From 81a49be5e80ea7cfba96bce982da35be771e9bf7 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 7 Dec 2021 14:46:14 -0700
Subject: [PATCH 1/9] Out of the Gates

Microsoft Exchange Mailbox Replication service writing Active Server Pages
---
 ...on_service_writing_active_server_pages.yml | 100 ++++++++++++++++++
 1 file changed, 100 insertions(+)
 create mode 100644 detections/experimental/endpoint/microsoft_exchange_mailbox_replication_service_writing_active_server_pages.yml

diff --git a/detections/experimental/endpoint/microsoft_exchange_mailbox_replication_service_writing_active_server_pages.yml b/detections/experimental/endpoint/microsoft_exchange_mailbox_replication_service_writing_active_server_pages.yml
new file mode 100644
index 0000000000..c41f9440b6
--- /dev/null
+++ b/detections/experimental/endpoint/microsoft_exchange_mailbox_replication_service_writing_active_server_pages.yml
@@ -0,0 +1,100 @@
+name: Microsoft Exchange Mailbox Replication service writing Active Server Pages
+id: 985f322c-57a5-11ec-b9ac-acde48001122
+version: 1
+date: '2021-12-07'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: 'The following query identifies suspicious .aspx created in 3 paths identified
+  by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM
+  group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`,
+  `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. The analytic is limited to process name MSExchangeMailboxReplication.exe, which typically does not write .aspx files to disk.
+  Upon triage, the suspicious
+  .aspx file will likely look obvious on the surface. inspect the contents for script
+  code inside. Identify additional log sources, IIS included, to review source and
+  other potential exploitation. It is often the case that a particular threat is only
+  applicable to a specific subset of systems in your environment. Typically analytics
+  to detect those threats are written without the benefit of being able to only target
+  those systems as well. Writing analytics against all systems when those behaviors
+  are limited to identifiable subsets of those systems is suboptimal. Consider the
+  case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information,
+  a hunter can limit their analytics to systems that have been identified as Exchange
+  servers. A hunter may start with the theory that the exchange server is communicating
+  with new systems that it has not previously. If this theory is run against all publicly
+  facing systems, the amount of noise it will generate will likely render this theory
+  untenable. However, using the asset information to limit this analytic to just the
+  Exchange servers will reduce the noise allowing the hunter to focus only on the
+  systems where this behavioral change is relevant.'
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where Processes.process_name=MSExchangeMailboxReplication.exe  by _time span=1h Processes.process_id Processes.process_name Processes.process_guid
+  Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [|
+  tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*",
+  "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx"
+  by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name
+  Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time
+  file_name file_path process_name process_path process process_guid] | dedup file_create_time
+  | table dest file_create_time, file_name, file_path, process_name | `microsoft_exchange_mailbox_replication_service_writing_active_server_pages_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem`
+  node.
+known_false_positives: The query is structured in a way that `action` (read, create)
+  is not defined. Review the results of this query, filter, and tune as necessary.
+  It may be necessary to generate this query specific to your endpoint product.
+references:
+  - https://redcanary.com/blog/blackbyte-ransomware/
+tags:
+  analytic_story:
+  - ProxyShell
+  - Ransomware
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Exploitation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon_proxylogon.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: A file - $file_name$ was written to disk that is related to IIS exploitation
+    related to ProxyShell. Review further file modifications on endpoint
+    $dest$ by user $user$.
+  mitre_attack_id:
+  - T1505
+  - T1505.003
+  - T1190
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: file_name
+    type: File Name
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.file_path
+  - Filesystem.process_id
+  - Filesystem.file_name
+  - Filesystem.file_hash
+  - Filesystem.user
+  - Filesystem.process_guid
+  - Processes.process_name
+  - Processes.process_id 
+  - Processes.process_name 
+  - Processes.process_guid
+  risk_score: 81
+  security_domain: endpoint
+
+  
\ No newline at end of file

From 12c8dccc593f0625edb72e3d7a0b44d027a7cae0 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 7 Dec 2021 14:46:35 -0700
Subject: [PATCH 2/9] added T

---
 detections/endpoint/detect_exchange_web_shell.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml
index ef48bc9c3b..6f2e31b762 100644
--- a/detections/endpoint/detect_exchange_web_shell.yml
+++ b/detections/endpoint/detect_exchange_web_shell.yml
@@ -67,6 +67,7 @@ tags:
   mitre_attack_id:
   - T1505
   - T1505.003
+  - T1190
   observable:
   - name: user
     type: User

From ec5f5713a17cd8346108f1e45eaaba7209e78c37 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 7 Dec 2021 15:54:21 -0700
Subject: [PATCH 3/9] Update resize_shadowstorage_volume.yml

---
 detections/endpoint/resize_shadowstorage_volume.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/resize_shadowstorage_volume.yml b/detections/endpoint/resize_shadowstorage_volume.yml
index 13d606a8f9..40e55b9dc5 100644
--- a/detections/endpoint/resize_shadowstorage_volume.yml
+++ b/detections/endpoint/resize_shadowstorage_volume.yml
@@ -28,8 +28,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   Sysmon TA.
 known_false_positives: network admin can resize the shadowstorage for valid purposes.
 references:
-- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
-- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
+  - https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
+  - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
+  - https://redcanary.com/blog/blackbyte-ransomware/
+  - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/vssadmin-resize-shadowstorage
 tags:
   analytic_story:
   - Clop Ransomware

From e3a84f8f6e9e56d9deb3e0a280d26f855559b88a Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 8 Dec 2021 13:07:50 -0700
Subject: [PATCH 4/9] Defense

---
 .../endpoint/windows_dism_remove_defender.yml | 74 +++++++++++++++++++
 .../windows_dism_remove_defender.test.yml     | 12 +++
 2 files changed, 86 insertions(+)
 create mode 100644 detections/endpoint/windows_dism_remove_defender.yml
 create mode 100644 tests/endpoint/windows_dism_remove_defender.test.yml

diff --git a/detections/endpoint/windows_dism_remove_defender.yml b/detections/endpoint/windows_dism_remove_defender.yml
new file mode 100644
index 0000000000..0d6c77031e
--- /dev/null
+++ b/detections/endpoint/windows_dism_remove_defender.yml
@@ -0,0 +1,74 @@
+name: Windows DISM Remove Defender
+id: 8567da9e-47f0-11ec-99a9-acde48001122
+version: 1
+date: '2021-11-17'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies the use of the Windows Disk Image Utility, `dism.exe`, to remove Windows Defender. Adversaries may use `dism.exe` to disable Defender before completing their objective. 
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=dism.exe
+  (Processes.process="*/online*" AND Processes.process="*/disable-feature*" AND Processes.process="*Windows-Defender*" AND Processes.process="*/remove*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_dism_remove_defender_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: Some legitimate administrative tools leverage `dism.exe` to manipulate packages and features of the operating system. Filter as needed.
+references:
+  - https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/  
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  - T1562
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: access
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to disable Windows Defender.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  
\ No newline at end of file
diff --git a/tests/endpoint/windows_dism_remove_defender.test.yml b/tests/endpoint/windows_dism_remove_defender.test.yml
new file mode 100644
index 0000000000..9f090a3664
--- /dev/null
+++ b/tests/endpoint/windows_dism_remove_defender.test.yml
@@ -0,0 +1,12 @@
+name: Windows DISM Remove Defender Unit Test
+tests:
+- name: Windows DISM Remove Defender
+  file: endpoint/windows_dism_remove_defender.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon_dism.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_dism.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From cd36c6dd6f1bc258054364476d178a9a6877843d Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 8 Dec 2021 13:25:21 -0700
Subject: [PATCH 5/9] Raccine Disable

---
 ...indows_raccine_scheduled_task_deletion.yml | 72 +++++++++++++++++++
 ...s_raccine_scheduled_task_deletion.test.yml | 12 ++++
 2 files changed, 84 insertions(+)
 create mode 100644 detections/endpoint/windows_raccine_scheduled_task_deletion.yml
 create mode 100644 tests/endpoint/windows_raccine_scheduled_task_deletion.test.yml

diff --git a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml
new file mode 100644
index 0000000000..b1c2f4e114
--- /dev/null
+++ b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml
@@ -0,0 +1,72 @@
+name: Windows Raccine Scheduled Task Deletion
+id: c9f010da-57ab-11ec-82bd-acde48001122
+version: 1
+date: '2021-12-07'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies the Raccine Rules Updater scheduled task being deleted. Adversaries may attempt to remove this task in order to prevent the update of Raccine.  Raccine is a "ransomware vaccine" created by security researcher Florian Roth, designed to intercept and prevent precursors and active ransomware behavior.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe
+  Processes.process="*delete*" AND Processes.process="*Raccine*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_raccine_scheduled_task_deletion_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives should be limited, however filter as needed.
+references:
+  - https://redcanary.com/blog/blackbyte-ransomware/
+  - https://github.com/Neo23x0/Raccine
+tags:
+  analytic_story:
+  - Ransomware
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user user$ attempting to disable Raccines scheduled task.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
\ No newline at end of file
diff --git a/tests/endpoint/windows_raccine_scheduled_task_deletion.test.yml b/tests/endpoint/windows_raccine_scheduled_task_deletion.test.yml
new file mode 100644
index 0000000000..849361ab9d
--- /dev/null
+++ b/tests/endpoint/windows_raccine_scheduled_task_deletion.test.yml
@@ -0,0 +1,12 @@
+name: Windows Raccine Scheduled Task Deletion Unit Test
+tests:
+- name: Windows Raccine Scheduled Task Deletion
+  file: endpoint/windows_raccine_scheduled_task_deletion.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon_raccine.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_raccine.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From 7f5d11bcd9983bde0e73938303997d2b1f89c0ea Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-157-178>
Date: Wed, 8 Dec 2021 20:29:14 +0000
Subject: [PATCH 6/9] Added detection testing service results inWindows DISM
 Remove Defender

---
 .../endpoint/windows_dism_remove_defender.yml | 43 +++++++++++--------
 1 file changed, 25 insertions(+), 18 deletions(-)

diff --git a/detections/endpoint/windows_dism_remove_defender.yml b/detections/endpoint/windows_dism_remove_defender.yml
index 0d6c77031e..17df9c7817 100644
--- a/detections/endpoint/windows_dism_remove_defender.yml
+++ b/detections/endpoint/windows_dism_remove_defender.yml
@@ -6,23 +6,30 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic identifies the use of the Windows Disk Image Utility, `dism.exe`, to remove Windows Defender. Adversaries may use `dism.exe` to disable Defender before completing their objective. 
+description: The following analytic identifies the use of the Windows Disk Image Utility,
+  `dism.exe`, to remove Windows Defender. Adversaries may use `dism.exe` to disable
+  Defender before completing their objective.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=dism.exe
-  (Processes.process="*/online*" AND Processes.process="*/disable-feature*" AND Processes.process="*Windows-Defender*" AND Processes.process="*/remove*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `windows_dism_remove_defender_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: Some legitimate administrative tools leverage `dism.exe` to manipulate packages and features of the operating system. Filter as needed.
+  (Processes.process="*/online*" AND Processes.process="*/disable-feature*" AND Processes.process="*Windows-Defender*"
+  AND Processes.process="*/remove*") by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_dism_remove_defender_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Some legitimate administrative tools leverage `dism.exe` to
+  manipulate packages and features of the operating system. Filter as needed.
 references:
-  - https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/  
+- https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_dism.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -36,11 +43,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
@@ -48,12 +55,12 @@ tags:
   security_domain: access
   impact: 80
   confidence: 100
-  # (impact * confidence)/100
   risk_score: 80
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to disable Windows Defender.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to disable Windows Defender.
   observable:
   - name: user
     type: User
@@ -71,4 +78,4 @@ tags:
     type: Process
     role:
     - Child Process
-  
\ No newline at end of file
+  automated_detection_testing: passed

From 219ba97d2d8dd8f1a8028a2f11f624d2670fb8a3 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 8 Dec 2021 13:44:23 -0700
Subject: [PATCH 7/9] installerfiletakeover

---
 ...msi_module_loaded_by_non_system_binary.yml | 80 +++++++++++++++++++
 ...odule_loaded_by_non_system_binary.test.yml | 12 +++
 2 files changed, 92 insertions(+)
 create mode 100644 detections/endpoint/msi_module_loaded_by_non_system_binary.yml
 create mode 100644 tests/endpoint/msi_module_loaded_by_non_system_binary.test.yml

diff --git a/detections/endpoint/msi_module_loaded_by_non_system_binary.yml b/detections/endpoint/msi_module_loaded_by_non_system_binary.yml
new file mode 100644
index 0000000000..aa7241ee98
--- /dev/null
+++ b/detections/endpoint/msi_module_loaded_by_non_system_binary.yml
@@ -0,0 +1,80 @@
+name: MSI Module Loaded by Non-System Binary
+id: ccb98a66-5851-11ec-b91c-acde48001122
+version: 1
+date: '2021-12-08'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel: []
+description: 'The following hunting analytic identifies `msi.dll` being loaded by a binary not located in `system32`, `syswow64`, `winsxs` or `windows` paths. This behavior is most recently related to InstallerFileTakeOver, or CVE-2021-41379, and DLL side-loading. 
+  CVE-2021-41379 requires a binary to be dropped and `msi.dll` to be loaded by it. To Successful exploitation of this issue happens in four parts \
+
+  1. Generation of an MSI that will trigger bad behavior. \
+
+  1. Preparing a directory for MSI installation. \
+
+  1. Inducing an error state. \
+
+  1. Racing to introduce a junction and a symlink to trick msiexec.exe to modify the attacker specified file. \
+  
+  In addition, `msi.dll` has been abused in DLL side-loading attacks by being loaded by non-system binaries.'
+search: '`sysmon` EventCode=7 ImageLoaded="*\\msi.dll" NOT (Image IN ("*\\System32\\*","*\\syswow64\\*","*\\windows\\*", "*\\winsxs\\*")) 
+  | stats count min(_time) as firstTime max(_time) as lastTime
+      by Image ImageLoaded process_name Computer EventCode Signed ProcessId 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `msi_module_loaded_by_non_system_binary_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name and imageloaded executions from your endpoints. If you
+  are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: It is possible some Administrative utilities will load msi.dll outside of normal system paths, filter as needed.
+references:
+  - https://attackerkb.com/topics/7LstI2clmF/cve-2021-41379/rapid7-analysis 
+  - https://github.com/klinix5/InstallerFileTakeOver
+  - https://github.com/mandiant/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/msi.dll%20Hijack%20(Methodology).ioc
+cve:
+  - CVE-2021-41379
+tags:
+  analytic_story:
+  - Windows Privilege Escalation
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1574.002
+  - T1574
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image 
+  - ImageLoaded
+  - process_name 
+  - Computer
+  - EventCode 
+  - Signed
+  - ProcessId 
+  security_domain: endpoint
+  impact: 80
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 56
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: The following module $ImageLoaded$ was loaded by $Image$ outside of the normal system paths on endpoint $Computer$, potentally related to DLL side-loading.
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: ImageLoaded
+    type: Other
+    role:
+    - Other
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  
\ No newline at end of file
diff --git a/tests/endpoint/msi_module_loaded_by_non_system_binary.test.yml b/tests/endpoint/msi_module_loaded_by_non_system_binary.test.yml
new file mode 100644
index 0000000000..c06a3b15a4
--- /dev/null
+++ b/tests/endpoint/msi_module_loaded_by_non_system_binary.test.yml
@@ -0,0 +1,12 @@
+name: MSI Module Loaded by Non-System Binary Unit Test
+tests:
+- name: MSI Module Loaded by Non-System Binary
+  file: endpoint/msi_module_loaded_by_non_system_binary.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/msi_module_load/windows-sysmon.log
+    source:  XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From 74cc7c54f2a9bace90d83afdcb80d1ada5519091 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-215-59>
Date: Thu, 9 Dec 2021 21:06:53 +0000
Subject: [PATCH 8/9] Added detection testing service results inWindows Raccine
 Scheduled Task Deletion

---
 ...indows_raccine_scheduled_task_deletion.yml | 43 +++++++++++--------
 1 file changed, 26 insertions(+), 17 deletions(-)

diff --git a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml
index b1c2f4e114..623a9a5afb 100644
--- a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml
+++ b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml
@@ -6,23 +6,31 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic identifies the Raccine Rules Updater scheduled task being deleted. Adversaries may attempt to remove this task in order to prevent the update of Raccine.  Raccine is a "ransomware vaccine" created by security researcher Florian Roth, designed to intercept and prevent precursors and active ransomware behavior.
+description: The following analytic identifies the Raccine Rules Updater scheduled
+  task being deleted. Adversaries may attempt to remove this task in order to prevent
+  the update of Raccine.  Raccine is a "ransomware vaccine" created by security researcher
+  Florian Roth, designed to intercept and prevent precursors and active ransomware
+  behavior.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe
-  Processes.process="*delete*" AND Processes.process="*Raccine*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `windows_raccine_scheduled_task_deletion_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  Processes.process="*delete*" AND Processes.process="*Raccine*" by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_raccine_scheduled_task_deletion_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: False positives should be limited, however filter as needed.
 references:
-  - https://redcanary.com/blog/blackbyte-ransomware/
-  - https://github.com/Neo23x0/Raccine
+- https://redcanary.com/blog/blackbyte-ransomware/
+- https://github.com/Neo23x0/Raccine
 tags:
   analytic_story:
   - Ransomware
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_raccine.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -35,11 +43,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
@@ -47,12 +55,12 @@ tags:
   security_domain: endpoint
   impact: 80
   confidence: 100
-  # (impact * confidence)/100
   risk_score: 80
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user user$ attempting to disable Raccines scheduled task.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user user$ attempting to disable Raccines scheduled task.
   observable:
   - name: user
     type: User
@@ -69,4 +77,5 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
\ No newline at end of file
+    - Child Process
+  automated_detection_testing: passed

From 89f37444f4f875b17fb2bb851a534ce1eb10d3fc Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 6 Jan 2022 10:06:40 -0700
Subject: [PATCH 9/9] Update msi_module_loaded_by_non_system_binary.yml

---
 .../endpoint/msi_module_loaded_by_non_system_binary.yml      | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/msi_module_loaded_by_non_system_binary.yml b/detections/endpoint/msi_module_loaded_by_non_system_binary.yml
index aa7241ee98..cebbcc8ebe 100644
--- a/detections/endpoint/msi_module_loaded_by_non_system_binary.yml
+++ b/detections/endpoint/msi_module_loaded_by_non_system_binary.yml
@@ -19,9 +19,9 @@ description: 'The following hunting analytic identifies `msi.dll` being loaded b
   In addition, `msi.dll` has been abused in DLL side-loading attacks by being loaded by non-system binaries.'
 search: '`sysmon` EventCode=7 ImageLoaded="*\\msi.dll" NOT (Image IN ("*\\System32\\*","*\\syswow64\\*","*\\windows\\*", "*\\winsxs\\*")) 
   | stats count min(_time) as firstTime max(_time) as lastTime
-      by Image ImageLoaded process_name Computer EventCode Signed ProcessId 
+      by Image ImageLoaded process_name Computer EventCode ProcessId 
   | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
+  | `security_content_ctime(lastTime)`
   | `msi_module_loaded_by_non_system_binary_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name and imageloaded executions from your endpoints. If you
@@ -53,7 +53,6 @@ tags:
   - process_name 
   - Computer
   - EventCode 
-  - Signed
   - ProcessId 
   security_domain: endpoint
   impact: 80