Branch was auto-updated.

detections/endpoint/disable_windows_behavior_monitoring.yml

@@ -1,7 +1,7 @@
 name: Disable Windows Behavior Monitoring
 id: 79439cae-9200-11eb-a4d3-acde48001122
 version: 3
-date: '2022-11-14'
+date: '2023-04-25'
 author: Steven Dick, Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -38,11 +38,12 @@ references:
 - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
 tags:
   analytic_story:
-  - Windows Defense Evasion Tactics
-  - Ransomware
-  - Revil Ransomware
-  - Windows Registry Abuse
   - Azorult
+  - Windows Registry Abuse
+  - Revil Ransomware
+  - RedLine Stealer
+  - Ransomware
+  - Windows Defense Evasion Tactics
   asset_type: Endpoint
   confidence: 100
   impact: 40

detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

@@ -1,7 +1,7 @@
 name: Executables Or Script Creation In Suspicious Path
 id: a7e3f0f0-ae42-11eb-b245-acde48001122
 version: 1
-date: '2023-04-14'
+date: '2023-04-25'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -37,24 +37,25 @@ references:
 - https://twitter.com/pr0xylife/status/1590394227758104576
 tags:
   analytic_story:
-  - DarkCrystal RAT
-  - AsyncRAT
   - Azorult
-  - Brute Ratel C4
-  - Double Zero Destructor
-  - Industroyer2
-  - AgentTesla
-  - Qakbot
-  - IcedID
-  - Remcos
+  - AsyncRAT
   - XMRig
-  - Hermetic Wiper
-  - Trickbot
-  - Chaos Ransomware
   - Swift Slicer
-  - LockBit Ransomware
+  - DarkCrystal RAT
+  - Double Zero Destructor
+  - Trickbot
   - Data Destruction
+  - LockBit Ransomware
+  - Industroyer2
+  - Remcos
+  - RedLine Stealer
   - WhisperGate
+  - IcedID
+  - Hermetic Wiper
+  - AgentTesla
+  - Brute Ratel C4
+  - Qakbot
+  - Chaos Ransomware
   asset_type: Endpoint
   confidence: 50
   impact: 40

detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml

@@ -1,7 +1,7 @@
 name: Non Chrome Process Accessing Chrome Default Dir
 id: 81263de4-160a-11ec-944f-acde48001122
 version: 1
-date: '2021-09-15'
+date: '2023-04-25'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -11,8 +11,8 @@ description: This search is to detect an anomaly event of a non-chrome process a
   the RAT, trojan spy as well as FIN7 jssloader try to parse the those sqlite database
   to collect information on the compromised host. This SACL Event (4663) need to be
   enabled to tthe firefox profile directory to be eable to use this. Since you monitoring
-  this access to the folder,  we observed noise that needs to be filter out and hence added
-  sqlite db browser and explorer .exe to make this detection more stable.
+  this access to the folder,  we observed noise that needs to be filter out and hence
+  added sqlite db browser and explorer .exe to make this detection more stable.
 data_source:
 - Windows Security 4663
 search: '`wineventlog_security` EventCode=4663 NOT (process_name IN ("*\\chrome.exe",
@@ -28,10 +28,11 @@ known_false_positives: other browser not listed related to firefox may catch by
 references: []
 tags:
   analytic_story:
-  - FIN7
   - Remcos
-  - AgentTesla
   - 3CX Supply Chain Attack
+  - AgentTesla
+  - RedLine Stealer
+  - FIN7
   asset_type: Endpoint
   confidence: 70
   impact: 50

detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml

@@ -1,18 +1,18 @@
 name: Non Firefox Process Access Firefox Profile Dir
 id: e6fc13b0-1609-11ec-b533-acde48001122
 version: 1
-date: '2021-09-15'
+date: '2023-04-25'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
 description: This search is to detect an anomaly event of a non-firefox process accessing
-  the files in the profile folder. This folder contains all the sqlite database of the
-  firefox browser related to users login, history, cookies and etc. Most of the RAT,
-  trojan spy as well as FIN7 jssloader try to parse the those sqlite database to collect
-  information on the compromised host. This SACL Event (4663) needs to be enabled to
-  the firefox profile directory to use this. Since this is monitoring the
-  access to the folder, we have obsevered noise and hence added `sqlite
-  db browser` and `explorer.exe` to make this detection more stable.
+  the files in the profile folder. This folder contains all the sqlite database of
+  the firefox browser related to users login, history, cookies and etc. Most of the
+  RAT, trojan spy as well as FIN7 jssloader try to parse the those sqlite database
+  to collect information on the compromised host. This SACL Event (4663) needs to
+  be enabled to the firefox profile directory to use this. Since this is monitoring
+  the access to the folder, we have obsevered noise and hence added `sqlite db browser`
+  and `explorer.exe` to make this detection more stable.
 data_source:
 - Windows Security 4663
 search: '`wineventlog_security` EventCode=4663 NOT (process_name IN ("*\\firefox.exe",
@@ -28,11 +28,12 @@ known_false_positives: other browser not listed related to firefox may catch by
 references: []
 tags:
   analytic_story:
-  - FIN7
-  - Remcos
   - Azorult
-  - AgentTesla
+  - Remcos
   - 3CX Supply Chain Attack
+  - AgentTesla
+  - RedLine Stealer
+  - FIN7
   asset_type: Endpoint
   confidence: 70
   impact: 50

detections/endpoint/suspicious_process_file_path.yml

@@ -1,7 +1,7 @@
 name: Suspicious Process File Path
 id: 9be25988-ad82-11eb-a14f-acde48001122
 version: 1
-date: '2023-04-14'
+date: '2023-04-25'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -35,25 +35,26 @@ references:
 - https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
 tags:
   analytic_story:
-  - AgentTesla
-  - Swift Slicer
-  - Prestige Ransomware
-  - Data Destruction
-  - AsyncRAT
-  - Brute Ratel C4
-  - XMRig
-  - LockBit Ransomware
-  - WhisperGate
-  - DarkCrystal RAT
-  - Qakbot
-  - Hermetic Wiper
-  - Chaos Ransomware
   - Azorult
+  - AsyncRAT
+  - XMRig
+  - Swift Slicer
+  - DarkCrystal RAT
   - Double Zero Destructor
-  - Industroyer2
-  - IcedID
   - Trickbot
+  - Data Destruction
+  - LockBit Ransomware
+  - Prestige Ransomware
+  - Industroyer2
   - Remcos
+  - RedLine Stealer
+  - WhisperGate
+  - IcedID
+  - Hermetic Wiper
+  - AgentTesla
+  - Brute Ratel C4
+  - Qakbot
+  - Chaos Ransomware
   asset_type: Endpoint
   confidence: 50
   impact: 70

detections/endpoint/windows_disableantispyware_registry.yml

@@ -1,7 +1,7 @@
 name: Windows DisableAntiSpyware Registry
 id: 23150a40-9301-4195-b802-5bb4f43067fb
 version: 2
-date: '2021-03-02'
+date: '2023-04-25'
 author: Rod Soto, Jose Hernandez, Michael Haag, Splunk
 status: production
 type: TTP
@@ -29,11 +29,12 @@ references:
 - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
 tags:
   analytic_story:
-  - Ryuk Ransomware
-  - Windows Defense Evasion Tactics
-  - Windows Registry Abuse
   - Azorult
+  - Windows Registry Abuse
   - CISA AA22-264A
+  - RedLine Stealer
+  - Windows Defense Evasion Tactics
+  - Ryuk Ransomware
   asset_type: Endpoint
   confidence: 80
   impact: 30

detections/endpoint/windows_event_for_service_disabled.yml

@@ -1,7 +1,7 @@
 name: Windows Event For Service Disabled
 id: 9c2620a8-94a1-11ec-b40c-acde48001122
 version: 2
-date: '2022-04-04'
+date: '2023-04-25'
 author: Teoderick Contreras, Splunk
 status: production
 type: Hunting
@@ -25,6 +25,7 @@ references:
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  - RedLine Stealer
   asset_type: Endpoint
   confidence: 60
   impact: 60

stories/redline.yml

@@ -0,0 +1,25 @@
+name: RedLine Stealer
+id: 12e31e8b-671b-4d6e-b362-a682812a71eb
+version: 1
+date: '2023-04-24'
+author: Teoderick Contreras, Splunk
+description: Leverage searches that allow you to detect and investigate unusual activities
+  that might relate to the Redline Stealer trojan, including looking for file writes associated
+  with its payload, screencapture, registry modification, persistence
+  and data collection..
+narrative: RedLine Stealer is a malware available on underground forum and subscription basis that are compiled or written in C#. 
+  This malware is capable of harvesting sensitive information from browsers such as saved credentials, auto file data, browser cookies 
+  and credit card information. It also gathers system information of the targeted or compromised host like username, location IP, RAM size available, hardware configuration and software installed. 
+  The current version of this malware contains features to steal wallet and crypto currency information. 
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
+- https://blogs.blackberry.com/en/2021/10/threat-thursday-redline-infostealer-update
+tags:
+  analytic_story: RedLine Stealer
+  category:
+  - Malware
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection