From 1f9615e785efaaac0273f29f5fc9e277ddfffc2c Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 19 Dec 2022 14:43:15 +0100 Subject: [PATCH] Converted ssa detections --- ...dential_extractionfgdump_and_cachedump.yml | 53 ++++ ...ash_observed_at_the_destination_device.yml | 68 +++++ ...observed_by_an_event_collecting_device.yml | 69 +++++ ...unusual_lolbas_in_short_period_of_time.yml | 71 +++++ .../ssa_unusually_long_command_line.yml | 50 ++++ ...anomalous_usage_of_account_credentials.yml | 44 +++ .../ssa_anomalous_usage_of_archive_tools.yml | 56 ++++ .../ssa_attempt_to_delete_services.yml | 58 ++++ .../ssa_attempt_to_disable_services.yml | 58 ++++ ...dential_dump_from_registry_via_reg_exe.yml | 55 ++++ ..._bcdedit_failure_recovery_modification.yml | 56 ++++ ...ar_unallocated_sector_using_cipher_app.yml | 55 ++++ .../endpoint/ssa_delete_a_net_user.yml | 59 ++++ ...sa_deny_permission_using_cacls_utility.yml | 54 ++++ .../endpoint/ssa_detect_kerberoasting.yml | 50 ++++ ...ohibited_applications_spawning_cmd_exe.yml | 61 +++++ .../ssa_detect_rclone_command_line_usage.yml | 67 +++++ ...sa_disable_defender_antivirus_registry.yml | 54 ++++ .../endpoint/ssa_disable_net_user_account.yml | 57 ++++ ...sa_dns_exfiltration_using_nslookup_app.yml | 63 +++++ ...xcessive_number_of_office_files_copied.yml | 42 +++ ..._first_time_seen_command_line_argument.yml | 59 ++++ .../endpoint/ssa_fsutil_zeroing_file.yml | 57 ++++ ...a_grant_permission_using_cacls_utility.yml | 54 ++++ ..._files_and_directories_with_attrib_exe.yml | 58 ++++ .../ssa_high_file_deletion_frequency.yml | 50 ++++ ...fy_acls_permission_of_files_or_folders.yml | 57 ++++ ...e_product_spawning_windows_script_host.yml | 58 ++++ ...rare_parent_child_process_relationship.yml | 78 ++++++ .../ssa_resize_shadowstorage_volume.yml | 57 ++++ .../ssa_sdelete_application_execution.yml | 69 +++++ ...ocess_running_from_unexpected_location.yml | 256 ++++++++++++++++++ ...d_messaging_service_spawning_a_process.yml | 60 ++++ .../ssa_wbadmin_delete_system_backups.yml | 56 ++++ .../ssa_wevtutil_usage_to_clear_logs.yml | 61 +++++ .../ssa_wevtutil_usage_to_disable_logs.yml | 57 ++++ .../ssa_windows_bits_job_persistence.yml | 65 +++++ .../ssa_windows_bitsadmin_download_file.yml | 69 +++++ .../ssa_windows_certutil_decode_file.yml | 64 +++++ ...ssa_windows_certutil_urlcache_download.yml | 60 ++++ ...sa_windows_certutil_verifyctl_download.yml | 61 +++++ ..._hijacking_inprocserver32_modification.yml | 61 +++++ ...dows_curl_upload_to_remote_destination.yml | 74 +++++ ...ws_defender_tools_in_non_standard_path.yml | 52 ++++ ...ssa_windows_diskshadow_proxy_execution.yml | 55 ++++ ...ows_dotnet_binary_in_non_standard_path.yml | 83 ++++++ .../ssa_windows_eventvwr_uac_bypass.yml | 63 +++++ ...ndows_exchange_powershell_module_usage.yml | 82 ++++++ ...s_execute_arbitrary_commands_with_msdt.yml | 65 +++++ ...s_ingress_tool_transfer_using_explorer.yml | 61 +++++ ...ows_lolbin_binary_in_non_standard_path.yml | 92 +++++++ .../ssa_windows_mshta_child_process.yml | 61 +++++ .../ssa_windows_mshta_command_line_url.yml | 63 +++++ ...ssa_windows_mshta_inline_hta_execution.yml | 61 +++++ ...sa_windows_odbcconf_load_response_file.yml | 59 ++++ ...tial_dumping_with_ntdsutil_export_ntds.yml | 69 +++++ ...ws_os_credential_dumping_with_procdump.yml | 65 +++++ ...connect_to_internet_with_hidden_window.yml | 69 +++++ ...re_authentication_discovery_get_aduser.yml | 60 ++++ ...uthentication_discovery_with_powerview.yml | 59 ++++ .../ssa_windows_powershell_downloadfile.yml | 63 +++++ ..._windows_powershell_start_bitstransfer.yml | 61 +++++ .../ssa_windows_rasautou_dll_execution.yml | 61 +++++ ...onsole_exe_lolbas_in_non_standard_path.yml | 56 ++++ ...adplus_exe_lolbas_in_non_standard_path.yml | 56 ++++ ...dvpack_dll_lolbas_in_non_standard_path.yml | 55 ++++ ...ecutor_exe_lolbas_in_non_standard_path.yml | 55 ++++ ...taller_exe_lolbas_in_non_standard_path.yml | 56 ++++ ...appvlp_exe_lolbas_in_non_standard_path.yml | 56 ++++ ...mpiler_exe_lolbas_in_non_standard_path.yml | 56 ++++ ...ies_at_exe_lolbas_in_non_standard_path.yml | 55 ++++ ...broker_exe_lolbas_in_non_standard_path.yml | 55 ++++ ...a_windows_rundll32_comsvcs_memory_dump.yml | 52 ++++ ..._windows_rundll32_inline_hta_execution.yml | 62 +++++ .../ssa_windows_script_host_spawn_msbuild.yml | 60 ++++ ...execution_compiled_html_file_decompile.yml | 60 ++++ ...compiled_html_file_url_in_command_line.yml | 69 +++++ ...l_file_using_infotech_storage_handlers.yml | 72 +++++ ...xy_execution_msiexec_dllregisterserver.yml | 56 ++++ ...roxy_execution_msiexec_remote_download.yml | 56 ++++ ...proxy_execution_msiexec_unregister_dll.yml | 56 ++++ .../ssa_windows_wmiprvse_spawn_msbuild.yml | 61 +++++ .../ssa_windows_wsreset_uac_bypass.yml | 55 ++++ ...ting_interpreter_outbound_ldap_traffic.yml | 56 ++++ ...wnload_from_internal_server_per_entity.yml | 61 +++++ 85 files changed, 5321 insertions(+) create mode 100644 ba_detections/deprecated/ssa_credential_extractionfgdump_and_cachedump.yml create mode 100644 ba_detections/deprecated/ssa_potential_pass_the_token_or_hash_observed_at_the_destination_device.yml create mode 100644 ba_detections/deprecated/ssa_potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml create mode 100644 ba_detections/deprecated/ssa_unusual_lolbas_in_short_period_of_time.yml create mode 100644 ba_detections/deprecated/ssa_unusually_long_command_line.yml create mode 100644 ba_detections/endpoint/ssa_anomalous_usage_of_account_credentials.yml create mode 100644 ba_detections/endpoint/ssa_anomalous_usage_of_archive_tools.yml create mode 100644 ba_detections/endpoint/ssa_attempt_to_delete_services.yml create mode 100644 ba_detections/endpoint/ssa_attempt_to_disable_services.yml create mode 100644 ba_detections/endpoint/ssa_attempted_credential_dump_from_registry_via_reg_exe.yml create mode 100644 ba_detections/endpoint/ssa_bcdedit_failure_recovery_modification.yml create mode 100644 ba_detections/endpoint/ssa_clear_unallocated_sector_using_cipher_app.yml create mode 100644 ba_detections/endpoint/ssa_delete_a_net_user.yml create mode 100644 ba_detections/endpoint/ssa_deny_permission_using_cacls_utility.yml create mode 100644 ba_detections/endpoint/ssa_detect_kerberoasting.yml create mode 100644 ba_detections/endpoint/ssa_detect_prohibited_applications_spawning_cmd_exe.yml create mode 100644 ba_detections/endpoint/ssa_detect_rclone_command_line_usage.yml create mode 100644 ba_detections/endpoint/ssa_disable_defender_antivirus_registry.yml create mode 100644 ba_detections/endpoint/ssa_disable_net_user_account.yml create mode 100644 ba_detections/endpoint/ssa_dns_exfiltration_using_nslookup_app.yml create mode 100644 ba_detections/endpoint/ssa_excessive_number_of_office_files_copied.yml create mode 100644 ba_detections/endpoint/ssa_first_time_seen_command_line_argument.yml create mode 100644 ba_detections/endpoint/ssa_fsutil_zeroing_file.yml create mode 100644 ba_detections/endpoint/ssa_grant_permission_using_cacls_utility.yml create mode 100644 ba_detections/endpoint/ssa_hiding_files_and_directories_with_attrib_exe.yml create mode 100644 ba_detections/endpoint/ssa_high_file_deletion_frequency.yml create mode 100644 ba_detections/endpoint/ssa_modify_acls_permission_of_files_or_folders.yml create mode 100644 ba_detections/endpoint/ssa_office_product_spawning_windows_script_host.yml create mode 100644 ba_detections/endpoint/ssa_rare_parent_child_process_relationship.yml create mode 100644 ba_detections/endpoint/ssa_resize_shadowstorage_volume.yml create mode 100644 ba_detections/endpoint/ssa_sdelete_application_execution.yml create mode 100644 ba_detections/endpoint/ssa_system_process_running_from_unexpected_location.yml create mode 100644 ba_detections/endpoint/ssa_unified_messaging_service_spawning_a_process.yml create mode 100644 ba_detections/endpoint/ssa_wbadmin_delete_system_backups.yml create mode 100644 ba_detections/endpoint/ssa_wevtutil_usage_to_clear_logs.yml create mode 100644 ba_detections/endpoint/ssa_wevtutil_usage_to_disable_logs.yml create mode 100644 ba_detections/endpoint/ssa_windows_bits_job_persistence.yml create mode 100644 ba_detections/endpoint/ssa_windows_bitsadmin_download_file.yml create mode 100644 ba_detections/endpoint/ssa_windows_certutil_decode_file.yml create mode 100644 ba_detections/endpoint/ssa_windows_certutil_urlcache_download.yml create mode 100644 ba_detections/endpoint/ssa_windows_certutil_verifyctl_download.yml create mode 100644 ba_detections/endpoint/ssa_windows_com_hijacking_inprocserver32_modification.yml create mode 100644 ba_detections/endpoint/ssa_windows_curl_upload_to_remote_destination.yml create mode 100644 ba_detections/endpoint/ssa_windows_defender_tools_in_non_standard_path.yml create mode 100644 ba_detections/endpoint/ssa_windows_diskshadow_proxy_execution.yml create mode 100644 ba_detections/endpoint/ssa_windows_dotnet_binary_in_non_standard_path.yml create mode 100644 ba_detections/endpoint/ssa_windows_eventvwr_uac_bypass.yml create mode 100644 ba_detections/endpoint/ssa_windows_exchange_powershell_module_usage.yml create mode 100644 ba_detections/endpoint/ssa_windows_execute_arbitrary_commands_with_msdt.yml create mode 100644 ba_detections/endpoint/ssa_windows_ingress_tool_transfer_using_explorer.yml create mode 100644 ba_detections/endpoint/ssa_windows_lolbin_binary_in_non_standard_path.yml create mode 100644 ba_detections/endpoint/ssa_windows_mshta_child_process.yml create mode 100644 ba_detections/endpoint/ssa_windows_mshta_command_line_url.yml create mode 100644 ba_detections/endpoint/ssa_windows_mshta_inline_hta_execution.yml create mode 100644 ba_detections/endpoint/ssa_windows_odbcconf_load_response_file.yml create mode 100644 ba_detections/endpoint/ssa_windows_os_credential_dumping_with_ntdsutil_export_ntds.yml create mode 100644 ba_detections/endpoint/ssa_windows_os_credential_dumping_with_procdump.yml create mode 100644 ba_detections/endpoint/ssa_windows_powershell_connect_to_internet_with_hidden_window.yml create mode 100644 ba_detections/endpoint/ssa_windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml create mode 100644 ba_detections/endpoint/ssa_windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml create mode 100644 ba_detections/endpoint/ssa_windows_powershell_downloadfile.yml create mode 100644 ba_detections/endpoint/ssa_windows_powershell_start_bitstransfer.yml create mode 100644 ba_detections/endpoint/ssa_windows_rasautou_dll_execution.yml create mode 100644 ba_detections/endpoint/ssa_windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml create mode 100644 ba_detections/endpoint/ssa_windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml create mode 100644 ba_detections/endpoint/ssa_windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml create mode 100644 ba_detections/endpoint/ssa_windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml create mode 100644 ba_detections/endpoint/ssa_windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml create mode 100644 ba_detections/endpoint/ssa_windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml create mode 100644 ba_detections/endpoint/ssa_windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml create mode 100644 ba_detections/endpoint/ssa_windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml create mode 100644 ba_detections/endpoint/ssa_windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml create mode 100644 ba_detections/endpoint/ssa_windows_rundll32_comsvcs_memory_dump.yml create mode 100644 ba_detections/endpoint/ssa_windows_rundll32_inline_hta_execution.yml create mode 100644 ba_detections/endpoint/ssa_windows_script_host_spawn_msbuild.yml create mode 100644 ba_detections/endpoint/ssa_windows_system_binary_proxy_execution_compiled_html_file_decompile.yml create mode 100644 ba_detections/endpoint/ssa_windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml create mode 100644 ba_detections/endpoint/ssa_windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml create mode 100644 ba_detections/endpoint/ssa_windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml create mode 100644 ba_detections/endpoint/ssa_windows_system_binary_proxy_execution_msiexec_remote_download.yml create mode 100644 ba_detections/endpoint/ssa_windows_system_binary_proxy_execution_msiexec_unregister_dll.yml create mode 100644 ba_detections/endpoint/ssa_windows_wmiprvse_spawn_msbuild.yml create mode 100644 ba_detections/endpoint/ssa_windows_wsreset_uac_bypass.yml create mode 100644 ba_detections/network/ssa_tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml create mode 100644 ba_detections/network/ssa_unusual_volume_of_data_download_from_internal_server_per_entity.yml diff --git a/ba_detections/deprecated/ssa_credential_extractionfgdump_and_cachedump.yml b/ba_detections/deprecated/ssa_credential_extractionfgdump_and_cachedump.yml new file mode 100644 index 0000000000..8e528285b9 --- /dev/null +++ b/ba_detections/deprecated/ssa_credential_extractionfgdump_and_cachedump.yml @@ -0,0 +1,53 @@ +name: Credential ExtractionFGDump and CacheDump +id: 3c40b0ef-a03f-460a-9484-e4b9117cbb38 +version: 2 +date: '2021-11-29' +author: Stanislav Miskovic, Splunk +status: deprecated +type: TTP +description: The following analytic identifies the use of CacheDump with the `-v` + parameter to dump cached credentials on the associated endpoint. Adversaries use + Cachedump as it is a publicly-available tool that extracts cached password hashes + from a system's registry. +data_source: [] +search: ' | from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line != null AND process_name != null AND process_path != null AND match_regex(process_name, + /(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path, /(?i)\\Temp/)=true + AND match_regex(cmd_line, /(?i)\-v/)=true + + | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: False positives will be limited as this analytic targets specific + credential dumping process names. Filter as needed. +references: [] +tags: + analytic_story: + - Unusual Processes + - Credential Dumping + asset_type: Windows + atomic_guid: [] + confidence: 90 + drilldown_search: [] + impact: 70 + message: Malicious actor is accessing stored credentials via FGDump or CacheDump + tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via process $process_name$ + mitre_attack_id: + - T1003 + - T1003.002 + product: + - Splunk Behavioral Analytics + risk_score: 63 + security_domain: endpoint +tests: [] diff --git a/ba_detections/deprecated/ssa_potential_pass_the_token_or_hash_observed_at_the_destination_device.yml b/ba_detections/deprecated/ssa_potential_pass_the_token_or_hash_observed_at_the_destination_device.yml new file mode 100644 index 0000000000..4de56654a6 --- /dev/null +++ b/ba_detections/deprecated/ssa_potential_pass_the_token_or_hash_observed_at_the_destination_device.yml @@ -0,0 +1,68 @@ +name: Potential Pass the Token or Hash Observed at the Destination Device +id: 82e76b80-5cdb-4899-9b43-85dbe777b36d +version: 3 +date: '2021-11-30' +author: Stanislav Miskovic, Splunk +status: deprecated +type: TTP +description: This detection identifies potential Pass the Token or Pass the Hash credential + stealing. We detect the main side effect of these attacks, which is a transition + from the dominant Kerberos logins to rare NTLM logins for a given user, as reported + by a detination device. +data_source: [] +search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + dest_user=lower(ucast(map_get(input_event, "dest_user_primary_artifact"), "string", + null)), dest_user_id= ucast(map_get(input_event, "dest_user_id"), "string", null), + dest_device_id= ucast(map_get(input_event, "dest_device_id"), "string", null), + signature_id= lower(ucast(map_get(input_event, "signature_id"), "string", null)), + authentication_method= lower(ucast(map_get(input_event, "authentication_method"), + "string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null) + + | where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos") + AND dest_user_id != null AND dest_device_id != null + + | eval isKerberos=if(authentication_method == "kerberos", 1, 0), isNtlm=if(authentication_method + == "ntlmssp", 1, 0), timeNTLM=if(isNtlm > 0, timestamp, null) + + | stats sum(isKerberos) as totalKerberos, sum(isNtlm) as totalNtlm, min(timestamp) as + startTime, min(timeNTLM) as startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as + endNTLMTime by dest_user_id, dest_user, dest_device_id, span(timestamp, 86400s) + + | where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime - + startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND + (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime) + + | eval start_time=ucast(startNTLMTime, "long", null), end_time=ucast(endNTLMTime, + "long", null), entities=mvappend(dest_user_id, dest_device_id), body=create_map(["event_id", + event_id, "total_kerberos", totalKerberos, "total_ntlm", totalNtlm, "analysis_start_time", + startTime, "analysis_end_time", endTime, "pth_start_time", startNTLMTime, "pth_end_time", + endNTLMTime]) + + | into write_ssa_detected_events();' +how_to_implement: You must be ingesting Windows Security logs from endpoint devices, + i.e., destinations of interest. Please make sure that event ID 4624 is being logged. +known_false_positives: Environments in which NTLM is used extremely rarely and for + benign purposes (such as a rare use of SMB shares). +references: +- https://attack.mitre.org/techniques/T1550/002/ +- https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/ +tags: + analytic_story: + - Active Directory Lateral Movement + asset_type: Windows + atomic_guid: [] + confidence: 90 + drilldown_search: [] + impact: 80 + message: Potential lateral movement and credential stealing via Pass the Token or + Pass the Hash techniques. Operation is performed via credentials of the account + $dest_user_id$ and observed by the destination device $dest_device_id$ + mitre_attack_id: + - T1550 + - T1550.002 + product: + - Splunk Behavioral Analytics + risk_score: 72 + security_domain: endpoint +tests: [] diff --git a/ba_detections/deprecated/ssa_potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml b/ba_detections/deprecated/ssa_potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml new file mode 100644 index 0000000000..22fc4d06a1 --- /dev/null +++ b/ba_detections/deprecated/ssa_potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml @@ -0,0 +1,69 @@ +name: Potential Pass the Token or Hash Observed by an Event Collecting Device +id: 1058ba3e-a698-49bc-a1e5-7cedece4ea87 +version: 2 +date: '2021-11-05' +author: Stanislav Miskovic, Splunk +status: deprecated +type: TTP +description: This detection identifies potential Pass the Token or Pass the Hash credential + stealing. We detect the main side effect of these attacks, which is a transition + from the dominant Kerberos logins to rare NTLM logins for a given user, as reported + by an event-collecting device (i.e., a specific domain controller or an endpoint + destination). +data_source: [] +search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamodels) + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"), + "string", null)), dest_user_id= ucast(map_get(input_event, "dest_user_id"), "string", + null), origin_device_id= ucast(map_get(input_event, "origin_device_id"), "string", + null), signature_id= lower(ucast(map_get(input_event, "signature_id"), "string", + null)), authentication_method= lower(ucast(map_get(input_event, "authentication_method"), + "string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos") + AND dest_user_id != null AND origin_device_id != null + + | eval isKerberos=if(authentication_method == "kerberos", 1, 0), isNtlm=if(authentication_method + == "ntlmssp", 1, 0), timeNTLM=if(isNtlm > 0, timestamp, null) + + | stats sum(isKerberos) as totalKerberos, sum(isNtlm) as totalNtlm, min(timestamp) as + startTime, min(timeNTLM) as startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as + endNTLMTime by dest_user_id, dest_user, origin_device_id, span(timestamp, 86400s) + + | where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime - + startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND + (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime) + + | eval start_time=startNTLMTime, end_time=endNTLMTime, entities=mvappend(dest_user_id, + origin_device_id), body=create_map(["event_id", event_id, "total_kerberos", totalKerberos, + "total_ntlm", totalNtlm, "analysis_start_time", startTime, "analysis_end_time", + endTime, "detection_start_time", startNTLMTime, "detection_end_time", endNTLMTime]) + + | into write_ssa_detected_events();' +how_to_implement: You must be ingesting Windows Security logs from devices of interest + - at least from domain controllers. Please make sure that event ID 4624 is being + logged. +known_false_positives: Environments in which NTLM is used extremely rarely and for + benign purposes (such as a rare use of SMB shares). +references: +- https://attack.mitre.org/techniques/T1550/002/ +- https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/ +tags: + analytic_story: + - Active Directory Lateral Movement + asset_type: Windows + atomic_guid: [] + confidence: 80 + drilldown_search: [] + impact: 80 + message: Potential lateral movement and credential stealing via Pass the Token or + Pass the Hash techniques. Operation is performed via credentials of the account + $dest_user_id$ and observed by the logging device $origin_device_id$ + mitre_attack_id: + - T1550 + - T1550.002 + product: + - Splunk Behavioral Analytics + risk_score: 64 + security_domain: endpoint +tests: [] diff --git a/ba_detections/deprecated/ssa_unusual_lolbas_in_short_period_of_time.yml b/ba_detections/deprecated/ssa_unusual_lolbas_in_short_period_of_time.yml new file mode 100644 index 0000000000..01cb6de4ce --- /dev/null +++ b/ba_detections/deprecated/ssa_unusual_lolbas_in_short_period_of_time.yml @@ -0,0 +1,71 @@ +name: Unusual LOLBAS in short period of time +id: 59c0dd70-169c-4900-9a1f-bfcf13302f93 +version: 2 +date: '2020-08-25' +author: Ignacio Bermudez Corrales, Splunk +status: deprecated +type: Anomaly +description: Attacker activity may compromise executing several LOLBAS applications + in conjunction to accomplish their objectives. We are looking for more than usual + LOLBAS applications over a window of time, by building profiles per machine. +data_source: [] +search: ' | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, + "dest_device_id"), "string", null), process_name=lower(ucast(map_get(input_event, + "process_name"), "string", null)), timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)) | where process_name=="regsvcs.exe" OR process_name=="ftp.exe" + OR process_name=="dfsvc.exe" OR process_name=="rasautou.exe" OR process_name=="schtasks.exe" + OR process_name=="xwizard.exe" OR process_name=="findstr.exe" OR process_name=="esentutl.exe" + OR process_name=="cscript.exe" OR process_name=="reg.exe" OR process_name=="csc.exe" + OR process_name=="atbroker.exe" OR process_name=="print.exe" OR process_name=="pcwrun.exe" + OR process_name=="vbc.exe" OR process_name=="rpcping.exe" OR process_name=="wsreset.exe" + OR process_name=="ilasm.exe" OR process_name=="certutil.exe" OR process_name=="replace.exe" + OR process_name=="mshta.exe" OR process_name=="bitsadmin.exe" OR process_name=="wscript.exe" + OR process_name=="ieexec.exe" OR process_name=="cmd.exe" OR process_name=="microsoft.workflow.compiler.exe" + OR process_name=="runscripthelper.exe" OR process_name=="makecab.exe" OR process_name=="forfiles.exe" + OR process_name=="desktopimgdownldr.exe" OR process_name=="control.exe" OR process_name=="msbuild.exe" + OR process_name=="register-cimprovider.exe" OR process_name=="tttracer.exe" OR process_name=="ie4uinit.exe" + OR process_name=="sc.exe" OR process_name=="bash.exe" OR process_name=="hh.exe" + OR process_name=="cmstp.exe" OR process_name=="mmc.exe" OR process_name=="jsc.exe" + OR process_name=="scriptrunner.exe" OR process_name=="odbcconf.exe" OR process_name=="extexport.exe" + OR process_name=="msdt.exe" OR process_name=="diskshadow.exe" OR process_name=="extrac32.exe" + OR process_name=="eventvwr.exe" OR process_name=="mavinject.exe" OR process_name=="regasm.exe" + OR process_name=="gpscript.exe" OR process_name=="rundll32.exe" OR process_name=="regsvr32.exe" + OR process_name=="regedit.exe" OR process_name=="msiexec.exe" OR process_name=="gfxdownloadwrapper.exe" + OR process_name=="presentationhost.exe" OR process_name=="regini.exe" OR process_name=="wmic.exe" + OR process_name=="runonce.exe" OR process_name=="syncappvpublishingserver.exe" OR + process_name=="verclsid.exe" OR process_name=="psr.exe" OR process_name=="infdefaultinstall.exe" + OR process_name=="explorer.exe" OR process_name=="expand.exe" OR process_name=="installutil.exe" + OR process_name=="netsh.exe" OR process_name=="wab.exe" OR process_name=="dnscmd.exe" + OR process_name=="at.exe" OR process_name=="pcalua.exe" OR process_name=="cmdkey.exe" + OR process_name=="msconfig.exe" | stats count(process_name) as lolbas_counter by + device,span(timestamp, 300s) | eval lolbas_counter=lolbas_counter*1.0 | rename window_end + as timestamp | adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device" + window=2419200000L | where label AND quantile>0.99 | eval start_time = window_start, + end_time = timestamp, entities = mvappend(device), body=create_map(["lolbas_counter", + lolbas_counter, "quantile", quantile, "device", device]) | into write_ssa_detected_events();' +how_to_implement: Collect endpoint data such as sysmon or 4688 events. +known_false_positives: 'Some administrative tasks may involve multiple use of LOLBAS + applications in a short period of time. This might trigger false positives at the + beginning when it hasn''t collected yet enough data to construct the baseline. + + ' +references: +- https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries +tags: + analytic_story: + - Unusual Processes + asset_type: Endpoint + atomic_guid: [] + confidence: 50 + drilldown_search: [] + impact: 50 + message: A system process $process_name$ with commandline $cmd_line$ spawn iin short + period of time in host $dest_device_id$ + mitre_attack_id: + - T1059 + - T1053 + product: + - Splunk Behavioral Analytics + risk_score: 25 + security_domain: endpoint +tests: [] diff --git a/ba_detections/deprecated/ssa_unusually_long_command_line.yml b/ba_detections/deprecated/ssa_unusually_long_command_line.yml new file mode 100644 index 0000000000..a0d0001158 --- /dev/null +++ b/ba_detections/deprecated/ssa_unusually_long_command_line.yml @@ -0,0 +1,50 @@ +name: Unusually Long Command Line +id: 58f43aba-1775-445e-b19c-be2b87d83ae3 +version: 1 +date: '2020-10-06' +author: Ignacio Bermudez Corrales, Splunk +status: deprecated +type: Anomaly +description: Command lines that are extremely long may be indicative of malicious + activity on your hosts. This search leverages the Splunk Streaming ML DSP plugin + to help identify command lines with lengths that are unusual for a given user. This + detection is inspired on Unusually Long Command Line authored by Rico Valdez. +data_source: [] +search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)) | eval cmd_line=ucast(map_get(input_event, "process"), + "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", + null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), + process_name=ucast(map_get(input_event, "process_name"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line!=null and dest_user_id!=null | eval + cmd_line_norm=replace(cast(cmd_line, "string"), /\s(--?\w+)|(\/\w+)/, " ARG"), cmd_line_norm=replace(cmd_line_norm, + /\w:\\[^\s]+/, "PATH"), cmd_line_norm=replace(cmd_line_norm, /\d+/, "N"), input=parse_double(len(coalesce(cmd_line_norm, + ""))) | select timestamp, process_name, dest_device_id, dest_user_id, cmd_line, + input | adaptive_threshold algorithm="quantile" entity="process_name" window=60480000 + | where label AND quantile>0.99 | first_time_event input_columns=["dest_device_id", + "cmd_line"] | where first_time_dest_device_id_cmd_line | eval start_time = timestamp, + end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map(["event_id", + event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' +how_to_implement: You must be ingesting sysmon endpoint data that monitors command + lines. +known_false_positives: This detection may flag suspiciously long command lines when + there is not sufficient evidence (samples) for a given process that this detection + is tracking; or when there is high variability in the length of the command line + for the tracked process. Also, some legitimate applications may use long command + lines. Such is the case of Ansible, that encodes Powershell scripts using long base64. + Attackers may use this technique to obfuscate their payloads. +references: [] +tags: + analytic_story: + - Unusual Processes + asset_type: Endpoint + atomic_guid: [] + confidence: 40 + drilldown_search: [] + impact: 30 + message: A process $process_name$ with a long commandline $cmd_line$ executed in + host $dest_device_id$ + product: + - Splunk Behavioral Analytics + risk_score: 12 + security_domain: endpoint +tests: [] diff --git a/ba_detections/endpoint/ssa_anomalous_usage_of_account_credentials.yml b/ba_detections/endpoint/ssa_anomalous_usage_of_account_credentials.yml new file mode 100644 index 0000000000..5b38eb9f41 --- /dev/null +++ b/ba_detections/endpoint/ssa_anomalous_usage_of_account_credentials.yml @@ -0,0 +1,44 @@ +name: Anomalous Usage of Account Credentials +id: 629cbf9e-5785-11ec-9611-acde48001122 +version: 1 +date: '2021-12-07' +author: Lou Stella, Splunk +status: experimental +type: Anomaly +description: This is an anomaly generating detection looking for multiple interactive + logins within a specific time period. An insider threat may attempt to steal colleagues + credentials in low tech, undetectable methods, in order to gain access to additional + information or to hide their own behavior. This should capture their attempted use + of those credentials on a workstation. +data_source: [] +search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, + "dest_device_id"), "string", null), auth_type=ucast(map_get(input_event, "authentication_type"), + "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", + null)), src_user=ucast(map_get(input_event, "dest_user_original_artifact"), "string", + null), signature_id=ucast(map_get(input_event, "EventCode"), "string", null) | where + signature_id="4624" | where auth_type="2" OR auth_type="11" | where NOT (src_user="SYSTEM") + AND NOT (src_user="ANONYMOUS LOGON") | stats estdc(src_user) AS user_counter by + device, span(timestamp, 600s, 300s) | where user_counter>=2 | rename window_end + AS timestamp | eval start_time=window_start, end_time=timestamp, entities=mvappend(device), + body=create_map(["user_counter", user_counter, "device", device]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this detection, you need to be ingesting + logon events from workstations. +known_false_positives: Shared workstations can cause false positives +references: +- https://attack.mitre.org/techniques/T1078/002/ +tags: + analytic_story: + - Insider Threat + asset_type: Endpoint + atomic_guid: [] + confidence: 30 + drilldown_search: [] + impact: 20 + message: Multiple interactive logins detected on $device$ + mitre_attack_id: + - T1078.002 + product: + - Splunk Behavioral Analytics + risk_score: 6 + security_domain: access +tests: [] diff --git a/ba_detections/endpoint/ssa_anomalous_usage_of_archive_tools.yml b/ba_detections/endpoint/ssa_anomalous_usage_of_archive_tools.yml new file mode 100644 index 0000000000..8e16b3762e --- /dev/null +++ b/ba_detections/endpoint/ssa_anomalous_usage_of_archive_tools.yml @@ -0,0 +1,56 @@ +name: Anomalous usage of Archive Tools +id: 63614a58-10e2-4c6c-ae81-ea1113681439 +version: 1 +date: '2021-11-22' +author: Patrick Bareiss, Splunk +status: production +type: Anomaly +description: The following detection identifies the usage of archive tools from the + command line. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"), + "string", null)), process=lower(ucast(map_get(input_event, "process"), "string", + null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", + null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), + parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), parent_process=ucast(map_get(input_event, "parent_process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process_name + IS NOT NULL AND parent_process_name IS NOT NULL | where like(process_name, "7z%") + OR process_name="WinRAR.exe" OR like(process_name, "winzip%") | where like(parent_process_name, + "%cmd.exe") OR like(parent_process_name, "%powershell.exe") | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["event_id", event_id, "process_name", process_name, "parent_process_name", + parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: False positives can be ligitmate usage of archive tools from + the command line. +references: +- https://attack.mitre.org/techniques/T1560/001/ +tags: + analytic_story: + - Cobalt Strike + - NOBELIUM Group + - Insider Threat + asset_type: Endpoint + atomic_guid: [] + confidence: 60 + drilldown_search: [] + impact: 70 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading + of 7zip. + mitre_attack_id: + - T1560.001 + - T1560 + product: + - Splunk Behavioral Analytics + risk_score: 42 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_tools/windows-security.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_attempt_to_delete_services.yml b/ba_detections/endpoint/ssa_attempt_to_delete_services.yml new file mode 100644 index 0000000000..adcdbb75d4 --- /dev/null +++ b/ba_detections/endpoint/ssa_attempt_to_delete_services.yml @@ -0,0 +1,58 @@ +name: Attempt To Delete Services +id: a0c8c292-d01a-11eb-aa18-acde48001122 +version: 3 +date: '2021-11-24' +author: Teoderick Contreras, splunk +status: production +type: TTP +description: The following analytic identifies Windows Service Control, `sc.exe`, + attempting to delete a service. This is typically identified in parallel with other + instances of service enumeration of attempts to stop a service and then delete it. + Adversaries utilize this technique to terminate security services or other related + services to continue there objective and evade detections. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND like(cmd_line, "%delete%") AND process_name = "sc.exe" + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: It is possible administrative scripts may start/stop/delete + services. Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md +tags: + analytic_story: + - XMRig + - Ransomware + asset_type: Endpoint + atomic_guid: [] + confidence: 60 + drilldown_search: [] + impact: 60 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a service. + mitre_attack_id: + - T1489 + - T1543 + - T1543.003 + product: + - Splunk Behavioral Analytics + risk_score: 36 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_del.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_attempt_to_disable_services.yml b/ba_detections/endpoint/ssa_attempt_to_disable_services.yml new file mode 100644 index 0000000000..29c6785e70 --- /dev/null +++ b/ba_detections/endpoint/ssa_attempt_to_disable_services.yml @@ -0,0 +1,58 @@ +name: Attempt To Disable Services +id: afb31de4-d023-11eb-98d5-acde48001122 +version: 3 +date: '2021-11-24' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic identifies Windows Service Control, `sc.exe`, + attempting to disable a service. This is typically identified in parallel with other + instances of service enumeration of attempts to stop a service and then disable + it. Adversaries utilize this technique to terminate security services or other related + services to continue there objective and evade detections. +data_source: [] +search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(input_event, + "_datamodels"), "collection", []), body={} | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND like(cmd_line, "%disabled%") AND like(cmd_line, "%config%") + AND process_name="sc.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: It is possible administrative scripts may start/stop/delete + services. Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service +tags: + analytic_story: + - XMRig + - Ransomware + asset_type: Endpoint + atomic_guid: [] + confidence: 60 + drilldown_search: [] + impact: 60 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable a service. + mitre_attack_id: + - T1489 + product: + - Splunk Behavioral Analytics + risk_score: 36 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_disable.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_attempted_credential_dump_from_registry_via_reg_exe.yml b/ba_detections/endpoint/ssa_attempted_credential_dump_from_registry_via_reg_exe.yml new file mode 100644 index 0000000000..44f9701505 --- /dev/null +++ b/ba_detections/endpoint/ssa_attempted_credential_dump_from_registry_via_reg_exe.yml @@ -0,0 +1,55 @@ +name: Attempted Credential Dump From Registry via Reg exe +id: 14038953-e5f2-4daf-acff-5452062baf03 +version: 2 +date: '2021-11-29' +author: Jose Hernandez, Splunk +status: production +type: TTP +description: The following analytic identifies the use of `reg.exe` attempting to + export Windows registry keys that contain hashed credentials. Adversaries will utilize + this technique to capture and perform offline password cracking. +data_source: [] +search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)) | eval process_name=lower(ucast(map_get(input_event, + "process_name"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), + "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", + null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process_name="cmd.exe" + OR process_name="reg.exe" | where cmd_line != null AND match_regex(cmd_line, /(?i)save\s+/)=true + AND ( match_regex(cmd_line, /(?i)HKLM\\Security/)=true OR match_regex(cmd_line, + /(?i)HKLM\\SAM/)=true OR match_regex(cmd_line, /(?i)HKLM\\System/)=true OR match_regex(cmd_line, + /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true + OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true ) | eval start_time + = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name]) + | into write_ssa_detected_events(); ' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: None identified. +references: +- https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets +tags: + analytic_story: + - Credential Dumping + asset_type: Endpoint + atomic_guid: [] + confidence: 90 + drilldown_search: [] + impact: 70 + message: An attempt to save registry keys storing credentials has been performed + on $dest_device_id$ by $dest_user_id$ via process $process_name$. + mitre_attack_id: + - T1003 + - T1003.002 + product: + - Splunk Behavioral Analytics + risk_score: 63 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-security.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_bcdedit_failure_recovery_modification.yml b/ba_detections/endpoint/ssa_bcdedit_failure_recovery_modification.yml new file mode 100644 index 0000000000..76be079bb5 --- /dev/null +++ b/ba_detections/endpoint/ssa_bcdedit_failure_recovery_modification.yml @@ -0,0 +1,56 @@ +name: BCDEdit Failure Recovery Modification +id: 76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13 +version: 1 +date: '2021-12-07' +author: Michael Haag, Splunk +status: production +type: TTP +description: This search looks for flags passed to bcdedit.exe modifications to the + built-in Windows error recovery boot configurations. This is typically used by ransomware + to prevent recovery. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bcdedit.exe" + AND (like (cmd_line, "%recoveryenabled%") AND like (cmd_line, "%no%")) | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint_Processess` datamodel. +known_false_positives: Administrators may modify the boot configuration. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair +tags: + analytic_story: + - Ryuk Ransomware + - Ransomware + - Information Sabotage + asset_type: Endpoint + atomic_guid: [] + confidence: 80 + drilldown_search: [] + impact: 100 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting disable the ability + to recover the endpoint. + mitre_attack_id: + - T1490 + product: + - Splunk Behavioral Analytics + risk_score: 80 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/ba_detections/endpoint/ssa_clear_unallocated_sector_using_cipher_app.yml b/ba_detections/endpoint/ssa_clear_unallocated_sector_using_cipher_app.yml new file mode 100644 index 0000000000..58bc0b79d2 --- /dev/null +++ b/ba_detections/endpoint/ssa_clear_unallocated_sector_using_cipher_app.yml @@ -0,0 +1,55 @@ +name: Clear Unallocated Sector Using Cipher App +id: 8f907d90-6173-11ec-9c23-acde48001122 +version: 1 +date: '2021-12-20' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: this search is to detect execution of `cipher.exe` to clear the unallocated + sectors of a specific disk. This technique was seen in some ransomware to make it + impossible to forensically recover deleted files. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND like(cmd_line, "%/w:%") AND process_name="cipher.exe" | + eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: administrator may execute this app to manage disk +references: +- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/ +- https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf +tags: + analytic_story: + - Ransomware + - Information Sabotage + asset_type: Endpoint + atomic_guid: [] + confidence: 100 + drilldown_search: [] + impact: 90 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors + of a specific disk. + mitre_attack_id: + - T1070.004 + - T1070 + product: + - Splunk Behavioral Analytics + risk_score: 90 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/ba_detections/endpoint/ssa_delete_a_net_user.yml b/ba_detections/endpoint/ssa_delete_a_net_user.yml new file mode 100644 index 0000000000..f125e8de6a --- /dev/null +++ b/ba_detections/endpoint/ssa_delete_a_net_user.yml @@ -0,0 +1,59 @@ +name: Delete A Net User +id: 8776d79c-d26e-11eb-9a56-acde48001122 +version: 4 +date: '2022-03-17' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: This analytic will detect a suspicious net.exe/net1.exe command-line + to delete a user on a system. This technique may be use by an administrator for + legitimate purposes, however this behavior has been used in the wild to impair some + user or deleting adversaries tracks created during its lateral movement additional + systems. During triage, review parallel processes for additional behavior. Identify + any other user accounts created before or after. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), process=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",null), + parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process + IS NOT NULL AND like(process, "%/delete%") AND like(process, "%user%") AND (process_name="net1.exe" + OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "process", process, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed net.exe may be used. +known_false_positives: System administrators or scripts may delete user accounts via + this technique. Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - XMRig + - Ransomware + asset_type: Endpoint + atomic_guid: [] + confidence: 70 + drilldown_search: [] + impact: 70 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a user + account. + mitre_attack_id: + - T1531 + product: + - Splunk Behavioral Analytics + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_del.log + source: WinEventLog:Security + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/atomic_red_team/security.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_deny_permission_using_cacls_utility.yml b/ba_detections/endpoint/ssa_deny_permission_using_cacls_utility.yml new file mode 100644 index 0000000000..31d2abfedc --- /dev/null +++ b/ba_detections/endpoint/ssa_deny_permission_using_cacls_utility.yml @@ -0,0 +1,54 @@ +name: Deny Permission using Cacls Utility +id: b76eae28-cd25-11eb-9c92-acde48001122 +version: 3 +date: '2021-11-29' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic identifies the use of `cacls.exe`, `icacls.exe` + or `xcacls.exe` placing the deny permission on a file or directory. Adversaries + perform this behavior to prevent responders from reviewing or gaining access to + adversary files on disk. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", + null), process_name=ucast(map_get(input_event, "process_name"), "string", null), + process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, + "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), + "string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)deny/)=true + AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. +known_false_positives: System administrators may use cacls utilities but this is not + a common practice. Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - XMRig + - Information Sabotage + asset_type: Endpoint + atomic_guid: [] + confidence: 70 + drilldown_search: [] + impact: 50 + message: A cacls process $process_name$ with commandline $cmd_line$ try to deny + a permission of a file or directory in host $dest_device_id$ + mitre_attack_id: + - T1222 + product: + - Splunk Behavioral Analytics + risk_score: 35 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_detect_kerberoasting.yml b/ba_detections/endpoint/ssa_detect_kerberoasting.yml new file mode 100644 index 0000000000..f78ebebd1c --- /dev/null +++ b/ba_detections/endpoint/ssa_detect_kerberoasting.yml @@ -0,0 +1,50 @@ +name: Detect Kerberoasting +id: dabdd6d7-3e10-42be-8711-4e124f7a3850 +version: 2 +date: '2020-10-21' +author: Xiao Lin, Splunk +status: experimental +type: TTP +description: This search detects a potential kerberoasting attack via service principal + name requests +data_source: [] +search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_time"), + EventCode=map_get(input_event, "event_code"), TicketOptions=map_get(input_event, + "ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"), + ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event, + "service_id"), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", + null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where EventCode="4769" + AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" | first_time_event + input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"] + | where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID + | eval start_time=_time, end_time=_time | eval body=create_map(["event_id", event_id, + "EventCode", EventCode, "ServiceName", ServiceName, "TicketOptions", TicketOptions, + "TicketEncryptionType", TicketEncryptionType]), entities = mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)) | select start_time, end_time, entities, body | into write_ssa_detected_events();' +how_to_implement: The test data is converted from Windows Security Event logs generated + from Attach Range simulation and used in SPL search and extended to SPL2 +known_false_positives: Older systems that support kerberos RC4 by default NetApp may + generate false positives +references: +- Initial ESCU implementation by Jose Hernandez and Patrick Bareiss +tags: + analytic_story: + - Credential Dumping + asset_type: Endpoint + atomic_guid: [] + confidence: 20 + drilldown_search: [] + impact: 70 + message: Kerberoasting malware is potentially applying stolen credentials. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via + command $cmd_line$ + mitre_attack_id: + - T1558.003 + - T1558 + product: + - Splunk Behavioral Analytics + risk_score: 14 + security_domain: endpoint +tests: [] diff --git a/ba_detections/endpoint/ssa_detect_prohibited_applications_spawning_cmd_exe.yml b/ba_detections/endpoint/ssa_detect_prohibited_applications_spawning_cmd_exe.yml new file mode 100644 index 0000000000..0a1765e787 --- /dev/null +++ b/ba_detections/endpoint/ssa_detect_prohibited_applications_spawning_cmd_exe.yml @@ -0,0 +1,61 @@ +name: Detect Prohibited Applications Spawning cmd exe +id: c10a18cb-fd80-4ffa-a844-25026e0a0c94 +version: 3 +date: '2022-03-01' +author: Ignacio Bermudez Corrales, Splunk +status: production +type: Anomaly +description: The following analytic identifies parent processes, browsers, Windows + terminal applications, Office Products and Java spawning cmd.exe. By its very nature, + many applications spawn cmd.exe natively or built into macros. Much of this will + need to be tuned to further enhance the risk. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)) | eval process_name = ucast(map_get(input_event, "process_name"), + "string", null), parent_process_name = lower(ucast(input_event.parent_process_name, + "string", null)), cmd_line = lower(ucast(map_get(input_event, "process"),"string", + null)), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), + dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), event_id=ucast(map_get(input_event,"event_id"), + "string", null) | where process_name="cmd.exe" | rex field=parent_process_name "(?[^\\\\]+)$" + | where ParentBaseFileName="winword.exe" OR ParentBaseFileName="excel.exe" OR ParentBaseFileName="outlook.exe" + OR ParentBaseFileName="powerpnt.exe" OR ParentBaseFileName="visio.exe" OR ParentBaseFileName="mspub.exe" + OR ParentBaseFileName="acrobat.exe" OR ParentBaseFileName="acrord32.exe" OR ParentBaseFileName="iexplore.exe" + OR ParentBaseFileName="opera.exe" OR ParentBaseFileName="firefox.exe" OR (ParentBaseFileName="java.exe" + AND (parent_process_name IS NOT NULL AND match_regex(parent_process_name, /(?i)patch1-Hotfix1a/)=false)) + OR ParentBaseFileName="powershell.exe" OR (ParentBaseFileName="chrome.exe" AND (cmd_line + IS NULL OR (cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)chrome-extension/)=false))) + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, + dest_user_id), body=create_map(["event_id", event_id, "process_name", process_name, + "parent_process_name", parent_process_name, "cmd_line", cmd_line, "ParentBaseFileName", + ParentBaseFileName]) | into write_ssa_detected_events()' +how_to_implement: In order to successfully implement this analytic, you will need + endpoint process data from a EDR product or Sysmon. This search has been modified + to process raw sysmon data from attack_range's nxlogs on DSP. +known_false_positives: There are circumstances where an application may legitimately + execute and interact with the Windows command-line interface. +references: +- https://attack.mitre.org/techniques/T1059/ +tags: + analytic_story: + - Suspicious Command-Line Executions + - Insider Threat + asset_type: Endpoint + atomic_guid: [] + confidence: 50 + drilldown_search: [] + impact: 70 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event + that warrants investigating. + mitre_attack_id: + - T1059 + product: + - Splunk Behavioral Analytics + risk_score: 35 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/ba_detections/endpoint/ssa_detect_rclone_command_line_usage.yml b/ba_detections/endpoint/ssa_detect_rclone_command_line_usage.yml new file mode 100644 index 0000000000..feee64603f --- /dev/null +++ b/ba_detections/endpoint/ssa_detect_rclone_command_line_usage.yml @@ -0,0 +1,67 @@ +name: Detect RClone Command-Line Usage +id: e8b74268-5454-11ec-a799-acde48001122 +version: 1 +date: '2021-12-03' +author: Michael Haag, Splunk +status: production +type: TTP +description: This analytic identifies commonly used command-line arguments used by + `rclone.exe` to initiate a file transfer. Some arguments were negated as they are + specific to the configuration used by adversaries. In particular, an adversary may + list the files or directories of the remote file share using `ls` or `lsd`, which + is not indicative of malicious behavior. During triage, at this stage of a ransomware + event, exfiltration is about to occur or has already. Isolate the endpoint and continue + investigating by review file modifications and parallel processes. +data_source: [] +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="rclone.exe" + AND (like (cmd_line, "%copy%") OR like (cmd_line, "%mega%")OR like (cmd_line, "%pcloud%") + OR like (cmd_line, "%ftp%") OR like (cmd_line, "%--config%") OR like (cmd_line, + "%--progress%") OR like (cmd_line, "%--no-check-certificate%") OR like (cmd_line, + "%--ignore-existing%") OR like (cmd_line, "%--auto-confirm%") OR like (cmd_line, + "%--transfers%") OR like (cmd_line, "%--multi-thread-streams%")) | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) + | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint_Processess` datamodel. +known_false_positives: False positives should be limited as this is restricted to + the Rclone process name. Filter or tune the analytic as needed. +references: +- https://redcanary.com/blog/rclone-mega-extortion/ +- https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations +- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ +- https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/ +tags: + analytic_story: + - DarkSide Ransomware + - Ransomware + - Insider Threat + asset_type: Endpoint + atomic_guid: [] + confidence: 70 + drilldown_search: [] + impact: 50 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to connect to a + remote cloud service to move files or folders. + mitre_attack_id: + - T1020 + product: + - Splunk Behavioral Analytics + risk_score: 35 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/ba_detections/endpoint/ssa_disable_defender_antivirus_registry.yml b/ba_detections/endpoint/ssa_disable_defender_antivirus_registry.yml new file mode 100644 index 0000000000..1c5d413725 --- /dev/null +++ b/ba_detections/endpoint/ssa_disable_defender_antivirus_registry.yml @@ -0,0 +1,54 @@ +name: Disable Defender AntiVirus Registry +id: aa4f115a-3024-11ec-9987-acde48001122 +version: 1 +date: '2021-12-08' +author: Bhavin Patel, Splunk +status: experimental +type: TTP +description: This particular behavior is typically executed when an adversaries or + malware gains access to an endpoint and beings to perform execution and to evade + detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled + task modifications will occur. During triage, review parallel processes and identify + any further file modifications. Endpoint should be isolated. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"), + "string", null)), registry_path=lower(ucast(map_get(input_event, "registry_path"), + "string", null)), registry_key_name=lower(ucast(map_get(input_event, "registry_key_name"), + "string", null)), registry_value_data=ucast(map_get(input_event, "registry_value_data"), + "string", null), process_guid=ucast(map_get(input_event, "process_guid"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + like(registry_path, "%\\Policies\\Microsoft\\Windows Defender%") AND registry_key_name="DisableAntiVirus" + AND registry_value_data="(0x00000001)" | eval start_time=timestamp, end_time=timestamp, + entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, + "dest_device_id"), "string", null)), body=create_map( [ "event_id", event_id, "registry_path", + registry_path, "registry_key_name", registry_key_name, "process_guid", process_guid,"registry_value_data",registry_value_data]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Admin or user may choose to disable windows defender product +references: +- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ +tags: + analytic_story: + - IcedID + asset_type: Endpoint + atomic_guid: [] + confidence: 70 + drilldown_search: [] + impact: 70 + message: Modified/added/deleted registry entry $registry_path$ in $dest$ + mitre_attack_id: + - T1562.001 + - T1562 + product: + - Splunk Behavioral Analytics + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/ba_detections/endpoint/ssa_disable_net_user_account.yml b/ba_detections/endpoint/ssa_disable_net_user_account.yml new file mode 100644 index 0000000000..c271fae183 --- /dev/null +++ b/ba_detections/endpoint/ssa_disable_net_user_account.yml @@ -0,0 +1,57 @@ +name: Disable Net User Account +id: ba858b08-d26c-11eb-af9b-acde48001122 +version: 3 +date: '2021-11-30' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: This analytic will identify a suspicious command-line that disables a + user account using the native `net.exe` or `net1.exe` utility to Windows. This technique + may used by the adversaries to interrupt availability of accounts and continue the + impact against the organization. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND like(cmd_line, "%user%") + AND (process_name="net1.exe" OR process_name="net.exe") | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be + used. +known_false_positives: System administrators or automated scripts may disable an account + but not a common practice. Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - XMRig + - Ransomware + asset_type: Endpoint + atomic_guid: [] + confidence: 70 + drilldown_search: [] + impact: 70 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable accounts. + mitre_attack_id: + - T1489 + - T1078 + product: + - Splunk Behavioral Analytics + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_dis.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_dns_exfiltration_using_nslookup_app.yml b/ba_detections/endpoint/ssa_dns_exfiltration_using_nslookup_app.yml new file mode 100644 index 0000000000..b7a846b869 --- /dev/null +++ b/ba_detections/endpoint/ssa_dns_exfiltration_using_nslookup_app.yml @@ -0,0 +1,63 @@ +name: DNS Exfiltration Using Nslookup App +id: 2452e632-9e0d-11eb-34ba-acde48001122 +version: 1 +date: '2021-12-07' +author: Michael Haag, Splunk +status: production +type: TTP +description: This search is to detect potential DNS exfiltration using nslookup application. + This technique are seen in couple of malware and APT group to exfiltrated collected + data in a infected machine or infected network. This detection is looking for unique + use of nslookup where it tries to use specific record type, TXT, A, AAAA, that are + commonly used by attacker and also the retry parameter which is designed to query + C2 DNS multiple tries. +data_source: [] +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="nslookup.exe" + AND (like (cmd_line, "%-querytype=%") OR like (cmd_line, "%-qt=%") OR like (cmd_line, + "%-q=%") OR like (cmd_line, "%-type=%") OR like (cmd_line, "%-retry=%")) | eval + start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, + "process_name", process_name, "parent_process_name", parent_process_name, "process_path", + process_path]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint_Processess` datamodel. +known_false_positives: It is possible for some legitimate administrative utilities + to use similar cmd_line parameters. Filter as needed. +references: +- https://www.mandiant.com/resources/fin7-spear-phishing-campaign-targets-personnel-involved-sec-filings +- https://www.varonis.com/blog/dns-tunneling +- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ +tags: + analytic_story: + - Suspicious DNS Traffic + - Dynamic DNS + - Data Exfiltration + - Command and Control + asset_type: Endpoint + atomic_guid: [] + confidence: 80 + drilldown_search: [] + impact: 90 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ performing activity related + to DNS exfiltration. + mitre_attack_id: + - T1048 + product: + - Splunk Behavioral Analytics + risk_score: 72 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/ba_detections/endpoint/ssa_excessive_number_of_office_files_copied.yml b/ba_detections/endpoint/ssa_excessive_number_of_office_files_copied.yml new file mode 100644 index 0000000000..dc0ddf8205 --- /dev/null +++ b/ba_detections/endpoint/ssa_excessive_number_of_office_files_copied.yml @@ -0,0 +1,42 @@ +name: Excessive Number of Office Files Copied +id: 3c6594a9-8df6-45a1-9357-d73b62083c63 +version: 1 +date: '2021-12-07' +author: Patrick Bareiss, Splunk +status: experimental +type: Anomaly +description: This detection detects a high amount of office file copied. This can + be an indicator for a malicious insider. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)) | eval action=ucast(map_get(input_event, "action"), "string", + null), process=ucast(map_get(input_event, "process"), "string", null), file_name=ucast(map_get(input_event, + "file_name"), "string", null), file_path=ucast(map_get(input_event, "file_path"), + "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", + null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) + | where "Endpoint_Filesystem" IN(_datamodels) | where action="created" | where like(file_name, + "%.doc%") OR like(file_name, "%.xls%") OR like(file_name, "%.ppt%") | stats count(file_name) + AS count BY dest_user_id, dest_device_id, span(timestamp, 10m) | where count > 20 + | eval start_time=window_start, end_time=window_end, entities=mvappend(dest_user_id, + dest_device_id), body=create_map(["count", count]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Filesytem` node. +known_false_positives: user may copy a lot of office fies from one folder to another +references: [] +tags: + analytic_story: + - Insider Threat + asset_type: Endpoint + atomic_guid: [] + confidence: 80 + drilldown_search: [] + impact: 90 + message: High number of files copied + mitre_attack_id: + - T1048.003 + product: + - Splunk Behavioral Analytics + risk_score: 72 + security_domain: endpoint +tests: [] diff --git a/ba_detections/endpoint/ssa_first_time_seen_command_line_argument.yml b/ba_detections/endpoint/ssa_first_time_seen_command_line_argument.yml new file mode 100644 index 0000000000..c21665e454 --- /dev/null +++ b/ba_detections/endpoint/ssa_first_time_seen_command_line_argument.yml @@ -0,0 +1,59 @@ +name: First time seen command line argument +id: fc0edc95-ff2b-48b0-9f6f-63da3789fd23 +version: 4 +date: '2021-11-30' +author: Ignacio Bermudez Corrales, Splunk +status: experimental +type: Anomaly +description: This search looks for command-line arguments that use a `/c` parameter + to execute a command that has not previously been seen. This is an implementation + on SPL2 of the rule `First time seen command line argument` by @bpatel. 'The following + analytic identifies first time seen command-line arguments on a single endpoint. + The analytic looks for arguments instantiated by `cmd.exe /c` and the associated + command-line. Adversaries automate or spawn multiple processes using this method, + this analytic may assist with identifying the first time it's been found on this + endpoint.' +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)) | eval dest_user_id=ucast(map_get(input_event, "dest_user_id"), + "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", + null), process_name=ucast(map_get(input_event, "process_name"), "string", null), + cmd_line=ucast(map_get(input_event, "process"), "string", null), cmd_line_norm=lower(cmd_line), + cmd_line_norm=replace(cmd_line_norm, /[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/, + "GUID"), cmd_line_norm=replace(cmd_line_norm, /(?<=\s)+\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/, + "\\PATH"), /* replaces " \\Something\\Something\\command.ext" => "PATH\\command.ext" + */ cmd_line_norm=replace(cmd_line_norm, /\w:\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/, "\\PATH"), + /* replaces "C:\\Something\\Something\\command.ext" => "PATH\\command.ext" */ cmd_line_norm=replace(cmd_line_norm, + /\d+/, "N"), event_id=ucast(map_get(input_event, "event_id"), "string", null) | + where process_name="cmd.exe" AND match_regex(ucast(cmd_line, "string", ""), /.* + \/[cC] .*/)=true | select process_name, cmd_line, cmd_line_norm, timestamp, dest_device_id, + dest_user_id | first_time_event input_columns=["cmd_line_norm"] | where first_time_cmd_line_norm + | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, + dest_user_id), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Legitimate programs use command-line arguments to execute. + Verify the command-line arguments to check what command/program is being executed. + Filtering will be needed. +references: [] +tags: + analytic_story: + - Unusual Processes + asset_type: Endpoint + atomic_guid: [] + confidence: 60 + drilldown_search: [] + impact: 50 + message: A process $process_name$ ha been identified in the environment with a command-line + $cmd_line$ not previously seen before on host $dest_device_id$ + mitre_attack_id: + - T1059 + - T1202 + product: + - Splunk Behavioral Analytics + risk_score: 30 + security_domain: endpoint +tests: [] diff --git a/ba_detections/endpoint/ssa_fsutil_zeroing_file.yml b/ba_detections/endpoint/ssa_fsutil_zeroing_file.yml new file mode 100644 index 0000000000..7ae69c65b7 --- /dev/null +++ b/ba_detections/endpoint/ssa_fsutil_zeroing_file.yml @@ -0,0 +1,57 @@ +name: Fsutil Zeroing File +id: f792cdc9-43ee-4429-a3c0-ffce4fed1a85 +version: 1 +date: '2021-12-07' +author: Michael Haag, Splunk +status: production +type: TTP +description: This search is to detect a suspicious fsutil process to zeroing a target + file. This technique was seen in lockbit ransomware where it tries to zero out its + malware path as part of its defense evasion after encrypting the compromised host. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="fsutil.exe" + AND (like (cmd_line, "%setzerodata%")) | eval start_time=timestamp, end_time=timestamp, + entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, + "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", + cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, + "process_path", process_path]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed net.exe may be used. +known_false_positives: System administrators or scripts may delete user accounts via + this technique. Filter as needed. +references: +- https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/ +- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file +tags: + analytic_story: + - Ransomware + - Insider Threat + - Information Sabotage + asset_type: Endpoint + atomic_guid: [] + confidence: 90 + drilldown_search: [] + impact: 60 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ atempting to perform file + deletion. + mitre_attack_id: + - T1070 + product: + - Splunk Behavioral Analytics + risk_score: 54 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/ba_detections/endpoint/ssa_grant_permission_using_cacls_utility.yml b/ba_detections/endpoint/ssa_grant_permission_using_cacls_utility.yml new file mode 100644 index 0000000000..a1ce2b59c6 --- /dev/null +++ b/ba_detections/endpoint/ssa_grant_permission_using_cacls_utility.yml @@ -0,0 +1,54 @@ +name: Grant Permission Using Cacls Utility +id: c6da561a-cd29-11eb-ae65-acde48001122 +version: 3 +date: '2021-11-30' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic identifies the use of `cacls.exe`, `icacls.exe` + or `xcacls.exe` placing the grant permission on a file or directory. Adversaries + perform this behavior to allow components of their files to run, however it allows + responders to review or gaining access to adversary files on disk. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", + null), process_name=ucast(map_get(input_event, "process_name"), "string", null), + process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, + "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), + "string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)grant/)=true + AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. +known_false_positives: System administrators may use cacls utilities but this is not + a common practice. Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - XMRig + - Insider Threat + asset_type: Endpoint + atomic_guid: [] + confidence: 70 + drilldown_search: [] + impact: 50 + message: A cacls process $process_name$ with commandline $cmd_line$ try to grant + user a permission to a file or directory in host $dest_device_id$ + mitre_attack_id: + - T1222 + product: + - Splunk Behavioral Analytics + risk_score: 35 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_hiding_files_and_directories_with_attrib_exe.yml b/ba_detections/endpoint/ssa_hiding_files_and_directories_with_attrib_exe.yml new file mode 100644 index 0000000000..a141e88ca6 --- /dev/null +++ b/ba_detections/endpoint/ssa_hiding_files_and_directories_with_attrib_exe.yml @@ -0,0 +1,58 @@ +name: Hiding Files And Directories With Attrib exe +id: 028e4406-6176-11ec-aec2-acde48001122 +version: 1 +date: '2021-12-20' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: Attackers leverage an existing Windows binary, attrib.exe, to mark specific + as hidden by using specific flags so that the victim does not see the file. The + search looks for specific command-line arguments to detect the use of attrib.exe + to hide files. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND match_regex(cmd_line, /\+h/)=true AND process_name="attrib.exe" + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: You must be ingesting data that records process activity from your + hosts to populate the Endpoint data model in the Processes node. You must also be + ingesting logs with both the process name and command line from your endpoints. + The command-line arguments are mapped to the "process" field in the Endpoint data + model. +known_false_positives: 'Some applications and users may legitimately use attrib.exe + to interact with the files. ' +references: +- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/attrib +tags: + analytic_story: + - Windows Defense Evasion Tactics + - Windows Persistence Techniques + - Information Sabotage + - Insider Threat + asset_type: Endpoint + atomic_guid: [] + confidence: 90 + drilldown_search: [] + impact: 80 + message: Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is detected. + mitre_attack_id: + - T1222.001 + - T1222 + product: + - Splunk Behavioral Analytics + risk_score: 72 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/ba_detections/endpoint/ssa_high_file_deletion_frequency.yml b/ba_detections/endpoint/ssa_high_file_deletion_frequency.yml new file mode 100644 index 0000000000..662869e71d --- /dev/null +++ b/ba_detections/endpoint/ssa_high_file_deletion_frequency.yml @@ -0,0 +1,50 @@ +name: High File Deletion Frequency +id: b6200efd-13bd-4336-920a-057b25bbcfaf +version: 1 +date: '2021-12-07' +author: Patrick Bareiss, Splunk +status: experimental +type: Anomaly +description: This detection detects a high amount of file deletions in a short time + for specific file types. This can be an indicator for a malicious insider. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)) | eval action=ucast(map_get(input_event, "action"), "string", + null), process=ucast(map_get(input_event, "process"), "string", null), file_name=ucast(map_get(input_event, + "file_name"), "string", null), file_path=ucast(map_get(input_event, "file_path"), + "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", + null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) + | where "Endpoint_Filesystem" IN(_datamodels) | where action="deleted" | where like(file_name, + "%.cmd") OR like(file_name, "%.ini") OR like(file_name, "%.gif") OR like(file_name, + "%.jpg") OR like(file_name, "%.jpeg") OR like(file_name, "%.db") OR like(file_name, + "%.doc%") OR like(file_name, "%.ps1") OR like(file_name, "%.xls%") OR like(file_name, + "%.ppt%") OR like(file_name, "%.bmp") OR like(file_name, "%.zip") OR like(file_name, + "%.rar") OR like(file_name, "%.7z") OR like(file_name, "%.chm") OR like(file_name, + "%.png") OR like(file_name, "%.log") OR like(file_name, "%.vbs") OR like(file_name, + "%.js") | stats count(file_name) AS count BY dest_user_id, dest_device_id, span(timestamp, + 10m) | where count > 20 | eval start_time=window_start, end_time=window_end, entities=mvappend(dest_user_id, + dest_device_id), body=create_map(["count", count]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Filesytem` node. +known_false_positives: user may delete bunch of pictures or files in a folder. +references: +- https://www.mandiant.com/resources/fin11-email-campaigns-precursor-for-ransomware-data-theft +- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html +tags: + analytic_story: + - Clop Ransomware + - Insider Threat + asset_type: Endpoint + atomic_guid: [] + confidence: 80 + drilldown_search: [] + impact: 90 + message: High frequency file deletion activity detected on host $Computer$ + mitre_attack_id: + - T1485 + product: + - Splunk Behavioral Analytics + risk_score: 72 + security_domain: endpoint +tests: [] diff --git a/ba_detections/endpoint/ssa_modify_acls_permission_of_files_or_folders.yml b/ba_detections/endpoint/ssa_modify_acls_permission_of_files_or_folders.yml new file mode 100644 index 0000000000..4273c3316d --- /dev/null +++ b/ba_detections/endpoint/ssa_modify_acls_permission_of_files_or_folders.yml @@ -0,0 +1,57 @@ +name: Modify ACLs Permission Of Files Or Folders +id: 9ae9a48a-cdbe-11eb-875a-acde48001122 +version: 3 +date: '2022-03-17' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: This analytic identifies suspicious modification of ACL permission to + a files or folder to make it available to everyone or to a specific user. This technique + may be used by the adversary to evade ACLs or protected files access. This changes + is commonly configured by the file or directory owner with appropriate permission. + This behavior raises suspicion if this command is seen on an endpoint utilized by + an account with no permission to do so. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), process=ucast(map_get(input_event, "process"), "string", + null), process_name=ucast(map_get(input_event, "process_name"), "string", null), + process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, + "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), + "string", null) | where process IS NOT NULL AND NOT like(process, "%:\\Windows\\QG\\ServiceNow%") + AND like(process, "%/g%") | where (match_regex(process, /(?i)everyone:/)=true OR + match_regex(process, /(?i)SYSTEM:/)=true OR match_regex(process, /(?i)S-1-1-0:/)=true) + | where (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "process", process, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used. +known_false_positives: System administrators may use this windows utility. filter + is needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - XMRig + asset_type: Endpoint + atomic_guid: [] + confidence: 70 + drilldown_search: [] + impact: 50 + message: A cacls process $process_name$ with commandline $cmd_line$ try to modify + a permission of a file or directory in host $dest_device_id$ + mitre_attack_id: + - T1222 + product: + - Splunk Behavioral Analytics + risk_score: 35 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_office_product_spawning_windows_script_host.yml b/ba_detections/endpoint/ssa_office_product_spawning_windows_script_host.yml new file mode 100644 index 0000000000..bf13298fa4 --- /dev/null +++ b/ba_detections/endpoint/ssa_office_product_spawning_windows_script_host.yml @@ -0,0 +1,58 @@ +name: Office Product Spawning Windows Script Host +id: 3ea3851a-8736-41a0-bc09-7e4485b48fa6 +version: 1 +date: '2022-10-12' +author: Michael Haag, Splunk +status: production +type: TTP +description: The following analytic will identify a Windows Office Product spawning + WScript.exe or CScript.exe. Tuning may be required based on legitimate application + usage that may spawn scripts from an Office product. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=lower(ucast(map_get(input_event, "parent_process_name"), + "string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name + IS NOT NULL | where (like(parent_process_name, "%\\\\winword.exe") OR like(parent_process_name, + "%\\\\excel.exe") OR like(parent_process_name, "%\\\\powerpnt.exe") OR like(parent_process_name, + "%\\\\mspub.exe") OR like(parent_process_name, "%\\\\visio.exe")) AND (process_name="wscript.exe" + OR process_name="cscript.exe") | eval start_time=timestamp, end_time=timestamp, + entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, + "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", + cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, + "process_path", process_path]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: False positives may be present based on macro based approved + documents in the organization. Filtering may be needed. +references: +- https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/ +tags: + analytic_story: + - Spearphishing Attachments + asset_type: Endpoint + atomic_guid: [] + confidence: 90 + drilldown_search: [] + impact: 70 + message: A Microsoft office parent process $parent_process_name$ has spawned a suspicious + child process $process_name$ on host $dest$. + mitre_attack_id: + - T1566 + - T1566.001 + product: + - Splunk Behavioral Analytics + risk_score: 63 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/ba_detections/endpoint/ssa_rare_parent_child_process_relationship.yml b/ba_detections/endpoint/ssa_rare_parent_child_process_relationship.yml new file mode 100644 index 0000000000..3c23c1ee6a --- /dev/null +++ b/ba_detections/endpoint/ssa_rare_parent_child_process_relationship.yml @@ -0,0 +1,78 @@ +name: Rare Parent-Child Process Relationship +id: cf090c78-bcc6-11eb-8529-0242ac130003 +version: 2 +date: '2021-11-30' +author: Peter Gael, Splunk; Ignacio Bermudez Corrales, Splunk +status: experimental +type: Anomaly +description: An attacker may use LOLBAS tools spawned from vulnerable applications + not typically used by system administrators. This analytic leverages the Splunk + Streaming ML DSP plugin to find rare parent/child relationships. The list of application + has been extracted from https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)) | eval parent_process=lower(ucast(map_get(input_event, + "parent_process_name"), "string", null)), parent_process_name=mvindex(split(parent_process, + "\\"), -1), process_name=lower(ucast(map_get(input_event, "process_name"), "string", + null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), dest_user_id=ucast(map_get(input_event, + "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where parent_process_name!=null | select parent_process_name, process_name, cmd_line, + timestamp, dest_device_id, dest_user_id | conditional_anomaly conditional="parent_process_name" + target="process_name" | where (process_name="powershell.exe" OR process_name="regsvcs.exe" + OR process_name="ftp.exe" OR process_name="dfsvc.exe" OR process_name="rasautou.exe" + OR process_name="schtasks.exe" OR process_name="xwizard.exe" OR process_name="findstr.exe" + OR process_name="esentutl.exe" OR process_name="cscript.exe" OR process_name="reg.exe" + OR process_name="csc.exe" OR process_name="atbroker.exe" OR process_name="print.exe" + OR process_name="pcwrun.exe" OR process_name="vbc.exe" OR process_name="rpcping.exe" + OR process_name="wsreset.exe" OR process_name="ilasm.exe" OR process_name="certutil.exe" + OR process_name="replace.exe" OR process_name="mshta.exe" OR process_name="bitsadmin.exe" + OR process_name="wscript.exe" OR process_name="ieexec.exe" OR process_name="cmd.exe" + OR process_name="microsoft.workflow.compiler.exe" OR process_name="runscripthelper.exe" + OR process_name="makecab.exe" OR process_name="forfiles.exe" OR process_name="desktopimgdownldr.exe" + OR process_name="control.exe" OR process_name="msbuild.exe" OR process_name="register-cimprovider.exe" + OR process_name="tttracer.exe" OR process_name="ie4uinit.exe" OR process_name="sc.exe" + OR process_name="bash.exe" OR process_name="hh.exe" OR process_name="cmstp.exe" + OR process_name="mmc.exe" OR process_name="jsc.exe" OR process_name="scriptrunner.exe" + OR process_name="odbcconf.exe" OR process_name="extexport.exe" OR process_name="msdt.exe" + OR process_name="diskshadow.exe" OR process_name="extrac32.exe" OR process_name="eventvwr.exe" + OR process_name="mavinject.exe" OR process_name="regasm.exe" OR process_name="gpscript.exe" + OR process_name="rundll32.exe" OR process_name="regsvr32.exe" OR process_name="regedit.exe" + OR process_name="msiexec.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="presentationhost.exe" + OR process_name="regini.exe" OR process_name="wmic.exe" OR process_name="runonce.exe" + OR process_name="syncappvpublishingserver.exe" OR process_name="verclsid.exe" OR + process_name="psr.exe" OR process_name="infdefaultinstall.exe" OR process_name="explorer.exe" + OR process_name="expand.exe" OR process_name="installutil.exe" OR process_name="netsh.exe" + OR process_name="wab.exe" OR process_name="dnscmd.exe" OR process_name="at.exe" + OR process_name="pcalua.exe" OR process_name="cmdkey.exe" OR process_name="msconfig.exe") + | eval input = (-1)*log(output) | adaptive_threshold algorithm="gaussian" threshold=0.001 + window=604800000L | where label AND input > mean | eval start_time = timestamp, + end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = + create_map(["process_name", process_name, "parent_process_name", parent_process_name, + "input", input, "mean", mean, "variance", variance, "output", output, "cmd_line", + cmd_line]) | into write_ssa_detected_events();' +how_to_implement: Collect endpoint data such as sysmon or 4688 events. +known_false_positives: Some custom tools used by administrators could be used rarely + to launch remotely applications. This might trigger false positives at the beginning + when it has not collected yet enough data to construct the baseline. +references: +- https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries +tags: + analytic_story: + - Unusual Processes + asset_type: Endpoint + atomic_guid: [] + confidence: 50 + drilldown_search: [] + impact: 50 + message: Rare Parent-Child Process Relationship + mitre_attack_id: + - T1203 + - T1059 + - T1053 + - T1072 + product: + - Splunk Behavioral Analytics + risk_score: 25 + security_domain: endpoint +tests: [] diff --git a/ba_detections/endpoint/ssa_resize_shadowstorage_volume.yml b/ba_detections/endpoint/ssa_resize_shadowstorage_volume.yml new file mode 100644 index 0000000000..0f72a477bb --- /dev/null +++ b/ba_detections/endpoint/ssa_resize_shadowstorage_volume.yml @@ -0,0 +1,57 @@ +name: Resize Shadowstorage Volume +id: dbc30554-d27e-11eb-9e5e-acde48001122 +version: 3 +date: '2021-11-30' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic identifies the resizing of shadowstorage using + vssadmin.exe to avoid the shadow volumes being made again. This technique is typically + found used by adversaries during a ransomware event and a precursor to deleting + the shadowstorage. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND like(cmd_line, "%resize%") AND like(cmd_line, "%shadowstorage%") + AND like(cmd_line, "%maxsize%") AND process_name="vssadmin.exe" | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: System administrators may resize the shadowstorage for valid + purposes. Filter as needed. +references: +- https://www.mandiant.com/resources/fin11-email-campaigns-precursor-for-ransomware-data-theft +- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html +tags: + analytic_story: + - Clop Ransomware + - Ransomware + asset_type: Endpoint + atomic_guid: [] + confidence: 80 + drilldown_search: [] + impact: 80 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to create a shadow + copy to perform offline password cracking. + mitre_attack_id: + - T1489 + product: + - Splunk Behavioral Analytics + risk_score: 64 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/windows-security.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_sdelete_application_execution.yml b/ba_detections/endpoint/ssa_sdelete_application_execution.yml new file mode 100644 index 0000000000..bd8d9242c3 --- /dev/null +++ b/ba_detections/endpoint/ssa_sdelete_application_execution.yml @@ -0,0 +1,69 @@ +name: Sdelete Application Execution +id: fcc52b9a-4616-11ec-8454-acde48001122 +version: 1 +date: '2021-11-15' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: This analytic will detect the execution of sdelete.exe attempting to + delete potentially important files that may related to adversary or insider threats + to destroy evidence or information sabotage. Sdelete is a SysInternals utility meant + to securely delete files on disk. This tool is commonly used to clear tracks and + artifact on the targeted host. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"), + "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", + null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", + null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), + parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), parent_cmd_line=ucast(map_get(input_event, "parent_process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line + IS NOT NULL AND process_name IS NOT NULL AND like(process_name, "%sdelete%") AND + (like (cmd_line, "%-c %") OR like (cmd_line, "%-f %")OR like (cmd_line, "%-p %") + OR like (cmd_line, "%-r %") OR like (cmd_line, "%-q %") OR like (cmd_line, "%-s + %") OR like (cmd_line, "%-z %") OR like (cmd_line, "%/accepteula%") OR like (cmd_line, + "%-nobanner%")OR like (cmd_line, "%.doc%")OR like (cmd_line, "%.xls%") OR like (cmd_line, + "%.ppt%")OR like (cmd_line, "%.rtf%") OR like (cmd_line, "%.pdf%") OR like (cmd_line, + "%.key%")OR like (cmd_line, "%.log%") OR like (cmd_line, "%.txt%") OR like (cmd_line, + "%.jpg%") OR like (cmd_line, "%.png%") OR like (cmd_line, "%.gif%") OR like (cmd_line, + "%.bmp%") OR like (cmd_line, "%.7z%") OR like (cmd_line, "%.zip%") OR like (cmd_line, + "%.rar%") OR like (cmd_line, "%.tar%") OR like (cmd_line, "%.gz%") OR like (cmd_line, + "%.xls%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "process_path", process_path, "parent_process_name", parent_process_name, + "parent_cmd_line", parent_cmd_line]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives should be limited, filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md +tags: + analytic_story: + - Information Sabotage + - Insider Threat + asset_type: Endpoint + atomic_guid: [] + confidence: 70 + drilldown_search: [] + impact: 60 + message: Sdelete process $process_name$ executed on $dest_device_id$ attempting + to permanently delete files by $dest_user_id$. + mitre_attack_id: + - T1485 + - T1070.004 + - T1070 + product: + - Splunk Behavioral Analytics + risk_score: 42 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/ba_detections/endpoint/ssa_system_process_running_from_unexpected_location.yml b/ba_detections/endpoint/ssa_system_process_running_from_unexpected_location.yml new file mode 100644 index 0000000000..01f7e08682 --- /dev/null +++ b/ba_detections/endpoint/ssa_system_process_running_from_unexpected_location.yml @@ -0,0 +1,256 @@ +name: System Process Running from Unexpected Location +id: 28179107-099a-464a-94d3-08301e6c055f +version: 4 +date: '2022-03-24' +author: Jose Hernadnez, Ignacio Bermudez Corrales, Splunk +status: production +type: Anomaly +description: An attacker tries might try to use different version of a system command + without overriding original, or they might try to avoid some detection running the + process from a different folder. This detection checks that a list of system processes + run inside C:\\Windows\System32 or C:\\Windows\SysWOW64 The list of system processes + has been extracted from https://github.com/splunk/security_content/blob/develop/lookups/is_windows_system_file.csv + and the original detection https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml +data_source: [] +search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, + "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"), + "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", + null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", + null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string", + null)), event_id=ucast(map_get(input_event, "event_id"), "string", null); + + $cond_1 = | from $ssa_input | where process_name="arp.exe" OR process_name="adaptertroubleshooter.exe" + OR process_name="applicationframehost.exe" OR process_name="atbroker.exe" OR process_name="authhost.exe" + OR process_name="autoworkplace.exe" OR process_name="axinstui.exe" OR process_name="backgroundtransferhost.exe" + OR process_name="bdehdcfg.exe" OR process_name="bdeuisrv.exe" OR process_name="bdeunlockwizard.exe" + OR process_name="bitlockerdeviceencryption.exe" OR process_name="bitlockerwizard.exe" + OR process_name="bitlockerwizardelev.exe" OR process_name="bytecodegenerator.exe" + OR process_name="camerasettingsuihost.exe" OR process_name="castsrv.exe" OR process_name="certenrollctrl.exe" + OR process_name="checknetisolation.exe" OR process_name="clipup.exe" OR process_name="cloudexperiencehostbroker.exe" + OR process_name="cloudnotifications.exe" OR process_name="cloudstoragewizard.exe" + OR process_name="compmgmtlauncher.exe" OR process_name="compattelrunner.exe" OR + process_name="computerdefaults.exe" OR process_name="credentialuibroker.exe" OR + process_name="dfdwiz.exe" OR process_name="dwwin.exe" OR process_name="dataexchangehost.exe" + OR process_name="defrag.exe" OR process_name="devicedisplayobjectprovider.exe" OR + process_name="deviceeject.exe" OR process_name="deviceenroller.exe" OR process_name="devicepairingwizard.exe" + OR process_name="deviceproperties.exe" OR process_name="disksnapshot.exe" OR process_name="dism.exe" + OR process_name="displayswitch.exe" OR process_name="dmnotificationbroker.exe" OR + process_name="dmomacpmo.exe" OR process_name="dpiscaling.exe" OR process_name="dsmusertask.exe" + OR process_name="dxpserver.exe" OR process_name="edpcleanup.exe" OR process_name="eosnotify.exe" + OR process_name="eap3host.exe" OR process_name="easpoliciesbrokerhost.exe" OR process_name="easeofaccessdialog.exe" + OR process_name="ehstorauthn.exe" OR process_name="fxscover.exe" OR process_name="fxssvc.exe" + OR process_name="fxsunatd.exe" OR process_name="filehistory.exe" OR process_name="fondue.exe" + OR process_name="gamepanel.exe" OR process_name="genvalobj.exe" OR process_name="gettingstarted.exe" + OR process_name="hostname.exe" OR process_name="icsentitlementhost.exe" OR process_name="infdefaultinstall.exe" + OR process_name="installagent.exe" OR process_name="languagecomponentsinstallercomhandler.exe" + OR process_name="launchtm.exe" OR process_name="launchwinapp.exe" OR process_name="legacynetuxhost.exe" + OR process_name="licensemanagershellext.exe" OR process_name="licensingui.exe" OR + process_name="locationnotificationwindows.exe" OR process_name="locationnotifications.exe" + OR process_name="locator.exe" OR process_name="lockapphost.exe" OR process_name="lockscreencontentserver.exe" + OR process_name="logonui.exe" OR process_name="lsaiso.exe" OR process_name="mdeserver.exe" + OR process_name="mdmagent.exe" OR process_name="mdmappinstaller.exe" OR process_name="mrinfo.exe" + OR process_name="mrt.exe" OR process_name="mschedexe.exe" OR process_name="magnify.exe" + OR process_name="mbaeparsertask.exe" OR process_name="mdres.exe" OR process_name="mdsched.exe" + OR process_name="migautoplay.exe" OR process_name="mpsigstub.exe" OR process_name="msspellcheckinghost.exe" + OR process_name="muiunattend.exe" OR process_name="multidigimon.exe" OR process_name="musnotification.exe" + OR process_name="musnotificationux.exe" OR process_name="napstat.exe" OR process_name="netstat.exe" + OR process_name="narrator.exe" OR process_name="netcfgnotifyobjecthost.exe" OR process_name="netevtfwdr.exe" + OR process_name="netproj.exe" OR process_name="netplwiz.exe" OR process_name="networkuxbroker.exe"; + + $cond_2 = | from $ssa_input | where process_name="openwith.exe" OR process_name="optionalfeatures.exe" + OR process_name="pathping.exe" OR process_name="ping.exe" OR process_name="passwordonwakesettingflyout.exe" + OR process_name="pickerhost.exe" OR process_name="pkgmgr.exe" OR process_name="pnpunattend.exe" + OR process_name="pnputil.exe" OR process_name="presentationhost.exe" OR process_name="presentationsettings.exe" + OR process_name="printbrmui.exe" OR process_name="printdialoghost.exe" OR process_name="printdialoghost3d.exe" + OR process_name="printisolationhost.exe" OR process_name="proximityuxhost.exe" OR + process_name="rdspnf.exe" OR process_name="rmactivate.exe" OR process_name="rmactivate_isv.exe" + OR process_name="rmactivate_ssp.exe" OR process_name="rmactivate_ssp_isv.exe" OR + process_name="route.exe" OR process_name="rdpsa.exe" OR process_name="rdpsaproxy.exe" + OR process_name="rdpsauachelper.exe" OR process_name="reagentc.exe" OR process_name="recoverydrive.exe" + OR process_name="register-cimprovider.exe" OR process_name="registeriepkeys.exe" + OR process_name="relpost.exe" OR process_name="remoteposworker.exe" OR process_name="rmclient.exe" + OR process_name="rpcping.exe" OR process_name="runlegacycplelevated.exe" OR process_name="runtimebroker.exe" + OR process_name="sihclient.exe" OR process_name="searchfilterhost.exe" OR process_name="searchindexer.exe" + OR process_name="searchprotocolhost.exe" OR process_name="secedit.exe" OR process_name="sensordataservice.exe" + OR process_name="setieinstalleddate.exe" OR process_name="settingsynchost.exe" OR + process_name="slidetoshutdown.exe" OR process_name="smartscreensettings.exe" OR + process_name="sndvol.exe" OR process_name="snippingtool.exe" OR process_name="soundrecorder.exe" + OR process_name="spaceagent.exe" OR process_name="sppextcomobj.exe" OR process_name="srtasks.exe" + OR process_name="stikynot.exe" OR process_name="synchost.exe" OR process_name="sysreseterr.exe" + OR process_name="systempropertiesadvanced.exe" OR process_name="systempropertiescomputername.exe" + OR process_name="systempropertiesdataexecutionprevention.exe" OR process_name="systempropertieshardware.exe" + OR process_name="systempropertiesperformance.exe" OR process_name="systempropertiesprotection.exe" + OR process_name="systempropertiesremote.exe" OR process_name="systemsettingsadminflows.exe" + OR process_name="systemsettingsbroker.exe" OR process_name="systemsettingsremovedevice.exe" + OR process_name="tcpsvcs.exe" OR process_name="tracert.exe" OR process_name="tstheme.exe" + OR process_name="tswbprxy.exe" OR process_name="tapiunattend.exe" OR process_name="taskmgr.exe" + OR process_name="thumbnailextractionhost.exe" OR process_name="tokenbrokercookies.exe" + OR process_name="tpminit.exe" OR process_name="tswpfwrp.exe" OR process_name="ui0detect.exe" + OR process_name="upgraderesultsui.exe" OR process_name="useraccountbroker.exe" OR + process_name="useraccountcontrolsettings.exe" OR process_name="usoclient.exe" OR + process_name="utilman.exe" OR process_name="vssvc.exe" OR process_name="vaultcmd.exe" + OR process_name="vaultsysui.exe" OR process_name="wfs.exe" OR process_name="wmpdmc.exe" + OR process_name="wpdshextautoplay.exe" OR process_name="wscollect.exe" OR process_name="wsmanhttpconfig.exe" + OR process_name="wsreset.exe" OR process_name="wudfhost.exe" OR process_name="wwahost.exe" + OR process_name="wallpaperhost.exe" OR process_name="webcache.exe" OR process_name="werfault.exe" + OR process_name="werfaultsecure.exe" OR process_name="winsat.exe" OR process_name="windows.media.backgroundplayback.exe" + OR process_name="windowsactiondialog.exe" OR process_name="windowsanytimeupgrade.exe" + OR process_name="windowsanytimeupgraderesults.exe"; + + $cond_3 = | from $ssa_input | where process_name="windowsanytimeupgradeui.exe" OR + process_name="windowsupdateelevatedinstaller.exe" OR process_name="workfolders.exe" + OR process_name="wpcmon.exe" OR process_name="acu.exe" OR process_name="aitagent.exe" + OR process_name="aitstatic.exe" OR process_name="alg.exe" OR process_name="appidcertstorecheck.exe" + OR process_name="appidpolicyconverter.exe" OR process_name="at.exe" OR process_name="attrib.exe" + OR process_name="audiodg.exe" OR process_name="auditpol.exe" OR process_name="autochk.exe" + OR process_name="autoconv.exe" OR process_name="autofmt.exe" OR process_name="baaupdate.exe" + OR process_name="backgroundtaskhost.exe" OR process_name="bcastdvr.exe" OR process_name="bcdboot.exe" + OR process_name="bcdedit.exe" OR process_name="bdechangepin.exe" OR process_name="bdeunlock.exe" + OR process_name="bitsadmin.exe" OR process_name="bootcfg.exe" OR process_name="bootim.exe" + OR process_name="bootsect.exe" OR process_name="bridgeunattend.exe" OR process_name="browser_broker.exe" + OR process_name="bthudtask.exe" OR process_name="cacls.exe" OR process_name="calc.exe" + OR process_name="cdpreference.exe" OR process_name="certreq.exe" OR process_name="certutil.exe" + OR process_name="change.exe" OR process_name="changepk.exe" OR process_name="charmap.exe" + OR process_name="chglogon.exe" OR process_name="chgport.exe" OR process_name="chgusr.exe" + OR process_name="chkdsk.exe" OR process_name="chkntfs.exe" OR process_name="choice.exe" + OR process_name="cipher.exe" OR process_name="cleanmgr.exe" OR process_name="cliconfg.exe" + OR process_name="clip.exe" OR process_name="cmd.exe" OR process_name="cmdkey.exe" + OR process_name="cmdl32.exe" OR process_name="cmmon32.exe" OR process_name="cmstp.exe" + OR process_name="cofire.exe" OR process_name="colorcpl.exe" OR process_name="comp.exe" + OR process_name="compact.exe" OR process_name="conhost.exe" OR process_name="consent.exe" + OR process_name="control.exe" OR process_name="convert.exe" OR process_name="credwiz.exe" + OR process_name="cscript.exe" OR process_name="csrss.exe" OR process_name="ctfmon.exe" + OR process_name="cttune.exe" OR process_name="cttunesvr.exe" OR process_name="dashost.exe" + OR process_name="dccw.exe" OR process_name="dcomcnfg.exe" OR process_name="ddodiag.exe" + OR process_name="dfrgui.exe" OR process_name="dialer.exe" OR process_name="diantz.exe" + OR process_name="dinotify.exe" OR process_name="diskpart.exe" OR process_name="diskperf.exe" + OR process_name="diskraid.exe" OR process_name="dispdiag.exe" OR process_name="djoin.exe" + OR process_name="dllhost.exe" OR process_name="dllhst3g.exe" OR process_name="dmcertinst.exe" + OR process_name="dmcfghost.exe" OR process_name="dmclient.exe" OR process_name="dnscacheugc.exe" + OR process_name="doskey.exe" OR process_name="dpapimig.exe" OR process_name="dpnsvr.exe" + OR process_name="driverquery.exe" OR process_name="drvcfg.exe" OR process_name="drvinst.exe" + OR process_name="dsregcmd.exe" OR process_name="dstokenclean.exe" OR process_name="dvdplay.exe" + OR process_name="dvdupgrd.exe" OR process_name="dwm.exe" OR process_name="dxdiag.exe" + OR process_name="easinvoker.exe" OR process_name="efsui.exe"; + + $cond_4 = | from $ssa_input | where process_name="embeddedapplauncher.exe" OR process_name="esentutl.exe" + OR process_name="eudcedit.exe" OR process_name="eventcreate.exe" OR process_name="eventvwr.exe" + OR process_name="expand.exe" OR process_name="extrac32.exe" OR process_name="fc.exe" + OR process_name="fhmanagew.exe" OR process_name="find.exe" OR process_name="findstr.exe" + OR process_name="finger.exe" OR process_name="fixmapi.exe" OR process_name="fltmc.exe" + OR process_name="fodhelper.exe" OR process_name="fontdrvhost.exe" OR process_name="fontview.exe" + OR process_name="forfiles.exe" OR process_name="fsavailux.exe" OR process_name="fsquirt.exe" + OR process_name="fsutil.exe" OR process_name="ftp.exe" OR process_name="fvenotify.exe" + OR process_name="fveprompt.exe" OR process_name="getmac.exe" OR process_name="gpresult.exe" + OR process_name="gpscript.exe" OR process_name="gpupdate.exe" OR process_name="grpconv.exe" + OR process_name="hdwwiz.exe" OR process_name="help.exe" OR process_name="hwrcomp.exe" + OR process_name="hwrreg.exe" OR process_name="icacls.exe" OR process_name="icardagt.exe" + OR process_name="icsunattend.exe" OR process_name="ie4uinit.exe" OR process_name="ieunatt.exe" + OR process_name="ieetwcollector.exe" OR process_name="iexpress.exe" OR process_name="immersivetpmvscmgrsvr.exe" + OR process_name="ipconfig.exe" OR process_name="irftp.exe" OR process_name="iscsicli.exe" + OR process_name="iscsicpl.exe" OR process_name="isoburn.exe" OR process_name="klist.exe" + OR process_name="ksetup.exe" OR process_name="ktmutil.exe" OR process_name="label.exe" + OR process_name="licensingdiag.exe" OR process_name="lodctr.exe" OR process_name="logagent.exe" + OR process_name="logman.exe" OR process_name="logoff.exe" OR process_name="lpkinstall.exe" + OR process_name="lpksetup.exe" OR process_name="lpremove.exe" OR process_name="lsass.exe" + OR process_name="lsm.exe" OR process_name="makecab.exe" OR process_name="manage-bde.exe" + OR process_name="mblctr.exe" OR process_name="mcbuilder.exe" OR process_name="mctadmin.exe" + OR process_name="mfpmp.exe" OR process_name="mmc.exe" OR process_name="mobsync.exe" + OR process_name="mountvol.exe" OR process_name="mpnotify.exe" OR process_name="msconfig.exe" + OR process_name="msdt.exe" OR process_name="msdtc.exe" OR process_name="msfeedssync.exe" + OR process_name="msg.exe" OR process_name="mshta.exe" OR process_name="msiexec.exe" + OR process_name="msinfo32.exe" OR process_name="mspaint.exe" OR process_name="msra.exe" + OR process_name="mstsc.exe" OR process_name="mtstocom.exe" OR process_name="nbtstat.exe" + OR process_name="ndadmin.exe" OR process_name="net.exe" OR process_name="net1.exe" + OR process_name="netbtugc.exe" OR process_name="netcfg.exe" OR process_name="netiougc.exe" + OR process_name="netsh.exe" OR process_name="newdev.exe" OR process_name="nltest.exe" + OR process_name="notepad.exe" OR process_name="nslookup.exe" OR process_name="ntoskrnl.exe" + OR process_name="ntprint.exe" OR process_name="ocsetup.exe" OR process_name="odbcad32.exe" + OR process_name="odbcconf.exe" OR process_name="omadmclient.exe" OR process_name="omadmprc.exe"; + + $cond_5 = | from $ssa_input | where process_name="openfiles.exe" OR process_name="osk.exe" + OR process_name="p2phost.exe" OR process_name="pcalua.exe" OR process_name="pcaui.exe" + OR process_name="pcawrk.exe" OR process_name="pcwrun.exe" OR process_name="perfmon.exe" + OR process_name="phoneactivate.exe" OR process_name="plasrv.exe" OR process_name="poqexec.exe" + OR process_name="powercfg.exe" OR process_name="prevhost.exe" OR process_name="print.exe" + OR process_name="printfilterpipelinesvc.exe" OR process_name="printui.exe" OR process_name="proquota.exe" + OR process_name="provtool.exe" OR process_name="psr.exe" OR process_name="pwlauncher.exe" + OR process_name="qappsrv.exe" OR process_name="qprocess.exe" OR process_name="query.exe" + OR process_name="quser.exe" OR process_name="qwinsta.exe" OR process_name="rasautou.exe" + OR process_name="rasdial.exe" OR process_name="raserver.exe" OR process_name="rasphone.exe" + OR process_name="rdpclip.exe" OR process_name="rdpinput.exe" OR process_name="rdrleakdiag.exe" + OR process_name="recdisc.exe" OR process_name="recover.exe" OR process_name="reg.exe" + OR process_name="regedt32.exe" OR process_name="regini.exe" OR process_name="regsvr32.exe" + OR process_name="rekeywiz.exe" OR process_name="relog.exe" OR process_name="repair-bde.exe" + OR process_name="replace.exe" OR process_name="reset.exe" OR process_name="resmon.exe" + OR process_name="rmttpmvscmgrsvr.exe" OR process_name="rrinstaller.exe" OR process_name="rstrui.exe" + OR process_name="runas.exe" OR process_name="rundll32.exe" OR process_name="runonce.exe" + OR process_name="rwinsta.exe" OR process_name="sbunattend.exe" OR process_name="sc.exe" + OR process_name="schtasks.exe" OR process_name="sdbinst.exe" OR process_name="sdchange.exe" + OR process_name="sdclt.exe" OR process_name="sdiagnhost.exe" OR process_name="secinit.exe" + OR process_name="services.exe" OR process_name="sessionmsg.exe" OR process_name="sethc.exe" + OR process_name="setspn.exe" OR process_name="setupcl.exe" OR process_name="setupugc.exe" + OR process_name="setx.exe" OR process_name="sfc.exe" OR process_name="shadow.exe" + OR process_name="shrpubw.exe" OR process_name="shutdown.exe" OR process_name="sigverif.exe" + OR process_name="sihost.exe" OR process_name="slui.exe" OR process_name="smss.exe" + OR process_name="snmptrap.exe" OR process_name="sort.exe" OR process_name="spinstall.exe" + OR process_name="spoolsv.exe" OR process_name="sppsvc.exe" OR process_name="spreview.exe" + OR process_name="srdelayed.exe" OR process_name="subst.exe" OR process_name="svchost.exe" + OR process_name="sxstrace.exe" OR process_name="syskey.exe" OR process_name="systeminfo.exe" + OR process_name="systemreset.exe" OR process_name="systray.exe" OR process_name="tabcal.exe" + OR process_name="takeown.exe" OR process_name="taskeng.exe" OR process_name="taskhost.exe" + OR process_name="taskhostw.exe" OR process_name="taskkill.exe" OR process_name="tasklist.exe" + OR process_name="taskmgr.exe" OR process_name="tcmsetup.exe" OR process_name="timeout.exe" + OR process_name="tpmvscmgr.exe" OR process_name="tpmvscmgrsvr.exe"; + + $cond_6 = | from $ssa_input | where process_name="tracerpt.exe" OR process_name="tscon.exe" + OR process_name="tsdiscon.exe" OR process_name="tskill.exe" OR process_name="typeperf.exe" + OR process_name="tzsync.exe" OR process_name="tzutil.exe" OR process_name="ucsvc.exe" + OR process_name="unlodctr.exe" OR process_name="unregmp2.exe" OR process_name="upnpcont.exe" + OR process_name="userinit.exe" OR process_name="vds.exe" OR process_name="vdsldr.exe" + OR process_name="verclsid.exe" OR process_name="verifier.exe" OR process_name="verifiergui.exe" + OR process_name="vmicsvc.exe" OR process_name="vssadmin.exe" OR process_name="w32tm.exe" + OR process_name="waitfor.exe" OR process_name="wbadmin.exe" OR process_name="wbengine.exe" + OR process_name="wecutil.exe" OR process_name="wermgr.exe" OR process_name="wevtutil.exe" + OR process_name="wextract.exe" OR process_name="where.exe" OR process_name="whoami.exe" + OR process_name="wiaacmgr.exe" OR process_name="wiawow64.exe" OR process_name="wifitask.exe" + OR process_name="wimserv.exe" OR process_name="wininit.exe" OR process_name="winload.exe" + OR process_name="winlogon.exe" OR process_name="winresume.exe" OR process_name="winrs.exe" + OR process_name="winrshost.exe" OR process_name="winver.exe" OR process_name="wisptis.exe" + OR process_name="wkspbroker.exe" OR process_name="wksprt.exe" OR process_name="wlanext.exe" + OR process_name="wlrmdr.exe" OR process_name="wowreg32.exe" OR process_name="wpnpinst.exe" + OR process_name="wpr.exe" OR process_name="write.exe" OR process_name="wscript.exe" + OR process_name="wsmprovhost.exe" OR process_name="wsqmcons.exe" OR process_name="wuapihost.exe" + OR process_name="wuapp.exe" OR process_name="wuauclt.exe" OR process_name="wusa.exe" + OR process_name="xcopy.exe" OR process_name="xpsrchvw.exe" OR process_name="xwizard.exe"; + + | from $cond_1 | union $cond_2 | union $cond_3 | union $cond_4 | union $cond_5 | + union $cond_6 | where match_regex(process_path, /(?i)\\windows\\system32/)=false + AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id", + event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();' +how_to_implement: Collect endpoint data such as sysmon or 4688 events. +known_false_positives: None +references: [] +tags: + analytic_story: + - Windows Defense Evasion Tactics + - Masquerading - Rename System Utilities + asset_type: Endpoint + atomic_guid: [] + confidence: 80 + drilldown_search: [] + impact: 70 + message: A system process $process_name$ with commandline $cmd_line$ spawn in non-default + folder path in host $dest_device_id$ + mitre_attack_id: + - T1036 + product: + - Splunk Behavioral Analytics + risk_score: 56 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/windows-security.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_unified_messaging_service_spawning_a_process.yml b/ba_detections/endpoint/ssa_unified_messaging_service_spawning_a_process.yml new file mode 100644 index 0000000000..b806676fd4 --- /dev/null +++ b/ba_detections/endpoint/ssa_unified_messaging_service_spawning_a_process.yml @@ -0,0 +1,60 @@ +name: Unified Messaging Service Spawning a Process +id: f1126df0-7bd5-11eb-988f-acde48001122 +version: 2 +date: '2022-10-03' +author: Michael Haag, Splunk +status: production +type: Anomaly +description: This detection identifies Microsoft Exchange Server's Unified Messaging + services, umworkerprocess.exe and umservice.exe, spawning a child process, indicating + possible exploitation of CVE-2021-26857 vulnerability. The query filters out werfault.exe + and wermgr.exe mostly due to potential false positives, however, if there is an + excessive amount of "wermgr.exe" or "WerFault.exe" failures, it may be due to the + active exploitation. During triage, identify any additional suspicious parallel + processes. Identify any recent out of place file modifications. Review Exchange + logs following Microsofts guide. To contain, perform egress filtering or restrict + public access to Exchange. In final, patch the vulnerablity and monitor. +data_source: +- Sysmon Event ID 1 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="umworkerprocess.exe" + OR Processes.parent_process_name="UMService.exe" NOT (Processes.process_name IN + ("wermgr.exe", "werfault.exe")) by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `unified_messaging_service_spawning_a_process_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Unknown. Tune out child processes as needed to limit volume + of false positives. +references: +- https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/ +- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/ +- https://www.rapid7.com/blog/post/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day/ +tags: + analytic_story: + - HAFNIUM Group + - ProxyShell + - ProxyNotShell + asset_type: Endpoint + atomic_guid: [] + confidence: 80 + drilldown_search: [] + impact: 70 + message: Possible CVE-2021-26857 exploitation on $dest$ + mitre_attack_id: + - T1190 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 56 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon_umservices.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/ba_detections/endpoint/ssa_wbadmin_delete_system_backups.yml b/ba_detections/endpoint/ssa_wbadmin_delete_system_backups.yml new file mode 100644 index 0000000000..940ec37384 --- /dev/null +++ b/ba_detections/endpoint/ssa_wbadmin_delete_system_backups.yml @@ -0,0 +1,56 @@ +name: WBAdmin Delete System Backups +id: 71efbf52-4dbb-4c00-a520-306aa546cbb7 +version: 1 +date: '2021-12-07' +author: Michael Haag, Splunk +status: production +type: TTP +description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator + Tool) that delete backup files. This is typically used by ransomware to prevent + recovery. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + (cmd_line IS NOT NULL AND process_name IS NOT NULL) | where process_name="wbadmin.exe" + | where like (cmd_line, "%delete%") OR like (cmd_line, "%catalog%") OR like (cmd_line, "%systemstatebackup%") + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint_Processess` datamodel. +known_false_positives: Administrators may modify the boot configuration. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md +- https://thedfirreport.com/2020/10/08/ryuks-return/ +- https://attack.mitre.org/techniques/T1490/ +- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin +tags: + analytic_story: + - Ryuk Ransomware + - Ransomware + asset_type: Endpoint + atomic_guid: [] + confidence: 50 + drilldown_search: [] + impact: 30 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete system + backups. + mitre_attack_id: + - T1490 + product: + - Splunk Behavioral Analytics + risk_score: 15 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-security_bcdedit_wbadmin.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_wevtutil_usage_to_clear_logs.yml b/ba_detections/endpoint/ssa_wevtutil_usage_to_clear_logs.yml new file mode 100644 index 0000000000..4cd6162413 --- /dev/null +++ b/ba_detections/endpoint/ssa_wevtutil_usage_to_clear_logs.yml @@ -0,0 +1,61 @@ +name: WevtUtil Usage To Clear Logs +id: 5438113c-cdd9-11eb-93b8-acde48001122 +version: 2 +date: '2021-06-15' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The wevtutil.exe application is the windows event log utility. This searches + for wevtutil.exe with parameters for clearing the application, security, setup, + powershell, sysmon, or system event logs. +data_source: [] +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND like(cmd_line, "% cl %") AND (match_regex(cmd_line, + /(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true OR match_regex(cmd_line, + /(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true OR match_regex(cmd_line, + /(?i)setup/)=true OR match_regex(cmd_line, /(?i)powershell/)=true) AND process_name="wevtutil.exe" + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, + "process_name", process_name, "parent_process_name", parent_process_name, "process_path", + process_path]) | into write_ssa_detected_events();' +how_to_implement: You must be ingesting data that records process activity from your + hosts to populate the Endpoint data model in the Processes node. You must also be + ingesting logs with both the process name and command line from your endpoints. + The command-line arguments are mapped to the "process" field in the Endpoint data + model. +known_false_positives: The wevtutil.exe application is a legitimate Windows event + log utility. Administrators may use it to manage Windows event logs. +references: +- https://www.splunk.com/en_us/blog/security/detecting-clop-ransomware.html +tags: + analytic_story: + - Windows Log Manipulation + - Ransomware + - Clop Ransomware + - Insider Threat + - CISA AA22-264A + asset_type: Endpoint + atomic_guid: [] + confidence: 90 + drilldown_search: [] + impact: 70 + message: A wevtutil process $process_name$ with commandline $cmd_line$ to clear + event logs in host $dest_device_id$ + mitre_attack_id: + - T1070 + - T1070.001 + product: + - Splunk Behavioral Analytics + risk_score: 63 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_wevtutil_usage_to_disable_logs.yml b/ba_detections/endpoint/ssa_wevtutil_usage_to_disable_logs.yml new file mode 100644 index 0000000000..062adc5754 --- /dev/null +++ b/ba_detections/endpoint/ssa_wevtutil_usage_to_disable_logs.yml @@ -0,0 +1,57 @@ +name: Wevtutil Usage To Disable Logs +id: a4bdc944-cdd9-11eb-ac97-acde48001122 +version: 2 +date: '2021-06-15' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: This search is to detect execution of wevtutil.exe to disable logs. This + technique was seen in several ransomware to disable the event logs to evade alerts + and detections in compromised host. +data_source: [] +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line, "%/e:false%") + AND process_name="wevtutil.exe" | eval start_time=timestamp, end_time=timestamp, + entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, + "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id, + "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, + "process_path", process_path]) | into write_ssa_detected_events();' +how_to_implement: You must be ingesting data that records process activity from your + hosts to populate the Endpoint data model in the Processes node. You must also be + ingesting logs with both the process name and command line from your endpoints. + The command-line arguments are mapped to the "process" field in the Endpoint data + model. +known_false_positives: network operator may disable audit event logs for debugging + purposes. +references: +- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/ +tags: + analytic_story: + - Windows Log Manipulation + - Ransomware + - Insider Threat + - Information Sabotage + asset_type: Endpoint + atomic_guid: [] + confidence: 90 + drilldown_search: [] + impact: 70 + message: A wevtutil process $process_name$ with commandline $cmd_line$ to disable + event logs in host $dest_device_id$ + mitre_attack_id: + - T1070 + - T1070.001 + product: + - Splunk Behavioral Analytics + risk_score: 63 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_windows_bits_job_persistence.yml b/ba_detections/endpoint/ssa_windows_bits_job_persistence.yml new file mode 100644 index 0000000000..1c6ca92391 --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_bits_job_persistence.yml @@ -0,0 +1,65 @@ +name: Windows Bits Job Persistence +id: 1e25e97a-8ea4-11ec-9767-acde48001122 +version: 1 +date: '2022-02-15' +author: Michael Haag, Splunk +status: production +type: TTP +description: The following query identifies Microsoft Background Intelligent Transfer + Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint. + The query identifies the parameters used to create, resume or add a file to a BITS + job. Typically seen combined in a oneliner or ran in sequence. If identified, review + the BITS job created and capture any files written to disk. It is possible for BITS + to be used to upload files and this may require further network data analysis to + identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. +data_source: [] +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bitsadmin.exe" + AND (like (cmd_line, "%create%") OR like (cmd_line, "%addfile%")OR like (cmd_line, + "%setnotifyflags%") OR like (cmd_line, "%setnotifycmdline%") OR like (cmd_line, + "%setminretrydelay%") OR like (cmd_line, "%setcustomheaders%") OR like (cmd_line, + "%resume%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, + "process_name", process_name, "parent_process_name", parent_process_name, "process_path", + process_path]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Limited false positives will be present. Typically, applications + will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments + (legitimate applications) or parent process. +references: +- https://attack.mitre.org/techniques/T1197/ +- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute +- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ +tags: + analytic_story: + - BITS Jobs + - Living Off The Land + asset_type: Endpoint + atomic_guid: [] + confidence: 80 + drilldown_search: [] + impact: 70 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $dest_user_id$ attempting to persist using BITS. + mitre_attack_id: + - T1197 + product: + - Splunk Behavioral Analytics + risk_score: 56 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_windows_bitsadmin_download_file.yml b/ba_detections/endpoint/ssa_windows_bitsadmin_download_file.yml new file mode 100644 index 0000000000..45477665d6 --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_bitsadmin_download_file.yml @@ -0,0 +1,69 @@ +name: Windows Bitsadmin Download File +id: d76e8188-8f5a-11ec-ace4-acde48001122 +version: 1 +date: '2022-02-16' +author: Michael Haag, Splunk +status: production +type: TTP +description: The following query identifies Microsoft Background Intelligent Transfer + Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote + object. In addition, look for `download` or `upload` on the command-line, the switches + are not required to perform a transfer. Capture any files downloaded. Review the + reputation of the IP or domain used. Typically once executed, a follow on command + will be used to execute the dropped file. Note that the network connection or file + modification events related will not spawn or create from `bitsadmin.exe`, but the + artifacts will appear in a parallel process of `svchost.exe` with a command-line + similar to `svchost.exe -k netsvcs -s BITS`. It's important to review all parallel + and child processes to capture any behaviors and artifacts. In some suspicious and + malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose` + to list out the jobs during investigation. +data_source: [] +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bitsadmin.exe" + AND (like (cmd_line, "%transfer%")) | eval start_time=timestamp, end_time=timestamp, + entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, + "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id, + "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, + "process_path", process_path]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Limited false positives, however it may be required to filter + based on parent process name or network connection. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download +- https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md +- https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool +- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ +tags: + analytic_story: + - Ingress Tool Transfer + - BITS Jobs + - DarkSide Ransomware + - Living Off The Land + asset_type: Endpoint + atomic_guid: [] + confidence: 70 + drilldown_search: [] + impact: 70 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $dest_user_id$ attempting to download a file. + mitre_attack_id: + - T1197 + - T1105 + product: + - Splunk Behavioral Analytics + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_windows_certutil_decode_file.yml b/ba_detections/endpoint/ssa_windows_certutil_decode_file.yml new file mode 100644 index 0000000000..d285cb1046 --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_certutil_decode_file.yml @@ -0,0 +1,64 @@ +name: Windows CertUtil Decode File +id: b06983f4-8f72-11ec-ab50-acde48001122 +version: 1 +date: '2022-02-16' +author: Michael Haag, Splunk +status: production +type: TTP +description: CertUtil.exe may be used to `encode` and `decode` a file, including PE + and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----` + and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded + file that was downloaded. Once decoded, it will be loaded by a parallel process. + Note that there are two additional command switches that may be used - `encodehex` + and `decodehex`. Similarly, the file will be encoded in HEX and later decoded for + further execution. During triage, identify the source of the file being decoded. + Review its contents or execution behavior for further analysis. +data_source: [] +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe" + AND (like (cmd_line, "%decode%")) | eval start_time=timestamp, end_time=timestamp, + entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, + "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id, + "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, + "process_path", process_path]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Typically seen used to `encode` files, but it is possible to + see legitimate use of `decode`. Filter based on parent-child relationship, file + paths, endpoint or user. +references: +- https://attack.mitre.org/techniques/T1140/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1140/T1140.md +- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil +- https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/ +tags: + analytic_story: + - Deobfuscate-Decode Files or Information + - Living Off The Land + asset_type: Endpoint + atomic_guid: [] + confidence: 80 + drilldown_search: [] + impact: 50 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to decode a file + on disk. + mitre_attack_id: + - T1140 + product: + - Splunk Behavioral Analytics + risk_score: 40 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/atomic_red_team/encode-windows-security.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_windows_certutil_urlcache_download.yml b/ba_detections/endpoint/ssa_windows_certutil_urlcache_download.yml new file mode 100644 index 0000000000..f227437b2e --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_certutil_urlcache_download.yml @@ -0,0 +1,60 @@ +name: Windows CertUtil URLCache Download +id: 8cb1ad38-8f6d-11ec-87a3-acde48001122 +version: 1 +date: '2022-02-16' +author: Michael Haag, Splunk +status: production +type: TTP +description: Certutil.exe may download a file from a remote destination using `-urlcache`. + This behavior does require a URL to be passed on the command-line. In addition, + `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will + be used. It is not entirely common for `certutil.exe` to contact public IP space. + However, it is uncommon for `certutil.exe` to write files to world writeable paths.\ + During triage, capture any files on disk and review. Review the reputation of the + remote IP or domain in question. +data_source: [] +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe" + AND (like (cmd_line, "%urlcache%") AND like (cmd_line, "%split%")) OR (like (cmd_line, + "%urlcache%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, + "process_name", process_name, "parent_process_name", parent_process_name, "process_path", + process_path]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Limited false positives in most environments, however tune + as needed based on parent-child relationship or network connection. +references: +- https://attack.mitre.org/techniques/T1105/ +- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats +- https://web.archive.org/web/20210921110637/https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html +tags: + analytic_story: + - Ingress Tool Transfer + - DarkSide Ransomware + - Living Off The Land + asset_type: Endpoint + atomic_guid: [] + confidence: 100 + drilldown_search: [] + impact: 90 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file. + mitre_attack_id: + - T1105 + product: + - Splunk Behavioral Analytics + risk_score: 90 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_windows_certutil_verifyctl_download.yml b/ba_detections/endpoint/ssa_windows_certutil_verifyctl_download.yml new file mode 100644 index 0000000000..8bc4bec95b --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_certutil_verifyctl_download.yml @@ -0,0 +1,61 @@ +name: Windows CertUtil VerifyCtl Download +id: 9ac29c40-8f6b-11ec-b19a-acde48001122 +version: 1 +date: '2022-02-16' +author: Michael Haag, Splunk +status: production +type: TTP +description: 'Certutil.exe may download a file from a remote destination using `-VerifyCtl`. + This behavior does require a URL to be passed on the command-line. In addition, + `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will + be used. It is not entirely common for `certutil.exe` to contact public IP space. + \ During triage, capture any files on disk and review. Review the reputation of + the remote IP or domain in question. Using `-VerifyCtl`, the file will either be + written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\`. ' +data_source: [] +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe" + AND (like (cmd_line, "%verifyctl%") AND like (cmd_line, "%split%")) OR (like (cmd_line, + "%verifyctl%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, + "process_name", process_name, "parent_process_name", parent_process_name, "process_path", + process_path]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Limited false positives in most environments, however tune + as needed based on parent-child relationship or network connection. +references: +- https://attack.mitre.org/techniques/T1105/ +- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/ +- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl +- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats +tags: + analytic_story: + - Ingress Tool Transfer + - DarkSide Ransomware + - Living Off The Land + asset_type: Endpoint + atomic_guid: [] + confidence: 100 + drilldown_search: [] + impact: 90 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file. + mitre_attack_id: + - T1105 + product: + - Splunk Behavioral Analytics + risk_score: 90 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_windows_com_hijacking_inprocserver32_modification.yml b/ba_detections/endpoint/ssa_windows_com_hijacking_inprocserver32_modification.yml new file mode 100644 index 0000000000..71f2835425 --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_com_hijacking_inprocserver32_modification.yml @@ -0,0 +1,61 @@ +name: Windows COM Hijacking InprocServer32 Modification +id: 0ae05a0f-bc84-456b-822a-a5b9c081c7ca +version: 1 +date: '2022-10-12' +author: Michael Haag, Splunk +status: production +type: TTP +description: The following analytic identifies the use of reg.exe performing an add + to the InProcServer32, which may be related to COM hijacking. Adversaries can use + the COM system to insert malicious code that can be executed in place of legitimate + software through hijacking the COM references and relationships as a means for persistence. + Hijacking a COM object requires a change in the Registry to replace a reference + to a legitimate system component which may cause that component to not work when + executed. When that system component is executed through normal system operation + the adversary's code will be executed instead. +data_source: [] +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="reg.exe" + AND like (cmd_line, "%inprocserver32%") | eval start_time=timestamp, end_time=timestamp, + entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, + "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id, + "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, + "process_path", process_path]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: False positives may be present and some filtering may be required. +references: +- https://attack.mitre.org/techniques/T1546/015/ +- https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.015/T1546.015.md +tags: + analytic_story: + - Living Off The Land + asset_type: Endpoint + atomic_guid: [] + confidence: 80 + drilldown_search: [] + impact: 80 + message: An instance of $parent_process_name$ has spawned $process_name$ attempting + to modify InProcServer32 within the registry on $dest_device_id$ by $dest_user_id$. + mitre_attack_id: + - T1546.015 + - T1546 + product: + - Splunk Behavioral Analytics + risk_score: 64 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/atomic_red_team/windows-security.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog + update_timestamp: true diff --git a/ba_detections/endpoint/ssa_windows_curl_upload_to_remote_destination.yml b/ba_detections/endpoint/ssa_windows_curl_upload_to_remote_destination.yml new file mode 100644 index 0000000000..c3b39159b7 --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_curl_upload_to_remote_destination.yml @@ -0,0 +1,74 @@ +name: Windows Curl Upload to Remote Destination +id: cc8d046a-543b-11ec-b864-acde48001122 +version: 1 +date: '2021-12-03' +author: Michael Haag, Splunk +status: production +type: TTP +description: 'The following analytic identifies the use of Windows Curl.exe uploading + a file to a remote destination. \ + + `-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination. + \ + + `-d` or `--data` POST is the HTTP method that was invented to send data to a receiving + web application, and it is, for example, how most common HTML forms on the web work. + \ + + HTTP multipart formposts are done with `-F`, but this appears to not be compatible + with the Windows version of Curl. Will update if identified adversary tradecraft. + \ + + Adversaries may use one of the three methods based on the remote destination and + what they are attempting to upload (zip vs txt). During triage, review parallel + processes for further behavior. In addition, identify if the upload was successful + in network logs. If a file was uploaded, isolate the endpoint and review.' +data_source: [] +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="curl.exe" + AND (like (cmd_line, "%-T %") OR like (cmd_line, "%--upload-file %")OR like (cmd_line, + "%-d %") OR like (cmd_line, "%--data %") OR like (cmd_line, "%-F %")) + + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, + "process_name", process_name, "parent_process_name", parent_process_name, "process_path", + process_path]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint_Processess` datamodel. +known_false_positives: False positives may be limited to source control applications + and may be required to be filtered out. +references: +- https://everything.curl.dev/usingcurl/uploads +- https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409 +- https://twitter.com/d1r4c/status/1279042657508081664?s=20 +tags: + analytic_story: + - Ingress Tool Transfer + - Insider Threat + asset_type: Endpoint + atomic_guid: [] + confidence: 100 + drilldown_search: [] + impact: 80 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ uploading a file to a remote + destination. + mitre_attack_id: + - T1105 + product: + - Splunk Behavioral Analytics + risk_score: 80 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-security.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_windows_defender_tools_in_non_standard_path.yml b/ba_detections/endpoint/ssa_windows_defender_tools_in_non_standard_path.yml new file mode 100644 index 0000000000..ee64dfda1a --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_defender_tools_in_non_standard_path.yml @@ -0,0 +1,52 @@ +name: Windows Defender Tools in Non Standard Path +id: c205bd2e-cd5b-4224-8510-578a2a1f83d7 +version: 1 +date: '2022-07-18' +author: Lou Stella, Splunk +status: production +type: Anomaly +description: The following analytic identifies usage of the MPCmdRun utility that + can be abused by adversaries by moving it to a new directory. +data_source: [] +search: ' from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, + "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"), + "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", + null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", + null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), + process_path=lower(ucast(map_get(input_event, "process_path"), "string", null)), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process_name + IS NOT NULL AND process_name="mpcmdrun.exe" | where process_path IS NOT NULL AND + match_regex(process_path, /(?i)\\microsoft\\windows defender\\platform/)=false AND + match_regex(process_path, /(?i)\\windows defender/)=false | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id", + event_id, "process_path", process_path, "process_name", process_name, "cmd_line", + cmd_line]) | into write_ssa_detected_events(); ' +how_to_implement: Collect endpoint data such as sysmon or 4688 events. +known_false_positives: False positives may be present and filtering may be required. +references: +- https://attack.mitre.org/techniques/T1036/003/ +- https://lolbas-project.github.io/lolbas/Binaries/MpCmdRun/ +tags: + analytic_story: + - Living Off The Land + asset_type: Endpoint + atomic_guid: [] + confidence: 80 + drilldown_search: [] + impact: 70 + message: Process $process_name$ with commandline $cmd_line$ spawn in non-default + folder path on host $dest_device_id$ + mitre_attack_id: + - T1036 + - T1036.003 + product: + - Splunk Behavioral Analytics + risk_score: 56 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/mpcmdrun/windows-security.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog + update_timestamp: true diff --git a/ba_detections/endpoint/ssa_windows_diskshadow_proxy_execution.yml b/ba_detections/endpoint/ssa_windows_diskshadow_proxy_execution.yml new file mode 100644 index 0000000000..758f7307c0 --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_diskshadow_proxy_execution.yml @@ -0,0 +1,55 @@ +name: Windows Diskshadow Proxy Execution +id: aa502688-9037-11ec-842d-acde48001122 +version: 1 +date: '2022-02-17' +author: Lou Stella, Splunk +status: production +type: Anomaly +description: DiskShadow.exe is a Microsoft Signed binary present on Windows Server. + It has a scripting mode intended for complex scripted backup operations. This feature + also allows for execution of arbitrary unsigned code. This analytic looks for the + usage of the scripting mode flags in executions of DiskShadow. During triage, compare + to known backup behavior in your environment and then review the scripts called + by diskshadow. +data_source: [] +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, + "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="diskshadow.exe" + AND (like (cmd_line, "%-s%") OR like (cmd_line, "%/s%")) | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) + | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on processes that include the name of the process responsible for the changes from + your endpoints into the `Endpoint_Processess` datamodel. +known_false_positives: Administrators using the DiskShadow tool in their infrastructure + as a main backup tool with scripts will cause false positives +references: +- https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/ +tags: + analytic_story: + - Living Off The Land + asset_type: Endpoint + atomic_guid: [] + confidence: 70 + drilldown_search: [] + impact: 70 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to run a script. + mitre_attack_id: + - T1218 + product: + - Splunk Behavioral Analytics + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/diskshadow/windows-security.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_windows_dotnet_binary_in_non_standard_path.yml b/ba_detections/endpoint/ssa_windows_dotnet_binary_in_non_standard_path.yml new file mode 100644 index 0000000000..12faa7defe --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_dotnet_binary_in_non_standard_path.yml @@ -0,0 +1,83 @@ +name: Windows DotNet Binary in Non Standard Path +id: 21179107-099a-324a-94d3-08301e6c065f +version: 1 +date: '2022-03-17' +author: Michael Haag, Splunk +status: production +type: Anomaly +description: The following analytic identifies native .net binaries within the Windows + operating system that may be abused by adversaries by moving it to a new directory. + The analytic identifies the .net binary by using a list. If one or the other matches + an alert will be generated. Adversaries abuse these binaries as they are native + to Windows and native DotNet. Note that not all SDK (post install of Windows) are + captured in the list. Lookup - https://github.com/splunk/security_content/blob/develop/lookups/is_net_windows_file.csv. +data_source: [] +search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, + "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"), + "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", + null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", + null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string", + null)), event_id=ucast(map_get(input_event, "event_id"), "string", null); + + $cond_1 = | from $ssa_input | where process_name="msbuild.exe" OR process_name="comsvcconfig.exe" + OR process_name="dfsradmin.exe" OR process_name="dfsvc.exe" OR process_name="microsoft.workflow.compiler.exe" + OR process_name="smsvchost.exe" OR process_name="wsatconfig.exe" OR process_name="addinprocess.exe" + OR process_name="addinprocess32.exe" OR process_name="addinutil.exe" OR process_name="aspnet_compiler.exe" + OR process_name="aspnet_regbrowsers.exe" OR process_name="aspnet_regsql.exe" OR + process_name="caspol.exe" OR process_name="datasvcutil.exe" OR process_name="edmgen.exe" + OR process_name="installutil.exe" OR process_name="jsc.exe" OR process_name="ngentask.exe" + OR process_name="regasm.exe" OR process_name="regsvcs.exe" OR process_name="sdnbr.exe" + OR process_name="acu.exe" OR process_name="appvstreamingux.exe" OR process_name="dsac.exe" + OR process_name="lbfoadmin.exe" OR process_name="microsoft.uev.synccontroller.exe" + OR process_name="mtedit.exe" OR process_name="scriptrunner.exe" OR process_name="servermanager.exe" + OR process_name="stordiag.exe" OR process_name="tzsync.exe" OR process_name="uevagentpolicygenerator.exe" + OR process_name="uevappmonitor.exe" OR process_name="uevtemplatebaselinegenerator.exe" + OR process_name="uevtemplateconfigitemgenerator.exe" OR process_name="powershell_ise.exe" + OR process_name="iediagcmd.exe" OR process_name="xbox.tcui.exe" OR process_name="microsoft.activedirectory.webservices.exe" + OR process_name="iisual.exe" OR process_name="filehistory.exe" OR process_name="secureassessmentbrowser.exe"; + + | from $cond_1 | where match_regex(process_path, /(?i)\\windows\\system32/)=false + AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false AND match_regex(process_path, + /(?i)\\windows\\adws/)=false AND match_regex(process_path, /(?i)\\windows\\networkcontroller/)=false + AND match_regex(process_path, /(?i)\\windows\\systemapps/)=false AND match_regex(process_path, + /(?i)\\winsxs/)=false AND match_regex(process_path, /(?i)\\microsoft.net/)=false + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(device, user), + body=create_map(["event_id", event_id, "process_path", process_path, "process_name", + process_name]) | into write_ssa_detected_events();' +how_to_implement: Collect endpoint data such as sysmon or 4688 events. +known_false_positives: False positives may be present and filtering may be required. + Certain utilities will run from non-standard paths based on the third-party application + in use. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml +- https://attack.mitre.org/techniques/T1036/003/ +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md +tags: + analytic_story: + - Masquerading - Rename System Utilities + - Unusual Processes + - Ransomware + - Signed Binary Proxy Execution InstallUtil + - WhisperGate + asset_type: Endpoint + atomic_guid: [] + confidence: 70 + drilldown_search: [] + impact: 70 + message: A system process $process_name$ with commandline $cmd_line$ spawn in non-default + folder path on host $dest_device_id$ + mitre_attack_id: + - T1036 + - T1036.003 + - T1218 + - T1218.004 + product: + - Splunk Behavioral Analytics + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_windows_eventvwr_uac_bypass.yml b/ba_detections/endpoint/ssa_windows_eventvwr_uac_bypass.yml new file mode 100644 index 0000000000..abfb1dd467 --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_eventvwr_uac_bypass.yml @@ -0,0 +1,63 @@ +name: Windows Eventvwr UAC Bypass +id: 66adff66-90d9-11ec-aba7-acde48001122 +version: 1 +date: '2022-02-18' +author: Lou Stella, Splunk +status: production +type: Anomaly +description: The following search identifies Eventvwr bypass by identifying the registry + modification into a specific path that eventvwr.msc looks to (but is not valid) + upon execution. A successful attack will include a suspicious command to be executed + upon eventvwr.msc loading. Upon triage, review the parallel processes that have + executed. Identify any additional registry modifications on the endpoint that may + look suspicious. Remediate as necessary. +data_source: [] +search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)), + registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)), + registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string", + null)), registry_key_name=lower(ucast(map_get(input_event, "parent_process_name"), + "string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"), + "string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"), + "string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"), + "string", null)) | where registry_path IS NOT NULL AND (like (registry_path, "%mscfile\\\\shell\\\\open\\\\command%")) + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)) | eval body=create_map(["registry_path", registry_path, "registry_hive", + registry_hive, "registry_value_name", registry_value_name, "registry_key_name", + registry_key_name, "registry_value_type", registry_value_type, "registry_value_data", + registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint_Registry` datamodel. +known_false_positives: None known at this time. +references: +- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md +- https://attack.mitre.org/techniques/T1548/002/ +- https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/ +tags: + analytic_story: + - Windows Defense Evasion Tactics + - IcedID + - Living Off The Land + asset_type: Endpoint + atomic_guid: [] + confidence: 100 + drilldown_search: [] + impact: 80 + message: Registry values were modified to bypass UAC using Event Viewer on $dest_device_id$ + mitre_attack_id: + - T1548.002 + - T1548 + product: + - Splunk Behavioral Analytics + risk_score: 80 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/ssa_eventvwr/windows-sysmon-registry.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/ba_detections/endpoint/ssa_windows_exchange_powershell_module_usage.yml b/ba_detections/endpoint/ssa_windows_exchange_powershell_module_usage.yml new file mode 100644 index 0000000000..e87cde64d1 --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_exchange_powershell_module_usage.yml @@ -0,0 +1,82 @@ +name: Windows Exchange PowerShell Module Usage +id: 1118bc65-b0c7-4589-bc2f-ad6802fd0909 +version: 1 +date: '2022-10-12' +author: Michael Haag, Splunk +status: production +type: TTP +description: 'The following analytic identifies the usage of Exchange PowerShell modules + that were recently used for a proof of concept related to ProxyShell. Currently, + there is no active data shared or data we could re-produce relate to this part of + the ProxyShell chain of exploits. \ + + Inherently, the usage of the modules is not malicious, but reviewing parallel processes, + and user, of the session will assist with determining the intent. \ + + Module - New-MailboxExportRequest will begin the process of exporting contents of + a primary mailbox or archive to a .pst file. \ + + Module - New-managementroleassignment can assign a management role to a management + role group, management role assignment policy, user, or universal security group + (USG). \ + + Module - New-MailboxSearch cmdlet to create a mailbox search and either get an estimate + of search results, place search results on In-Place Hold or copy them to a Discovery + mailbox. You can also place all contents in a mailbox on hold by not specifying + a search query, which accomplishes similar results as Litigation Hold. \ Module + - Get-Recipient cmdlet to view existing recipient objects in your organization. + This cmdlet returns all mail-enabled objects (for example, mailboxes, mail users, + mail contacts, and distribution groups).' +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL | where (like (cmd_line, "%new-mailboxexportrequest%") + OR like (cmd_line, "%new-managementroleassignment%") OR like (cmd_line, "%new-mailboxsearch%") + OR like (cmd_line,"%get-recipient%")) | eval start_time=timestamp, end_time=timestamp, + entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, + "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", + cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, + "process_path", process_path]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. + This will only work with Multiline event logs, not XML. +known_false_positives: Administrators or power users may use this PowerShell commandlet +references: +- https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps +- https://docs.microsoft.com/en-us/powershell/module/exchange/new-managementroleassignment?view=exchange-ps +- https://blog.orange.tw/2021/08/proxyshell-a-new-attack-surface-on-ms-exchange-part-3.html +- https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell +- https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/ +- https://www.cisa.gov/uscert/ncas/alerts/aa22-264a +- https://learn.microsoft.com/en-us/powershell/module/exchange/new-mailboxsearch?view=exchange-ps +- https://learn.microsoft.com/en-us/powershell/module/exchange/get-recipient?view=exchange-ps +- https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/ +tags: + analytic_story: + - ProxyShell + - CISA AA22-264A + asset_type: Endpoint + atomic_guid: [] + confidence: 80 + drilldown_search: [] + impact: 40 + message: Exchange enumeration using PowerShell on $dest_device_id$. + mitre_attack_id: + - T1059 + - T1059.001 + product: + - Splunk Behavioral Analytics + risk_score: 32 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/exchange/windows-powershell.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog + update_timestamp: true diff --git a/ba_detections/endpoint/ssa_windows_execute_arbitrary_commands_with_msdt.yml b/ba_detections/endpoint/ssa_windows_execute_arbitrary_commands_with_msdt.yml new file mode 100644 index 0000000000..c40af83b94 --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_execute_arbitrary_commands_with_msdt.yml @@ -0,0 +1,65 @@ +name: Windows Execute Arbitrary Commands with MSDT +id: f253f9c2-10f0-4cc8-b469-f505ba8c2038 +version: 1 +date: '2022-09-15' +author: Michael Haag, Splunk +status: production +type: TTP +description: The following analytic identifies a recently disclosed arbitraty command + execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample + identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve + a remote payload. During triage, review file modifications for html. Identify parallel + process execution that may be related, including an Office Product. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msdt.exe" AND + (like (cmd_line, "%msdt%") OR like (cmd_line, "%ms-msdt:%") OR like (cmd_line, "%ms-msdt:/id%") + OR like (cmd_line, "%ms-msdt:-id%") OR like (cmd_line, "%ms-msdt:/id%")) AND (like + (cmd_line, "%it_browseforfile=%") OR like (cmd_line, "%it_rebrowseforfile=%") OR + like (cmd_line, "%.xml%")) AND like (cmd_line, "%pcwdiagnostic%") | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: False positives may be present, filter as needed. Added .xml + to potentially capture any answer file usage. Remove as needed. +references: +- https://isc.sans.edu/diary/rss/28694 +- https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e +- https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A +- https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ +- https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection +- https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html +tags: + analytic_story: + - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190 + asset_type: Endpoint + atomic_guid: [] + confidence: 100 + drilldown_search: [] + impact: 100 + message: $process_name$ on $dest_device_id$ under user $dest_user_id$ possibly indicative + of indirect command execution. + mitre_attack_id: + - T1218 + product: + - Splunk Behavioral Analytics + risk_score: 100 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt-windows-security.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog + update_timestamp: true diff --git a/ba_detections/endpoint/ssa_windows_ingress_tool_transfer_using_explorer.yml b/ba_detections/endpoint/ssa_windows_ingress_tool_transfer_using_explorer.yml new file mode 100644 index 0000000000..c44f172e46 --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_ingress_tool_transfer_using_explorer.yml @@ -0,0 +1,61 @@ +name: Windows Ingress Tool Transfer Using Explorer +id: 695bfad6-9662-4f9e-a576-bf02a951aa60 +version: 1 +date: '2022-09-13' +author: Michael Haag, Splunk +status: production +type: TTP +description: The following analytic identifies the Windows Explorer process with a + URL within the command-line. Explorer.exe is known Windows process that handles + start menu, taskbar, desktop and file manager. Many adversaries abuse this process, + like DCRat malware, where it attempts to open the URL with the default browser application + on the target host by putting the URL as a parameter on explorer.exe process. This + anomaly detection might be a good pivot to check which user and how this process + was executed, what is the parent process and what is the URL link. This technique + is not commonly used to open an URL. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="explorer.exe" + AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%")) AND NOT (like(parent_process_name, + "userinit.exe") OR like(parent_process_name, "svchost.exe")) | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints. +known_false_positives: False positives may be present based on legitimate applications + or third party utilities. Filter out any additional parent process names. +references: +- https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor +tags: + analytic_story: + - DarkCrystal RAT + asset_type: Endpoint + atomic_guid: [] + confidence: 50 + drilldown_search: [] + impact: 50 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote + destination to download an additional payload. + mitre_attack_id: + - T1105 + product: + - Splunk Behavioral Analytics + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105_explorer-windows-security.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog + update_timestamp: true diff --git a/ba_detections/endpoint/ssa_windows_lolbin_binary_in_non_standard_path.yml b/ba_detections/endpoint/ssa_windows_lolbin_binary_in_non_standard_path.yml new file mode 100644 index 0000000000..cf0c3e46ff --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_lolbin_binary_in_non_standard_path.yml @@ -0,0 +1,92 @@ +name: Windows LOLBin Binary in Non Standard Path +id: 25689101-012a-324a-94d3-08301e6c065a +version: 4 +date: '2022-08-31' +author: Michael Haag, Splunk +status: production +type: Anomaly +description: The following analytic identifies native living off the land binaries + within the Windows operating system that may be abused by adversaries by moving + it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io + site, and excluded common process names (cmd.exe, explorer.exe, csc.exe, hh.exe, + regedit.exe) and DotNet binaries. It also does not include the category of OtherMSBinaries. +data_source: [] +search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, + "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"), + "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", + null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", + null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string", + null)), event_id=ucast(map_get(input_event, "event_id"), "string", null); + + $cond_1 = | from $ssa_input | where process_name="bitsadmin.exe" OR process_name="certoc.exe" + OR process_name="certreq.exe" OR process_name="certutil.exe" OR process_name="cmdkey.exe" + OR process_name="cmdl32.exe" OR process_name="cmstp.exe" OR process_name="configsecuritypolicy.exe" + OR process_name="control.exe" OR process_name="cscript.exe" OR process_name="datasvcutil.exe" + OR process_name="desktopimgdownldr.exe" OR process_name="dfsvc.exe" OR process_name="diantz.exe" + OR process_name="diskshadow.exe" OR process_name="dllhost.exe" OR process_name="dnscmd.exe" + OR process_name="esentutl.exe" OR process_name="eventvwr.exe" OR process_name="expand.exe" + OR process_name="extexport.exe" OR process_name="extrac32.exe" OR process_name="findstr.exe" + OR process_name="finger.exe" OR process_name="fltmc.exe" OR process_name="forfiles.exe" + OR process_name="ftp.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="gpscript.exe" + OR process_name="imewdbld.exe" OR process_name="ie4uinit.exe" OR process_name="ieexec.exe" + OR process_name="ilasm.exe" OR process_name="infdefaultinstall.exe" OR process_name="makecab.exe" + OR process_name="mavinject.exe" OR process_name="microsoft.workflow.compiler.exe" + OR process_name="mmc.exe" OR process_name="msconfig.exe" OR process_name="msdt.exe" + OR process_name="mshta.exe" OR process_name="msiexec.exe" OR process_name="netsh.exe" + OR process_name="odbcconf.exe" OR process_name="offlinescannershell.exe" OR process_name="pcalua.exe" + OR process_name="pcwrun.exe" OR process_name="pktmon.exe" OR process_name="pnputil.exe" + OR process_name="presentationhost.exe" OR process_name="print.exe" OR process_name="printbrm.exe" + OR process_name="psr.exe" OR process_name="rasautou.exe" OR process_name="reg.exe" + OR process_name="regini.exe" OR process_name="register-cimprovider.exe" OR process_name="regsvr32.exe" + OR process_name="replace.exe" OR process_name="rpcping.exe" OR process_name="rundll32.exe" + OR process_name="runonce.exe" OR process_name="runscripthelper.exe" OR process_name="sc.exe" + OR process_name="schtasks.exe" OR process_name="scriptrunner.exe" OR process_name="settingsynchost.exe" + OR process_name="syncappvpublishingserver.exe" OR process_name="ttdinject.exe" OR + process_name="tttracer.exe" OR process_name="vbc.exe" OR process_name="verclsid.exe" + OR process_name="wab.exe" OR process_name="wlrmdr.exe" OR process_name="wmic.exe" + OR process_name="workfolders.exe" OR process_name="wscript.exe" OR process_name="wsreset.exe" + OR process_name="wuauclt.exe" OR process_name="xwizard.exe"; + + | from $cond_1 | where match_regex(process_path, /(?i)\\windows\\system32/)=false + AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false AND match_regex(process_path, + /(?i)\\windows\\adws/)=false AND match_regex(process_path, /(?i)\\windows\\networkcontroller/)=false + AND match_regex(process_path, /(?i)\\windows\\systemapps/)=false AND match_regex(process_path, + /(?i)\\winsxs/)=false AND match_regex(process_path, /(?i)\\microsoft.net/)=false + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(device, user), + body=create_map(["event_id", event_id, "process_path", process_path, "process_name", + process_name]) | into write_ssa_detected_events();' +how_to_implement: Collect endpoint data such as sysmon or 4688 events. +known_false_positives: False positives may be present and filtering may be required. + Certain utilities will run from non-standard paths based on the third-party application + in use. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml +- https://attack.mitre.org/techniques/T1036/003/ +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md +tags: + analytic_story: + - Unusual Processes + - Ransomware + - WhisperGate + asset_type: Endpoint + atomic_guid: [] + confidence: 70 + drilldown_search: [] + impact: 70 + message: A system process $process_name$ with commandline $cmd_line$ spawn in non-default + folder path on host $dest_device_id$ + mitre_attack_id: + - T1036 + - T1036.003 + - T1218 + - T1218.004 + product: + - Splunk Behavioral Analytics + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_windows_mshta_child_process.yml b/ba_detections/endpoint/ssa_windows_mshta_child_process.yml new file mode 100644 index 0000000000..184026b1df --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_mshta_child_process.yml @@ -0,0 +1,61 @@ +name: Windows MSHTA Child Process +id: f63f7e9c-9526-11ec-9fc7-acde48001122 +version: 2 +date: '2022-02-23' +author: Michael Haag, Splunk +status: production +type: TTP +description: The following analytic identifies child processes spawning from "mshta.exe". + The search will return the first time and last time these command-line arguments + were used for these executions, as well as the target system, the user, parent process + "mshta.exe" and its child process. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=lower(ucast(map_get(input_event, "parent_process_name"), + "string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name + IS NOT NULL | where like(parent_process_name, "%\\\\mshta.exe") AND (process_name="powershell.exe" + OR process_name="cmd.exe" OR process_name="scrcons.exe" OR process_name="colorcpl.exe" + OR process_name="msbuild.exe" OR process_name="microsoft.workflow.compiler.exe" + OR process_name="searchprotocolhost.exe" OR process_name="cscript.exe" OR process_name="wscript.exe") + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Although unlikely, some legitimate applications may exhibit + this behavior, triggering a false positive. +references: +- https://github.com/redcanaryco/AtomicTestHarnesses +- https://redcanary.com/blog/introducing-atomictestharnesses/ +tags: + analytic_story: + - Suspicious MSHTA Activity + - Living Off The Land + asset_type: Endpoint + atomic_guid: [] + confidence: 100 + drilldown_search: [] + impact: 80 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote + destination to download an additional payload. + mitre_attack_id: + - T1218.005 + - T1218 + product: + - Splunk Behavioral Analytics + risk_score: 80 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_windows_mshta_command_line_url.yml b/ba_detections/endpoint/ssa_windows_mshta_command_line_url.yml new file mode 100644 index 0000000000..6a362b86d3 --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_mshta_command_line_url.yml @@ -0,0 +1,63 @@ +name: Windows MSHTA Command-Line URL +id: 9b35c538-94ef-11ec-9439-acde48001122 +version: 1 +date: '2022-02-23' +author: Michael Haag, Splunk +status: production +type: TTP +description: This analytic identifies when Microsoft HTML Application Host (mshta.exe) + utility is used to make remote http connections. Adversaries may use mshta.exe to + proxy the download and execution of remote .hta files. The analytic identifies command + line arguments of http and https being used. This technique is commonly used by + malicious software to bypass preventative controls. The search will return the first + time and last time these command-line arguments were used for these executions, + as well as the target system, the user, process "rundll32.exe" and its parent process. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="mshta.exe" + AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%")) | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: It is possible legitimate applications may perform this behavior + and will need to be filtered. +references: +- https://github.com/redcanaryco/AtomicTestHarnesses +- https://redcanary.com/blog/introducing-atomictestharnesses/ +- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing +tags: + analytic_story: + - Suspicious MSHTA Activity + - Living Off The Land + asset_type: Endpoint + atomic_guid: [] + confidence: 100 + drilldown_search: [] + impact: 80 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote + destination to download an additional payload. + mitre_attack_id: + - T1218.005 + - T1218 + product: + - Splunk Behavioral Analytics + risk_score: 80 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_windows_mshta_inline_hta_execution.yml b/ba_detections/endpoint/ssa_windows_mshta_inline_hta_execution.yml new file mode 100644 index 0000000000..37eb659d9c --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_mshta_inline_hta_execution.yml @@ -0,0 +1,61 @@ +name: Windows MSHTA Inline HTA Execution +id: 24962154-9524-11ec-9333-acde48001122 +version: 1 +date: '2022-02-23' +author: Michael Haag, Splunk +status: production +type: TTP +description: The following analytic identifies "mshta.exe" execution with inline protocol + handlers. "JavaScript", "VBScript", and "About" are the only supported options when + invoking HTA content directly on the command-line. The search will return the first + time and last time these command-line arguments were used for these executions, + as well as the target system, the user, process "mshta.exe" and its parent process. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="mshta.exe" + AND (like (cmd_line, "%vbscript%") OR like (cmd_line, "%javascript%") OR like (cmd_line, + "%about%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Although unlikely, some legitimate applications may exhibit + this behavior, triggering a false positive. +references: +- https://github.com/redcanaryco/AtomicTestHarnesses +- https://redcanary.com/blog/introducing-atomictestharnesses/ +- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing +tags: + analytic_story: + - Suspicious MSHTA Activity + - Living Off The Land + asset_type: Endpoint + atomic_guid: [] + confidence: 100 + drilldown_search: [] + impact: 80 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ executing with inline HTA, + indicative of defense evasion. + mitre_attack_id: + - T1218.005 + - T1218 + product: + - Splunk Behavioral Analytics + risk_score: 80 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_windows_odbcconf_load_response_file.yml b/ba_detections/endpoint/ssa_windows_odbcconf_load_response_file.yml new file mode 100644 index 0000000000..2bb014759c --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_odbcconf_load_response_file.yml @@ -0,0 +1,59 @@ +name: Windows Odbcconf Load Response File +id: 7b6c3fac-0c37-4efc-a85e-de88f42b6763 +version: 1 +date: '2022-09-15' +author: Michael Haag, Splunk +status: production +type: TTP +description: The following analytic identifies the odbcconf.exe, Windows Open Database + Connectivity utility, loading up a resource file. The file extension is arbitrary + and may be named anything. The resource file itself may have different commands + supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands. + During triage, review file modifications and parallel processes. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="odbcconf.exe" + AND (like (cmd_line, "%-f %") OR like (cmd_line, "%/f %")) AND like (cmd_line, "%.rsp%") + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: False positives may be present and filtering may need to occur + based on legitimate application usage. Filter as needed. +references: +- https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html +- https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw +tags: + analytic_story: + - Living Off The Land + asset_type: Endpoint + atomic_guid: [] + confidence: 70 + drilldown_search: [] + impact: 60 + message: $process_name$ has been identified on $dest_device_id$ under user $dest_user_id$ + attempting to circumvent controls. + mitre_attack_id: + - T1218.008 + - T1218 + product: + - Splunk Behavioral Analytics + risk_score: 42 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/odbcconf-windows-security.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog + update_timestamp: true diff --git a/ba_detections/endpoint/ssa_windows_os_credential_dumping_with_ntdsutil_export_ntds.yml b/ba_detections/endpoint/ssa_windows_os_credential_dumping_with_ntdsutil_export_ntds.yml new file mode 100644 index 0000000000..5b1444f7d6 --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_os_credential_dumping_with_ntdsutil_export_ntds.yml @@ -0,0 +1,69 @@ +name: Windows OS Credential Dumping with Ntdsutil Export NTDS +id: dad9ddec-a72a-47be-87b6-a0f7ba98ed6e +version: 1 +date: '2022-08-31' +author: Michael Haag, Splunk +status: production +type: TTP +description: 'Monitor for signs that Ntdsutil is being used to Extract Active Directory + database - NTDS.dit, typically used for offline password cracking. It may be used + in normal circumstances with no command line arguments or shorthand variations of + more common arguments. Ntdsutil.exe is typically seen run on a Windows Server. Typical + command used to dump ntds.dit \ + + ntdsutil "ac i ntds" "ifm" "create full C:\Temp" q q \ + + This technique uses "Install from Media" (IFM), which will extract a copy of the + Active Directory database. A successful export of the Active Directory database + will yield a file modification named ntds.dit to the destination.' +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="ntdsutil.exe" + AND (like (cmd_line, "%ntds%") AND like (cmd_line, "%create%")) | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Highly possible Server Administrators will troubleshoot with + ntdsutil.exe, generating false positives. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.003/T1003.003.md#atomic-test-3---dump-active-directory-database-with-ntdsutil +- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753343(v=ws.11) +- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf +- https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html +tags: + analytic_story: + - Credential Dumping + - HAFNIUM Group + - Living Off The Land + asset_type: Endpoint + atomic_guid: [] + confidence: 50 + drilldown_search: [] + impact: 100 + message: Active Directory NTDS export on $dest_device_id$ using $process_name$ by + $dest_user_id$. + mitre_attack_id: + - T1003.003 + - T1003 + product: + - Splunk Behavioral Analytics + risk_score: 50 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/4688_windows-security.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog + update_timestamp: true diff --git a/ba_detections/endpoint/ssa_windows_os_credential_dumping_with_procdump.yml b/ba_detections/endpoint/ssa_windows_os_credential_dumping_with_procdump.yml new file mode 100644 index 0000000000..aa59b99b2b --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_os_credential_dumping_with_procdump.yml @@ -0,0 +1,65 @@ +name: Windows OS Credential Dumping with Procdump +id: e102e297-dbe6-4a19-b319-5c08f4c19a06 +version: 1 +date: '2022-08-31' +author: Michael Haag, Splunk +status: production +type: TTP +description: 'Detect procdump.exe dumping the lsass process. This query looks for + both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump + file with all process memory. Both are highly suspect and should be reviewed. This + query does not monitor for the internal name (original_file_name=procdump) of the + PE or look for procdump64.exe. Modify the query as needed.\ + + During triage, confirm this is procdump.exe executing. If it is the first time a + Sysinternals utility has been ran, it is possible there will be a -accepteula on + the command line. Review other endpoint data sources for cross process (injection) + into lsass.exe.' +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL AND (process_name="procdump.exe" + OR process_name="procdump64.exe") AND (like (cmd_line, "%-mm %") OR like (cmd_line, + "%-ma %")) AND like (cmd_line, "%lsass%") | eval start_time=timestamp, end_time=timestamp, + entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, + "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", + cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, + "process_path", process_path]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: None identified. +references: +- https://attack.mitre.org/techniques/T1003/001/ +- https://docs.microsoft.com/en-us/sysinternals/downloads/procdump +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump +- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ +tags: + analytic_story: + - Credential Dumping + - HAFNIUM Group + asset_type: Endpoint + atomic_guid: [] + confidence: 100 + drilldown_search: [] + impact: 80 + message: Procdump was utilized to dump lsass on $dest_device_id$ by $dest_user_id$. + mitre_attack_id: + - T1003.001 + - T1003 + product: + - Splunk Behavioral Analytics + risk_score: 80 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/procdump_windows-security.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog + update_timestamp: true diff --git a/ba_detections/endpoint/ssa_windows_powershell_connect_to_internet_with_hidden_window.yml b/ba_detections/endpoint/ssa_windows_powershell_connect_to_internet_with_hidden_window.yml new file mode 100644 index 0000000000..0938e7ad29 --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_powershell_connect_to_internet_with_hidden_window.yml @@ -0,0 +1,69 @@ +name: Windows Powershell Connect to Internet With Hidden Window +id: 477e068e-8b6d-11ec-b6c1-81af21670352 +version: 1 +date: '2022-02-11' +author: Jose Hernandez, David Dorsey, Michael Haag Splunk +status: production +type: Anomaly +description: The following hunting analytic identifies PowerShell commands utilizing + the WindowStyle parameter to hide the window on the compromised endpoint. This combination + of command-line options is suspicious because it is overriding the default PowerShell + execution policy, attempts to hide its activity from the user, and connects to the + Internet. Removed in this version of the query is New-Object. The analytic identifies + all variations of WindowStyle, as PowerShell allows the ability to shorten the parameter. + For example w, win, windowsty and so forth. In addition, through our research it + was identified that PowerShell will interpret different command switch types beyond + the hyphen. We have added endash, emdash, horizontal bar, and forward slash. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), process=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + process IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe" + OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" + OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where match_regex(process, + /(?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+[^-]/)=true | eval start_time=timestamp, end_time=timestamp, + entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, + "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "process", + process, "process_name", process_name, "parent_process_name", parent_process_name, + "process_path", process_path]) | into write_ssa_detected_events();' +how_to_implement: You must be ingesting data that records process activity from your + hosts to populate the Endpoint data model in the Processes node. You must also be + ingesting logs with both the process name and command line from your endpoints. + The command-line arguments are mapped to the "process" field in the Endpoint data + model. +known_false_positives: Legitimate process can have this combination of command-line + options, but it's not common. +references: +- https://regexr.com/663rr +- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1 +- https://ss64.com/ps/powershell.html +- https://twitter.com/M_haggis/status/1440758396534214658?s=20 +- https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/ +tags: + analytic_story: + - Malicious PowerShell + - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns + - HAFNIUM Group + - Log4Shell CVE-2021-44228 + asset_type: Endpoint + atomic_guid: [] + confidence: 70 + drilldown_search: [] + impact: 50 + message: PowerShell processes $process$ started with parameters to modify the execution + policy of the run, run in a hidden window, and connect to the Internet on host + $dest$ executed by user $user$. + mitre_attack_id: + - T1020 + product: + - Splunk Behavioral Analytics + risk_score: 35 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/hidden_powershell/hidden_windows-security.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml b/ba_detections/endpoint/ssa_windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml new file mode 100644 index 0000000000..2c845bd9d7 --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml @@ -0,0 +1,60 @@ +name: Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser +id: d57b4d91-fc91-4482-a325-47693cced1eb +version: 1 +date: '2022-11-14' +author: Michael Haag, Splunk +status: production +type: TTP +description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) + to identify the execution of the `Get-ADUser` commandlet with specific parameters. + `Get-ADUser` is part of the Active Directory PowerShell module used to manage Windows + Active Directory networks. As the name suggests, `Get-ADUser` is used to query for + domain users. With the appropiate parameters, Get-ADUser allows adversaries to discover + domain accounts with Kerberos Pre Authentication disabled.\ Red Teams and adversaries + alike use may abuse Get-ADUSer to enumerate these accounts and attempt to crack + their passwords offline. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL | where (like (cmd_line, "%get-aduser%") + AND like (cmd_line, "%4194304%")) | eval start_time=timestamp, end_time=timestamp, + entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, + "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", + cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, + "process_path", process_path]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators or power users may use search for accounts with + Kerberos Pre Authentication disabled for legitimate purposes. +references: +- https://attack.mitre.org/techniques/T1558/004/ +- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html +- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/ +tags: + analytic_story: + - Active Directory Kerberos Attacks + asset_type: Endpoint + atomic_guid: [] + confidence: 90 + drilldown_search: [] + impact: 60 + message: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser from $dest_device_id$ + mitre_attack_id: + - T1558 + - T1558.004 + product: + - Splunk Behavioral Analytics + risk_score: 54 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/windows-powershell.log + source: WinEventLog + sourcetype: WinEventLog + update_timestamp: true diff --git a/ba_detections/endpoint/ssa_windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/ba_detections/endpoint/ssa_windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml new file mode 100644 index 0000000000..7aa71b3de8 --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml @@ -0,0 +1,59 @@ +name: Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView +id: dc3f2af7-ca69-47ce-a122-9f9787e19417 +version: 1 +date: '2022-11-14' +author: Michael Haag, Splunk +status: production +type: TTP +description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) + to identify the execution of the `Get-DomainUser` commandlet with specific parameters. + `Get-DomainUser` is part of PowerView, a PowerShell tool used to perform enumeration + on Windows Active Directory networks. As the name suggests, `Get-DomainUser` is + used to identify domain users and combining it with `-PreauthNotRequired` allows + adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\ + Red Teams and adversaries alike use may leverage PowerView to enumerate these accounts + and attempt to crack their passwords offline. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL | where (like (cmd_line, "%get-domainuser%") + AND like (cmd_line, "%preauthnotrequired%")) | eval start_time=timestamp, end_time=timestamp, + entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, + "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", + cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, + "process_path", process_path]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators or power users may use PowerView for troubleshooting +references: +- https://attack.mitre.org/techniques/T1558/004/ +- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html +- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/ +tags: + analytic_story: + - Active Directory Kerberos Attacks + asset_type: endpoint + atomic_guid: [] + confidence: 90 + drilldown_search: [] + impact: 60 + message: Disabled Kerberos Pre-Authentication Discovery With PowerView from $dest_device_id$ + mitre_attack_id: + - T1558 + - T1558.004 + product: + - Splunk Behavioral Analytics + risk_score: 54 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdomainuser.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog + update_timestamp: true diff --git a/ba_detections/endpoint/ssa_windows_powershell_downloadfile.yml b/ba_detections/endpoint/ssa_windows_powershell_downloadfile.yml new file mode 100644 index 0000000000..493ecee80d --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_powershell_downloadfile.yml @@ -0,0 +1,63 @@ +name: Windows Powershell DownloadFile +id: 46440222-81d5-44b1-a376-19dcd70d1b08 +version: 1 +date: '2022-02-11' +author: Jose Hernandez, Michael Haag, Splunk +status: production +type: Anomaly +description: The following analytic identifies the use of PowerShell downloading a + file using `DownloadFile` method. This particular method is utilized in many different + PowerShell frameworks to download files and output to disk. Identify the source + (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell + transaction logs are available, review for further details of the implant. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe" + OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" + OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like + (cmd_line, "%downloadfile%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives may be present and filtering will need to occur + by parent process or command line argument. It may be required to modify this query + to an EDR product for more granular coverage. +references: +- https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0 +- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md +tags: + analytic_story: + - Malicious PowerShell + - Ingress Tool Transfer + - Log4Shell CVE-2021-44228 + asset_type: Endpoint + atomic_guid: [] + confidence: 70 + drilldown_search: [] + impact: 50 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile + within PowerShell. + mitre_attack_id: + - T1020 + product: + - Splunk Behavioral Analytics + risk_score: 35 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/downloadfile_windows-security.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_windows_powershell_start_bitstransfer.yml b/ba_detections/endpoint/ssa_windows_powershell_start_bitstransfer.yml new file mode 100644 index 0000000000..e7f3c8f0ee --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_powershell_start_bitstransfer.yml @@ -0,0 +1,61 @@ +name: Windows PowerShell Start-BitsTransfer +id: 0bafd086-8f61-11ec-996e-acde48001122 +version: 1 +date: '2022-02-16' +author: Michael Haag, Splunk +status: production +type: TTP +description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar + functionality is present. This technique variation is not as commonly used by adversaries, + but has been abused in the past. Lesser known uses include the ability to set the + `-TransferType` to `Upload` for exfiltration of files. In an instance where `Upload` + is used, it is highly possible files will be archived. During triage, review parallel + processes and process lineage. Capture any files on disk and review. For the remote + domain or IP, what is the reputation? +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe" + OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" + OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like + (cmd_line, "%start-bitstransfer%")) | eval start_time=timestamp, end_time=timestamp, + entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, + "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", + cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, + "process_path", process_path]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint_Processess` datamodel. +known_false_positives: Limited false positives. It is possible administrators will + utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent + process or command-line arguments. +references: +- https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281 +- https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs +tags: + analytic_story: + - BITS Jobs + - Living Off The Land + asset_type: Endpoint + atomic_guid: [] + confidence: 70 + drilldown_search: [] + impact: 70 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $dest_user_id$ attempting to download a file. + mitre_attack_id: + - T1197 + - T1105 + product: + - Splunk Behavioral Analytics + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/T1197_windows-security.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_windows_rasautou_dll_execution.yml b/ba_detections/endpoint/ssa_windows_rasautou_dll_execution.yml new file mode 100644 index 0000000000..08586937f5 --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_rasautou_dll_execution.yml @@ -0,0 +1,61 @@ +name: Windows Rasautou DLL Execution +id: 6f42b8ce-1e15-11ec-ad5a-acde48001122 +version: 1 +date: '2022-02-15' +author: Michael Haag, Splunk +status: production +type: TTP +description: The following analytic identifies the Windows Windows Remote Auto Dialer, + rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary + shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review + parent and child process behavior including file and image loads. +data_source: [] +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="rasautou.exe" + AND (like (cmd_line, "%-d %") AND like (cmd_line, "%-p %")) | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) + | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives will be limited to applications that require + Rasautou.exe to load a DLL from disk. Filter as needed. +references: +- https://github.com/mandiant/DueDLLigence +- https://github.com/MHaggis/notes/blob/master/utilities/Invoke-SPLDLLigence.ps1 +- https://gist.github.com/NickTyrer/c6043e4b302d5424f701f15baf136513 +- https://www.mandiant.com/resources/staying-hidden-on-the-endpoint-evading-detection-with-shellcode +tags: + analytic_story: + - Windows Defense Evasion Tactics + - Living Off The Land + asset_type: Endpoint + atomic_guid: [] + confidence: 100 + drilldown_search: [] + impact: 80 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ attempting to load a DLL in a suspicious manner. + mitre_attack_id: + - T1055.001 + - T1218 + - T1055 + product: + - Splunk Behavioral Analytics + risk_score: 80 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-security.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml b/ba_detections/endpoint/ssa_windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml new file mode 100644 index 0000000000..44551a3cc0 --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml @@ -0,0 +1,56 @@ +name: Windows Rename System Utilities Acccheckconsole exe LOLBAS in Non Standard Path +id: c842931e-661f-42bc-a4df-0460d93cfb69 +version: 1 +date: '2022-10-18' +author: Splunk Threat Research Bot, Splunk +status: production +type: Anomaly +description: The following analytic identifies AccCheckConsole.exe which is a native + living off the land binary or script (LOLBAS) within the Windows operating system + that may be abused by adversaries by moving it to a new directory. The list of binaries + was derived from the https://lolbas-project.github.io site. +data_source: [] +search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, + "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"), + "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", + null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", + null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string", + null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where + process_name IS NOT NULL AND process_name="acccheckconsole.exe"| where process_path + IS NOT NULL AND match_regex(process_path, /(?i)\\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker/)=false + | eval start_time=timestamp,end_time=timestamp, entities=mvappend(device, user), + body=create_map(["event_id", event_id, "process_path", process_path, "process_name", + process_name]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you must be ingesting logs + with the process name, command-line arguments, and parent processes from your endpoints. + Collect endpoint data such as Sysmon or Windows Events 4688. +known_false_positives: False positives may be present and filtering may be required. + Certain utilities will run from non-standard paths based on the third-party application + in use. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml +- https://attack.mitre.org/techniques/T1036/003/ +- https://lolbas-project.github.io/ +tags: + analytic_story: + - Unusual Processes + - Living Off The Land + asset_type: Endpoint + atomic_guid: [] + confidence: 70 + drilldown_search: [] + impact: 20 + message: A system process $process_name$ with path $process_path$ spawn in non-default + folder path on host $dest_device_id$ + mitre_attack_id: + - T1036 + - T1036.003 + product: + - Splunk Behavioral Analytics + risk_score: 14 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml b/ba_detections/endpoint/ssa_windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml new file mode 100644 index 0000000000..10305c2bc6 --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml @@ -0,0 +1,56 @@ +name: Windows Rename System Utilities Adplus exe LOLBAS in Non Standard Path +id: ecaaf956-c516-4980-b08e-8c01c19614ca +version: 1 +date: '2022-10-18' +author: Splunk Threat Research Bot, Splunk +status: production +type: Anomaly +description: The following analytic identifies adplus.exe which is a native living + off the land binary or script (LOLBAS) within the Windows operating system that + may be abused by adversaries by moving it to a new directory. The list of binaries + was derived from the https://lolbas-project.github.io site. +data_source: [] +search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, + "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"), + "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", + null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", + null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string", + null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where + process_name IS NOT NULL AND process_name="adplus.exe"| where process_path IS NOT + NULL AND match_regex(process_path, /(?i)\\program files (x86)\\windows kits\\10\\debuggers\\x86/)=false + | eval start_time=timestamp,end_time=timestamp, entities=mvappend(device, user), + body=create_map(["event_id", event_id, "process_path", process_path, "process_name", + process_name]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you must be ingesting logs + with the process name, command-line arguments, and parent processes from your endpoints. + Collect endpoint data such as Sysmon or Windows Events 4688. +known_false_positives: False positives may be present and filtering may be required. + Certain utilities will run from non-standard paths based on the third-party application + in use. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml +- https://attack.mitre.org/techniques/T1036/003/ +- https://lolbas-project.github.io/ +tags: + analytic_story: + - Unusual Processes + - Living Off The Land + asset_type: Endpoint + atomic_guid: [] + confidence: 70 + drilldown_search: [] + impact: 20 + message: A system process $process_name$ with path $process_path$ spawn in non-default + folder path on host $dest_device_id$ + mitre_attack_id: + - T1036 + - T1036.003 + product: + - Splunk Behavioral Analytics + risk_score: 14 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml b/ba_detections/endpoint/ssa_windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml new file mode 100644 index 0000000000..718fa86f8f --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml @@ -0,0 +1,55 @@ +name: Windows Rename System Utilities Advpack dll LOLBAS in Non Standard Path +id: 3284e4f4-67f7-49b6-ad5e-a8fcead2eef8 +version: 1 +date: '2022-10-18' +author: Splunk Threat Research Bot, Splunk +status: production +type: Anomaly +description: The following analytic identifies Advpack.dll which is a native living + off the land binary or script (LOLBAS) within the Windows operating system that + may be abused by adversaries by moving it to a new directory. The list of binaries + was derived from the https://lolbas-project.github.io site. +data_source: [] +search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, + "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"), + "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", + null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", + null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string", + null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where + process_name IS NOT NULL AND process_name="advpack.dll"| where process_path IS NOT + NULL AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,end_time=timestamp, + entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path", + process_path, "process_name", process_name]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you must be ingesting logs + with the process name, command-line arguments, and parent processes from your endpoints. + Collect endpoint data such as Sysmon or Windows Events 4688. +known_false_positives: False positives may be present and filtering may be required. + Certain utilities will run from non-standard paths based on the third-party application + in use. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml +- https://attack.mitre.org/techniques/T1036/003/ +- https://lolbas-project.github.io/ +tags: + analytic_story: + - Unusual Processes + - Living Off The Land + asset_type: Endpoint + atomic_guid: [] + confidence: 70 + drilldown_search: [] + impact: 20 + message: A system process $process_name$ with path $process_path$ spawn in non-default + folder path on host $dest_device_id$ + mitre_attack_id: + - T1036 + - T1036.003 + product: + - Splunk Behavioral Analytics + risk_score: 14 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml b/ba_detections/endpoint/ssa_windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml new file mode 100644 index 0000000000..90352ee2e8 --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml @@ -0,0 +1,55 @@ +name: Windows Rename System Utilities Agentexecutor exe LOLBAS in Non Standard Path +id: e124f71f-11bc-47e4-9931-6046d256005d +version: 1 +date: '2022-10-18' +author: Splunk Threat Research Bot, Splunk +status: production +type: Anomaly +description: The following analytic identifies AgentExecutor.exe which is a native + living off the land binary or script (LOLBAS) within the Windows operating system + that may be abused by adversaries by moving it to a new directory. The list of binaries + was derived from the https://lolbas-project.github.io site. +data_source: [] +search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, + "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"), + "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", + null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", + null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string", + null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where + process_name IS NOT NULL AND process_name="agentexecutor.exe"| where process_path + IS NOT NULL AND match_regex(process_path, /(?i)\\program files (x86)/)=false | eval + start_time=timestamp,end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id", + event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you must be ingesting logs + with the process name, command-line arguments, and parent processes from your endpoints. + Collect endpoint data such as Sysmon or Windows Events 4688. +known_false_positives: False positives may be present and filtering may be required. + Certain utilities will run from non-standard paths based on the third-party application + in use. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml +- https://attack.mitre.org/techniques/T1036/003/ +- https://lolbas-project.github.io/ +tags: + analytic_story: + - Unusual Processes + - Living Off The Land + asset_type: Endpoint + atomic_guid: [] + confidence: 70 + drilldown_search: [] + impact: 20 + message: A system process $process_name$ with path $process_path$ spawn in non-default + folder path on host $dest_device_id$ + mitre_attack_id: + - T1036 + - T1036.003 + product: + - Splunk Behavioral Analytics + risk_score: 14 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml b/ba_detections/endpoint/ssa_windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml new file mode 100644 index 0000000000..4cc81b6d02 --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml @@ -0,0 +1,56 @@ +name: Windows Rename System Utilities Appinstaller exe LOLBAS in Non Standard Path +id: 057c06c7-ef31-4749-b5c9-199152e53a06 +version: 1 +date: '2022-10-18' +author: Splunk Threat Research Bot, Splunk +status: production +type: Anomaly +description: The following analytic identifies AppInstaller.exe which is a native + living off the land binary or script (LOLBAS) within the Windows operating system + that may be abused by adversaries by moving it to a new directory. The list of binaries + was derived from the https://lolbas-project.github.io site. +data_source: [] +search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, + "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"), + "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", + null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", + null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string", + null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where + process_name IS NOT NULL AND process_name="appinstaller.exe"| where process_path + IS NOT NULL AND match_regex(process_path, /(?i)\\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe/)=false + | eval start_time=timestamp,end_time=timestamp, entities=mvappend(device, user), + body=create_map(["event_id", event_id, "process_path", process_path, "process_name", + process_name]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you must be ingesting logs + with the process name, command-line arguments, and parent processes from your endpoints. + Collect endpoint data such as Sysmon or Windows Events 4688. +known_false_positives: False positives may be present and filtering may be required. + Certain utilities will run from non-standard paths based on the third-party application + in use. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml +- https://attack.mitre.org/techniques/T1036/003/ +- https://lolbas-project.github.io/ +tags: + analytic_story: + - Unusual Processes + - Living Off The Land + asset_type: Endpoint + atomic_guid: [] + confidence: 70 + drilldown_search: [] + impact: 20 + message: A system process $process_name$ with path $process_path$ spawn in non-default + folder path on host $dest_device_id$ + mitre_attack_id: + - T1036 + - T1036.003 + product: + - Splunk Behavioral Analytics + risk_score: 14 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml b/ba_detections/endpoint/ssa_windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml new file mode 100644 index 0000000000..346af764c0 --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml @@ -0,0 +1,56 @@ +name: Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard Path +id: 93862a89-abe0-4094-909a-08ec390aa5e3 +version: 1 +date: '2022-10-18' +author: Splunk Threat Research Bot, Splunk +status: production +type: Anomaly +description: The following analytic identifies Appvlp.exe which is a native living + off the land binary or script (LOLBAS) within the Windows operating system that + may be abused by adversaries by moving it to a new directory. The list of binaries + was derived from the https://lolbas-project.github.io site. +data_source: [] +search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, + "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"), + "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", + null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", + null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string", + null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where + process_name IS NOT NULL AND process_name="appvlp.exe"| where process_path IS NOT + NULL AND match_regex(process_path, /(?i)\\program files (x86)\\microsoft office\\root\\client/)=false + | eval start_time=timestamp,end_time=timestamp, entities=mvappend(device, user), + body=create_map(["event_id", event_id, "process_path", process_path, "process_name", + process_name]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you must be ingesting logs + with the process name, command-line arguments, and parent processes from your endpoints. + Collect endpoint data such as Sysmon or Windows Events 4688. +known_false_positives: False positives may be present and filtering may be required. + Certain utilities will run from non-standard paths based on the third-party application + in use. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml +- https://attack.mitre.org/techniques/T1036/003/ +- https://lolbas-project.github.io/ +tags: + analytic_story: + - Unusual Processes + - Living Off The Land + asset_type: Endpoint + atomic_guid: [] + confidence: 70 + drilldown_search: [] + impact: 20 + message: A system process $process_name$ with path $process_path$ spawn in non-default + folder path on host $dest_device_id$ + mitre_attack_id: + - T1036 + - T1036.003 + product: + - Splunk Behavioral Analytics + risk_score: 14 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml b/ba_detections/endpoint/ssa_windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml new file mode 100644 index 0000000000..b11c059e6b --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml @@ -0,0 +1,56 @@ +name: Windows Rename System Utilities Aspnet compiler exe LOLBAS in Non Standard Path +id: d75cc561-3828-4d0a-92c4-0eb93bfe0929 +version: 1 +date: '2022-10-18' +author: Splunk Threat Research Bot, Splunk +status: production +type: Anomaly +description: The following analytic identifies Aspnet_Compiler.exe which is a native + living off the land binary or script (LOLBAS) within the Windows operating system + that may be abused by adversaries by moving it to a new directory. The list of binaries + was derived from the https://lolbas-project.github.io site. +data_source: [] +search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, + "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"), + "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", + null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", + null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string", + null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where + process_name IS NOT NULL AND process_name="aspnet_compiler.exe"| where process_path + IS NOT NULL AND match_regex(process_path, /(?i)\\windows\\microsoft.net\\framework64\\v4.0.30319/)=false + | eval start_time=timestamp,end_time=timestamp, entities=mvappend(device, user), + body=create_map(["event_id", event_id, "process_path", process_path, "process_name", + process_name]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you must be ingesting logs + with the process name, command-line arguments, and parent processes from your endpoints. + Collect endpoint data such as Sysmon or Windows Events 4688. +known_false_positives: False positives may be present and filtering may be required. + Certain utilities will run from non-standard paths based on the third-party application + in use. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml +- https://attack.mitre.org/techniques/T1036/003/ +- https://lolbas-project.github.io/ +tags: + analytic_story: + - Unusual Processes + - Living Off The Land + asset_type: Endpoint + atomic_guid: [] + confidence: 70 + drilldown_search: [] + impact: 20 + message: A system process $process_name$ with path $process_path$ spawn in non-default + folder path on host $dest_device_id$ + mitre_attack_id: + - T1036 + - T1036.003 + product: + - Splunk Behavioral Analytics + risk_score: 14 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml b/ba_detections/endpoint/ssa_windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml new file mode 100644 index 0000000000..fa6ecde1db --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml @@ -0,0 +1,55 @@ +name: Windows Rename System Utilities At exe LOLBAS in Non Standard Path +id: 6401d583-0052-4dc5-a713-68b510826d2b +version: 1 +date: '2022-10-18' +author: Splunk Threat Research Bot, Splunk +status: production +type: Anomaly +description: The following analytic identifies At.exe which is a native living off + the land binary or script (LOLBAS) within the Windows operating system that may + be abused by adversaries by moving it to a new directory. The list of binaries was + derived from the https://lolbas-project.github.io site. +data_source: [] +search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, + "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"), + "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", + null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", + null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string", + null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where + process_name IS NOT NULL AND process_name="at.exe"| where process_path IS NOT NULL + AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,end_time=timestamp, + entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path", + process_path, "process_name", process_name]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you must be ingesting logs + with the process name, command-line arguments, and parent processes from your endpoints. + Collect endpoint data such as Sysmon or Windows Events 4688. +known_false_positives: False positives may be present and filtering may be required. + Certain utilities will run from non-standard paths based on the third-party application + in use. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml +- https://attack.mitre.org/techniques/T1036/003/ +- https://lolbas-project.github.io/ +tags: + analytic_story: + - Unusual Processes + - Living Off The Land + asset_type: Endpoint + atomic_guid: [] + confidence: 70 + drilldown_search: [] + impact: 20 + message: A system process $process_name$ with path $process_path$ spawn in non-default + folder path on host $dest_device_id$ + mitre_attack_id: + - T1036 + - T1036.003 + product: + - Splunk Behavioral Analytics + risk_score: 14 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml b/ba_detections/endpoint/ssa_windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml new file mode 100644 index 0000000000..f6e927a36d --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml @@ -0,0 +1,55 @@ +name: Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard Path +id: b8da7ea5-8c16-4eff-9787-54ec271159e0 +version: 1 +date: '2022-10-18' +author: Splunk Threat Research Bot, Splunk +status: production +type: Anomaly +description: The following analytic identifies Atbroker.exe which is a native living + off the land binary or script (LOLBAS) within the Windows operating system that + may be abused by adversaries by moving it to a new directory. The list of binaries + was derived from the https://lolbas-project.github.io site. +data_source: [] +search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, + "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"), + "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", + null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", + null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string", + null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where + process_name IS NOT NULL AND process_name="atbroker.exe"| where process_path IS + NOT NULL AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,end_time=timestamp, + entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path", + process_path, "process_name", process_name]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you must be ingesting logs + with the process name, command-line arguments, and parent processes from your endpoints. + Collect endpoint data such as Sysmon or Windows Events 4688. +known_false_positives: False positives may be present and filtering may be required. + Certain utilities will run from non-standard paths based on the third-party application + in use. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml +- https://attack.mitre.org/techniques/T1036/003/ +- https://lolbas-project.github.io/ +tags: + analytic_story: + - Unusual Processes + - Living Off The Land + asset_type: Endpoint + atomic_guid: [] + confidence: 70 + drilldown_search: [] + impact: 20 + message: A system process $process_name$ with path $process_path$ spawn in non-default + folder path on host $dest_device_id$ + mitre_attack_id: + - T1036 + - T1036.003 + product: + - Splunk Behavioral Analytics + risk_score: 14 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_windows_rundll32_comsvcs_memory_dump.yml b/ba_detections/endpoint/ssa_windows_rundll32_comsvcs_memory_dump.yml new file mode 100644 index 0000000000..3b80a58776 --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_rundll32_comsvcs_memory_dump.yml @@ -0,0 +1,52 @@ +name: Windows Rundll32 Comsvcs Memory Dump +id: 76bb9e35-f314-4c3d-a385-83c72a13ce4e +version: 5 +date: '2022-04-14' +author: Jose Hernandez, Michael Haag, Splunk +status: production +type: TTP +description: The following analytic identifies memory dumping using comsvcs.dll with + the minidump function with `rundll32.exe`. This technique is common with adversaries + who would like to dump the memory of lsass.exe. +data_source: [] +search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_event, + "_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"), + "string", null), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", + null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where process IS NOT NULL AND process_name IS NOT + NULL AND process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)minidump\s+/)=true + AND match_regex(process, /(?i)comsvcs.dll\s+/)=true | eval start_time = timestamp, + end_time = timestamp, entities = mvappend(machine), body=create_map(["event_id", + event_id, "process_name", process_name, "process", process]) | into write_ssa_detected_events();' +how_to_implement: You must be ingesting endpoint data that tracks process activity, + including Windows command line logging. You can see how we test this with [Event + Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a) + on the [attack_range](https://github.com/splunk/attack_range/blob/develop/ansible/roles/windows_common/tasks/windows-enable-4688-cmd-line-audit.yml). +known_false_positives: False positives should be limited, filter as needed. +references: +- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-3---dump-lsassexe-memory-using-comsvcsdll +tags: + analytic_story: + - Credential Dumping + - Suspicious Rundll32 Activity + asset_type: Endpoint + atomic_guid: [] + confidence: 100 + drilldown_search: [] + impact: 40 + message: A dump of a process was attempted using comsvcs.dll with the minidump function + on endpoint $dest_device_id$ by user $dest_device_user$. + mitre_attack_id: + - T1003.003 + - T1003 + product: + - Splunk Behavioral Analytics + risk_score: 40 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-security.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_windows_rundll32_inline_hta_execution.yml b/ba_detections/endpoint/ssa_windows_rundll32_inline_hta_execution.yml new file mode 100644 index 0000000000..f3f9635548 --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_rundll32_inline_hta_execution.yml @@ -0,0 +1,62 @@ +name: Windows Rundll32 Inline HTA Execution +id: 0caa1dd6-94f5-11ec-9786-acde48001122 +version: 1 +date: '2022-02-23' +author: Michael Haag, Splunk +status: production +type: TTP +description: The following analytic identifies "rundll32.exe" execution with inline + protocol handlers. "JavaScript", "VBScript", and "About" are the only supported + options when invoking HTA content directly on the command-line. This type of behavior + is commonly observed with fileless malware or application whitelisting bypass techniques. + The search will return the first time and last time these command-line arguments + were used for these executions, as well as the target system, the user, process + "rundll32.exe" and its parent process. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="rundll32.exe" + AND (like (cmd_line, "%vbscript%") OR like (cmd_line, "%javascript%") OR like (cmd_line, + "%about%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Although unlikely, some legitimate applications may exhibit + this behavior, triggering a false positive. +references: +- https://github.com/redcanaryco/AtomicTestHarnesses +- https://redcanary.com/blog/introducing-atomictestharnesses/ +- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing +tags: + analytic_story: + - Suspicious MSHTA Activity + - NOBELIUM Group + - Living Off The Land + asset_type: Endpoint + atomic_guid: [] + confidence: 80 + drilldown_search: [] + impact: 70 + message: Suspicious $process_name$ inline HTA execution on $dest_device_id$. + mitre_attack_id: + - T1218 + - T1218.005 + product: + - Splunk Behavioral Analytics + risk_score: 56 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_windows_script_host_spawn_msbuild.yml b/ba_detections/endpoint/ssa_windows_script_host_spawn_msbuild.yml new file mode 100644 index 0000000000..cd368bbc67 --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_script_host_spawn_msbuild.yml @@ -0,0 +1,60 @@ +name: Windows Script Host Spawn MSBuild +id: 92886f1c-9b11-11ec-848a-acde48001122 +version: 1 +date: '2022-03-03' +author: Michael Haag, Splunk +status: production +type: TTP +description: This analytic is to detect a suspicious child process of MSBuild spawned + by Windows Script Host - cscript or wscript. This behavior or event are commonly + seen and used by malware or adversaries to execute malicious msbuild process using + malicious script in the compromised host. During triage, review parallel processes + and identify any file modifications. MSBuild may load a script from the same path + without having command-line arguments. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name IS NOT + NULL | where (parent_process_name LIKE "%wscript.exe" OR parent_process_name LIKE + "%cscript.exe%") AND process_name="msbuild.exe" | eval start_time=timestamp, end_time=timestamp, + entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, + "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", + cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, + "process_path", process_path]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives should be limited as developers do not spawn + MSBuild via a WSH. +references: +- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# +- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1127.001_MSBuild/InvokeMSBuild.ps1 +tags: + analytic_story: + - Trusted Developer Utilities Proxy Execution MSBuild + - Living Off The Land + asset_type: Endpoint + atomic_guid: [] + confidence: 100 + drilldown_search: [] + impact: 80 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$. + mitre_attack_id: + - T1127.001 + - T1127 + product: + - Splunk Behavioral Analytics + risk_score: 80 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/msbuild-windows-security.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/ba_detections/endpoint/ssa_windows_system_binary_proxy_execution_compiled_html_file_decompile.yml new file mode 100644 index 0000000000..1bb51558db --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_system_binary_proxy_execution_compiled_html_file_decompile.yml @@ -0,0 +1,60 @@ +name: Windows System Binary Proxy Execution Compiled HTML File Decompile +id: 11c32b19-05a6-48a8-ab28-18dbd9ec5d50 +version: 1 +date: '2022-09-02' +author: Michael Haag, Splunk +status: production +type: TTP +description: The following analytic identifies the decompile parameter with the HTML + Help application, HH.exe. This is a uncommon command to see ran and behavior. Most + recently this was seen in a APT41 campaign where a CHM file was delivered and a + script inside used a technique for running an arbitrary command in a CHM file via + an ActiveX object. This unpacks an HTML help file to a specified path for launching + the next stage. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="hh.exe" AND + like (cmd_line, "%-decompile%")| eval start_time=timestamp, end_time=timestamp, + entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, + "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", + cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, + "process_path", process_path]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: False positives should be limited, filter as needed. +references: +- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/ +- https://redcanary.com/blog/introducing-atomictestharnesses/ +- https://attack.mitre.org/techniques/T1218/001/ +- https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa +tags: + analytic_story: + - Suspicious Compiled HTML Activity + - Living Off The Land + asset_type: Endpoint + atomic_guid: [] + confidence: 90 + drilldown_search: [] + impact: 100 + message: $process_name$ has been identified using decompile against a CHM on $dest_device_id$ + under user $dest_user_id$. + mitre_attack_id: + - T1218.001 + - T1218 + product: + - Splunk Behavioral Analytics + risk_score: 90 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log + source: XmlWinEventLog + update_timestamp: true diff --git a/ba_detections/endpoint/ssa_windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml b/ba_detections/endpoint/ssa_windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml new file mode 100644 index 0000000000..91b52cabf8 --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml @@ -0,0 +1,69 @@ +name: Windows System Binary Proxy Execution Compiled HTML File URL In Command Line +id: 0fec631a-7c9b-4e4c-b28b-93260953e25f +version: 1 +date: '2022-09-02' +author: Michael Haag, Splunk +status: production +type: TTP +description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled + HTML Help (CHM) file from a remote url. This particular technique will load Windows + script code from a compiled help file. CHM files may contain nearly any file type + embedded, but only execute html/htm. Upon a successful execution, the following + script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, + JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe + upon execution. The "htm" and "html" file extensions were the only extensions observed + to be supported for the execution of Shortcut commands or WSH script code. During + investigation, identify script content origination. Review reputation of remote + IP and domain. Some instances, it is worth decompiling the .chm file to review its + original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="hh.exe" AND + (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%"))| eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Although unlikely, some legitimate applications may retrieve + a CHM remotely, filter as needed. +references: +- https://attack.mitre.org/techniques/T1218/001/ +- https://www.kb.cert.org/vuls/id/851869 +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md +- https://lolbas-project.github.io/lolbas/Binaries/Hh/ +- https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7 +- https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ +tags: + analytic_story: + - Suspicious Compiled HTML Activity + - Living Off The Land + asset_type: Endpoint + atomic_guid: [] + confidence: 100 + drilldown_search: [] + impact: 90 + message: An instance of $process_name$ was identified on endpoint $dest_device_id$ + by user $dest_user_id$ contacting a remote destination. + mitre_attack_id: + - T1218.001 + - T1218 + product: + - Splunk Behavioral Analytics + risk_score: 90 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/chm-wineventlog-security.log + source: WinEventLog:Security + update_timestamp: true diff --git a/ba_detections/endpoint/ssa_windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml b/ba_detections/endpoint/ssa_windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml new file mode 100644 index 0000000000..a322de90d3 --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml @@ -0,0 +1,72 @@ +name: Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage + Handlers +id: ba0c2450-caea-4086-ac3a-a71e2659754b +version: 1 +date: '2022-09-02' +author: Michael Haag, Splunk +status: production +type: TTP +description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled + HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique + will load Windows script code from a compiled help file, using InfoTech Storage + Handlers. itss.dll will load upon execution. Three InfoTech Storage handlers are + supported - ms-its, its, mk:@MSITStore. ITSS may be used to launch a specific html/htm + file from within a CHM file. CHM files may contain nearly any file type embedded. + Upon a successful execution, the following script engines may be used for execution + - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may + identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" + and "html" file extensions were the only extensions observed to be supported for + the execution of Shortcut commands or WSH script code. During investigation, identify + script content origination. hh.exe is natively found in C:\Windows\system32 and + C:\Windows\syswow64. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="hh.exe" AND + (like (cmd_line, "%its:%") OR like (cmd_line, "%mk:@MSITStore:%"))| eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: It is rare to see instances of InfoTech Storage Handlers being + used, but it does happen in some legitimate instances. Filter as needed. +references: +- https://attack.mitre.org/techniques/T1218/001/ +- https://www.kb.cert.org/vuls/id/851869 +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md +- https://lolbas-project.github.io/lolbas/Binaries/Hh/ +- https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7 +- https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ +tags: + analytic_story: + - Suspicious Compiled HTML Activity + - Living Off The Land + asset_type: Endpoint + atomic_guid: [] + confidence: 90 + drilldown_search: [] + impact: 80 + message: $process_name$ has been identified using Infotech Storage Handlers to load + a specific file within a CHM on $dest_device_id$ under user $dest_user_id$. + mitre_attack_id: + - T1218.001 + - T1218 + product: + - Splunk Behavioral Analytics + risk_score: 72 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/chm-wineventlog-security.log + source: WinEventLog:Security + update_timestamp: true diff --git a/ba_detections/endpoint/ssa_windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml b/ba_detections/endpoint/ssa_windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml new file mode 100644 index 0000000000..b409373edf --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml @@ -0,0 +1,56 @@ +name: Windows System Binary Proxy Execution MSIExec DLLRegisterServer +id: 8d1d5570-722c-49a3-996c-2e2cceef5163 +version: 1 +date: '2022-08-31' +author: Michael Haag, Splunk +status: production +type: TTP +description: The following analytic identifies the usage of msiexec.exe using the + /y switch parameter, which grants the ability for msiexec to load DLLRegisterServer. + Upon triage, review parent process and capture any artifacts for further review. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msiexec.exe" + AND (like (cmd_line, "%/y %") OR like (cmd_line, "%-y %")) | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: This analytic will need to be tuned for your environment based + on legitimate usage of msiexec.exe. Filter as needed. +references: +- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md +tags: + analytic_story: + - Windows System Binary Proxy Execution MSIExec + asset_type: Endpoint + atomic_guid: [] + confidence: 50 + drilldown_search: [] + impact: 70 + message: An instance of spawning $process_name$ was identified on endpoint $dest_device_id$ + by user $dest_user_id$ attempting to register a file. + mitre_attack_id: + - T1218.007 + product: + - Splunk Behavioral Analytics + risk_score: 35 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog + update_timestamp: true diff --git a/ba_detections/endpoint/ssa_windows_system_binary_proxy_execution_msiexec_remote_download.yml b/ba_detections/endpoint/ssa_windows_system_binary_proxy_execution_msiexec_remote_download.yml new file mode 100644 index 0000000000..cbf9397b09 --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_system_binary_proxy_execution_msiexec_remote_download.yml @@ -0,0 +1,56 @@ +name: Windows System Binary Proxy Execution MSIExec Remote Download +id: 92cbbf0f-9a6b-4e9d-8c35-cc9244a4e3d5 +version: 1 +date: '2022-08-31' +author: Michael Haag, Splunk +status: production +type: TTP +description: The following analytic identifies msiexec.exe with http in the command-line. + This procedure will utilize msiexec.exe to download a remote file and load it. During + triage, review parallel processes and capture any artifacts on disk for review. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msiexec.exe" + AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%")) | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: False positives may be present, filter by destination or parent + process as needed. +references: +- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md +tags: + analytic_story: + - Windows System Binary Proxy Execution MSIExec + asset_type: Endpoint + atomic_guid: [] + confidence: 50 + drilldown_search: [] + impact: 70 + message: An instance of spawning $process_name$ was identified on endpoint $dest_device_id$ + by user $dest_user_id$ attempting to download a file. + mitre_attack_id: + - T1218.007 + product: + - Splunk Behavioral Analytics + risk_score: 35 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog + update_timestamp: true diff --git a/ba_detections/endpoint/ssa_windows_system_binary_proxy_execution_msiexec_unregister_dll.yml b/ba_detections/endpoint/ssa_windows_system_binary_proxy_execution_msiexec_unregister_dll.yml new file mode 100644 index 0000000000..0b69c329ec --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_system_binary_proxy_execution_msiexec_unregister_dll.yml @@ -0,0 +1,56 @@ +name: Windows System Binary Proxy Execution MSIExec Unregister DLL +id: df76a8d1-92e1-4ec9-b8f7-695b5838703e +version: 1 +date: '2022-08-31' +author: Michael Haag, Splunk +status: production +type: TTP +description: The following analytic identifies the usage of msiexec.exe using the + /z switch parameter, which grants the ability for msiexec to unload DLLRegisterServer. + Upon triage, review parent process and capture any artifacts for further review. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msiexec.exe" + AND (like (cmd_line, "%/z %") OR like (cmd_line, "%-z %")) | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: False positives may be present, filter by destination or parent + process as needed. +references: +- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md +tags: + analytic_story: + - Windows System Binary Proxy Execution MSIExec + asset_type: Endpoint + atomic_guid: [] + confidence: 50 + drilldown_search: [] + impact: 70 + message: An instance of spawning $process_name$ was identified on endpoint $dest_device_id$ + by user $dest_user_id$ attempting to unregister a DLL. + mitre_attack_id: + - T1218.007 + product: + - Splunk Behavioral Analytics + risk_score: 35 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog + update_timestamp: true diff --git a/ba_detections/endpoint/ssa_windows_wmiprvse_spawn_msbuild.yml b/ba_detections/endpoint/ssa_windows_wmiprvse_spawn_msbuild.yml new file mode 100644 index 0000000000..30436d312f --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_wmiprvse_spawn_msbuild.yml @@ -0,0 +1,61 @@ +name: Windows WMIPrvse Spawn MSBuild +id: 76b3b290-9b31-11ec-a934-acde48001122 +version: 1 +date: '2022-03-03' +author: Michael Haag, Splunk +status: production +type: TTP +description: The following analytic identifies wmiprvse.exe spawning msbuild.exe. + This behavior is indicative of a COM object being utilized to spawn msbuild from + wmiprvse.exe. It is common for MSBuild.exe to be spawned from devenv.exe while using + Visual Studio. In this instance, there will be command line arguments and file paths. + In a malicious instance, MSBuild.exe will spawn from non-standard processes and + have no command line arguments. For example, MSBuild.exe spawning from explorer.exe, + powershell.exe is far less common and should be investigated. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=lower(ucast(map_get(input_event, "parent_process_name"), + "string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name + IS NOT NULL | where parent_process_name LIKE "%wmiprvse.exe%" AND process_name="msbuild.exe" + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Although unlikely, some legitimate applications may exhibit + this behavior, triggering a false positive. +references: +- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md +tags: + analytic_story: + - Trusted Developer Utilities Proxy Execution MSBuild + - Living Off The Land + asset_type: Endpoint + atomic_guid: [] + confidence: 100 + drilldown_search: [] + impact: 80 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$. + mitre_attack_id: + - T1127 + - T1127.001 + product: + - Splunk Behavioral Analytics + risk_score: 80 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/msbuild-windows-security.log + source: WinEventLog:Security diff --git a/ba_detections/endpoint/ssa_windows_wsreset_uac_bypass.yml b/ba_detections/endpoint/ssa_windows_wsreset_uac_bypass.yml new file mode 100644 index 0000000000..b3b5fd0d59 --- /dev/null +++ b/ba_detections/endpoint/ssa_windows_wsreset_uac_bypass.yml @@ -0,0 +1,55 @@ +name: Windows WSReset UAC Bypass +id: 3118f0c2-90d9-11ec-b833-acde48001122 +version: 1 +date: '2022-02-18' +author: Lou Stella, Splunk +status: experimental +type: Anomaly +description: This analytic is built to detect a suspicious modification of the Windows + registry related to UAC bypass. This technique is to modify the registry in this + detection, create a registry value with the path of the payload and run WSreset.exe + to bypass User Account Control. +data_source: [] +search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)), + registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)), + registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string", + null)), registry_key_name=lower(ucast(map_get(input_event, "registry_key_name"), + "string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"), + "string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"), + "string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"), + "string", null)) | where registry_path IS NOT NULL AND registry_value_name IS NOT + NULL and like (registry_path, "%\\\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\\\Shell\\\\open\\\\command%") + AND (registry_value_name="(Default)" OR registry_value_name="DelegateExecute") | + eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)) | eval body=create_map(["registry_path", registry_path, "registry_hive", + registry_hive, "registry_value_name", registry_value_name, "registry_key_name", + registry_key_name, "registry_value_type", registry_value_type, "registry_value_data", + registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events(); ' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint_Registry` datamodel. +known_false_positives: Unknown at this point in time. +references: +- https://github.com/hfiref0x/UACME +- https://blog.morphisec.com/trickbot-uses-a-new-windows-10-uac-bypass +tags: + analytic_story: + - Living Off The Land + - Windows Defense Evasion Tactics + asset_type: Endpoint + atomic_guid: [] + confidence: 90 + drilldown_search: [] + impact: 70 + message: tbd + mitre_attack_id: + - T1548.002 + - T1548 + product: + - Splunk Behavioral Analytics + risk_score: 63 + security_domain: endpoint +tests: [] diff --git a/ba_detections/network/ssa_tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml b/ba_detections/network/ssa_tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml new file mode 100644 index 0000000000..86ad8a5c3d --- /dev/null +++ b/ba_detections/network/ssa_tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml @@ -0,0 +1,56 @@ +name: TCP Command and Scripting Interpreter Outbound LDAP Traffic +id: 4d16a90c-d1a9-4d17-8156-d0db0c73c449 +version: 1 +date: '2022-02-17' +author: Jose Hernandez, Michael Haag, Splunk +status: experimental +type: Anomaly +description: Malicious actors often abuse misconfigured LDAP servers or applications + that use the LDAP servers in organizations. Outbound LDAP traffic should not be + allowed outbound through your perimeter firewall. This search will help determine + if you have any LDAP connections to IP addresses outside of private (RFC1918) address + space. +data_source: [] +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), dest_port=map_get(input_event, "dest_port"), event_id=ucast(map_get(input_event, + "event_id"), "string", null), dest_ip=ucast(map_get(input_event, "dest_device_ips"), + "collection", [])[0] | where dest_port=389 OR dest_port=1389 OR dest_port=636 + | where NOT (cidrmatch(ip: dest_ip, cidr_range: "10.0.0.0/8") OR cidrmatch(ip: dest_ip, + cidr_range: "192.168.0.0/16") OR cidrmatch(ip: dest_ip, cidr_range: "172.16.0.0/12")) + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "dest_port", dest_port, + "dest_ip", dest_ip]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on network traffic, specifically data that populates the Network_Traffic datamodel. + To develop this analytic we used specifically Zeek/Bro conn.log and PAN Traffic + events. +known_false_positives: Unknown at this moment. Outbound LDAP traffic should not be + allowed outbound through your perimeter firewall. Please check those servers to + verify if the activity is legitimate. +references: +- https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/ +- https://www.splunk.com/en_us/blog/security/simulating-detecting-and-responding-to-log4shell-with-splunk.html +- https://www.cisa.gov/uscert/ncas/alerts/aa21-356a +tags: + analytic_story: + - Log4Shell CVE-2021-44228 + asset_type: endpoint + atomic_guid: [] + confidence: 70 + drilldown_search: [] + impact: 50 + message: An outbound LDAP connection from $src_ip$ in your infrastructure connecting + to dest ip $dest_ip$ + mitre_attack_id: + - T1059 + product: + - Splunk Behavioral Analytics + risk_score: 35 + security_domain: network +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.log + source: pan:traffic + sourcetype: pan:traffic diff --git a/ba_detections/network/ssa_unusual_volume_of_data_download_from_internal_server_per_entity.yml b/ba_detections/network/ssa_unusual_volume_of_data_download_from_internal_server_per_entity.yml new file mode 100644 index 0000000000..fcd6e6578f --- /dev/null +++ b/ba_detections/network/ssa_unusual_volume_of_data_download_from_internal_server_per_entity.yml @@ -0,0 +1,61 @@ +name: Unusual Volume of Data Download from Internal Server Per Entity +id: cca028f4-77dd-11ec-bc09-acde48001122 +version: 1 +date: '2022-01-17' +author: Xiao Lin, Splunk +status: experimental +type: Anomaly +description: Insider might conduct information collection before data exfiltration, + and unusual volume of data download from internal server is an indicator of such + potential threat. This detection evaluates the total bytes downloaded from internal + servers at specific time window per entity level, and then flagged these that are + higher than 99.999% percentile as an anamaly. A behavior will be reported as long + as the downloaded byte volume is unusual even though that operation is benign, which + causes false positive. It is therefore advised to adjust threshold and time window + based on detection performance whenever necessary. It should be noted that seasonality + is not modeled in the current approach. +data_source: [] +search: '| from read_ssa_enriched_events() | eval sourcetype = ucast(map_get(input_event, + "sourcetype"), "string", null) | eval timestamp = parse_long(ucast(map_get(input_event, + "_time"), "string", null)) | where sourcetype == "pan:traffic" | eval src_device_scope + =ucast(map_get(input_event, "src_device_scope"), "string", null) | eval dest_device_scope=ucast(map_get(input_event, + "dest_device_scope"), "string", null) | where src_device_scope IS NOT NULL AND dest_device_scope + IS NOT NULL | eval dest_device = ucast(map_get(input_event, "dest_device_ips"), + "collection", [])[0] | where dest_device IS NOT NULL AND dest_device_scope + == "INTERNAL" | eval src_device = ucast(map_get(input_event, "src_device_ips"), + "collection", [])[0] | where src_device IS NOT NULL AND src_device_scope + == "INTERNAL" | eval bytes_in = ucast(map_get(input_event, "bytes_in"), "integer", + 0) | eval download_bytes = cast(bytes_in, "double") | eval tenant = ucast(map_get(input_event, + "_tenant"), "string", null) | eval event_id = ucast(map_get(input_event, "event_id"), + "string", null) | adaptive_threshold algorithm="quantile" value="download_bytes" + entity="dest_device" window=86400000L | where label AND quantile>0.99999 | eval + end_time = timestamp | eval start_time = end_time - 86400000 | eval body = create_map(["event_id", + event_id, "tenant", tenant]) | eval entities=mvappend(dest_device) | into write_ssa_detected_events();' +how_to_implement: Ingest PAN traffic logs +known_false_positives: Benign large volume data download might be flagged as (false) + positive. +references: +- https://github.com/twitter/AnomalyDetection +tags: + analytic_story: + - Insider Threat + asset_type: endpoint + atomic_guid: [] + confidence: 50 + drilldown_search: [] + impact: 50 + message: $src_device_ip downloaded unusually amount of data from internal server + within one day + mitre_attack_id: + - T1213 + - T1039 + product: + - Splunk Behavioral Analytics + risk_score: 25 + security_domain: network +tests: +- name: True Positive Test + attack_data: + - data: https://github.com/splunk/attack_data/blob/master/datasets/suspicious_behaviour/unusual_data_download/unusual_volume_data_download.txt + source: PAN Traffic Log + sourcetype: pan:traffic