diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml index 37ccd709d2..5a15de9e89 100644 --- a/detections/endpoint/any_powershell_downloadstring.yml +++ b/detections/endpoint/any_powershell_downloadstring.yml @@ -1,7 +1,7 @@ name: Any Powershell DownloadString id: 4d015ef2-7adf-11eb-95da-acde48001122 version: 3 -date: '2022-04-07' +date: '2023-04-05' author: Michael Haag, Splunk status: production type: TTP @@ -31,10 +31,12 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md tags: analytic_story: + - Winter Vivern + - Ingress Tool Transfer - Hermetic Wiper - Malicious PowerShell - HAFNIUM Group - - Ingress Tool Transfer + - Data Destruction asset_type: Endpoint confidence: 70 impact: 80 diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml index 648ddbf303..049ae23f0e 100644 --- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml +++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml @@ -1,7 +1,7 @@ name: CMD Carry Out String Command Parameter id: 54a6ed00-3256-11ec-b031-acde48001122 version: 3 -date: '2022-01-18' +date: '2023-04-05' author: Teoderick Contreras, Bhavin Patel, Splunk status: production type: Hunting @@ -31,19 +31,22 @@ references: - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: - - Data Destruction - - IcedID - - Log4Shell CVE-2021-44228 - - WhisperGate - - Hermetic Wiper - - Living Off The Land - - Azorult - - DarkCrystal RAT - ProxyNotShell - Qakbot - - Chaos Ransomware + - Winter Vivern + - DarkCrystal RAT - AsyncRAT + - Log4Shell CVE-2021-44228 + - Hermetic Wiper + - Chaos Ransomware + - IcedID + - WhisperGate + - Data Destruction + - Living Off The Land + - Azorult + - Data Destruction asset_type: Endpoint + automated_detection_testing: passed confidence: 50 cve: - CVE-2021-44228 diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell.yml b/detections/endpoint/getwmiobject_user_account_with_powershell.yml index 3ca29241fd..20c3549176 100644 --- a/detections/endpoint/getwmiobject_user_account_with_powershell.yml +++ b/detections/endpoint/getwmiobject_user_account_with_powershell.yml @@ -1,7 +1,7 @@ name: GetWmiObject User Account with PowerShell id: b44f6ac6-0429-11ec-87e9-acde48001122 version: 1 -date: '2021-08-23' +date: '2023-04-05' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -27,6 +27,7 @@ references: - https://attack.mitre.org/techniques/T1087/001/ tags: analytic_story: + - Winter Vivern - Active Directory Discovery asset_type: Endpoint confidence: 50 diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml index f310e66693..dc002f3d91 100644 --- a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml @@ -1,7 +1,7 @@ name: GetWmiObject User Account with PowerShell Script Block id: 640b0eda-0429-11ec-accd-acde48001122 version: 2 -date: '2022-05-02' +date: '2023-04-05' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -25,6 +25,7 @@ references: - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html tags: analytic_story: + - Winter Vivern - Active Directory Discovery - Malicious PowerShell asset_type: Endpoint diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml index be7082c8cc..21772ba8f0 100644 --- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml +++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml @@ -1,10 +1,12 @@ name: Powershell Fileless Script Contains Base64 Encoded Content id: 8acbc04c-c882-11eb-b060-acde48001122 -version: 2 -date: '2022-04-26' +version: 3 +date: '2023-04-05' author: Michael Haag, Splunk status: production type: TTP +data_source: +- Powershell 4104 description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output @@ -20,8 +22,6 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.' -data_source: -- Powershell 4104 search: '`powershell` EventCode=4104 ScriptBlockText = "*frombase64string*" OR ScriptBlockText = "*gnirtS46esaBmorF*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` @@ -39,8 +39,9 @@ tags: analytic_story: - Hermetic Wiper - Malicious PowerShell + - Winter Vivern - AsyncRAT - asset_type: Endpoint + - Data Destruction confidence: 80 impact: 70 message: A suspicious powershell script contains base64 command in $ScriptBlockText$ @@ -67,6 +68,7 @@ tags: - EventCode risk_score: 56 security_domain: endpoint + asset_type: Endpoint tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml index a40da514b0..8a03336f65 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml @@ -1,10 +1,12 @@ name: PowerShell Loading DotNET into Memory via Reflection id: 85bc3f30-ca28-11eb-bd21-acde48001122 -version: 2 -date: '2022-05-02' +version: 3 +date: '2023-04-05' author: Michael Haag, Splunk status: production type: TTP +data_source: +- Powershell 4104 description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output @@ -19,8 +21,6 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.' -data_source: -- Powershell 4104 search: '`powershell` EventCode=4104 ScriptBlockText IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*", "*reflection.assembly*") | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` @@ -38,10 +38,12 @@ references: - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ tags: analytic_story: - - Hermetic Wiper - - Malicious PowerShell + - Winter Vivern - AgentTesla - AsyncRAT + - Hermetic Wiper + - Malicious PowerShell + - Data Destruction asset_type: Endpoint confidence: 80 impact: 70 diff --git a/detections/endpoint/schedule_task_with_http_command_arguments.yml b/detections/endpoint/schedule_task_with_http_command_arguments.yml index 0db88becc8..1849d66731 100644 --- a/detections/endpoint/schedule_task_with_http_command_arguments.yml +++ b/detections/endpoint/schedule_task_with_http_command_arguments.yml @@ -1,7 +1,7 @@ name: Schedule Task with HTTP Command Arguments id: 523c2684-a101-11eb-916b-acde48001122 version: 1 -date: '2021-04-19' +date: '2023-04-05' author: Teoderick Contreras, Splunk status: production type: TTP @@ -33,8 +33,9 @@ references: - https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/ tags: analytic_story: - - Windows Persistence Techniques - Living Off The Land + - Winter Vivern + - Windows Persistence Techniques asset_type: Endpoint confidence: 90 impact: 70 diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index 37c7d2ccc5..a6b629765a 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -1,7 +1,7 @@ name: Scheduled Task Deleted Or Created via CMD id: d5af132c-7c17-439c-9d31-13d55340f36c version: 6 -date: '2022-02-22' +date: '2023-04-05' author: Bhavin Patel, Splunk status: production type: TTP @@ -29,18 +29,19 @@ references: - https://www.joesandbox.com/analysis/691823/0/html tags: analytic_story: - - DHS Report TA18-074A + - Qakbot - NOBELIUM Group - Windows Persistence Techniques - - Living Off The Land - - Azorult - - DarkCrystal RAT - - CISA AA22-257A - - AgentTesla - - Qakbot - - Trickbot + - Winter Vivern - Prestige Ransomware + - DarkCrystal RAT + - AgentTesla + - Trickbot - AsyncRAT + - Living Off The Land + - CISA AA22-257A + - DHS Report TA18-074A + - Azorult asset_type: Endpoint confidence: 80 impact: 70 diff --git a/detections/endpoint/system_user_discovery_with_whoami.yml b/detections/endpoint/system_user_discovery_with_whoami.yml index cf3fe178fd..254b242051 100644 --- a/detections/endpoint/system_user_discovery_with_whoami.yml +++ b/detections/endpoint/system_user_discovery_with_whoami.yml @@ -1,7 +1,7 @@ name: System User Discovery With Whoami id: 894fc43e-6f50-47d5-a68b-ee9ee23e18f4 version: 1 -date: '2021-09-13' +date: '2023-04-05' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -24,6 +24,7 @@ references: - https://attack.mitre.org/techniques/T1033/ tags: analytic_story: + - Winter Vivern - Active Directory Discovery - Qakbot asset_type: Endpoint diff --git a/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml b/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml new file mode 100644 index 0000000000..2641701a1a --- /dev/null +++ b/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml @@ -0,0 +1,54 @@ +name: Windows Exfiltration Over C2 Via Invoke RestMethod +id: 06ade821-f6fa-40d0-80af-15bc1d45b3ba +version: 1 +date: '2023-04-05' +author: Teoderick Contreras, Splunk +status: production +type: TTP +data_source: +- Powershell 4104 +description: The following analytic identifies the potential exfiltration of data using PowerShell's Invoke-RestMethod. This technique was observed in the Winter-Vivern malware, which uploads desktop screenshots and files from compromised or targeted hosts. Detecting this TTP can serve as a valuable indicator that a process is attempting to upload files to an external or internal URI link. We recommend examining the process, the files it is trying to upload, and the URL link or C2 destination where the data is being uploaded. +search: '`powershell` EventCode=4104 ScriptBlockText = "*Invoke-RestMethod *" AND ScriptBlockText = "* -Uri *" AND ScriptBlockText = "* -Method *" AND ScriptBlockText = "* Post *" AND ScriptBlockText = "* -InFile *" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_exfiltration_over_c2_via_invoke_restmethod_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: False positives should be limited. Filter as needed. +references: +- https://twitter.com/_CERT_UA/status/1620781684257091584 +- https://cert.gov.ua/article/3761104 +tags: + analytic_story: + - Winter Vivern + asset_type: Endpoint + confidence: 70 + impact: 70 + message: A PowerShell script on $Computer$ is attempting to transfer files to a remote URL. + mitre_attack_id: + - T1041 + observable: + - name: Computer + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - ScriptBlockText + - Computer + - UserID + - EventCode + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml b/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml new file mode 100644 index 0000000000..8fb28cdc9e --- /dev/null +++ b/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml @@ -0,0 +1,54 @@ +name: Windows Exfiltration Over C2 Via Powershell UploadString +id: 59e8bf41-7472-412a-90d3-00f3afa452e9 +version: 1 +date: '2023-04-05' +author: Teoderick Contreras, Splunk +status: production +type: TTP +data_source: +- Powershell 4104 +description: The following analytic identifies potential data exfiltration using the PowerShell net.webclient command. This technique was observed in the Winter-Vivern malware, which uploads desktop screenshots and files from compromised or targeted hosts. Detecting this TTP can serve as a valuable indicator that a process is attempting to upload files to an external or internal URI link. We recommend examining the process, the files it is trying to upload, and the URL link or C2 destination where the data is being uploaded. +search: '`powershell` EventCode=4104 ScriptBlockText = "*Net.webclient*" AND ScriptBlockText = "*.UploadString*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_exfiltration_over_c2_via_powershell_uploadstring_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: False positives should be limited. Filter as needed. +references: +- https://twitter.com/_CERT_UA/status/1620781684257091584 +- https://cert.gov.ua/article/3761104 +tags: + analytic_story: + - Winter Vivern + asset_type: Endpoint + confidence: 70 + impact: 70 + message: A PowerShell script on $Computer$ is attempting to transfer files to a remote URL. + mitre_attack_id: + - T1041 + observable: + - name: Computer + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - ScriptBlockText + - Computer + - UserID + - EventCode + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_uploadstring/windows-powershell-xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/endpoint/windows_scheduled_task_created_via_xml.yml b/detections/endpoint/windows_scheduled_task_created_via_xml.yml new file mode 100644 index 0000000000..83e75bee59 --- /dev/null +++ b/detections/endpoint/windows_scheduled_task_created_via_xml.yml @@ -0,0 +1,72 @@ +name: Windows Scheduled Task Created Via XML +id: 7e03b682-3965-4598-8e91-a60a40a3f7e4 +version: 1 +date: '2023-04-05' +author: Teoderick Contreras, Splunk +status: production +type: TTP +data_source: +- Sysmon Event ID 1 +description: The following analytic identifies the creation of a scheduled task using schtasks.exe, with the flags -create being passed on the command-line along with an XML parameter. This technique has been associated with threat actors, adversaries, and red teamers seeking to gain persistence or achieve privilege escalation on targeted hosts. Notably, the Trickbot and Winter-Vivern malware have been observed employing this method, utilizing an XML file to create scheduled tasks. It is important to monitor and investigate such activity in order to mitigate potential security risks. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name=schtasks.exe Processes.process=*create* Processes.process="* /xml *" + by Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.process_id Processes.parent_process_guid Processes.dest + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_scheduled_task_created_via_xml_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: It is possible scripts or administrators may trigger this analytic. + Filter as needed based on parent process, application. +references: +- https://twitter.com/_CERT_UA/status/1620781684257091584 +- https://cert.gov.ua/article/3761104 +tags: + analytic_story: + - Winter Vivern + asset_type: Endpoint + confidence: 70 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/scheduledtask/sysmon.log + impact: 70 + message: A scheduled task process, $process_name$, with 'create' or 'delete' commands present in the command line. + mitre_attack_id: + - T1053.005 + - T1053 + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process_id + - Processes.process + - Processes.dest + - Processes.user + - Processes.process_id + - Processes.parent_process_id + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/scheduledtask/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true \ No newline at end of file diff --git a/detections/endpoint/windows_screen_capture_via_powershell.yml b/detections/endpoint/windows_screen_capture_via_powershell.yml new file mode 100644 index 0000000000..ddc619a0b0 --- /dev/null +++ b/detections/endpoint/windows_screen_capture_via_powershell.yml @@ -0,0 +1,61 @@ +name: Windows Screen Capture Via Powershell +id: 5e0b1936-8f99-4399-8ee2-9edc5b32e170 +version: 1 +date: '2023-04-05' +author: Teoderick Contreras, Splunk +status: production +type: TTP +data_source: +- Powershell 4104 +description: The following analytic identifies a potential PowerShell script that captures screen images on compromised or targeted hosts. This technique was observed in the Winter-Vivern malware, which attempts to capture desktop screens using a PowerShell script and send the images to its C2 server as part of its exfiltration strategy. This TTP serves as a useful indicator that a PowerShell process may be gathering desktop screenshots from a host system, potentially signaling malicious activity. +search: '`powershell` EventCode=4104 ScriptBlockText = "*[Drawing.Graphics]::FromImage(*" AND ScriptBlockText = "*New-Object Drawing.Bitmap*" + AND ScriptBlockText = "*.CopyFromScreen*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_screen_capture_via_powershell_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: unknown +references: +- https://twitter.com/_CERT_UA/status/1620781684257091584 +- https://cert.gov.ua/article/3761104 +tags: + analytic_story: + - Winter Vivern + asset_type: Endpoint + confidence: 70 + context: + - Source:Endpoint + - Stage:Collection + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml.log + impact: 70 + message: A PowerShell script was identified possibly performing screen captures on $Computer$. + mitre_attack_id: + - T1113 + observable: + - name: Computer + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - ScriptBlockText + - Computer + - UserID + - EventCode + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog + update_timestamp: true \ No newline at end of file diff --git a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml index 84d9a8def6..7d3543b649 100644 --- a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml +++ b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml @@ -1,10 +1,11 @@ name: WinEvent Scheduled Task Created to Spawn Shell id: 203ef0ea-9bd8-11eb-8201-acde48001122 version: 2 -date: '2021-04-12' +date: '2023-04-05' author: Michael Haag, Splunk status: production type: TTP +datamodel: [] description: The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed with a native Windows @@ -39,8 +40,9 @@ references: - https://docs.microsoft.com/en-us/windows/win32/taskschd/time-trigger-example--scripting-?redirectedfrom=MSDN tags: analytic_story: - - Windows Persistence Techniques - Ransomware + - Windows Persistence Techniques + - Winter Vivern - Ryuk Ransomware - CISA AA22-257A asset_type: Endpoint @@ -79,3 +81,4 @@ tests: source: WinEventLog:Security sourcetype: WinEventLog update_timestamp: true + diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml index e1d9993594..8255cb753a 100644 --- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -1,10 +1,11 @@ name: WinEvent Scheduled Task Created Within Public Path id: 5d9c6eee-988c-11eb-8253-acde48001122 version: 1 -date: '2021-04-08' +date: '2023-04-05' author: Michael Haag, Splunk status: production type: TTP +datamodel: [] description: The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed from a user writeable @@ -39,15 +40,17 @@ references: - https://app.any.run/tasks/e26f1b2e-befa-483b-91d2-e18636e2faf3/ tags: analytic_story: - - Windows Persistence Techniques - Ransomware - - Ryuk Ransomware - - IcedID - - Active Directory Lateral Movement - - Industroyer2 - - CISA AA22-257A + - Windows Persistence Techniques + - Winter Vivern - Prestige Ransomware - AsyncRAT + - Ryuk Ransomware + - IcedID + - CISA AA22-257A + - Industroyer2 + - Active Directory Lateral Movement + - Data Destruction asset_type: Endpoint confidence: 100 impact: 70 diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml index 301b6f4db8..d34328ff6b 100644 --- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml +++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml @@ -1,7 +1,7 @@ name: WinEvent Windows Task Scheduler Event Action Started id: b3632472-310b-11ec-9aab-acde48001122 version: 1 -date: '2021-10-19' +date: '2023-04-05' author: Michael Haag, Splunk status: production type: Hunting @@ -29,14 +29,17 @@ references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ tags: analytic_story: - - IcedID - - Windows Persistence Techniques - - Industroyer2 - - DarkCrystal RAT - - CISA AA22-257A - Qakbot + - Windows Persistence Techniques + - Winter Vivern - Prestige Ransomware + - DarkCrystal RAT - AsyncRAT + - IcedID + - CISA AA22-257A + - Industroyer2 + - Sandworm Tools + - Data Destruction asset_type: Endpoint confidence: 100 impact: 80 diff --git a/stories/winter_vivern.yml b/stories/winter_vivern.yml new file mode 100644 index 0000000000..772838a631 --- /dev/null +++ b/stories/winter_vivern.yml @@ -0,0 +1,18 @@ +name: Winter Vivern +id: 5ce5f311-b311-4568-90ca-0c36781d07a4 +version: 1 +date: '2023-02-16' +author: Teoderick Contreras, Splunk +description: Utilize searches that enable you to detect and investigate unusual activities potentially related to the Winter Vivern malicious software. This includes examining multiple timeout executions, scheduled task creations, screenshots, and downloading files through PowerShell, among other indicators. +narrative: The Winter Vivern malware, identified by CERT UA, is designed to download and run multiple PowerShell scripts on targeted hosts. These scripts aim to gather a variety of files with specific extensions, including (.edb, .ems, .eme, .emz, .key, .pem, .ovpn, .bat, .cer, .p12, .cfg, .log, .txt, .pdf, .doc, .docx, .xls, .xlsx, and .rdg), primarily from desktop directories. In addition to this, the malware captures desktop screenshots and performs data exfiltration using HTTP. To maintain its presence on the targeted host, Winter Vivern also establishes a persistence mechanism, such as creating a scheduled task. +references: +- https://cert.gov.ua/article/3761023 +tags: + analytic_story: Winter Vivern + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file