fontdrvhost.exe" OR process_name="fontview.exe"
OR process_name="forfiles.exe" OR process_name="fsavailux.exe" OR process_name="fsquirt.exe"
OR process_name="fsutil.exe" OR process_name="ftp.exe" OR process_name="fvenotify.exe"
OR process_name="fveprompt.exe" OR process_name="getmac.exe" OR process_name="gpresult.exe"
OR process_name="gpscript.exe" OR process_name="gpupdate.exe" OR process_name="grpconv.exe"
OR process_name="hdwwiz.exe" OR process_name="help.exe" OR process_name="hwrcomp.exe"
OR process_name="hwrreg.exe" OR process_name="icacls.exe" OR process_name="icardagt.exe"
OR process_name="icsunattend.exe" OR process_name="ie4uinit.exe" OR process_name="ieunatt.exe"
OR process_name="ieetwcollector.exe" OR process_name="iexpress.exe" OR process_name="immersivetpmvscmgrsvr.exe"
OR process_name="ipconfig.exe" OR process_name="irftp.exe" OR process_name="iscsicli.exe"
OR process_name="iscsicpl.exe" OR process_name="isoburn.exe" OR process_name="klist.exe"
OR process_name="ksetup.exe" OR process_name="ktmutil.exe" OR process_name="label.exe"
OR process_name="licensingdiag.exe" OR process_name="lodctr.exe" OR process_name="logagent.exe"
OR process_name="logman.exe" OR process_name="logoff.exe" OR process_name="lpkinstall.exe"
OR process_name="lpksetup.exe" OR process_name="lpremove.exe" OR process_name="lsass.exe"
OR process_name="lsm.exe" OR process_name="makecab.exe" OR process_name="manage-bde.exe"
OR process_name="mblctr.exe" OR process_name="mcbuilder.exe" OR process_name="mctadmin.exe"
OR process_name="mfpmp.exe" OR process_name="mmc.exe" OR process_name="mobsync.exe"
OR process_name="mountvol.exe" OR process_name="mpnotify.exe" OR process_name="msconfig.exe"
OR process_name="msdt.exe" OR process_name="msdtc.exe" OR process_name="msfeedssync.exe"
OR process_name="msg.exe" OR process_name="mshta.exe" OR process_name="msiexec.exe"
OR process_name="msinfo32.exe" OR process_name="mspaint.exe" OR process_name="msra.exe"
OR process_name="mstsc.exe" OR process_name="mtstocom.exe" OR process_name="nbtstat.exe"
OR process_name="ndadmin.exe" OR process_name="net.exe" OR process_name="net1.exe"
OR process_name="netbtugc.exe" OR process_name="netcfg.exe" OR process_name="netiougc.exe"
OR process_name="netsh.exe" OR process_name="newdev.exe" OR process_name="nltest.exe"
OR process_name="notepad.exe" OR process_name="nslookup.exe" OR process_name="ntoskrnl.exe"
OR process_name="ntprint.exe" OR process_name="ocsetup.exe" OR process_name="odbcad32.exe"
OR process_name="odbcconf.exe" OR process_name="omadmclient.exe" OR process_name="omadmprc.exe";
$cond_5 = | from $ssa_input | where process_name="openfiles.exe" OR process_name="osk.exe"
OR process_name="p2phost.exe" OR process_name="pcalua.exe" OR process_name="pcaui.exe"
OR process_name="pcawrk.exe" OR process_name="pcwrun.exe" OR process_name="perfmon.exe"
OR process_name="phoneactivate.exe" OR process_name="plasrv.exe" OR process_name="poqexec.exe"
OR process_name="powercfg.exe" OR process_name="prevhost.exe" OR process_name="print.exe"
OR process_name="printfilterpipelinesvc.exe" OR process_name="printui.exe" OR process_name="proquota.exe"
OR process_name="provtool.exe" OR process_name="psr.exe" OR process_name="pwlauncher.exe"
OR process_name="qappsrv.exe" OR process_name="qprocess.exe" OR process_name="query.exe"
OR process_name="quser.exe" OR process_name="qwinsta.exe" OR process_name="rasautou.exe"
OR process_name="rasdial.exe" OR process_name="raserver.exe" OR process_name="rasphone.exe"
OR process_name="rdpclip.exe" OR process_name="rdpinput.exe" OR process_name="rdrleakdiag.exe"
OR process_name="recdisc.exe" OR process_name="recover.exe" OR process_name="reg.exe"
OR process_name="regedt32.exe" OR process_name="regini.exe" OR process_name="regsvr32.exe"
OR process_name="rekeywiz.exe" OR process_name="relog.exe" OR process_name="repair-bde.exe"
OR process_name="replace.exe" OR process_name="reset.exe" OR process_name="resmon.exe"
OR process_name="rmttpmvscmgrsvr.exe" OR process_name="rrinstaller.exe" OR process_name="rstrui.exe"
OR process_name="runas.exe" OR process_name="rundll32.exe" OR process_name="runonce.exe"
OR process_name="rwinsta.exe" OR process_name="sbunattend.exe" OR process_name="sc.exe"
OR process_name="schtasks.exe" OR process_name="sdbinst.exe" OR process_name="sdchange.exe"
OR process_name="sdclt.exe" OR process_name="sdiagnhost.exe" OR process_name="secinit.exe"
OR process_name="services.exe" OR process_name="sessionmsg.exe" OR process_name="sethc.exe"
OR process_name="setspn.exe" OR process_name="setupcl.exe" OR process_name="setupugc.exe"
OR process_name="setx.exe" OR process_name="sfc.exe" OR process_name="shadow.exe"
OR process_name="shrpubw.exe" OR process_name="shutdown.exe" OR process_name="sigverif.exe"
OR process_name="sihost.exe" OR process_name="slui.exe" OR process_name="smss.exe"
OR process_name="snmptrap.exe" OR process_name="sort.exe" OR process_name="spinstall.exe"
OR process_name="spoolsv.exe" OR process_name="sppsvc.exe" OR process_name="spreview.exe"
OR process_name="srdelayed.exe" OR process_name="subst.exe" OR process_name="svchost.exe"
OR process_name="sxstrace.exe" OR process_name="syskey.exe" OR process_name="systeminfo.exe"
OR process_name="systemreset.exe" OR process_name="systray.exe" OR process_name="tabcal.exe"
OR process_name="takeown.exe" OR process_name="taskeng.exe" OR process_name="taskhost.exe"
OR process_name="taskhostw.exe" OR process_name="taskkill.exe" OR process_name="tasklist.exe"
OR process_name="taskmgr.exe" OR process_name="tcmsetup.exe" OR process_name="timeout.exe"
OR process_name="tpmvscmgr.exe" OR process_name="tpmvscmgrsvr.exe";
$cond_6 = | from $ssa_input | where process_name="tracerpt.exe" OR process_name="tscon.exe"
OR process_name="tsdiscon.exe" OR process_name="tskill.exe" OR process_name="typeperf.exe"
OR process_name="tzsync.exe" OR process_name="tzutil.exe" OR process_name="ucsvc.exe"
OR process_name="unlodctr.exe" OR process_name="unregmp2.exe" OR process_name="upnpcont.exe"
OR process_name="userinit.exe" OR process_name="vds.exe" OR process_name="vdsldr.exe"
OR process_name="verclsid.exe" OR process_name="verifier.exe" OR process_name="verifiergui.exe"
OR process_name="vmicsvc.exe" OR process_name="vssadmin.exe" OR process_name="w32tm.exe"
OR process_name="waitfor.exe" OR process_name="wbadmin.exe" OR process_name="wbengine.exe"
OR process_name="wecutil.exe" OR process_name="wermgr.exe" OR process_name="wevtutil.exe"
OR process_name="wextract.exe" OR process_name="where.exe" OR process_name="whoami.exe"
OR process_name="wiaacmgr.exe" OR process_name="wiawow64.exe" OR process_name="wifitask.exe"
OR process_name="wimserv.exe" OR process_name="wininit.exe" OR process_name="winload.exe"
OR process_name="winlogon.exe" OR process_name="winresume.exe" OR process_name="winrs.exe"
OR process_name="winrshost.exe" OR process_name="winver.exe" OR process_name="wisptis.exe"
OR process_name="wkspbroker.exe" OR process_name="wksprt.exe" OR process_name="wlanext.exe"
OR process_name="wlrmdr.exe" OR process_name="wowreg32.exe" OR process_name="wpnpinst.exe"
OR process_name="wpr.exe" OR process_name="write.exe" OR process_name="wscript.exe"
OR process_name="wsmprovhost.exe" OR process_name="wsqmcons.exe" OR process_name="wuapihost.exe"
OR process_name="wuapp.exe" OR process_name="wuauclt.exe" OR process_name="wusa.exe"
OR process_name="xcopy.exe" OR process_name="xpsrchvw.exe" OR process_name="xwizard.exe";
| from $cond_1 | union $cond_2 | union $cond_3 | union $cond_4 | union $cond_5 |
union $cond_6 | where match_regex(process_path, /(?i)\\windows\\system32/)=false
AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id",
event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();'
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
known_false_positives: None
references: []
tags:
analytic_story:
- Windows Defense Evasion Tactics
- Masquerading - Rename System Utilities
asset_type: Endpoint
atomic_guid: []
confidence: 80
drilldown_search: []
impact: 70
message: A system process $process_name$ with commandline $cmd_line$ spawn in non-default
folder path in host $dest_device_id$
mitre_attack_id:
- T1036
product:
- Splunk Behavioral Analytics
risk_score: 56
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/windows-security.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_unified_messaging_service_spawning_a_process.yml
+60
View File
@@ -0,0 +1,60 @@
name: Unified Messaging Service Spawning a Process
id: f1126df0-7bd5-11eb-988f-acde48001122
version: 2
date: '2022-10-03'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: This detection identifies Microsoft Exchange Server's Unified Messaging
services, umworkerprocess.exe and umservice.exe, spawning a child process, indicating
possible exploitation of CVE-2021-26857 vulnerability. The query filters out werfault.exe
and wermgr.exe mostly due to potential false positives, however, if there is an
excessive amount of "wermgr.exe" or "WerFault.exe" failures, it may be due to the
active exploitation. During triage, identify any additional suspicious parallel
processes. Identify any recent out of place file modifications. Review Exchange
logs following Microsofts guide. To contain, perform egress filtering or restrict
public access to Exchange. In final, patch the vulnerablity and monitor.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="umworkerprocess.exe"
OR Processes.parent_process_name="UMService.exe" NOT (Processes.process_name IN
("wermgr.exe", "werfault.exe")) by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `unified_messaging_service_spawning_a_process_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: Unknown. Tune out child processes as needed to limit volume
of false positives.
references:
- https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/
- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
- https://www.rapid7.com/blog/post/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day/
tags:
analytic_story:
- HAFNIUM Group
- ProxyShell
- ProxyNotShell
asset_type: Endpoint
atomic_guid: []
confidence: 80
drilldown_search: []
impact: 70
message: Possible CVE-2021-26857 exploitation on $dest$
mitre_attack_id:
- T1190
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 56
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon_umservices.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
ba_detections/endpoint/ssa_wbadmin_delete_system_backups.yml
+56
View File
@@ -0,0 +1,56 @@
name: WBAdmin Delete System Backups
id: 71efbf52-4dbb-4c00-a520-306aa546cbb7
version: 1
date: '2021-12-07'
author: Michael Haag, Splunk
status: production
type: TTP
description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator
Tool) that delete backup files. This is typically used by ransomware to prevent
recovery.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
(cmd_line IS NOT NULL AND process_name IS NOT NULL) | where process_name="wbadmin.exe"
| where like (cmd_line, "%delete%") OR like (cmd_line, "%catalog%") OR like (cmd_line, "%systemstatebackup%")
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
known_false_positives: Administrators may modify the boot configuration.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
- https://thedfirreport.com/2020/10/08/ryuks-return/
- https://attack.mitre.org/techniques/T1490/
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin
tags:
analytic_story:
- Ryuk Ransomware
- Ransomware
asset_type: Endpoint
atomic_guid: []
confidence: 50
drilldown_search: []
impact: 30
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete system
backups.
mitre_attack_id:
- T1490
product:
- Splunk Behavioral Analytics
risk_score: 15
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-security_bcdedit_wbadmin.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_wevtutil_usage_to_clear_logs.yml
+61
View File
@@ -0,0 +1,61 @@
name: WevtUtil Usage To Clear Logs
id: 5438113c-cdd9-11eb-93b8-acde48001122
version: 2
date: '2021-06-15'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The wevtutil.exe application is the windows event log utility. This searches
for wevtutil.exe with parameters for clearing the application, security, setup,
powershell, sysmon, or system event logs.
data_source: []
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND like(cmd_line, "% cl %") AND (match_regex(cmd_line,
/(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true OR match_regex(cmd_line,
/(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true OR match_regex(cmd_line,
/(?i)setup/)=true OR match_regex(cmd_line, /(?i)powershell/)=true) AND process_name="wevtutil.exe"
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
"process_name", process_name, "parent_process_name", parent_process_name, "process_path",
process_path]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
The command-line arguments are mapped to the "process" field in the Endpoint data
model.
known_false_positives: The wevtutil.exe application is a legitimate Windows event
log utility. Administrators may use it to manage Windows event logs.
references:
- https://www.splunk.com/en_us/blog/security/detecting-clop-ransomware.html
tags:
analytic_story:
- Windows Log Manipulation
- Ransomware
- Clop Ransomware
- Insider Threat
- CISA AA22-264A
asset_type: Endpoint
atomic_guid: []
confidence: 90
drilldown_search: []
impact: 70
message: A wevtutil process $process_name$ with commandline $cmd_line$ to clear
event logs in host $dest_device_id$
mitre_attack_id:
- T1070
- T1070.001
product:
- Splunk Behavioral Analytics
risk_score: 63
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_wevtutil_usage_to_disable_logs.yml
+57
View File
@@ -0,0 +1,57 @@
name: Wevtutil Usage To Disable Logs
id: a4bdc944-cdd9-11eb-ac97-acde48001122
version: 2
date: '2021-06-15'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: This search is to detect execution of wevtutil.exe to disable logs. This
technique was seen in several ransomware to disable the event logs to evade alerts
and detections in compromised host.
data_source: []
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line, "%/e:false%")
AND process_name="wevtutil.exe" | eval start_time=timestamp, end_time=timestamp,
entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
"dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id,
"cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
"process_path", process_path]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
The command-line arguments are mapped to the "process" field in the Endpoint data
model.
known_false_positives: network operator may disable audit event logs for debugging
purposes.
references:
- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/
tags:
analytic_story:
- Windows Log Manipulation
- Ransomware
- Insider Threat
- Information Sabotage
asset_type: Endpoint
atomic_guid: []
confidence: 90
drilldown_search: []
impact: 70
message: A wevtutil process $process_name$ with commandline $cmd_line$ to disable
event logs in host $dest_device_id$
mitre_attack_id:
- T1070
- T1070.001
product:
- Splunk Behavioral Analytics
risk_score: 63
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_windows_bits_job_persistence.yml
+65
View File
@@ -0,0 +1,65 @@
name: Windows Bits Job Persistence
id: 1e25e97a-8ea4-11ec-9767-acde48001122
version: 1
date: '2022-02-15'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following query identifies Microsoft Background Intelligent Transfer
Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint.
The query identifies the parameters used to create, resume or add a file to a BITS
job. Typically seen combined in a oneliner or ran in sequence. If identified, review
the BITS job created and capture any files written to disk. It is possible for BITS
to be used to upload files and this may require further network data analysis to
identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation.
data_source: []
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bitsadmin.exe"
AND (like (cmd_line, "%create%") OR like (cmd_line, "%addfile%")OR like (cmd_line,
"%setnotifyflags%") OR like (cmd_line, "%setnotifycmdline%") OR like (cmd_line,
"%setminretrydelay%") OR like (cmd_line, "%setcustomheaders%") OR like (cmd_line,
"%resume%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
"process_name", process_name, "parent_process_name", parent_process_name, "process_path",
process_path]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Limited false positives will be present. Typically, applications
will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments
(legitimate applications) or parent process.
references:
- https://attack.mitre.org/techniques/T1197/
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute
- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
tags:
analytic_story:
- BITS Jobs
- Living Off The Land
asset_type: Endpoint
atomic_guid: []
confidence: 80
drilldown_search: []
impact: 70
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $dest_user_id$ attempting to persist using BITS.
mitre_attack_id:
- T1197
product:
- Splunk Behavioral Analytics
risk_score: 56
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_windows_bitsadmin_download_file.yml
+69
View File
@@ -0,0 +1,69 @@
name: Windows Bitsadmin Download File
id: d76e8188-8f5a-11ec-ace4-acde48001122
version: 1
date: '2022-02-16'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following query identifies Microsoft Background Intelligent Transfer
Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote
object. In addition, look for `download` or `upload` on the command-line, the switches
are not required to perform a transfer. Capture any files downloaded. Review the
reputation of the IP or domain used. Typically once executed, a follow on command
will be used to execute the dropped file. Note that the network connection or file
modification events related will not spawn or create from `bitsadmin.exe`, but the
artifacts will appear in a parallel process of `svchost.exe` with a command-line
similar to `svchost.exe -k netsvcs -s BITS`. It's important to review all parallel
and child processes to capture any behaviors and artifacts. In some suspicious and
malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose`
to list out the jobs during investigation.
data_source: []
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bitsadmin.exe"
AND (like (cmd_line, "%transfer%")) | eval start_time=timestamp, end_time=timestamp,
entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
"dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id,
"cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
"process_path", process_path]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Limited false positives, however it may be required to filter
based on parent process name or network connection.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download
- https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md
- https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool
- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
tags:
analytic_story:
- Ingress Tool Transfer
- BITS Jobs
- DarkSide Ransomware
- Living Off The Land
asset_type: Endpoint
atomic_guid: []
confidence: 70
drilldown_search: []
impact: 70
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $dest_user_id$ attempting to download a file.
mitre_attack_id:
- T1197
- T1105
product:
- Splunk Behavioral Analytics
risk_score: 49
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_windows_certutil_decode_file.yml
+64
View File
@@ -0,0 +1,64 @@
name: Windows CertUtil Decode File
id: b06983f4-8f72-11ec-ab50-acde48001122
version: 1
date: '2022-02-16'
author: Michael Haag, Splunk
status: production
type: TTP
description: CertUtil.exe may be used to `encode` and `decode` a file, including PE
and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----`
and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded
file that was downloaded. Once decoded, it will be loaded by a parallel process.
Note that there are two additional command switches that may be used - `encodehex`
and `decodehex`. Similarly, the file will be encoded in HEX and later decoded for
further execution. During triage, identify the source of the file being decoded.
Review its contents or execution behavior for further analysis.
data_source: []
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe"
AND (like (cmd_line, "%decode%")) | eval start_time=timestamp, end_time=timestamp,
entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
"dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id,
"cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
"process_path", process_path]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Typically seen used to `encode` files, but it is possible to
see legitimate use of `decode`. Filter based on parent-child relationship, file
paths, endpoint or user.
references:
- https://attack.mitre.org/techniques/T1140/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1140/T1140.md
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
- https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/
tags:
analytic_story:
- Deobfuscate-Decode Files or Information
- Living Off The Land
asset_type: Endpoint
atomic_guid: []
confidence: 80
drilldown_search: []
impact: 50
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to decode a file
on disk.
mitre_attack_id:
- T1140
product:
- Splunk Behavioral Analytics
risk_score: 40
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/atomic_red_team/encode-windows-security.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_windows_certutil_urlcache_download.yml
+60
View File
@@ -0,0 +1,60 @@
name: Windows CertUtil URLCache Download
id: 8cb1ad38-8f6d-11ec-87a3-acde48001122
version: 1
date: '2022-02-16'
author: Michael Haag, Splunk
status: production
type: TTP
description: Certutil.exe may download a file from a remote destination using `-urlcache`.
This behavior does require a URL to be passed on the command-line. In addition,
`-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will
be used. It is not entirely common for `certutil.exe` to contact public IP space.
However, it is uncommon for `certutil.exe` to write files to world writeable paths.\
During triage, capture any files on disk and review. Review the reputation of the
remote IP or domain in question.
data_source: []
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe"
AND (like (cmd_line, "%urlcache%") AND like (cmd_line, "%split%")) OR (like (cmd_line,
"%urlcache%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
"process_name", process_name, "parent_process_name", parent_process_name, "process_path",
process_path]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
known_false_positives: Limited false positives in most environments, however tune
as needed based on parent-child relationship or network connection.
references:
- https://attack.mitre.org/techniques/T1105/
- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
- https://web.archive.org/web/20210921110637/https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html
tags:
analytic_story:
- Ingress Tool Transfer
- DarkSide Ransomware
- Living Off The Land
asset_type: Endpoint
atomic_guid: []
confidence: 100
drilldown_search: []
impact: 90
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
mitre_attack_id:
- T1105
product:
- Splunk Behavioral Analytics
risk_score: 90
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_windows_certutil_verifyctl_download.yml
+61
View File
@@ -0,0 +1,61 @@
name: Windows CertUtil VerifyCtl Download
id: 9ac29c40-8f6b-11ec-b19a-acde48001122
version: 1
date: '2022-02-16'
author: Michael Haag, Splunk
status: production
type: TTP
description: 'Certutil.exe may download a file from a remote destination using `-VerifyCtl`.
This behavior does require a URL to be passed on the command-line. In addition,
`-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will
be used. It is not entirely common for `certutil.exe` to contact public IP space.
\ During triage, capture any files on disk and review. Review the reputation of
the remote IP or domain in question. Using `-VerifyCtl`, the file will either be
written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\<hash>`. '
data_source: []
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe"
AND (like (cmd_line, "%verifyctl%") AND like (cmd_line, "%split%")) OR (like (cmd_line,
"%verifyctl%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
"process_name", process_name, "parent_process_name", parent_process_name, "process_path",
process_path]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
known_false_positives: Limited false positives in most environments, however tune
as needed based on parent-child relationship or network connection.
references:
- https://attack.mitre.org/techniques/T1105/
- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/
- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl
- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
tags:
analytic_story:
- Ingress Tool Transfer
- DarkSide Ransomware
- Living Off The Land
asset_type: Endpoint
atomic_guid: []
confidence: 100
drilldown_search: []
impact: 90
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
mitre_attack_id:
- T1105
product:
- Splunk Behavioral Analytics
risk_score: 90
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_windows_com_hijacking_inprocserver32_modification.yml
+61
View File
@@ -0,0 +1,61 @@
name: Windows COM Hijacking InprocServer32 Modification
id: 0ae05a0f-bc84-456b-822a-a5b9c081c7ca
version: 1
date: '2022-10-12'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies the use of reg.exe performing an add
to the InProcServer32, which may be related to COM hijacking. Adversaries can use
the COM system to insert malicious code that can be executed in place of legitimate
software through hijacking the COM references and relationships as a means for persistence.
Hijacking a COM object requires a change in the Registry to replace a reference
to a legitimate system component which may cause that component to not work when
executed. When that system component is executed through normal system operation
the adversary's code will be executed instead.
data_source: []
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="reg.exe"
AND like (cmd_line, "%inprocserver32%") | eval start_time=timestamp, end_time=timestamp,
entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
"dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id,
"cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
"process_path", process_path]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: False positives may be present and some filtering may be required.
references:
- https://attack.mitre.org/techniques/T1546/015/
- https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.015/T1546.015.md
tags:
analytic_story:
- Living Off The Land
asset_type: Endpoint
atomic_guid: []
confidence: 80
drilldown_search: []
impact: 80
message: An instance of $parent_process_name$ has spawned $process_name$ attempting
to modify InProcServer32 within the registry on $dest_device_id$ by $dest_user_id$.
mitre_attack_id:
- T1546.015
- T1546
product:
- Splunk Behavioral Analytics
risk_score: 64
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/atomic_red_team/windows-security.log
source: XmlWinEventLog
sourcetype: XmlWinEventLog
update_timestamp: true
ba_detections/endpoint/ssa_windows_curl_upload_to_remote_destination.yml
+74
View File
@@ -0,0 +1,74 @@
name: Windows Curl Upload to Remote Destination
id: cc8d046a-543b-11ec-b864-acde48001122
version: 1
date: '2021-12-03'
author: Michael Haag, Splunk
status: production
type: TTP
description: 'The following analytic identifies the use of Windows Curl.exe uploading
a file to a remote destination. \
`-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination.
\
`-d` or `--data` POST is the HTTP method that was invented to send data to a receiving
web application, and it is, for example, how most common HTML forms on the web work.
\
HTTP multipart formposts are done with `-F`, but this appears to not be compatible
with the Windows version of Curl. Will update if identified adversary tradecraft.
\
Adversaries may use one of the three methods based on the remote destination and
what they are attempting to upload (zip vs txt). During triage, review parallel
processes for further behavior. In addition, identify if the upload was successful
in network logs. If a file was uploaded, isolate the endpoint and review.'
data_source: []
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="curl.exe"
AND (like (cmd_line, "%-T %") OR like (cmd_line, "%--upload-file %")OR like (cmd_line,
"%-d %") OR like (cmd_line, "%--data %") OR like (cmd_line, "%-F %"))
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
"process_name", process_name, "parent_process_name", parent_process_name, "process_path",
process_path]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
known_false_positives: False positives may be limited to source control applications
and may be required to be filtered out.
references:
- https://everything.curl.dev/usingcurl/uploads
- https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409
- https://twitter.com/d1r4c/status/1279042657508081664?s=20
tags:
analytic_story:
- Ingress Tool Transfer
- Insider Threat
asset_type: Endpoint
atomic_guid: []
confidence: 100
drilldown_search: []
impact: 80
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ uploading a file to a remote
destination.
mitre_attack_id:
- T1105
product:
- Splunk Behavioral Analytics
risk_score: 80
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-security.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_windows_defender_tools_in_non_standard_path.yml
+52
View File
@@ -0,0 +1,52 @@
name: Windows Defender Tools in Non Standard Path
id: c205bd2e-cd5b-4224-8510-578a2a1f83d7
version: 1
date: '2022-07-18'
author: Lou Stella, Splunk
status: production
type: Anomaly
description: The following analytic identifies usage of the MPCmdRun utility that
can be abused by adversaries by moving it to a new directory.
data_source: []
search: ' from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)),
process_path=lower(ucast(map_get(input_event, "process_path"), "string", null)),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process_name
IS NOT NULL AND process_name="mpcmdrun.exe" | where process_path IS NOT NULL AND
match_regex(process_path, /(?i)\\microsoft\\windows defender\\platform/)=false AND
match_regex(process_path, /(?i)\\windows defender/)=false | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id",
event_id, "process_path", process_path, "process_name", process_name, "cmd_line",
cmd_line]) | into write_ssa_detected_events(); '
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
known_false_positives: False positives may be present and filtering may be required.
references:
- https://attack.mitre.org/techniques/T1036/003/
- https://lolbas-project.github.io/lolbas/Binaries/MpCmdRun/
tags:
analytic_story:
- Living Off The Land
asset_type: Endpoint
atomic_guid: []
confidence: 80
drilldown_search: []
impact: 70
message: Process $process_name$ with commandline $cmd_line$ spawn in non-default
folder path on host $dest_device_id$
mitre_attack_id:
- T1036
- T1036.003
product:
- Splunk Behavioral Analytics
risk_score: 56
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/mpcmdrun/windows-security.log
source: XmlWinEventLog
sourcetype: XmlWinEventLog
update_timestamp: true
ba_detections/endpoint/ssa_windows_diskshadow_proxy_execution.yml
+55
View File
@@ -0,0 +1,55 @@
name: Windows Diskshadow Proxy Execution
id: aa502688-9037-11ec-842d-acde48001122
version: 1
date: '2022-02-17'
author: Lou Stella, Splunk
status: production
type: Anomaly
description: DiskShadow.exe is a Microsoft Signed binary present on Windows Server.
It has a scripting mode intended for complex scripted backup operations. This feature
also allows for execution of arbitrary unsigned code. This analytic looks for the
usage of the scripting mode flags in executions of DiskShadow. During triage, compare
to known backup behavior in your environment and then review the scripts called
by diskshadow.
data_source: []
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event,
"process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="diskshadow.exe"
AND (like (cmd_line, "%-s%") OR like (cmd_line, "%/s%")) | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
| eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on processes that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
known_false_positives: Administrators using the DiskShadow tool in their infrastructure
as a main backup tool with scripts will cause false positives
references:
- https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
tags:
analytic_story:
- Living Off The Land
asset_type: Endpoint
atomic_guid: []
confidence: 70
drilldown_search: []
impact: 70
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to run a script.
mitre_attack_id:
- T1218
product:
- Splunk Behavioral Analytics
risk_score: 49
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/diskshadow/windows-security.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_windows_dotnet_binary_in_non_standard_path.yml
+83
View File
@@ -0,0 +1,83 @@
name: Windows DotNet Binary in Non Standard Path
id: 21179107-099a-324a-94d3-08301e6c065f
version: 1
date: '2022-03-17'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic identifies native .net binaries within the Windows
operating system that may be abused by adversaries by moving it to a new directory.
The analytic identifies the .net binary by using a list. If one or the other matches
an alert will be generated. Adversaries abuse these binaries as they are native
to Windows and native DotNet. Note that not all SDK (post install of Windows) are
captured in the list. Lookup - https://github.com/splunk/security_content/blob/develop/lookups/is_net_windows_file.csv.
data_source: []
search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null);
$cond_1 = | from $ssa_input | where process_name="msbuild.exe" OR process_name="comsvcconfig.exe"
OR process_name="dfsradmin.exe" OR process_name="dfsvc.exe" OR process_name="microsoft.workflow.compiler.exe"
OR process_name="smsvchost.exe" OR process_name="wsatconfig.exe" OR process_name="addinprocess.exe"
OR process_name="addinprocess32.exe" OR process_name="addinutil.exe" OR process_name="aspnet_compiler.exe"
OR process_name="aspnet_regbrowsers.exe" OR process_name="aspnet_regsql.exe" OR
process_name="caspol.exe" OR process_name="datasvcutil.exe" OR process_name="edmgen.exe"
OR process_name="installutil.exe" OR process_name="jsc.exe" OR process_name="ngentask.exe"
OR process_name="regasm.exe" OR process_name="regsvcs.exe" OR process_name="sdnbr.exe"
OR process_name="acu.exe" OR process_name="appvstreamingux.exe" OR process_name="dsac.exe"
OR process_name="lbfoadmin.exe" OR process_name="microsoft.uev.synccontroller.exe"
OR process_name="mtedit.exe" OR process_name="scriptrunner.exe" OR process_name="servermanager.exe"
OR process_name="stordiag.exe" OR process_name="tzsync.exe" OR process_name="uevagentpolicygenerator.exe"
OR process_name="uevappmonitor.exe" OR process_name="uevtemplatebaselinegenerator.exe"
OR process_name="uevtemplateconfigitemgenerator.exe" OR process_name="powershell_ise.exe"
OR process_name="iediagcmd.exe" OR process_name="xbox.tcui.exe" OR process_name="microsoft.activedirectory.webservices.exe"
OR process_name="iisual.exe" OR process_name="filehistory.exe" OR process_name="secureassessmentbrowser.exe";
| from $cond_1 | where match_regex(process_path, /(?i)\\windows\\system32/)=false
AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false AND match_regex(process_path,
/(?i)\\windows\\adws/)=false AND match_regex(process_path, /(?i)\\windows\\networkcontroller/)=false
AND match_regex(process_path, /(?i)\\windows\\systemapps/)=false AND match_regex(process_path,
/(?i)\\winsxs/)=false AND match_regex(process_path, /(?i)\\microsoft.net/)=false
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(device, user),
body=create_map(["event_id", event_id, "process_path", process_path, "process_name",
process_name]) | into write_ssa_detected_events();'
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
known_false_positives: False positives may be present and filtering may be required.
Certain utilities will run from non-standard paths based on the third-party application
in use.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
- https://attack.mitre.org/techniques/T1036/003/
- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
tags:
analytic_story:
- Masquerading - Rename System Utilities
- Unusual Processes
- Ransomware
- Signed Binary Proxy Execution InstallUtil
- WhisperGate
asset_type: Endpoint
atomic_guid: []
confidence: 70
drilldown_search: []
impact: 70
message: A system process $process_name$ with commandline $cmd_line$ spawn in non-default
folder path on host $dest_device_id$
mitre_attack_id:
- T1036
- T1036.003
- T1218
- T1218.004
product:
- Splunk Behavioral Analytics
risk_score: 49
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_windows_eventvwr_uac_bypass.yml
+63
View File
@@ -0,0 +1,63 @@
name: Windows Eventvwr UAC Bypass
id: 66adff66-90d9-11ec-aba7-acde48001122
version: 1
date: '2022-02-18'
author: Lou Stella, Splunk
status: production
type: Anomaly
description: The following search identifies Eventvwr bypass by identifying the registry
modification into a specific path that eventvwr.msc looks to (but is not valid)
upon execution. A successful attack will include a suspicious command to be executed
upon eventvwr.msc loading. Upon triage, review the parallel processes that have
executed. Identify any additional registry modifications on the endpoint that may
look suspicious. Remediate as necessary.
data_source: []
search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)),
registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)),
registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string",
null)), registry_key_name=lower(ucast(map_get(input_event, "parent_process_name"),
"string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"),
"string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"),
"string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"),
"string", null)) | where registry_path IS NOT NULL AND (like (registry_path, "%mscfile\\\\shell\\\\open\\\\command%"))
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)) | eval body=create_map(["registry_path", registry_path, "registry_hive",
registry_hive, "registry_value_name", registry_value_name, "registry_key_name",
registry_key_name, "registry_value_type", registry_value_type, "registry_value_data",
registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Registry` datamodel.
known_false_positives: None known at this time.
references:
- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
- https://attack.mitre.org/techniques/T1548/002/
- https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
tags:
analytic_story:
- Windows Defense Evasion Tactics
- IcedID
- Living Off The Land
asset_type: Endpoint
atomic_guid: []
confidence: 100
drilldown_search: []
impact: 80
message: Registry values were modified to bypass UAC using Event Viewer on $dest_device_id$
mitre_attack_id:
- T1548.002
- T1548
product:
- Splunk Behavioral Analytics
risk_score: 80
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/ssa_eventvwr/windows-sysmon-registry.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
ba_detections/endpoint/ssa_windows_exchange_powershell_module_usage.yml
+82
View File
@@ -0,0 +1,82 @@
name: Windows Exchange PowerShell Module Usage
id: 1118bc65-b0c7-4589-bc2f-ad6802fd0909
version: 1
date: '2022-10-12'
author: Michael Haag, Splunk
status: production
type: TTP
description: 'The following analytic identifies the usage of Exchange PowerShell modules
that were recently used for a proof of concept related to ProxyShell. Currently,
there is no active data shared or data we could re-produce relate to this part of
the ProxyShell chain of exploits. \
Inherently, the usage of the modules is not malicious, but reviewing parallel processes,
and user, of the session will assist with determining the intent. \
Module - New-MailboxExportRequest will begin the process of exporting contents of
a primary mailbox or archive to a .pst file. \
Module - New-managementroleassignment can assign a management role to a management
role group, management role assignment policy, user, or universal security group
(USG). \
Module - New-MailboxSearch cmdlet to create a mailbox search and either get an estimate
of search results, place search results on In-Place Hold or copy them to a Discovery
mailbox. You can also place all contents in a mailbox on hold by not specifying
a search query, which accomplishes similar results as Litigation Hold. \ Module
- Get-Recipient cmdlet to view existing recipient objects in your organization.
This cmdlet returns all mail-enabled objects (for example, mailboxes, mail users,
mail contacts, and distribution groups).'
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL | where (like (cmd_line, "%new-mailboxexportrequest%")
OR like (cmd_line, "%new-managementroleassignment%") OR like (cmd_line, "%new-mailboxsearch%")
OR like (cmd_line,"%get-recipient%")) | eval start_time=timestamp, end_time=timestamp,
entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
"dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
"process_path", process_path]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
This will only work with Multiline event logs, not XML.
known_false_positives: Administrators or power users may use this PowerShell commandlet
references:
- https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps
- https://docs.microsoft.com/en-us/powershell/module/exchange/new-managementroleassignment?view=exchange-ps
- https://blog.orange.tw/2021/08/proxyshell-a-new-attack-surface-on-ms-exchange-part-3.html
- https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell
- https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/
- https://www.cisa.gov/uscert/ncas/alerts/aa22-264a
- https://learn.microsoft.com/en-us/powershell/module/exchange/new-mailboxsearch?view=exchange-ps
- https://learn.microsoft.com/en-us/powershell/module/exchange/get-recipient?view=exchange-ps
- https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/
tags:
analytic_story:
- ProxyShell
- CISA AA22-264A
asset_type: Endpoint
atomic_guid: []
confidence: 80
drilldown_search: []
impact: 40
message: Exchange enumeration using PowerShell on $dest_device_id$.
mitre_attack_id:
- T1059
- T1059.001
product:
- Splunk Behavioral Analytics
risk_score: 32
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/exchange/windows-powershell.log
source: XmlWinEventLog
sourcetype: XmlWinEventLog
update_timestamp: true
ba_detections/endpoint/ssa_windows_execute_arbitrary_commands_with_msdt.yml
+65
View File
@@ -0,0 +1,65 @@
name: Windows Execute Arbitrary Commands with MSDT
id: f253f9c2-10f0-4cc8-b469-f505ba8c2038
version: 1
date: '2022-09-15'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies a recently disclosed arbitraty command
execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample
identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve
a remote payload. During triage, review file modifications for html. Identify parallel
process execution that may be related, including an Office Product.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msdt.exe" AND
(like (cmd_line, "%msdt%") OR like (cmd_line, "%ms-msdt:%") OR like (cmd_line, "%ms-msdt:/id%")
OR like (cmd_line, "%ms-msdt:-id%") OR like (cmd_line, "%ms-msdt:/id%")) AND (like
(cmd_line, "%it_browseforfile=%") OR like (cmd_line, "%it_rebrowseforfile=%") OR
like (cmd_line, "%.xml%")) AND like (cmd_line, "%pcwdiagnostic%") | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: False positives may be present, filter as needed. Added .xml
to potentially capture any answer file usage. Remove as needed.
references:
- https://isc.sans.edu/diary/rss/28694
- https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
- https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A
- https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
- https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection
- https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html
tags:
analytic_story:
- Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190
asset_type: Endpoint
atomic_guid: []
confidence: 100
drilldown_search: []
impact: 100
message: $process_name$ on $dest_device_id$ under user $dest_user_id$ possibly indicative
of indirect command execution.
mitre_attack_id:
- T1218
product:
- Splunk Behavioral Analytics
risk_score: 100
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt-windows-security.log
source: XmlWinEventLog
sourcetype: XmlWinEventLog
update_timestamp: true
ba_detections/endpoint/ssa_windows_ingress_tool_transfer_using_explorer.yml
+61
View File
@@ -0,0 +1,61 @@
name: Windows Ingress Tool Transfer Using Explorer
id: 695bfad6-9662-4f9e-a576-bf02a951aa60
version: 1
date: '2022-09-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies the Windows Explorer process with a
URL within the command-line. Explorer.exe is known Windows process that handles
start menu, taskbar, desktop and file manager. Many adversaries abuse this process,
like DCRat malware, where it attempts to open the URL with the default browser application
on the target host by putting the URL as a parameter on explorer.exe process. This
anomaly detection might be a good pivot to check which user and how this process
was executed, what is the parent process and what is the URL link. This technique
is not commonly used to open an URL.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="explorer.exe"
AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%")) AND NOT (like(parent_process_name,
"userinit.exe") OR like(parent_process_name, "svchost.exe")) | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints.
known_false_positives: False positives may be present based on legitimate applications
or third party utilities. Filter out any additional parent process names.
references:
- https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor
tags:
analytic_story:
- DarkCrystal RAT
asset_type: Endpoint
atomic_guid: []
confidence: 50
drilldown_search: []
impact: 50
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote
destination to download an additional payload.
mitre_attack_id:
- T1105
product:
- Splunk Behavioral Analytics
risk_score: 25
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105_explorer-windows-security.log
source: XmlWinEventLog
sourcetype: XmlWinEventLog
update_timestamp: true
ba_detections/endpoint/ssa_windows_lolbin_binary_in_non_standard_path.yml
+92
View File
@@ -0,0 +1,92 @@
name: Windows LOLBin Binary in Non Standard Path
id: 25689101-012a-324a-94d3-08301e6c065a
version: 4
date: '2022-08-31'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic identifies native living off the land binaries
within the Windows operating system that may be abused by adversaries by moving
it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io
site, and excluded common process names (cmd.exe, explorer.exe, csc.exe, hh.exe,
regedit.exe) and DotNet binaries. It also does not include the category of OtherMSBinaries.
data_source: []
search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null);
$cond_1 = | from $ssa_input | where process_name="bitsadmin.exe" OR process_name="certoc.exe"
OR process_name="certreq.exe" OR process_name="certutil.exe" OR process_name="cmdkey.exe"
OR process_name="cmdl32.exe" OR process_name="cmstp.exe" OR process_name="configsecuritypolicy.exe"
OR process_name="control.exe" OR process_name="cscript.exe" OR process_name="datasvcutil.exe"
OR process_name="desktopimgdownldr.exe" OR process_name="dfsvc.exe" OR process_name="diantz.exe"
OR process_name="diskshadow.exe" OR process_name="dllhost.exe" OR process_name="dnscmd.exe"
OR process_name="esentutl.exe" OR process_name="eventvwr.exe" OR process_name="expand.exe"
OR process_name="extexport.exe" OR process_name="extrac32.exe" OR process_name="findstr.exe"
OR process_name="finger.exe" OR process_name="fltmc.exe" OR process_name="forfiles.exe"
OR process_name="ftp.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="gpscript.exe"
OR process_name="imewdbld.exe" OR process_name="ie4uinit.exe" OR process_name="ieexec.exe"
OR process_name="ilasm.exe" OR process_name="infdefaultinstall.exe" OR process_name="makecab.exe"
OR process_name="mavinject.exe" OR process_name="microsoft.workflow.compiler.exe"
OR process_name="mmc.exe" OR process_name="msconfig.exe" OR process_name="msdt.exe"
OR process_name="mshta.exe" OR process_name="msiexec.exe" OR process_name="netsh.exe"
OR process_name="odbcconf.exe" OR process_name="offlinescannershell.exe" OR process_name="pcalua.exe"
OR process_name="pcwrun.exe" OR process_name="pktmon.exe" OR process_name="pnputil.exe"
OR process_name="presentationhost.exe" OR process_name="print.exe" OR process_name="printbrm.exe"
OR process_name="psr.exe" OR process_name="rasautou.exe" OR process_name="reg.exe"
OR process_name="regini.exe" OR process_name="register-cimprovider.exe" OR process_name="regsvr32.exe"
OR process_name="replace.exe" OR process_name="rpcping.exe" OR process_name="rundll32.exe"
OR process_name="runonce.exe" OR process_name="runscripthelper.exe" OR process_name="sc.exe"
OR process_name="schtasks.exe" OR process_name="scriptrunner.exe" OR process_name="settingsynchost.exe"
OR process_name="syncappvpublishingserver.exe" OR process_name="ttdinject.exe" OR
process_name="tttracer.exe" OR process_name="vbc.exe" OR process_name="verclsid.exe"
OR process_name="wab.exe" OR process_name="wlrmdr.exe" OR process_name="wmic.exe"
OR process_name="workfolders.exe" OR process_name="wscript.exe" OR process_name="wsreset.exe"
OR process_name="wuauclt.exe" OR process_name="xwizard.exe";
| from $cond_1 | where match_regex(process_path, /(?i)\\windows\\system32/)=false
AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false AND match_regex(process_path,
/(?i)\\windows\\adws/)=false AND match_regex(process_path, /(?i)\\windows\\networkcontroller/)=false
AND match_regex(process_path, /(?i)\\windows\\systemapps/)=false AND match_regex(process_path,
/(?i)\\winsxs/)=false AND match_regex(process_path, /(?i)\\microsoft.net/)=false
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(device, user),
body=create_map(["event_id", event_id, "process_path", process_path, "process_name",
process_name]) | into write_ssa_detected_events();'
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
known_false_positives: False positives may be present and filtering may be required.
Certain utilities will run from non-standard paths based on the third-party application
in use.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
- https://attack.mitre.org/techniques/T1036/003/
- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
tags:
analytic_story:
- Unusual Processes
- Ransomware
- WhisperGate
asset_type: Endpoint
atomic_guid: []
confidence: 70
drilldown_search: []
impact: 70
message: A system process $process_name$ with commandline $cmd_line$ spawn in non-default
folder path on host $dest_device_id$
mitre_attack_id:
- T1036
- T1036.003
- T1218
- T1218.004
product:
- Splunk Behavioral Analytics
risk_score: 49
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_windows_mshta_child_process.yml
+61
View File
@@ -0,0 +1,61 @@
name: Windows MSHTA Child Process
id: f63f7e9c-9526-11ec-9fc7-acde48001122
version: 2
date: '2022-02-23'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies child processes spawning from "mshta.exe".
The search will return the first time and last time these command-line arguments
were used for these executions, as well as the target system, the user, parent process
"mshta.exe" and its child process.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=lower(ucast(map_get(input_event, "parent_process_name"),
"string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name
IS NOT NULL | where like(parent_process_name, "%\\\\mshta.exe") AND (process_name="powershell.exe"
OR process_name="cmd.exe" OR process_name="scrcons.exe" OR process_name="colorcpl.exe"
OR process_name="msbuild.exe" OR process_name="microsoft.workflow.compiler.exe"
OR process_name="searchprotocolhost.exe" OR process_name="cscript.exe" OR process_name="wscript.exe")
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: Although unlikely, some legitimate applications may exhibit
this behavior, triggering a false positive.
references:
- https://github.com/redcanaryco/AtomicTestHarnesses
- https://redcanary.com/blog/introducing-atomictestharnesses/
tags:
analytic_story:
- Suspicious MSHTA Activity
- Living Off The Land
asset_type: Endpoint
atomic_guid: []
confidence: 100
drilldown_search: []
impact: 80
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote
destination to download an additional payload.
mitre_attack_id:
- T1218.005
- T1218
product:
- Splunk Behavioral Analytics
risk_score: 80
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_windows_mshta_command_line_url.yml
+63
View File
@@ -0,0 +1,63 @@
name: Windows MSHTA Command-Line URL
id: 9b35c538-94ef-11ec-9439-acde48001122
version: 1
date: '2022-02-23'
author: Michael Haag, Splunk
status: production
type: TTP
description: This analytic identifies when Microsoft HTML Application Host (mshta.exe)
utility is used to make remote http connections. Adversaries may use mshta.exe to
proxy the download and execution of remote .hta files. The analytic identifies command
line arguments of http and https being used. This technique is commonly used by
malicious software to bypass preventative controls. The search will return the first
time and last time these command-line arguments were used for these executions,
as well as the target system, the user, process "rundll32.exe" and its parent process.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="mshta.exe"
AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%")) | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: It is possible legitimate applications may perform this behavior
and will need to be filtered.
references:
- https://github.com/redcanaryco/AtomicTestHarnesses
- https://redcanary.com/blog/introducing-atomictestharnesses/
- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
tags:
analytic_story:
- Suspicious MSHTA Activity
- Living Off The Land
asset_type: Endpoint
atomic_guid: []
confidence: 100
drilldown_search: []
impact: 80
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote
destination to download an additional payload.
mitre_attack_id:
- T1218.005
- T1218
product:
- Splunk Behavioral Analytics
risk_score: 80
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_windows_mshta_inline_hta_execution.yml
+61
View File
@@ -0,0 +1,61 @@
name: Windows MSHTA Inline HTA Execution
id: 24962154-9524-11ec-9333-acde48001122
version: 1
date: '2022-02-23'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies "mshta.exe" execution with inline protocol
handlers. "JavaScript", "VBScript", and "About" are the only supported options when
invoking HTA content directly on the command-line. The search will return the first
time and last time these command-line arguments were used for these executions,
as well as the target system, the user, process "mshta.exe" and its parent process.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="mshta.exe"
AND (like (cmd_line, "%vbscript%") OR like (cmd_line, "%javascript%") OR like (cmd_line,
"%about%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Although unlikely, some legitimate applications may exhibit
this behavior, triggering a false positive.
references:
- https://github.com/redcanaryco/AtomicTestHarnesses
- https://redcanary.com/blog/introducing-atomictestharnesses/
- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
tags:
analytic_story:
- Suspicious MSHTA Activity
- Living Off The Land
asset_type: Endpoint
atomic_guid: []
confidence: 100
drilldown_search: []
impact: 80
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ executing with inline HTA,
indicative of defense evasion.
mitre_attack_id:
- T1218.005
- T1218
product:
- Splunk Behavioral Analytics
risk_score: 80
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_windows_odbcconf_load_response_file.yml
+59
View File
@@ -0,0 +1,59 @@
name: Windows Odbcconf Load Response File
id: 7b6c3fac-0c37-4efc-a85e-de88f42b6763
version: 1
date: '2022-09-15'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies the odbcconf.exe, Windows Open Database
Connectivity utility, loading up a resource file. The file extension is arbitrary
and may be named anything. The resource file itself may have different commands
supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands.
During triage, review file modifications and parallel processes.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="odbcconf.exe"
AND (like (cmd_line, "%-f %") OR like (cmd_line, "%/f %")) AND like (cmd_line, "%.rsp%")
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: False positives may be present and filtering may need to occur
based on legitimate application usage. Filter as needed.
references:
- https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html
- https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw
tags:
analytic_story:
- Living Off The Land
asset_type: Endpoint
atomic_guid: []
confidence: 70
drilldown_search: []
impact: 60
message: $process_name$ has been identified on $dest_device_id$ under user $dest_user_id$
attempting to circumvent controls.
mitre_attack_id:
- T1218.008
- T1218
product:
- Splunk Behavioral Analytics
risk_score: 42
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/odbcconf-windows-security.log
source: XmlWinEventLog
sourcetype: XmlWinEventLog
update_timestamp: true
ba_detections/endpoint/ssa_windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
+69
View File
@@ -0,0 +1,69 @@
name: Windows OS Credential Dumping with Ntdsutil Export NTDS
id: dad9ddec-a72a-47be-87b6-a0f7ba98ed6e
version: 1
date: '2022-08-31'
author: Michael Haag, Splunk
status: production
type: TTP
description: 'Monitor for signs that Ntdsutil is being used to Extract Active Directory
database - NTDS.dit, typically used for offline password cracking. It may be used
in normal circumstances with no command line arguments or shorthand variations of
more common arguments. Ntdsutil.exe is typically seen run on a Windows Server. Typical
command used to dump ntds.dit \
ntdsutil "ac i ntds" "ifm" "create full C:\Temp" q q \
This technique uses "Install from Media" (IFM), which will extract a copy of the
Active Directory database. A successful export of the Active Directory database
will yield a file modification named ntds.dit to the destination.'
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="ntdsutil.exe"
AND (like (cmd_line, "%ntds%") AND like (cmd_line, "%create%")) | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: Highly possible Server Administrators will troubleshoot with
ntdsutil.exe, generating false positives.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.003/T1003.003.md#atomic-test-3---dump-active-directory-database-with-ntdsutil
- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753343(v=ws.11)
- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
- https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html
tags:
analytic_story:
- Credential Dumping
- HAFNIUM Group
- Living Off The Land
asset_type: Endpoint
atomic_guid: []
confidence: 50
drilldown_search: []
impact: 100
message: Active Directory NTDS export on $dest_device_id$ using $process_name$ by
$dest_user_id$.
mitre_attack_id:
- T1003.003
- T1003
product:
- Splunk Behavioral Analytics
risk_score: 50
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/4688_windows-security.log
source: XmlWinEventLog
sourcetype: XmlWinEventLog
update_timestamp: true
ba_detections/endpoint/ssa_windows_os_credential_dumping_with_procdump.yml
+65
View File
@@ -0,0 +1,65 @@
name: Windows OS Credential Dumping with Procdump
id: e102e297-dbe6-4a19-b319-5c08f4c19a06
version: 1
date: '2022-08-31'
author: Michael Haag, Splunk
status: production
type: TTP
description: 'Detect procdump.exe dumping the lsass process. This query looks for
both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump
file with all process memory. Both are highly suspect and should be reviewed. This
query does not monitor for the internal name (original_file_name=procdump) of the
PE or look for procdump64.exe. Modify the query as needed.\
During triage, confirm this is procdump.exe executing. If it is the first time a
Sysinternals utility has been ran, it is possible there will be a -accepteula on
the command line. Review other endpoint data sources for cross process (injection)
into lsass.exe.'
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL AND (process_name="procdump.exe"
OR process_name="procdump64.exe") AND (like (cmd_line, "%-mm %") OR like (cmd_line,
"%-ma %")) AND like (cmd_line, "%lsass%") | eval start_time=timestamp, end_time=timestamp,
entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
"dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
"process_path", process_path]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: None identified.
references:
- https://attack.mitre.org/techniques/T1003/001/
- https://docs.microsoft.com/en-us/sysinternals/downloads/procdump
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump
- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
tags:
analytic_story:
- Credential Dumping
- HAFNIUM Group
asset_type: Endpoint
atomic_guid: []
confidence: 100
drilldown_search: []
impact: 80
message: Procdump was utilized to dump lsass on $dest_device_id$ by $dest_user_id$.
mitre_attack_id:
- T1003.001
- T1003
product:
- Splunk Behavioral Analytics
risk_score: 80
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/procdump_windows-security.log
source: XmlWinEventLog
sourcetype: XmlWinEventLog
update_timestamp: true
ba_detections/endpoint/ssa_windows_powershell_connect_to_internet_with_hidden_window.yml
+69
View File
@@ -0,0 +1,69 @@
name: Windows Powershell Connect to Internet With Hidden Window
id: 477e068e-8b6d-11ec-b6c1-81af21670352
version: 1
date: '2022-02-11'
author: Jose Hernandez, David Dorsey, Michael Haag Splunk
status: production
type: Anomaly
description: The following hunting analytic identifies PowerShell commands utilizing
the WindowStyle parameter to hide the window on the compromised endpoint. This combination
of command-line options is suspicious because it is overriding the default PowerShell
execution policy, attempts to hide its activity from the user, and connects to the
Internet. Removed in this version of the query is New-Object. The analytic identifies
all variations of WindowStyle, as PowerShell allows the ability to shorten the parameter.
For example w, win, windowsty and so forth. In addition, through our research it
was identified that PowerShell will interpret different command switch types beyond
the hyphen. We have added endash, emdash, horizontal bar, and forward slash.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), process=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
process IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe"
OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe"
OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where match_regex(process,
/(?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+[^-]/)=true | eval start_time=timestamp, end_time=timestamp,
entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
"dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "process",
process, "process_name", process_name, "parent_process_name", parent_process_name,
"process_path", process_path]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
The command-line arguments are mapped to the "process" field in the Endpoint data
model.
known_false_positives: Legitimate process can have this combination of command-line
options, but it's not common.
references:
- https://regexr.com/663rr
- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1
- https://ss64.com/ps/powershell.html
- https://twitter.com/M_haggis/status/1440758396534214658?s=20
- https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/
tags:
analytic_story:
- Malicious PowerShell
- Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
- HAFNIUM Group
- Log4Shell CVE-2021-44228
asset_type: Endpoint
atomic_guid: []
confidence: 70
drilldown_search: []
impact: 50
message: PowerShell processes $process$ started with parameters to modify the execution
policy of the run, run in a hidden window, and connect to the Internet on host
$dest$ executed by user $user$.
mitre_attack_id:
- T1020
product:
- Splunk Behavioral Analytics
risk_score: 35
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/hidden_powershell/hidden_windows-security.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml
+60
View File
@@ -0,0 +1,60 @@
name: Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser
id: d57b4d91-fc91-4482-a325-47693cced1eb
version: 1
date: '2022-11-14'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
to identify the execution of the `Get-ADUser` commandlet with specific parameters.
`Get-ADUser` is part of the Active Directory PowerShell module used to manage Windows
Active Directory networks. As the name suggests, `Get-ADUser` is used to query for
domain users. With the appropiate parameters, Get-ADUser allows adversaries to discover
domain accounts with Kerberos Pre Authentication disabled.\ Red Teams and adversaries
alike use may abuse Get-ADUSer to enumerate these accounts and attempt to crack
their passwords offline.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL | where (like (cmd_line, "%get-aduser%")
AND like (cmd_line, "%4194304%")) | eval start_time=timestamp, end_time=timestamp,
entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
"dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
"process_path", process_path]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: Administrators or power users may use search for accounts with
Kerberos Pre Authentication disabled for legitimate purposes.
references:
- https://attack.mitre.org/techniques/T1558/004/
- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
tags:
analytic_story:
- Active Directory Kerberos Attacks
asset_type: Endpoint
atomic_guid: []
confidence: 90
drilldown_search: []
impact: 60
message: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser from $dest_device_id$
mitre_attack_id:
- T1558
- T1558.004
product:
- Splunk Behavioral Analytics
risk_score: 54
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/windows-powershell.log
source: WinEventLog
sourcetype: WinEventLog
update_timestamp: true
ba_detections/endpoint/ssa_windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml
+59
View File
@@ -0,0 +1,59 @@
name: Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView
id: dc3f2af7-ca69-47ce-a122-9f9787e19417
version: 1
date: '2022-11-14'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
to identify the execution of the `Get-DomainUser` commandlet with specific parameters.
`Get-DomainUser` is part of PowerView, a PowerShell tool used to perform enumeration
on Windows Active Directory networks. As the name suggests, `Get-DomainUser` is
used to identify domain users and combining it with `-PreauthNotRequired` allows
adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\
Red Teams and adversaries alike use may leverage PowerView to enumerate these accounts
and attempt to crack their passwords offline.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL | where (like (cmd_line, "%get-domainuser%")
AND like (cmd_line, "%preauthnotrequired%")) | eval start_time=timestamp, end_time=timestamp,
entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
"dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
"process_path", process_path]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: Administrators or power users may use PowerView for troubleshooting
references:
- https://attack.mitre.org/techniques/T1558/004/
- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
tags:
analytic_story:
- Active Directory Kerberos Attacks
asset_type: endpoint
atomic_guid: []
confidence: 90
drilldown_search: []
impact: 60
message: Disabled Kerberos Pre-Authentication Discovery With PowerView from $dest_device_id$
mitre_attack_id:
- T1558
- T1558.004
product:
- Splunk Behavioral Analytics
risk_score: 54
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdomainuser.log
source: XmlWinEventLog
sourcetype: XmlWinEventLog
update_timestamp: true
ba_detections/endpoint/ssa_windows_powershell_downloadfile.yml
+63
View File
@@ -0,0 +1,63 @@
name: Windows Powershell DownloadFile
id: 46440222-81d5-44b1-a376-19dcd70d1b08
version: 1
date: '2022-02-11'
author: Jose Hernandez, Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic identifies the use of PowerShell downloading a
file using `DownloadFile` method. This particular method is utilized in many different
PowerShell frameworks to download files and output to disk. Identify the source
(IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell
transaction logs are available, review for further details of the implant.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe"
OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe"
OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like
(cmd_line, "%downloadfile%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: False positives may be present and filtering will need to occur
by parent process or command line argument. It may be required to modify this query
to an EDR product for more granular coverage.
references:
- https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0
- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md
tags:
analytic_story:
- Malicious PowerShell
- Ingress Tool Transfer
- Log4Shell CVE-2021-44228
asset_type: Endpoint
atomic_guid: []
confidence: 70
drilldown_search: []
impact: 50
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile
within PowerShell.
mitre_attack_id:
- T1020
product:
- Splunk Behavioral Analytics
risk_score: 35
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/downloadfile_windows-security.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_windows_powershell_start_bitstransfer.yml
+61
View File
@@ -0,0 +1,61 @@
name: Windows PowerShell Start-BitsTransfer
id: 0bafd086-8f61-11ec-996e-acde48001122
version: 1
date: '2022-02-16'
author: Michael Haag, Splunk
status: production
type: TTP
description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar
functionality is present. This technique variation is not as commonly used by adversaries,
but has been abused in the past. Lesser known uses include the ability to set the
`-TransferType` to `Upload` for exfiltration of files. In an instance where `Upload`
is used, it is highly possible files will be archived. During triage, review parallel
processes and process lineage. Capture any files on disk and review. For the remote
domain or IP, what is the reputation?
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe"
OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe"
OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like
(cmd_line, "%start-bitstransfer%")) | eval start_time=timestamp, end_time=timestamp,
entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
"dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
"process_path", process_path]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
known_false_positives: Limited false positives. It is possible administrators will
utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent
process or command-line arguments.
references:
- https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281
- https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs
tags:
analytic_story:
- BITS Jobs
- Living Off The Land
asset_type: Endpoint
atomic_guid: []
confidence: 70
drilldown_search: []
impact: 70
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $dest_user_id$ attempting to download a file.
mitre_attack_id:
- T1197
- T1105
product:
- Splunk Behavioral Analytics
risk_score: 49
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/T1197_windows-security.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_windows_rasautou_dll_execution.yml
+61
View File
@@ -0,0 +1,61 @@
name: Windows Rasautou DLL Execution
id: 6f42b8ce-1e15-11ec-ad5a-acde48001122
version: 1
date: '2022-02-15'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies the Windows Windows Remote Auto Dialer,
rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary
shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review
parent and child process behavior including file and image loads.
data_source: []
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="rasautou.exe"
AND (like (cmd_line, "%-d %") AND like (cmd_line, "%-p %")) | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
| eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: False positives will be limited to applications that require
Rasautou.exe to load a DLL from disk. Filter as needed.
references:
- https://github.com/mandiant/DueDLLigence
- https://github.com/MHaggis/notes/blob/master/utilities/Invoke-SPLDLLigence.ps1
- https://gist.github.com/NickTyrer/c6043e4b302d5424f701f15baf136513
- https://www.mandiant.com/resources/staying-hidden-on-the-endpoint-evading-detection-with-shellcode
tags:
analytic_story:
- Windows Defense Evasion Tactics
- Living Off The Land
asset_type: Endpoint
atomic_guid: []
confidence: 100
drilldown_search: []
impact: 80
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ attempting to load a DLL in a suspicious manner.
mitre_attack_id:
- T1055.001
- T1218
- T1055
product:
- Splunk Behavioral Analytics
risk_score: 80
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-security.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml
+56
View File
@@ -0,0 +1,56 @@
name: Windows Rename System Utilities Acccheckconsole exe LOLBAS in Non Standard Path
id: c842931e-661f-42bc-a4df-0460d93cfb69
version: 1
date: '2022-10-18'
author: Splunk Threat Research Bot, Splunk
status: production
type: Anomaly
description: The following analytic identifies AccCheckConsole.exe which is a native
living off the land binary or script (LOLBAS) within the Windows operating system
that may be abused by adversaries by moving it to a new directory. The list of binaries
was derived from the https://lolbas-project.github.io site.
data_source: []
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
process_name IS NOT NULL AND process_name="acccheckconsole.exe"| where process_path
IS NOT NULL AND match_regex(process_path, /(?i)\\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker/)=false
| eval start_time=timestamp,end_time=timestamp, entities=mvappend(device, user),
body=create_map(["event_id", event_id, "process_path", process_path, "process_name",
process_name]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you must be ingesting logs
with the process name, command-line arguments, and parent processes from your endpoints.
Collect endpoint data such as Sysmon or Windows Events 4688.
known_false_positives: False positives may be present and filtering may be required.
Certain utilities will run from non-standard paths based on the third-party application
in use.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
- https://attack.mitre.org/techniques/T1036/003/
- https://lolbas-project.github.io/
tags:
analytic_story:
- Unusual Processes
- Living Off The Land
asset_type: Endpoint
atomic_guid: []
confidence: 70
drilldown_search: []
impact: 20
message: A system process $process_name$ with path $process_path$ spawn in non-default
folder path on host $dest_device_id$
mitre_attack_id:
- T1036
- T1036.003
product:
- Splunk Behavioral Analytics
risk_score: 14
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml
+56
View File
@@ -0,0 +1,56 @@
name: Windows Rename System Utilities Adplus exe LOLBAS in Non Standard Path
id: ecaaf956-c516-4980-b08e-8c01c19614ca
version: 1
date: '2022-10-18'
author: Splunk Threat Research Bot, Splunk
status: production
type: Anomaly
description: The following analytic identifies adplus.exe which is a native living
off the land binary or script (LOLBAS) within the Windows operating system that
may be abused by adversaries by moving it to a new directory. The list of binaries
was derived from the https://lolbas-project.github.io site.
data_source: []
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
process_name IS NOT NULL AND process_name="adplus.exe"| where process_path IS NOT
NULL AND match_regex(process_path, /(?i)\\program files (x86)\\windows kits\\10\\debuggers\\x86/)=false
| eval start_time=timestamp,end_time=timestamp, entities=mvappend(device, user),
body=create_map(["event_id", event_id, "process_path", process_path, "process_name",
process_name]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you must be ingesting logs
with the process name, command-line arguments, and parent processes from your endpoints.
Collect endpoint data such as Sysmon or Windows Events 4688.
known_false_positives: False positives may be present and filtering may be required.
Certain utilities will run from non-standard paths based on the third-party application
in use.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
- https://attack.mitre.org/techniques/T1036/003/
- https://lolbas-project.github.io/
tags:
analytic_story:
- Unusual Processes
- Living Off The Land
asset_type: Endpoint
atomic_guid: []
confidence: 70
drilldown_search: []
impact: 20
message: A system process $process_name$ with path $process_path$ spawn in non-default
folder path on host $dest_device_id$
mitre_attack_id:
- T1036
- T1036.003
product:
- Splunk Behavioral Analytics
risk_score: 14
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml
+55
View File
@@ -0,0 +1,55 @@
name: Windows Rename System Utilities Advpack dll LOLBAS in Non Standard Path
id: 3284e4f4-67f7-49b6-ad5e-a8fcead2eef8
version: 1
date: '2022-10-18'
author: Splunk Threat Research Bot, Splunk
status: production
type: Anomaly
description: The following analytic identifies Advpack.dll which is a native living
off the land binary or script (LOLBAS) within the Windows operating system that
may be abused by adversaries by moving it to a new directory. The list of binaries
was derived from the https://lolbas-project.github.io site.
data_source: []
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
process_name IS NOT NULL AND process_name="advpack.dll"| where process_path IS NOT
NULL AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,end_time=timestamp,
entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path",
process_path, "process_name", process_name]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you must be ingesting logs
with the process name, command-line arguments, and parent processes from your endpoints.
Collect endpoint data such as Sysmon or Windows Events 4688.
known_false_positives: False positives may be present and filtering may be required.
Certain utilities will run from non-standard paths based on the third-party application
in use.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
- https://attack.mitre.org/techniques/T1036/003/
- https://lolbas-project.github.io/
tags:
analytic_story:
- Unusual Processes
- Living Off The Land
asset_type: Endpoint
atomic_guid: []
confidence: 70
drilldown_search: []
impact: 20
message: A system process $process_name$ with path $process_path$ spawn in non-default
folder path on host $dest_device_id$
mitre_attack_id:
- T1036
- T1036.003
product:
- Splunk Behavioral Analytics
risk_score: 14
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml
+55
View File
@@ -0,0 +1,55 @@
name: Windows Rename System Utilities Agentexecutor exe LOLBAS in Non Standard Path
id: e124f71f-11bc-47e4-9931-6046d256005d
version: 1
date: '2022-10-18'
author: Splunk Threat Research Bot, Splunk
status: production
type: Anomaly
description: The following analytic identifies AgentExecutor.exe which is a native
living off the land binary or script (LOLBAS) within the Windows operating system
that may be abused by adversaries by moving it to a new directory. The list of binaries
was derived from the https://lolbas-project.github.io site.
data_source: []
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
process_name IS NOT NULL AND process_name="agentexecutor.exe"| where process_path
IS NOT NULL AND match_regex(process_path, /(?i)\\program files (x86)/)=false | eval
start_time=timestamp,end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id",
event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you must be ingesting logs
with the process name, command-line arguments, and parent processes from your endpoints.
Collect endpoint data such as Sysmon or Windows Events 4688.
known_false_positives: False positives may be present and filtering may be required.
Certain utilities will run from non-standard paths based on the third-party application
in use.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
- https://attack.mitre.org/techniques/T1036/003/
- https://lolbas-project.github.io/
tags:
analytic_story:
- Unusual Processes
- Living Off The Land
asset_type: Endpoint
atomic_guid: []
confidence: 70
drilldown_search: []
impact: 20
message: A system process $process_name$ with path $process_path$ spawn in non-default
folder path on host $dest_device_id$
mitre_attack_id:
- T1036
- T1036.003
product:
- Splunk Behavioral Analytics
risk_score: 14
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml
+56
View File
@@ -0,0 +1,56 @@
name: Windows Rename System Utilities Appinstaller exe LOLBAS in Non Standard Path
id: 057c06c7-ef31-4749-b5c9-199152e53a06
version: 1
date: '2022-10-18'
author: Splunk Threat Research Bot, Splunk
status: production
type: Anomaly
description: The following analytic identifies AppInstaller.exe which is a native
living off the land binary or script (LOLBAS) within the Windows operating system
that may be abused by adversaries by moving it to a new directory. The list of binaries
was derived from the https://lolbas-project.github.io site.
data_source: []
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
process_name IS NOT NULL AND process_name="appinstaller.exe"| where process_path
IS NOT NULL AND match_regex(process_path, /(?i)\\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe/)=false
| eval start_time=timestamp,end_time=timestamp, entities=mvappend(device, user),
body=create_map(["event_id", event_id, "process_path", process_path, "process_name",
process_name]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you must be ingesting logs
with the process name, command-line arguments, and parent processes from your endpoints.
Collect endpoint data such as Sysmon or Windows Events 4688.
known_false_positives: False positives may be present and filtering may be required.
Certain utilities will run from non-standard paths based on the third-party application
in use.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
- https://attack.mitre.org/techniques/T1036/003/
- https://lolbas-project.github.io/
tags:
analytic_story:
- Unusual Processes
- Living Off The Land
asset_type: Endpoint
atomic_guid: []
confidence: 70
drilldown_search: []
impact: 20
message: A system process $process_name$ with path $process_path$ spawn in non-default
folder path on host $dest_device_id$
mitre_attack_id:
- T1036
- T1036.003
product:
- Splunk Behavioral Analytics
risk_score: 14
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml
+56
View File
@@ -0,0 +1,56 @@
name: Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard Path
id: 93862a89-abe0-4094-909a-08ec390aa5e3
version: 1
date: '2022-10-18'
author: Splunk Threat Research Bot, Splunk
status: production
type: Anomaly
description: The following analytic identifies Appvlp.exe which is a native living
off the land binary or script (LOLBAS) within the Windows operating system that
may be abused by adversaries by moving it to a new directory. The list of binaries
was derived from the https://lolbas-project.github.io site.
data_source: []
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
process_name IS NOT NULL AND process_name="appvlp.exe"| where process_path IS NOT
NULL AND match_regex(process_path, /(?i)\\program files (x86)\\microsoft office\\root\\client/)=false
| eval start_time=timestamp,end_time=timestamp, entities=mvappend(device, user),
body=create_map(["event_id", event_id, "process_path", process_path, "process_name",
process_name]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you must be ingesting logs
with the process name, command-line arguments, and parent processes from your endpoints.
Collect endpoint data such as Sysmon or Windows Events 4688.
known_false_positives: False positives may be present and filtering may be required.
Certain utilities will run from non-standard paths based on the third-party application
in use.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
- https://attack.mitre.org/techniques/T1036/003/
- https://lolbas-project.github.io/
tags:
analytic_story:
- Unusual Processes
- Living Off The Land
asset_type: Endpoint
atomic_guid: []
confidence: 70
drilldown_search: []
impact: 20
message: A system process $process_name$ with path $process_path$ spawn in non-default
folder path on host $dest_device_id$
mitre_attack_id:
- T1036
- T1036.003
product:
- Splunk Behavioral Analytics
risk_score: 14
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml
+56
View File
@@ -0,0 +1,56 @@
name: Windows Rename System Utilities Aspnet compiler exe LOLBAS in Non Standard Path
id: d75cc561-3828-4d0a-92c4-0eb93bfe0929
version: 1
date: '2022-10-18'
author: Splunk Threat Research Bot, Splunk
status: production
type: Anomaly
description: The following analytic identifies Aspnet_Compiler.exe which is a native
living off the land binary or script (LOLBAS) within the Windows operating system
that may be abused by adversaries by moving it to a new directory. The list of binaries
was derived from the https://lolbas-project.github.io site.
data_source: []
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
process_name IS NOT NULL AND process_name="aspnet_compiler.exe"| where process_path
IS NOT NULL AND match_regex(process_path, /(?i)\\windows\\microsoft.net\\framework64\\v4.0.30319/)=false
| eval start_time=timestamp,end_time=timestamp, entities=mvappend(device, user),
body=create_map(["event_id", event_id, "process_path", process_path, "process_name",
process_name]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you must be ingesting logs
with the process name, command-line arguments, and parent processes from your endpoints.
Collect endpoint data such as Sysmon or Windows Events 4688.
known_false_positives: False positives may be present and filtering may be required.
Certain utilities will run from non-standard paths based on the third-party application
in use.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
- https://attack.mitre.org/techniques/T1036/003/
- https://lolbas-project.github.io/
tags:
analytic_story:
- Unusual Processes
- Living Off The Land
asset_type: Endpoint
atomic_guid: []
confidence: 70
drilldown_search: []
impact: 20
message: A system process $process_name$ with path $process_path$ spawn in non-default
folder path on host $dest_device_id$
mitre_attack_id:
- T1036
- T1036.003
product:
- Splunk Behavioral Analytics
risk_score: 14
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml
+55
View File
@@ -0,0 +1,55 @@
name: Windows Rename System Utilities At exe LOLBAS in Non Standard Path
id: 6401d583-0052-4dc5-a713-68b510826d2b
version: 1
date: '2022-10-18'
author: Splunk Threat Research Bot, Splunk
status: production
type: Anomaly
description: The following analytic identifies At.exe which is a native living off
the land binary or script (LOLBAS) within the Windows operating system that may
be abused by adversaries by moving it to a new directory. The list of binaries was
derived from the https://lolbas-project.github.io site.
data_source: []
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
process_name IS NOT NULL AND process_name="at.exe"| where process_path IS NOT NULL
AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,end_time=timestamp,
entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path",
process_path, "process_name", process_name]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you must be ingesting logs
with the process name, command-line arguments, and parent processes from your endpoints.
Collect endpoint data such as Sysmon or Windows Events 4688.
known_false_positives: False positives may be present and filtering may be required.
Certain utilities will run from non-standard paths based on the third-party application
in use.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
- https://attack.mitre.org/techniques/T1036/003/
- https://lolbas-project.github.io/
tags:
analytic_story:
- Unusual Processes
- Living Off The Land
asset_type: Endpoint
atomic_guid: []
confidence: 70
drilldown_search: []
impact: 20
message: A system process $process_name$ with path $process_path$ spawn in non-default
folder path on host $dest_device_id$
mitre_attack_id:
- T1036
- T1036.003
product:
- Splunk Behavioral Analytics
risk_score: 14
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml
+55
View File
@@ -0,0 +1,55 @@
name: Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard Path
id: b8da7ea5-8c16-4eff-9787-54ec271159e0
version: 1
date: '2022-10-18'
author: Splunk Threat Research Bot, Splunk
status: production
type: Anomaly
description: The following analytic identifies Atbroker.exe which is a native living
off the land binary or script (LOLBAS) within the Windows operating system that
may be abused by adversaries by moving it to a new directory. The list of binaries
was derived from the https://lolbas-project.github.io site.
data_source: []
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
process_name IS NOT NULL AND process_name="atbroker.exe"| where process_path IS
NOT NULL AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,end_time=timestamp,
entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path",
process_path, "process_name", process_name]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you must be ingesting logs
with the process name, command-line arguments, and parent processes from your endpoints.
Collect endpoint data such as Sysmon or Windows Events 4688.
known_false_positives: False positives may be present and filtering may be required.
Certain utilities will run from non-standard paths based on the third-party application
in use.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
- https://attack.mitre.org/techniques/T1036/003/
- https://lolbas-project.github.io/
tags:
analytic_story:
- Unusual Processes
- Living Off The Land
asset_type: Endpoint
atomic_guid: []
confidence: 70
drilldown_search: []
impact: 20
message: A system process $process_name$ with path $process_path$ spawn in non-default
folder path on host $dest_device_id$
mitre_attack_id:
- T1036
- T1036.003
product:
- Splunk Behavioral Analytics
risk_score: 14
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_windows_rundll32_comsvcs_memory_dump.yml
+52
View File
@@ -0,0 +1,52 @@
name: Windows Rundll32 Comsvcs Memory Dump
id: 76bb9e35-f314-4c3d-a385-83c72a13ce4e
version: 5
date: '2022-04-14'
author: Jose Hernandez, Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies memory dumping using comsvcs.dll with
the minidump function with `rundll32.exe`. This technique is common with adversaries
who would like to dump the memory of lsass.exe.
data_source: []
search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_event,
"_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"),
"string", null), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where process IS NOT NULL AND process_name IS NOT
NULL AND process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)minidump\s+/)=true
AND match_regex(process, /(?i)comsvcs.dll\s+/)=true | eval start_time = timestamp,
end_time = timestamp, entities = mvappend(machine), body=create_map(["event_id",
event_id, "process_name", process_name, "process", process]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting endpoint data that tracks process activity,
including Windows command line logging. You can see how we test this with [Event
Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a)
on the [attack_range](https://github.com/splunk/attack_range/blob/develop/ansible/roles/windows_common/tasks/windows-enable-4688-cmd-line-audit.yml).
known_false_positives: False positives should be limited, filter as needed.
references:
- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-3---dump-lsassexe-memory-using-comsvcsdll
tags:
analytic_story:
- Credential Dumping
- Suspicious Rundll32 Activity
asset_type: Endpoint
atomic_guid: []
confidence: 100
drilldown_search: []
impact: 40
message: A dump of a process was attempted using comsvcs.dll with the minidump function
on endpoint $dest_device_id$ by user $dest_device_user$.
mitre_attack_id:
- T1003.003
- T1003
product:
- Splunk Behavioral Analytics
risk_score: 40
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-security.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_windows_rundll32_inline_hta_execution.yml
+62
View File
@@ -0,0 +1,62 @@
name: Windows Rundll32 Inline HTA Execution
id: 0caa1dd6-94f5-11ec-9786-acde48001122
version: 1
date: '2022-02-23'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies "rundll32.exe" execution with inline
protocol handlers. "JavaScript", "VBScript", and "About" are the only supported
options when invoking HTA content directly on the command-line. This type of behavior
is commonly observed with fileless malware or application whitelisting bypass techniques.
The search will return the first time and last time these command-line arguments
were used for these executions, as well as the target system, the user, process
"rundll32.exe" and its parent process.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="rundll32.exe"
AND (like (cmd_line, "%vbscript%") OR like (cmd_line, "%javascript%") OR like (cmd_line,
"%about%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Although unlikely, some legitimate applications may exhibit
this behavior, triggering a false positive.
references:
- https://github.com/redcanaryco/AtomicTestHarnesses
- https://redcanary.com/blog/introducing-atomictestharnesses/
- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
tags:
analytic_story:
- Suspicious MSHTA Activity
- NOBELIUM Group
- Living Off The Land
asset_type: Endpoint
atomic_guid: []
confidence: 80
drilldown_search: []
impact: 70
message: Suspicious $process_name$ inline HTA execution on $dest_device_id$.
mitre_attack_id:
- T1218
- T1218.005
product:
- Splunk Behavioral Analytics
risk_score: 56
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_windows_script_host_spawn_msbuild.yml
+60
View File
@@ -0,0 +1,60 @@
name: Windows Script Host Spawn MSBuild
id: 92886f1c-9b11-11ec-848a-acde48001122
version: 1
date: '2022-03-03'
author: Michael Haag, Splunk
status: production
type: TTP
description: This analytic is to detect a suspicious child process of MSBuild spawned
by Windows Script Host - cscript or wscript. This behavior or event are commonly
seen and used by malware or adversaries to execute malicious msbuild process using
malicious script in the compromised host. During triage, review parallel processes
and identify any file modifications. MSBuild may load a script from the same path
without having command-line arguments.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name IS NOT
NULL | where (parent_process_name LIKE "%wscript.exe" OR parent_process_name LIKE
"%cscript.exe%") AND process_name="msbuild.exe" | eval start_time=timestamp, end_time=timestamp,
entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
"dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
"process_path", process_path]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: False positives should be limited as developers do not spawn
MSBuild via a WSH.
references:
- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/#
- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1127.001_MSBuild/InvokeMSBuild.ps1
tags:
analytic_story:
- Trusted Developer Utilities Proxy Execution MSBuild
- Living Off The Land
asset_type: Endpoint
atomic_guid: []
confidence: 100
drilldown_search: []
impact: 80
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$.
mitre_attack_id:
- T1127.001
- T1127
product:
- Splunk Behavioral Analytics
risk_score: 80
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/msbuild-windows-security.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
+60
View File
@@ -0,0 +1,60 @@
name: Windows System Binary Proxy Execution Compiled HTML File Decompile
id: 11c32b19-05a6-48a8-ab28-18dbd9ec5d50
version: 1
date: '2022-09-02'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies the decompile parameter with the HTML
Help application, HH.exe. This is a uncommon command to see ran and behavior. Most
recently this was seen in a APT41 campaign where a CHM file was delivered and a
script inside used a technique for running an arbitrary command in a CHM file via
an ActiveX object. This unpacks an HTML help file to a specified path for launching
the next stage.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="hh.exe" AND
like (cmd_line, "%-decompile%")| eval start_time=timestamp, end_time=timestamp,
entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
"dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
"process_path", process_path]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: False positives should be limited, filter as needed.
references:
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
- https://redcanary.com/blog/introducing-atomictestharnesses/
- https://attack.mitre.org/techniques/T1218/001/
- https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa
tags:
analytic_story:
- Suspicious Compiled HTML Activity
- Living Off The Land
asset_type: Endpoint
atomic_guid: []
confidence: 90
drilldown_search: []
impact: 100
message: $process_name$ has been identified using decompile against a CHM on $dest_device_id$
under user $dest_user_id$.
mitre_attack_id:
- T1218.001
- T1218
product:
- Splunk Behavioral Analytics
risk_score: 90
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
source: XmlWinEventLog
update_timestamp: true
ba_detections/endpoint/ssa_windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml
+69
View File
@@ -0,0 +1,69 @@
name: Windows System Binary Proxy Execution Compiled HTML File URL In Command Line
id: 0fec631a-7c9b-4e4c-b28b-93260953e25f
version: 1
date: '2022-09-02'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled
HTML Help (CHM) file from a remote url. This particular technique will load Windows
script code from a compiled help file. CHM files may contain nearly any file type
embedded, but only execute html/htm. Upon a successful execution, the following
script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode,
JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe
upon execution. The "htm" and "html" file extensions were the only extensions observed
to be supported for the execution of Shortcut commands or WSH script code. During
investigation, identify script content origination. Review reputation of remote
IP and domain. Some instances, it is worth decompiling the .chm file to review its
original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="hh.exe" AND
(like (cmd_line, "%http://%") OR like (cmd_line, "%https://%"))| eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: Although unlikely, some legitimate applications may retrieve
a CHM remotely, filter as needed.
references:
- https://attack.mitre.org/techniques/T1218/001/
- https://www.kb.cert.org/vuls/id/851869
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md
- https://lolbas-project.github.io/lolbas/Binaries/Hh/
- https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7
- https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/
tags:
analytic_story:
- Suspicious Compiled HTML Activity
- Living Off The Land
asset_type: Endpoint
atomic_guid: []
confidence: 100
drilldown_search: []
impact: 90
message: An instance of $process_name$ was identified on endpoint $dest_device_id$
by user $dest_user_id$ contacting a remote destination.
mitre_attack_id:
- T1218.001
- T1218
product:
- Splunk Behavioral Analytics
risk_score: 90
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/chm-wineventlog-security.log
source: WinEventLog:Security
update_timestamp: true
ba_detections/endpoint/ssa_windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml
+72
View File
@@ -0,0 +1,72 @@
name: Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage
Handlers
id: ba0c2450-caea-4086-ac3a-a71e2659754b
version: 1
date: '2022-09-02'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled
HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique
will load Windows script code from a compiled help file, using InfoTech Storage
Handlers. itss.dll will load upon execution. Three InfoTech Storage handlers are
supported - ms-its, its, mk:@MSITStore. ITSS may be used to launch a specific html/htm
file from within a CHM file. CHM files may contain nearly any file type embedded.
Upon a successful execution, the following script engines may be used for execution
- JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may
identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm"
and "html" file extensions were the only extensions observed to be supported for
the execution of Shortcut commands or WSH script code. During investigation, identify
script content origination. hh.exe is natively found in C:\Windows\system32 and
C:\Windows\syswow64.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="hh.exe" AND
(like (cmd_line, "%its:%") OR like (cmd_line, "%mk:@MSITStore:%"))| eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: It is rare to see instances of InfoTech Storage Handlers being
used, but it does happen in some legitimate instances. Filter as needed.
references:
- https://attack.mitre.org/techniques/T1218/001/
- https://www.kb.cert.org/vuls/id/851869
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md
- https://lolbas-project.github.io/lolbas/Binaries/Hh/
- https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7
- https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/
tags:
analytic_story:
- Suspicious Compiled HTML Activity
- Living Off The Land
asset_type: Endpoint
atomic_guid: []
confidence: 90
drilldown_search: []
impact: 80
message: $process_name$ has been identified using Infotech Storage Handlers to load
a specific file within a CHM on $dest_device_id$ under user $dest_user_id$.
mitre_attack_id:
- T1218.001
- T1218
product:
- Splunk Behavioral Analytics
risk_score: 72
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/chm-wineventlog-security.log
source: WinEventLog:Security
update_timestamp: true
ba_detections/endpoint/ssa_windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml
+56
View File
@@ -0,0 +1,56 @@
name: Windows System Binary Proxy Execution MSIExec DLLRegisterServer
id: 8d1d5570-722c-49a3-996c-2e2cceef5163
version: 1
date: '2022-08-31'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies the usage of msiexec.exe using the
/y switch parameter, which grants the ability for msiexec to load DLLRegisterServer.
Upon triage, review parent process and capture any artifacts for further review.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msiexec.exe"
AND (like (cmd_line, "%/y %") OR like (cmd_line, "%-y %")) | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: This analytic will need to be tuned for your environment based
on legitimate usage of msiexec.exe. Filter as needed.
references:
- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
tags:
analytic_story:
- Windows System Binary Proxy Execution MSIExec
asset_type: Endpoint
atomic_guid: []
confidence: 50
drilldown_search: []
impact: 70
message: An instance of spawning $process_name$ was identified on endpoint $dest_device_id$
by user $dest_user_id$ attempting to register a file.
mitre_attack_id:
- T1218.007
product:
- Splunk Behavioral Analytics
risk_score: 35
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
source: XmlWinEventLog
sourcetype: XmlWinEventLog
update_timestamp: true
ba_detections/endpoint/ssa_windows_system_binary_proxy_execution_msiexec_remote_download.yml
+56
View File
@@ -0,0 +1,56 @@
name: Windows System Binary Proxy Execution MSIExec Remote Download
id: 92cbbf0f-9a6b-4e9d-8c35-cc9244a4e3d5
version: 1
date: '2022-08-31'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies msiexec.exe with http in the command-line.
This procedure will utilize msiexec.exe to download a remote file and load it. During
triage, review parallel processes and capture any artifacts on disk for review.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msiexec.exe"
AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%")) | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: False positives may be present, filter by destination or parent
process as needed.
references:
- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
tags:
analytic_story:
- Windows System Binary Proxy Execution MSIExec
asset_type: Endpoint
atomic_guid: []
confidence: 50
drilldown_search: []
impact: 70
message: An instance of spawning $process_name$ was identified on endpoint $dest_device_id$
by user $dest_user_id$ attempting to download a file.
mitre_attack_id:
- T1218.007
product:
- Splunk Behavioral Analytics
risk_score: 35
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
source: XmlWinEventLog
sourcetype: XmlWinEventLog
update_timestamp: true
ba_detections/endpoint/ssa_windows_system_binary_proxy_execution_msiexec_unregister_dll.yml
+56
View File
@@ -0,0 +1,56 @@
name: Windows System Binary Proxy Execution MSIExec Unregister DLL
id: df76a8d1-92e1-4ec9-b8f7-695b5838703e
version: 1
date: '2022-08-31'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies the usage of msiexec.exe using the
/z switch parameter, which grants the ability for msiexec to unload DLLRegisterServer.
Upon triage, review parent process and capture any artifacts for further review.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msiexec.exe"
AND (like (cmd_line, "%/z %") OR like (cmd_line, "%-z %")) | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: False positives may be present, filter by destination or parent
process as needed.
references:
- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
tags:
analytic_story:
- Windows System Binary Proxy Execution MSIExec
asset_type: Endpoint
atomic_guid: []
confidence: 50
drilldown_search: []
impact: 70
message: An instance of spawning $process_name$ was identified on endpoint $dest_device_id$
by user $dest_user_id$ attempting to unregister a DLL.
mitre_attack_id:
- T1218.007
product:
- Splunk Behavioral Analytics
risk_score: 35
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
source: XmlWinEventLog
sourcetype: XmlWinEventLog
update_timestamp: true
ba_detections/endpoint/ssa_windows_wmiprvse_spawn_msbuild.yml
+61
View File
@@ -0,0 +1,61 @@
name: Windows WMIPrvse Spawn MSBuild
id: 76b3b290-9b31-11ec-a934-acde48001122
version: 1
date: '2022-03-03'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies wmiprvse.exe spawning msbuild.exe.
This behavior is indicative of a COM object being utilized to spawn msbuild from
wmiprvse.exe. It is common for MSBuild.exe to be spawned from devenv.exe while using
Visual Studio. In this instance, there will be command line arguments and file paths.
In a malicious instance, MSBuild.exe will spawn from non-standard processes and
have no command line arguments. For example, MSBuild.exe spawning from explorer.exe,
powershell.exe is far less common and should be investigated.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=lower(ucast(map_get(input_event, "parent_process_name"),
"string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name
IS NOT NULL | where parent_process_name LIKE "%wmiprvse.exe%" AND process_name="msbuild.exe"
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Although unlikely, some legitimate applications may exhibit
this behavior, triggering a false positive.
references:
- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
tags:
analytic_story:
- Trusted Developer Utilities Proxy Execution MSBuild
- Living Off The Land
asset_type: Endpoint
atomic_guid: []
confidence: 100
drilldown_search: []
impact: 80
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$.
mitre_attack_id:
- T1127
- T1127.001
product:
- Splunk Behavioral Analytics
risk_score: 80
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/msbuild-windows-security.log
source: WinEventLog:Security
ba_detections/endpoint/ssa_windows_wsreset_uac_bypass.yml
+55
View File
@@ -0,0 +1,55 @@
name: Windows WSReset UAC Bypass
id: 3118f0c2-90d9-11ec-b833-acde48001122
version: 1
date: '2022-02-18'
author: Lou Stella, Splunk
status: experimental
type: Anomaly
description: This analytic is built to detect a suspicious modification of the Windows
registry related to UAC bypass. This technique is to modify the registry in this
detection, create a registry value with the path of the payload and run WSreset.exe
to bypass User Account Control.
data_source: []
search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)),
registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)),
registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string",
null)), registry_key_name=lower(ucast(map_get(input_event, "registry_key_name"),
"string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"),
"string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"),
"string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"),
"string", null)) | where registry_path IS NOT NULL AND registry_value_name IS NOT
NULL and like (registry_path, "%\\\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\\\Shell\\\\open\\\\command%")
AND (registry_value_name="(Default)" OR registry_value_name="DelegateExecute") |
eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)) | eval body=create_map(["registry_path", registry_path, "registry_hive",
registry_hive, "registry_value_name", registry_value_name, "registry_key_name",
registry_key_name, "registry_value_type", registry_value_type, "registry_value_data",
registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events(); '
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Registry` datamodel.
known_false_positives: Unknown at this point in time.
references:
- https://github.com/hfiref0x/UACME
- https://blog.morphisec.com/trickbot-uses-a-new-windows-10-uac-bypass
tags:
analytic_story:
- Living Off The Land
- Windows Defense Evasion Tactics
asset_type: Endpoint
atomic_guid: []
confidence: 90
drilldown_search: []
impact: 70
message: tbd
mitre_attack_id:
- T1548.002
- T1548
product:
- Splunk Behavioral Analytics
risk_score: 63
security_domain: endpoint
tests: []
ba_detections/network/ssa_tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml
+56
View File
@@ -0,0 +1,56 @@
name: TCP Command and Scripting Interpreter Outbound LDAP Traffic
id: 4d16a90c-d1a9-4d17-8156-d0db0c73c449
version: 1
date: '2022-02-17'
author: Jose Hernandez, Michael Haag, Splunk
status: experimental
type: Anomaly
description: Malicious actors often abuse misconfigured LDAP servers or applications
that use the LDAP servers in organizations. Outbound LDAP traffic should not be
allowed outbound through your perimeter firewall. This search will help determine
if you have any LDAP connections to IP addresses outside of private (RFC1918) address
space.
data_source: []
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), dest_port=map_get(input_event, "dest_port"), event_id=ucast(map_get(input_event,
"event_id"), "string", null), dest_ip=ucast(map_get(input_event, "dest_device_ips"),
"collection<string>", [])[0] | where dest_port=389 OR dest_port=1389 OR dest_port=636
| where NOT (cidrmatch(ip: dest_ip, cidr_range: "10.0.0.0/8") OR cidrmatch(ip: dest_ip,
cidr_range: "192.168.0.0/16") OR cidrmatch(ip: dest_ip, cidr_range: "172.16.0.0/12"))
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "dest_port", dest_port,
"dest_ip", dest_ip]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on network traffic, specifically data that populates the Network_Traffic datamodel.
To develop this analytic we used specifically Zeek/Bro conn.log and PAN Traffic
events.
known_false_positives: Unknown at this moment. Outbound LDAP traffic should not be
allowed outbound through your perimeter firewall. Please check those servers to
verify if the activity is legitimate.
references:
- https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/
- https://www.splunk.com/en_us/blog/security/simulating-detecting-and-responding-to-log4shell-with-splunk.html
- https://www.cisa.gov/uscert/ncas/alerts/aa21-356a
tags:
analytic_story:
- Log4Shell CVE-2021-44228
asset_type: endpoint
atomic_guid: []
confidence: 70
drilldown_search: []
impact: 50
message: An outbound LDAP connection from $src_ip$ in your infrastructure connecting
to dest ip $dest_ip$
mitre_attack_id:
- T1059
product:
- Splunk Behavioral Analytics
risk_score: 35
security_domain: network
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.log
source: pan:traffic
sourcetype: pan:traffic
ba_detections/network/ssa_unusual_volume_of_data_download_from_internal_server_per_entity.yml
+61
View File
@@ -0,0 +1,61 @@
name: Unusual Volume of Data Download from Internal Server Per Entity
id: cca028f4-77dd-11ec-bc09-acde48001122
version: 1
date: '2022-01-17'
author: Xiao Lin, Splunk
status: experimental
type: Anomaly
description: Insider might conduct information collection before data exfiltration,
and unusual volume of data download from internal server is an indicator of such
potential threat. This detection evaluates the total bytes downloaded from internal
servers at specific time window per entity level, and then flagged these that are
higher than 99.999% percentile as an anamaly. A behavior will be reported as long
as the downloaded byte volume is unusual even though that operation is benign, which
causes false positive. It is therefore advised to adjust threshold and time window
based on detection performance whenever necessary. It should be noted that seasonality
is not modeled in the current approach.
data_source: []
search: '| from read_ssa_enriched_events() | eval sourcetype = ucast(map_get(input_event,
"sourcetype"), "string", null) | eval timestamp = parse_long(ucast(map_get(input_event,
"_time"), "string", null)) | where sourcetype == "pan:traffic" | eval src_device_scope
=ucast(map_get(input_event, "src_device_scope"), "string", null) | eval dest_device_scope=ucast(map_get(input_event,
"dest_device_scope"), "string", null) | where src_device_scope IS NOT NULL AND dest_device_scope
IS NOT NULL | eval dest_device = ucast(map_get(input_event, "dest_device_ips"),
"collection<string>", [])[0] | where dest_device IS NOT NULL AND dest_device_scope
== "INTERNAL" | eval src_device = ucast(map_get(input_event, "src_device_ips"),
"collection<string>", [])[0] | where src_device IS NOT NULL AND src_device_scope
== "INTERNAL" | eval bytes_in = ucast(map_get(input_event, "bytes_in"), "integer",
0) | eval download_bytes = cast(bytes_in, "double") | eval tenant = ucast(map_get(input_event,
"_tenant"), "string", null) | eval event_id = ucast(map_get(input_event, "event_id"),
"string", null) | adaptive_threshold algorithm="quantile" value="download_bytes"
entity="dest_device" window=86400000L | where label AND quantile>0.99999 | eval
end_time = timestamp | eval start_time = end_time - 86400000 | eval body = create_map(["event_id",
event_id, "tenant", tenant]) | eval entities=mvappend(dest_device) | into write_ssa_detected_events();'
how_to_implement: Ingest PAN traffic logs
known_false_positives: Benign large volume data download might be flagged as (false)
positive.
references:
- https://github.com/twitter/AnomalyDetection
tags:
analytic_story:
- Insider Threat
asset_type: endpoint
atomic_guid: []
confidence: 50
drilldown_search: []
impact: 50
message: $src_device_ip downloaded unusually amount of data from internal server
within one day
mitre_attack_id:
- T1213
- T1039
product:
- Splunk Behavioral Analytics
risk_score: 25
security_domain: network
tests:
- name: True Positive Test
attack_data:
- data: https://github.com/splunk/attack_data/blob/master/datasets/suspicious_behaviour/unusual_data_download/unusual_volume_data_download.txt
source: PAN Traffic Log
sourcetype: pan:traffic