Branch was auto-updated.

detections/endpoint/any_powershell_downloadstring.yml

@@ -1,7 +1,7 @@
 name: Any Powershell DownloadString
 id: 4d015ef2-7adf-11eb-95da-acde48001122
 version: 3
-date: '2022-04-07'
+date: '2023-04-05'
 author: Michael Haag, Splunk
 status: production
 type: TTP
@@ -31,10 +31,12 @@ references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md
 tags:
   analytic_story:
+  - Winter Vivern
+  - Ingress Tool Transfer
   - Hermetic Wiper
   - Malicious PowerShell
   - HAFNIUM Group
-  - Ingress Tool Transfer
+  - Data Destruction
   asset_type: Endpoint
   confidence: 70
   impact: 80

detections/endpoint/cmd_carry_out_string_command_parameter.yml

@@ -1,7 +1,7 @@
 name: CMD Carry Out String Command Parameter
 id: 54a6ed00-3256-11ec-b031-acde48001122
 version: 3
-date: '2022-01-18'
+date: '2023-04-05'
 author: Teoderick Contreras, Bhavin Patel, Splunk
 status: production
 type: Hunting
@@ -31,19 +31,22 @@ references:
 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
-  - Data Destruction
-  - IcedID
-  - Log4Shell CVE-2021-44228
-  - WhisperGate
-  - Hermetic Wiper
-  - Living Off The Land
-  - Azorult
-  - DarkCrystal RAT
   - ProxyNotShell
   - Qakbot
-  - Chaos Ransomware
+  - Winter Vivern
+  - DarkCrystal RAT
   - AsyncRAT
+  - Log4Shell CVE-2021-44228
+  - Hermetic Wiper
+  - Chaos Ransomware
+  - IcedID
+  - WhisperGate
+  - Data Destruction
+  - Living Off The Land
+  - Azorult
+  - Data Destruction
   asset_type: Endpoint
+  automated_detection_testing: passed
   confidence: 50
   cve:
   - CVE-2021-44228

detections/endpoint/getwmiobject_user_account_with_powershell.yml

@@ -1,7 +1,7 @@
 name: GetWmiObject User Account with PowerShell
 id: b44f6ac6-0429-11ec-87e9-acde48001122
 version: 1
-date: '2021-08-23'
+date: '2023-04-05'
 author: Mauricio Velazco, Splunk
 status: production
 type: Hunting
@@ -27,6 +27,7 @@ references:
 - https://attack.mitre.org/techniques/T1087/001/
 tags:
   analytic_story:
+  - Winter Vivern
   - Active Directory Discovery
   asset_type: Endpoint
   confidence: 50

detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml

@@ -1,7 +1,7 @@
 name: GetWmiObject User Account with PowerShell Script Block
 id: 640b0eda-0429-11ec-accd-acde48001122
 version: 2
-date: '2022-05-02'
+date: '2023-04-05'
 author: Mauricio Velazco, Splunk
 status: production
 type: Hunting
@@ -25,6 +25,7 @@ references:
 - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
+  - Winter Vivern
   - Active Directory Discovery
   - Malicious PowerShell
   asset_type: Endpoint

detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml

@@ -1,10 +1,12 @@
 name: Powershell Fileless Script Contains Base64 Encoded Content
 id: 8acbc04c-c882-11eb-b060-acde48001122
-version: 2
-date: '2022-04-26'
+version: 3
+date: '2023-04-05'
 author: Michael Haag, Splunk
 status: production
 type: TTP
+data_source:
+- Powershell 4104
 description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify suspicious PowerShell execution. Script Block Logging captures the command
   sent to PowerShell, the full command to be executed. Upon enabling, logs will output
@@ -20,8 +22,6 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   During triage, review parallel processes using an EDR product or 4688 events. It
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
-data_source:
-- Powershell 4104
 search: '`powershell` EventCode=4104 ScriptBlockText = "*frombase64string*" OR ScriptBlockText
   = "*gnirtS46esaBmorF*" | stats count min(_time) as firstTime max(_time) as lastTime
   by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
@@ -39,8 +39,9 @@ tags:
   analytic_story:
   - Hermetic Wiper
   - Malicious PowerShell
+  - Winter Vivern
   - AsyncRAT
-  asset_type: Endpoint
+  - Data Destruction
   confidence: 80
   impact: 70
   message: A suspicious powershell script contains base64 command in $ScriptBlockText$
@@ -67,6 +68,7 @@ tags:
   - EventCode
   risk_score: 56
   security_domain: endpoint
+  asset_type: Endpoint
 tests:
 - name: True Positive Test
   attack_data:

detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml

@@ -1,10 +1,12 @@
 name: PowerShell Loading DotNET into Memory via Reflection
 id: 85bc3f30-ca28-11eb-bd21-acde48001122
-version: 2
-date: '2022-05-02'
+version: 3
+date: '2023-04-05'
 author: Michael Haag, Splunk
 status: production
 type: TTP
+data_source:
+- Powershell 4104
 description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify suspicious PowerShell execution. Script Block Logging captures the command
   sent to PowerShell, the full command to be executed. Upon enabling, logs will output
@@ -19,8 +21,6 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   During triage, review parallel processes using an EDR product or 4688 events. It
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
-data_source:
-- Powershell 4104
 search: '`powershell` EventCode=4104 ScriptBlockText IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*",
   "*reflection.assembly*") | stats count min(_time) as firstTime max(_time) as lastTime
   by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)`
@@ -38,10 +38,12 @@ references:
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
 tags:
   analytic_story:
-  - Hermetic Wiper
-  - Malicious PowerShell
+  - Winter Vivern
   - AgentTesla
   - AsyncRAT
+  - Hermetic Wiper
+  - Malicious PowerShell
+  - Data Destruction
   asset_type: Endpoint
   confidence: 80
   impact: 70

detections/endpoint/schedule_task_with_http_command_arguments.yml

@@ -1,7 +1,7 @@
 name: Schedule Task with HTTP Command Arguments
 id: 523c2684-a101-11eb-916b-acde48001122
 version: 1
-date: '2021-04-19'
+date: '2023-04-05'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -33,8 +33,9 @@ references:
 - https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/
 tags:
   analytic_story:
-  - Windows Persistence Techniques
   - Living Off The Land
+  - Winter Vivern
+  - Windows Persistence Techniques
   asset_type: Endpoint
   confidence: 90
   impact: 70

detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml

@@ -1,7 +1,7 @@
 name: Scheduled Task Deleted Or Created via CMD
 id: d5af132c-7c17-439c-9d31-13d55340f36c
 version: 6
-date: '2022-02-22'
+date: '2023-04-05'
 author: Bhavin Patel, Splunk
 status: production
 type: TTP
@@ -29,18 +29,19 @@ references:
 - https://www.joesandbox.com/analysis/691823/0/html
 tags:
   analytic_story:
-  - DHS Report TA18-074A
+  - Qakbot
   - NOBELIUM Group
   - Windows Persistence Techniques
-  - Living Off The Land
-  - Azorult
-  - DarkCrystal RAT
-  - CISA AA22-257A
-  - AgentTesla
-  - Qakbot
-  - Trickbot
+  - Winter Vivern
   - Prestige Ransomware
+  - DarkCrystal RAT
+  - AgentTesla
+  - Trickbot
   - AsyncRAT
+  - Living Off The Land
+  - CISA AA22-257A
+  - DHS Report TA18-074A
+  - Azorult
   asset_type: Endpoint
   confidence: 80
   impact: 70

detections/endpoint/system_user_discovery_with_whoami.yml

@@ -1,7 +1,7 @@
 name: System User Discovery With Whoami
 id: 894fc43e-6f50-47d5-a68b-ee9ee23e18f4
 version: 1
-date: '2021-09-13'
+date: '2023-04-05'
 author: Mauricio Velazco, Splunk
 status: production
 type: Hunting
@@ -24,6 +24,7 @@ references:
 - https://attack.mitre.org/techniques/T1033/
 tags:
   analytic_story:
+  - Winter Vivern
   - Active Directory Discovery
   - Qakbot
   asset_type: Endpoint

detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml

@@ -0,0 +1,54 @@
+name: Windows Exfiltration Over C2 Via Invoke RestMethod
+id: 06ade821-f6fa-40d0-80af-15bc1d45b3ba
+version: 1
+date: '2023-04-05'
+author: Teoderick Contreras, Splunk
+status: production
+type: TTP
+data_source:
+- Powershell 4104
+description: The following analytic identifies the potential exfiltration of data using PowerShell's Invoke-RestMethod. This technique was observed in the Winter-Vivern malware, which uploads desktop screenshots and files from compromised or targeted hosts. Detecting this TTP can serve as a valuable indicator that a process is attempting to upload files to an external or internal URI link. We recommend examining the process, the files it is trying to upload, and the URL link or C2 destination where the data is being uploaded.
+search: '`powershell` EventCode=4104 ScriptBlockText = "*Invoke-RestMethod *" AND ScriptBlockText = "* -Uri *" AND ScriptBlockText = "* -Method *" AND ScriptBlockText = "* Post *" AND ScriptBlockText = "* -InFile *"
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_exfiltration_over_c2_via_invoke_restmethod_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: False positives should be limited. Filter as needed.
+references:
+- https://twitter.com/_CERT_UA/status/1620781684257091584
+- https://cert.gov.ua/article/3761104
+tags:
+  analytic_story:
+  - Winter Vivern
+  asset_type: Endpoint
+  confidence: 70
+  impact: 70
+  message: A PowerShell script on $Computer$ is attempting to transfer files to a remote URL.
+  mitre_attack_id:
+  - T1041
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - ScriptBlockText
+  - Computer
+  - UserID
+  - EventCode
+  risk_score: 49
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml

@@ -0,0 +1,54 @@
+name: Windows Exfiltration Over C2 Via Powershell UploadString
+id: 59e8bf41-7472-412a-90d3-00f3afa452e9
+version: 1
+date: '2023-04-05'
+author: Teoderick Contreras, Splunk
+status: production
+type: TTP
+data_source:
+- Powershell 4104
+description: The following analytic identifies potential data exfiltration using the PowerShell net.webclient command. This technique was observed in the Winter-Vivern malware, which uploads desktop screenshots and files from compromised or targeted hosts. Detecting this TTP can serve as a valuable indicator that a process is attempting to upload files to an external or internal URI link. We recommend examining the process, the files it is trying to upload, and the URL link or C2 destination where the data is being uploaded.
+search: '`powershell` EventCode=4104 ScriptBlockText = "*Net.webclient*" AND ScriptBlockText = "*.UploadString*" 
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_exfiltration_over_c2_via_powershell_uploadstring_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: False positives should be limited. Filter as needed.
+references:
+- https://twitter.com/_CERT_UA/status/1620781684257091584
+- https://cert.gov.ua/article/3761104
+tags:
+  analytic_story:
+  - Winter Vivern
+  asset_type: Endpoint
+  confidence: 70
+  impact: 70
+  message: A PowerShell script on $Computer$ is attempting to transfer files to a remote URL.
+  mitre_attack_id:
+  - T1041
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - ScriptBlockText
+  - Computer
+  - UserID
+  - EventCode
+  risk_score: 49
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_uploadstring/windows-powershell-xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/windows_scheduled_task_created_via_xml.yml

@@ -0,0 +1,72 @@
+name: Windows Scheduled Task Created Via XML
+id: 7e03b682-3965-4598-8e91-a60a40a3f7e4
+version: 1
+date: '2023-04-05'
+author: Teoderick Contreras, Splunk
+status: production
+type: TTP
+data_source:
+- Sysmon Event ID 1
+description: The following analytic identifies the creation of a scheduled task using schtasks.exe, with the flags -create being passed on the command-line along with an XML parameter. This technique has been associated with threat actors, adversaries, and red teamers seeking to gain persistence or achieve privilege escalation on targeted hosts. Notably, the Trickbot and Winter-Vivern malware have been observed employing this method, utilizing an XML file to create scheduled tasks. It is important to monitor and investigate such activity in order to mitigate potential security risks.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where Processes.process_name=schtasks.exe Processes.process=*create* Processes.process="* /xml *" 
+  by Processes.user  Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.process_id Processes.parent_process_guid Processes.dest 
+  | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_scheduled_task_created_via_xml_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: It is possible scripts or administrators may trigger this analytic.
+  Filter as needed based on parent process, application.
+references:
+- https://twitter.com/_CERT_UA/status/1620781684257091584
+- https://cert.gov.ua/article/3761104
+tags:
+  analytic_story:
+  - Winter Vivern
+  asset_type: Endpoint
+  confidence: 70
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/scheduledtask/sysmon.log
+  impact: 70
+  message: A scheduled task process, $process_name$, with 'create' or 'delete' commands present in the command line.
+  mitre_attack_id:
+  - T1053.005
+  - T1053
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process_id
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.process_id
+  - Processes.parent_process_id
+  risk_score: 49
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/scheduledtask/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

detections/endpoint/windows_screen_capture_via_powershell.yml

@@ -0,0 +1,61 @@
+name: Windows Screen Capture Via Powershell
+id: 5e0b1936-8f99-4399-8ee2-9edc5b32e170
+version: 1
+date: '2023-04-05'
+author: Teoderick Contreras, Splunk
+status: production
+type: TTP
+data_source:
+- Powershell 4104
+description: The following analytic identifies a potential PowerShell script that captures screen images on compromised or targeted hosts. This technique was observed in the Winter-Vivern malware, which attempts to capture desktop screens using a PowerShell script and send the images to its C2 server as part of its exfiltration strategy. This TTP serves as a useful indicator that a PowerShell process may be gathering desktop screenshots from a host system, potentially signaling malicious activity.
+search: '`powershell` EventCode=4104 ScriptBlockText = "*[Drawing.Graphics]::FromImage(*" AND ScriptBlockText = "*New-Object Drawing.Bitmap*" 
+  AND ScriptBlockText = "*.CopyFromScreen*"
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_screen_capture_via_powershell_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: unknown
+references:
+- https://twitter.com/_CERT_UA/status/1620781684257091584
+- https://cert.gov.ua/article/3761104
+tags:
+  analytic_story:
+  - Winter Vivern
+  asset_type: Endpoint
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Collection
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml.log
+  impact: 70
+  message: A PowerShell script was identified possibly performing screen captures on $Computer$.
+  mitre_attack_id:
+  - T1113
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - ScriptBlockText
+  - Computer
+  - UserID
+  - EventCode
+  risk_score: 49
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml

@@ -1,10 +1,11 @@
 name: WinEvent Scheduled Task Created to Spawn Shell
 id: 203ef0ea-9bd8-11eb-8201-acde48001122
 version: 2
-date: '2021-04-12'
+date: '2023-04-05'
 author: Michael Haag, Splunk
 status: production
 type: TTP
+datamodel: []
 description: The following query utilizes Windows Security EventCode 4698, `A scheduled
   task was created`, to identify suspicious tasks registered on Windows either via
   schtasks.exe OR TaskService with a command to be executed with a native Windows
@@ -39,8 +40,9 @@ references:
 - https://docs.microsoft.com/en-us/windows/win32/taskschd/time-trigger-example--scripting-?redirectedfrom=MSDN
 tags:
   analytic_story:
-  - Windows Persistence Techniques
   - Ransomware
+  - Windows Persistence Techniques
+  - Winter Vivern
   - Ryuk Ransomware
   - CISA AA22-257A
   asset_type: Endpoint
@@ -79,3 +81,4 @@ tests:
     source: WinEventLog:Security
     sourcetype: WinEventLog
     update_timestamp: true
+

detections/endpoint/winevent_scheduled_task_created_within_public_path.yml

@@ -1,10 +1,11 @@
 name: WinEvent Scheduled Task Created Within Public Path
 id: 5d9c6eee-988c-11eb-8253-acde48001122
 version: 1
-date: '2021-04-08'
+date: '2023-04-05'
 author: Michael Haag, Splunk
 status: production
 type: TTP
+datamodel: []
 description: The following query utilizes Windows Security EventCode 4698, `A scheduled
   task was created`, to identify suspicious tasks registered on Windows either via
   schtasks.exe OR TaskService with a command to be executed from a user writeable
@@ -39,15 +40,17 @@ references:
 - https://app.any.run/tasks/e26f1b2e-befa-483b-91d2-e18636e2faf3/
 tags:
   analytic_story:
-  - Windows Persistence Techniques
   - Ransomware
-  - Ryuk Ransomware
-  - IcedID
-  - Active Directory Lateral Movement
-  - Industroyer2
-  - CISA AA22-257A
+  - Windows Persistence Techniques
+  - Winter Vivern
   - Prestige Ransomware
   - AsyncRAT
+  - Ryuk Ransomware
+  - IcedID
+  - CISA AA22-257A
+  - Industroyer2
+  - Active Directory Lateral Movement
+  - Data Destruction
   asset_type: Endpoint
   confidence: 100
   impact: 70

detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml

@@ -1,7 +1,7 @@
 name: WinEvent Windows Task Scheduler Event Action Started
 id: b3632472-310b-11ec-9aab-acde48001122
 version: 1
-date: '2021-10-19'
+date: '2023-04-05'
 author: Michael Haag, Splunk
 status: production
 type: Hunting
@@ -29,14 +29,17 @@ references:
 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
-  - IcedID
-  - Windows Persistence Techniques
-  - Industroyer2
-  - DarkCrystal RAT
-  - CISA AA22-257A
   - Qakbot
+  - Windows Persistence Techniques
+  - Winter Vivern
   - Prestige Ransomware
+  - DarkCrystal RAT
   - AsyncRAT
+  - IcedID
+  - CISA AA22-257A
+  - Industroyer2
+  - Sandworm Tools
+  - Data Destruction
   asset_type: Endpoint
   confidence: 100
   impact: 80

stories/winter_vivern.yml

@@ -0,0 +1,18 @@
+name: Winter Vivern
+id: 5ce5f311-b311-4568-90ca-0c36781d07a4
+version: 1
+date: '2023-02-16'
+author: Teoderick Contreras, Splunk
+description: Utilize searches that enable you to detect and investigate unusual activities potentially related to the Winter Vivern malicious software. This includes examining multiple timeout executions, scheduled task creations, screenshots, and downloading files through PowerShell, among other indicators.
+narrative: The Winter Vivern malware, identified by CERT UA, is designed to download and run multiple PowerShell scripts on targeted hosts. These scripts aim to gather a variety of files with specific extensions, including (.edb, .ems, .eme, .emz, .key, .pem, .ovpn, .bat, .cer, .p12, .cfg, .log, .txt, .pdf, .doc, .docx, .xls, .xlsx, and .rdg), primarily from desktop directories. In addition to this, the malware captures desktop screenshots and performs data exfiltration using HTTP. To maintain its presence on the targeted host, Winter Vivern also establishes a persistence mechanism, such as creating a scheduled task.
+references:
+- https://cert.gov.ua/article/3761023
+tags:
+  analytic_story: Winter Vivern
+  category:
+  - Malware
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection