From 217d7fd23e8fc2b2848ec85dd4d505e6af1e6ea4 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 16 Sep 2021 09:42:56 -0600 Subject: [PATCH] updates --- detections/endpoint/account_discovery_with_net_app.yml | 8 +++----- .../attempt_to_add_certificate_to_untrusted_store.yml | 6 +++--- detections/endpoint/detect_html_help_renamed.yml | 6 +++--- detections/endpoint/detect_mshta_renamed.yml | 7 ++++--- detections/endpoint/suspicious_rundll32_rename.yml | 2 +- 5 files changed, 14 insertions(+), 15 deletions(-) diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/endpoint/account_discovery_with_net_app.yml index 30f31c74e6..14fd59c9f9 100644 --- a/detections/endpoint/account_discovery_with_net_app.yml +++ b/detections/endpoint/account_discovery_with_net_app.yml @@ -1,7 +1,7 @@ name: Account Discovery With Net App id: 339805ce-ac30-11eb-b87d-acde48001122 -version: 2 -date: '2021-05-03' +version: 3 +date: '2021-09-16' author: Teoderick Contreras, Splunk type: TTP datamodel: @@ -16,9 +16,7 @@ description: this search is to detect a potential account discovery series of co search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where `process_net` AND - (Processes.process="*user*" OR Processes.process="*config*" OR Processes.process="*view - /all*") by Processes.process_name Processes.dest Processes.user Processes.parent_process_name + where `process_net` AND (Processes.process="*user*" OR Processes.process="*config*" OR Processes.process="*view /all*") by Processes.process_name Processes.dest Processes.user Processes.parent_process_name | where count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `account_discovery_with_net_app_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.. diff --git a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml index 64404c913f..87a828d8d3 100644 --- a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml +++ b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml @@ -1,14 +1,14 @@ name: Attempt To Add Certificate To Untrusted Store id: 6bc5243e-ef36-45dc-9b12-f4a6be131159 -version: 6 -date: '2020-11-03' +version: 7 +date: '2021-09-16' author: Patrick Bareiss, Rico Valdez, Splunk type: TTP datamodel: - Endpoint description: Attempt To Add Certificate To Untrusted Store search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) - as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=*certutil* + as process max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*-addstore*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml index b2518140b1..44a56d7d33 100644 --- a/detections/endpoint/detect_html_help_renamed.yml +++ b/detections/endpoint/detect_html_help_renamed.yml @@ -1,11 +1,11 @@ name: Detect HTML Help Renamed id: 62fed254-513b-460e-953d-79771493a9f3 version: 3 -date: '2021-02-11' +date: '2021-09-16' author: Michael Haag, Splunk -type: TTP +type: Hunting datamodel: -- Endpoint + - Endpoint description: The following analytic identifies a renamed instance of hh.exe (HTML Help) executing a Compiled HTML Help (CHM). This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/endpoint/detect_mshta_renamed.yml index 702796d6ce..92207bcc67 100644 --- a/detections/endpoint/detect_mshta_renamed.yml +++ b/detections/endpoint/detect_mshta_renamed.yml @@ -1,10 +1,11 @@ name: Detect mshta renamed id: 8f45fcf0-5b68-11eb-ae93-0242ac130002 version: 2 -date: '2021-01-20' +date: '2021-09-16' author: Michael Haag, Splunk -type: TTP -datamodel: [] +type: Hunting +datamodel: + - Endpoint description: The following analytic identifies renamed instances of mshta.exe executing. Mshta.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. This analytic utilizes the internal name of the PE to identify if is the legitimate mshta diff --git a/detections/endpoint/suspicious_rundll32_rename.yml b/detections/endpoint/suspicious_rundll32_rename.yml index 15beb66012..c61f510865 100644 --- a/detections/endpoint/suspicious_rundll32_rename.yml +++ b/detections/endpoint/suspicious_rundll32_rename.yml @@ -3,7 +3,7 @@ id: 7360137f-abad-473e-8189-acbdaa34d114 version: 3 date: '2021-02-04' author: Michael Haag, Splunk -type: TTP +type: Hunting datamodel: - Endpoint description: The following analytic identifies renamed instances of rundll32.exe executing.