Branch was auto-updated.

detections/endpoint/detect_exchange_web_shell.yml

@@ -67,6 +67,7 @@ tags:
   mitre_attack_id:
   - T1505
   - T1505.003
+  - T1190
   observable:
   - name: user
     type: User

detections/endpoint/msi_module_loaded_by_non_system_binary.yml

@@ -0,0 +1,79 @@
+name: MSI Module Loaded by Non-System Binary
+id: ccb98a66-5851-11ec-b91c-acde48001122
+version: 1
+date: '2021-12-08'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel: []
+description: 'The following hunting analytic identifies `msi.dll` being loaded by a binary not located in `system32`, `syswow64`, `winsxs` or `windows` paths. This behavior is most recently related to InstallerFileTakeOver, or CVE-2021-41379, and DLL side-loading. 
+  CVE-2021-41379 requires a binary to be dropped and `msi.dll` to be loaded by it. To Successful exploitation of this issue happens in four parts \
+
+  1. Generation of an MSI that will trigger bad behavior. \
+
+  1. Preparing a directory for MSI installation. \
+
+  1. Inducing an error state. \
+
+  1. Racing to introduce a junction and a symlink to trick msiexec.exe to modify the attacker specified file. \
+  
+  In addition, `msi.dll` has been abused in DLL side-loading attacks by being loaded by non-system binaries.'
+search: '`sysmon` EventCode=7 ImageLoaded="*\\msi.dll" NOT (Image IN ("*\\System32\\*","*\\syswow64\\*","*\\windows\\*", "*\\winsxs\\*")) 
+  | stats count min(_time) as firstTime max(_time) as lastTime
+      by Image ImageLoaded process_name Computer EventCode ProcessId 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `msi_module_loaded_by_non_system_binary_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name and imageloaded executions from your endpoints. If you
+  are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: It is possible some Administrative utilities will load msi.dll outside of normal system paths, filter as needed.
+references:
+  - https://attackerkb.com/topics/7LstI2clmF/cve-2021-41379/rapid7-analysis 
+  - https://github.com/klinix5/InstallerFileTakeOver
+  - https://github.com/mandiant/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/msi.dll%20Hijack%20(Methodology).ioc
+cve:
+  - CVE-2021-41379
+tags:
+  analytic_story:
+  - Windows Privilege Escalation
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1574.002
+  - T1574
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image 
+  - ImageLoaded
+  - process_name 
+  - Computer
+  - EventCode 
+  - ProcessId 
+  security_domain: endpoint
+  impact: 80
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 56
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: The following module $ImageLoaded$ was loaded by $Image$ outside of the normal system paths on endpoint $Computer$, potentally related to DLL side-loading.
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: ImageLoaded
+    type: Other
+    role:
+    - Other
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  

detections/endpoint/resize_shadowstorage_volume.yml

@@ -28,8 +28,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   Sysmon TA.
 known_false_positives: network admin can resize the shadowstorage for valid purposes.
 references:
-- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
-- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
+  - https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
+  - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
+  - https://redcanary.com/blog/blackbyte-ransomware/
+  - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/vssadmin-resize-shadowstorage
 tags:
   analytic_story:
   - Clop Ransomware

detections/endpoint/windows_dism_remove_defender.yml

@@ -0,0 +1,81 @@
+name: Windows DISM Remove Defender
+id: 8567da9e-47f0-11ec-99a9-acde48001122
+version: 1
+date: '2021-11-17'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies the use of the Windows Disk Image Utility,
+  `dism.exe`, to remove Windows Defender. Adversaries may use `dism.exe` to disable
+  Defender before completing their objective.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=dism.exe
+  (Processes.process="*/online*" AND Processes.process="*/disable-feature*" AND Processes.process="*Windows-Defender*"
+  AND Processes.process="*/remove*") by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_dism_remove_defender_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Some legitimate administrative tools leverage `dism.exe` to
+  manipulate packages and features of the operating system. Filter as needed.
+references:
+- https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_dism.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  - T1562
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: access
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to disable Windows Defender.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  automated_detection_testing: passed

detections/endpoint/windows_raccine_scheduled_task_deletion.yml

@@ -0,0 +1,81 @@
+name: Windows Raccine Scheduled Task Deletion
+id: c9f010da-57ab-11ec-82bd-acde48001122
+version: 1
+date: '2021-12-07'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies the Raccine Rules Updater scheduled
+  task being deleted. Adversaries may attempt to remove this task in order to prevent
+  the update of Raccine.  Raccine is a "ransomware vaccine" created by security researcher
+  Florian Roth, designed to intercept and prevent precursors and active ransomware
+  behavior.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe
+  Processes.process="*delete*" AND Processes.process="*Raccine*" by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_raccine_scheduled_task_deletion_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives should be limited, however filter as needed.
+references:
+- https://redcanary.com/blog/blackbyte-ransomware/
+- https://github.com/Neo23x0/Raccine
+tags:
+  analytic_story:
+  - Ransomware
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_raccine.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user user$ attempting to disable Raccines scheduled task.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  automated_detection_testing: passed

detections/experimental/endpoint/microsoft_exchange_mailbox_replication_service_writing_active_server_pages.yml

@@ -0,0 +1,100 @@
+name: Microsoft Exchange Mailbox Replication service writing Active Server Pages
+id: 985f322c-57a5-11ec-b9ac-acde48001122
+version: 1
+date: '2021-12-07'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: 'The following query identifies suspicious .aspx created in 3 paths identified
+  by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM
+  group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`,
+  `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. The analytic is limited to process name MSExchangeMailboxReplication.exe, which typically does not write .aspx files to disk.
+  Upon triage, the suspicious
+  .aspx file will likely look obvious on the surface. inspect the contents for script
+  code inside. Identify additional log sources, IIS included, to review source and
+  other potential exploitation. It is often the case that a particular threat is only
+  applicable to a specific subset of systems in your environment. Typically analytics
+  to detect those threats are written without the benefit of being able to only target
+  those systems as well. Writing analytics against all systems when those behaviors
+  are limited to identifiable subsets of those systems is suboptimal. Consider the
+  case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information,
+  a hunter can limit their analytics to systems that have been identified as Exchange
+  servers. A hunter may start with the theory that the exchange server is communicating
+  with new systems that it has not previously. If this theory is run against all publicly
+  facing systems, the amount of noise it will generate will likely render this theory
+  untenable. However, using the asset information to limit this analytic to just the
+  Exchange servers will reduce the noise allowing the hunter to focus only on the
+  systems where this behavioral change is relevant.'
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where Processes.process_name=MSExchangeMailboxReplication.exe  by _time span=1h Processes.process_id Processes.process_name Processes.process_guid
+  Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [|
+  tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*",
+  "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx"
+  by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name
+  Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time
+  file_name file_path process_name process_path process process_guid] | dedup file_create_time
+  | table dest file_create_time, file_name, file_path, process_name | `microsoft_exchange_mailbox_replication_service_writing_active_server_pages_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem`
+  node.
+known_false_positives: The query is structured in a way that `action` (read, create)
+  is not defined. Review the results of this query, filter, and tune as necessary.
+  It may be necessary to generate this query specific to your endpoint product.
+references:
+  - https://redcanary.com/blog/blackbyte-ransomware/
+tags:
+  analytic_story:
+  - ProxyShell
+  - Ransomware
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Exploitation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon_proxylogon.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: A file - $file_name$ was written to disk that is related to IIS exploitation
+    related to ProxyShell. Review further file modifications on endpoint
+    $dest$ by user $user$.
+  mitre_attack_id:
+  - T1505
+  - T1505.003
+  - T1190
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: file_name
+    type: File Name
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.file_path
+  - Filesystem.process_id
+  - Filesystem.file_name
+  - Filesystem.file_hash
+  - Filesystem.user
+  - Filesystem.process_guid
+  - Processes.process_name
+  - Processes.process_id 
+  - Processes.process_name 
+  - Processes.process_guid
+  risk_score: 81
+  security_domain: endpoint
+
+  

tests/endpoint/msi_module_loaded_by_non_system_binary.test.yml

@@ -0,0 +1,12 @@
+name: MSI Module Loaded by Non-System Binary Unit Test
+tests:
+- name: MSI Module Loaded by Non-System Binary
+  file: endpoint/msi_module_loaded_by_non_system_binary.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/msi_module_load/windows-sysmon.log
+    source:  XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/windows_dism_remove_defender.test.yml

@@ -0,0 +1,12 @@
+name: Windows DISM Remove Defender Unit Test
+tests:
+- name: Windows DISM Remove Defender
+  file: endpoint/windows_dism_remove_defender.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon_dism.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_dism.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/windows_raccine_scheduled_task_deletion.test.yml

@@ -0,0 +1,12 @@
+name: Windows Raccine Scheduled Task Deletion Unit Test
+tests:
+- name: Windows Raccine Scheduled Task Deletion
+  file: endpoint/windows_raccine_scheduled_task_deletion.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon_raccine.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_raccine.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog