From e44c03cb1704692647ac3b998e83e3013d466e00 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 5 Apr 2023 10:21:44 +0200 Subject: [PATCH 01/19] winter_vivern_analytics --- .../any_powershell_downloadstring.yml | 7 +- ...cmd_carry_out_string_command_parameter.yml | 21 ++--- ...wmiobject_user_account_with_powershell.yml | 3 +- ...r_account_with_powershell_script_block.yml | 3 +- ...script_contains_base64_encoded_content.yml | 18 ++--- ...ding_dotnet_into_memory_via_reflection.yml | 17 ++-- ...edule_task_with_http_command_arguments.yml | 5 +- ...eduled_task_deleted_or_created_via_cmd.yml | 19 ++--- .../system_user_discovery_with_whoami.yml | 3 +- ...ltration_over_c2_via_invoke_restmethod.yml | 63 +++++++++++++++ ...on_over_c2_via_powershell_uploadstring.yml | 63 +++++++++++++++ ...windows_scheduled_task_created_via_xml.yml | 81 +++++++++++++++++++ .../windows_screen_capture_via_powershell.yml | 63 +++++++++++++++ ..._scheduled_task_created_to_spawn_shell.yml | 29 ++++--- ...eduled_task_created_within_public_path.yml | 45 +++++------ ...ws_task_scheduler_event_action_started.yml | 13 +-- stories/winter_vivern.yml | 24 ++++++ ...ion_over_c2_via_invoke_restmethod.test.yml | 14 ++++ ...er_c2_via_powershell_uploadstring.test.yml | 13 +++ ...ws_scheduled_task_created_via_xml.test.yml | 13 +++ ...ows_screen_capture_via_powershell.test.yml | 13 +++ 21 files changed, 443 insertions(+), 87 deletions(-) create mode 100644 detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml create mode 100644 detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml create mode 100644 detections/endpoint/windows_scheduled_task_created_via_xml.yml create mode 100644 detections/endpoint/windows_screen_capture_via_powershell.yml create mode 100644 stories/winter_vivern.yml create mode 100644 tests/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.test.yml create mode 100644 tests/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.test.yml create mode 100644 tests/endpoint/windows_scheduled_task_created_via_xml.test.yml create mode 100644 tests/endpoint/windows_screen_capture_via_powershell.test.yml diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml index 7f22b096e4..95ee463eca 100644 --- a/detections/endpoint/any_powershell_downloadstring.yml +++ b/detections/endpoint/any_powershell_downloadstring.yml @@ -1,7 +1,7 @@ name: Any Powershell DownloadString id: 4d015ef2-7adf-11eb-95da-acde48001122 version: 3 -date: '2022-04-07' +date: '2023-04-05' author: Michael Haag, Splunk type: TTP datamodel: @@ -30,10 +30,11 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md tags: analytic_story: - - Hermetic Wiper + - Winter Vivern + - Ingress Tool Transfer + - Hermetic Wiper - Malicious PowerShell - HAFNIUM Group - - Ingress Tool Transfer confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml index 1239ddecd3..517f137002 100644 --- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml +++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml @@ -1,7 +1,7 @@ name: CMD Carry Out String Command Parameter id: 54a6ed00-3256-11ec-b031-acde48001122 version: 3 -date: '2022-01-18' +date: '2023-04-05' author: Teoderick Contreras, Bhavin Patel, Splunk type: Hunting datamodel: @@ -30,18 +30,19 @@ references: - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: - - Data Destruction - - IcedID - - Log4Shell CVE-2021-44228 - - WhisperGate - - Hermetic Wiper - - Living Off The Land - - Azorult - - DarkCrystal RAT - ProxyNotShell - Qakbot - - Chaos Ransomware + - Winter Vivern + - DarkCrystal RAT - AsyncRAT + - Log4Shell CVE-2021-44228 + - Hermetic Wiper + - Chaos Ransomware + - IcedID + - WhisperGate + - Data Destruction + - Living Off The Land + - Azorult automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell.yml b/detections/endpoint/getwmiobject_user_account_with_powershell.yml index 2df30b1ba7..e31a324906 100644 --- a/detections/endpoint/getwmiobject_user_account_with_powershell.yml +++ b/detections/endpoint/getwmiobject_user_account_with_powershell.yml @@ -1,7 +1,7 @@ name: GetWmiObject User Account with PowerShell id: b44f6ac6-0429-11ec-87e9-acde48001122 version: 1 -date: '2021-08-23' +date: '2023-04-05' author: Mauricio Velazco, Splunk type: Hunting datamodel: @@ -26,6 +26,7 @@ references: - https://attack.mitre.org/techniques/T1087/001/ tags: analytic_story: + - Winter Vivern - Active Directory Discovery confidence: 50 context: diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml index bb3a548d47..a242e40cad 100644 --- a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml @@ -1,7 +1,7 @@ name: GetWmiObject User Account with PowerShell Script Block id: 640b0eda-0429-11ec-accd-acde48001122 version: 2 -date: '2022-05-02' +date: '2023-04-05' author: Mauricio Velazco, Splunk type: Hunting datamodel: [] @@ -23,6 +23,7 @@ references: - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html tags: analytic_story: + - Winter Vivern - Active Directory Discovery - Malicious PowerShell confidence: 50 diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml index 6371bc490e..a22c6bf0f5 100644 --- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml +++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml @@ -1,7 +1,7 @@ name: Powershell Fileless Script Contains Base64 Encoded Content id: 8acbc04c-c882-11eb-b060-acde48001122 version: 2 -date: '2022-04-26' +date: '2023-04-05' author: Michael Haag, Splunk type: TTP datamodel: [] @@ -20,11 +20,10 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.' -search: '`powershell` EventCode=4104 ScriptBlockText = "*frombase64string*" OR ScriptBlockText = "*gnirtS46esaBmorF*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `powershell_fileless_script_contains_base64_encoded_content_filter`' +search: '`powershell` EventCode=4104 ScriptBlockText = "*frombase64string*" OR ScriptBlockText + = "*gnirtS46esaBmorF*" | stats count min(_time) as firstTime max(_time) as lastTime + by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `powershell_fileless_script_contains_base64_encoded_content_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -36,8 +35,9 @@ references: - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ tags: analytic_story: - - Hermetic Wiper + - Hermetic Wiper - Malicious PowerShell + - Winter Vivern - AsyncRAT confidence: 80 context: @@ -48,8 +48,8 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: A suspicious powershell script contains base64 command in $ScriptBlockText$ with - EventCode $EventCode$ in host $Computer$ + message: A suspicious powershell script contains base64 command in $ScriptBlockText$ + with EventCode $EventCode$ in host $Computer$ mitre_attack_id: - T1059 - T1027 diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml index c7994cef85..6292d732af 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml @@ -1,7 +1,7 @@ name: PowerShell Loading DotNET into Memory via Reflection id: 85bc3f30-ca28-11eb-bd21-acde48001122 version: 2 -date: '2022-05-02' +date: '2023-04-05' author: Michael Haag, Splunk type: TTP datamodel: [] @@ -19,9 +19,10 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.' -search: '`powershell` EventCode=4104 ScriptBlockText IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*", "*reflection.assembly*") - | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `powershell_loading_dotnet_into_memory_via_reflection_filter`' +search: '`powershell` EventCode=4104 ScriptBlockText IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*", + "*reflection.assembly*") | stats count min(_time) as firstTime max(_time) as lastTime + by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `powershell_loading_dotnet_into_memory_via_reflection_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -35,10 +36,11 @@ references: - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ tags: analytic_story: - - Hermetic Wiper - - Malicious PowerShell + - Winter Vivern - AgentTesla - AsyncRAT + - Hermetic Wiper + - Malicious PowerShell confidence: 80 context: - Source:Endpoint @@ -49,7 +51,8 @@ tags: kill_chain_phases: - Exploitation message: A suspicious powershell script contains reflective class assembly command - in $ScriptBlockText$ to load .net code in memory with EventCode $EventCode$ in host $Computer$ + in $ScriptBlockText$ to load .net code in memory with EventCode $EventCode$ in + host $Computer$ mitre_attack_id: - T1059 - T1059.001 diff --git a/detections/endpoint/schedule_task_with_http_command_arguments.yml b/detections/endpoint/schedule_task_with_http_command_arguments.yml index acfd1992d4..2a81754a32 100644 --- a/detections/endpoint/schedule_task_with_http_command_arguments.yml +++ b/detections/endpoint/schedule_task_with_http_command_arguments.yml @@ -1,7 +1,7 @@ name: Schedule Task with HTTP Command Arguments id: 523c2684-a101-11eb-916b-acde48001122 version: 1 -date: '2021-04-19' +date: '2023-04-05' author: Teoderick Contreras, Splunk type: TTP datamodel: @@ -32,8 +32,9 @@ references: - https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/ tags: analytic_story: - - Windows Persistence Techniques - Living Off The Land + - Winter Vivern + - Windows Persistence Techniques confidence: 90 context: - Source:Endpoint diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index 86658c58f1..d750642704 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -1,7 +1,7 @@ name: Scheduled Task Deleted Or Created via CMD id: d5af132c-7c17-439c-9d31-13d55340f36c version: 6 -date: '2022-02-22' +date: '2023-04-05' author: Bhavin Patel, Splunk type: TTP datamodel: @@ -28,18 +28,19 @@ references: - https://www.joesandbox.com/analysis/691823/0/html tags: analytic_story: - - DHS Report TA18-074A + - Qakbot - NOBELIUM Group - Windows Persistence Techniques - - Living Off The Land - - Azorult - - DarkCrystal RAT - - CISA AA22-257A - - AgentTesla - - Qakbot - - Trickbot + - Winter Vivern - Prestige Ransomware + - DarkCrystal RAT + - AgentTesla + - Trickbot - AsyncRAT + - Living Off The Land + - CISA AA22-257A + - DHS Report TA18-074A + - Azorult asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/system_user_discovery_with_whoami.yml b/detections/endpoint/system_user_discovery_with_whoami.yml index 230f140f70..b4a7286a41 100644 --- a/detections/endpoint/system_user_discovery_with_whoami.yml +++ b/detections/endpoint/system_user_discovery_with_whoami.yml @@ -1,7 +1,7 @@ name: System User Discovery With Whoami id: 894fc43e-6f50-47d5-a68b-ee9ee23e18f4 version: 1 -date: '2021-09-13' +date: '2023-04-05' author: Mauricio Velazco, Splunk type: Hunting datamodel: @@ -23,6 +23,7 @@ references: - https://attack.mitre.org/techniques/T1033/ tags: analytic_story: + - Winter Vivern - Active Directory Discovery - Qakbot confidence: 50 diff --git a/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml b/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml new file mode 100644 index 0000000000..04d85e3c55 --- /dev/null +++ b/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml @@ -0,0 +1,63 @@ +name: Windows Exfiltration Over C2 Via Invoke RestMethod +id: 06ade821-f6fa-40d0-80af-15bc1d45b3ba +version: 1 +date: '2023-04-05' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies the possible exfiltration of data using powershell Invoke-RestMethod. + This technique was seen in Winter-Vivern malware that upload desktop screenshots and desktop files from compromised or targeted hosts. + This TTP detection can be a good indicator that a process tries to upload files in an external or internal URI link. + We recommend verifying the process, the files it tries to upload and the URL link or C2 where it uploads the data. +search: '`powershell` EventCode=4104 ScriptBlockText = "*Invoke-RestMethod *" AND ScriptBlockText = "* -Uri *" AND ScriptBlockText = "* -Method *" AND ScriptBlockText = "* Post *" AND ScriptBlockText = "* -InFile *" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_exfiltration_over_c2_via_invoke_restmethod_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: False positives should be limited. Filter as needed. +references: +- https://twitter.com/_CERT_UA/status/1620781684257091584 +- https://cert.gov.ua/article/3761104 +tags: + analytic_story: + - Winter Vivern + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Exfiltration + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml.log + impact: 70 + kill_chain_phases: + - Command & Control + message: a powershell script tries to upload files in a url link in $Computer$ + mitre_attack_id: + - T1041 + nist: + - DE.CM + observable: + - name: Computer + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - ScriptBlockText + - Computer + - UserID + - EventCode + risk_score: 49 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml b/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml new file mode 100644 index 0000000000..c35c6ad26f --- /dev/null +++ b/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml @@ -0,0 +1,63 @@ +name: Windows Exfiltration Over C2 Via Powershell UploadString +id: 59e8bf41-7472-412a-90d3-00f3afa452e9 +version: 1 +date: '2023-04-05' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies the possible exfiltration of data using powershell net.webclient command. + This technique was seen in Winter-Vivern malware that upload desktop screenshots and desktop files from compromised or targeted hosts. + This TTP detection can be a good indicator that a process tries to upload files in an external or internal URI link. + We recommend verifying the process, the files it tries to upload and the URL link or C2 where it uploads the data. +search: '`powershell` EventCode=4104 ScriptBlockText = "*Net.webclient*" AND ScriptBlockText = "*.UploadString*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_exfiltration_over_c2_via_powershell_uploadstring_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: False positives should be limited. Filter as needed. +references: +- https://twitter.com/_CERT_UA/status/1620781684257091584 +- https://cert.gov.ua/article/3761104 +tags: + analytic_story: + - Winter Vivern + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Exfiltration + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_uploadstring/windows-powershell-xml.log + impact: 70 + kill_chain_phases: + - Command & Control + message: a powershell script tries to upload files in a url link in $Computer$ + mitre_attack_id: + - T1041 + nist: + - DE.CM + observable: + - name: Computer + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - ScriptBlockText + - Computer + - UserID + - EventCode + risk_score: 49 + security_domain: endpoint diff --git a/detections/endpoint/windows_scheduled_task_created_via_xml.yml b/detections/endpoint/windows_scheduled_task_created_via_xml.yml new file mode 100644 index 0000000000..66e00c5631 --- /dev/null +++ b/detections/endpoint/windows_scheduled_task_created_via_xml.yml @@ -0,0 +1,81 @@ +name: Windows Scheduled Task Created Via XML +id: 7e03b682-3965-4598-8e91-a60a40a3f7e4 +version: 1 +date: '2023-04-05' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies the creation of a scheduled + task using schtasks.exe with flags - create being passed on the command-line with xml parameter. + This has been associated with the threat actor, adversaries and red-teamers to gain persistence or + privilege escalation to targeted hosts. This technique has been seen in trickbot and winter-vivern malware that uses xml file to create + scheduled task. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name=schtasks.exe Processes.process=*create* Processes.process="* /xml *" + by Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.process_id Processes.parent_process_guid Processes.dest + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_scheduled_task_created_via_xml_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: It is possible scripts or administrators may trigger this analytic. + Filter as needed based on parent process, application. +references: +- https://twitter.com/_CERT_UA/status/1620781684257091584 +- https://cert.gov.ua/article/3761104 +tags: + analytic_story: + - Winter Vivern + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Execution + - Stage:Persistence + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/scheduledtask/sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: A schedule task process $process_name$ with create or delete commandline + mitre_attack_id: + - T1053.005 + - T1053 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process_id + - Processes.process + - Processes.dest + - Processes.user + - Processes.process_id + - Processes.parent_process_id + risk_score: 49 + security_domain: endpoint diff --git a/detections/endpoint/windows_screen_capture_via_powershell.yml b/detections/endpoint/windows_screen_capture_via_powershell.yml new file mode 100644 index 0000000000..f2a316bfbe --- /dev/null +++ b/detections/endpoint/windows_screen_capture_via_powershell.yml @@ -0,0 +1,63 @@ +name: Windows Screen Capture Via Powershell +id: 5e0b1936-8f99-4399-8ee2-9edc5b32e170 +version: 1 +date: '2023-04-05' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies a possible powershell script that does screen capture in the compromised or targeted hosts. + This technique was seen in Winter-Vivern malware that tries to capture desktop screen via powershell script and send it to its C2 server as part + of its exfiltration technique. This TTP is a good indicator that a powershell process is possibly collecting desktop screenshots to a host system. +search: '`powershell` EventCode=4104 ScriptBlockText = "*[Drawing.Graphics]::FromImage(*" AND ScriptBlockText = "*New-Object Drawing.Bitmap*" + AND ScriptBlockText = “*.CopyFromScreen*” + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_screen_capture_via_powershell_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: unknown +references: +- https://twitter.com/_CERT_UA/status/1620781684257091584 +- https://cert.gov.ua/article/3761104 +tags: + analytic_story: + - Winter Vivern + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Collection + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml.log + impact: 70 + kill_chain_phases: + - Exploitation + message: a powershell script that possibly doing screen capture on $Computer$ + mitre_attack_id: + - T1113 + nist: + - DE.CM + observable: + - name: Computer + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - ScriptBlockText + - Computer + - UserID + - EventCode + risk_score: 49 + security_domain: endpoint diff --git a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml index 9a0047e23e..6d1e6a4fd4 100644 --- a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml +++ b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml @@ -1,25 +1,23 @@ name: WinEvent Scheduled Task Created to Spawn Shell id: 203ef0ea-9bd8-11eb-8201-acde48001122 version: 2 -date: '2021-04-12' +date: '2023-04-05' author: Michael Haag, Splunk type: TTP datamodel: [] -description: 'The following query utilizes Windows Security EventCode 4698, `A scheduled +description: The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed with a native Windows - shell (PowerShell, Cmd, Wscript, Cscript).\ - The search will return the first time and last time the task was registered, as - well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether - it is `Hidden` or not.\ - schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ - The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. + shell (PowerShell, Cmd, Wscript, Cscript).\ The search will return the first time + and last time the task was registered, as well as the `Command` to be executed, + `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not.\ schtasks.exe + is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ The following + DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered - within that process context in memory.\ - Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? - Review the job created and the Command to be executed. Capture any artifacts on - disk and review. Identify any parallel processes within the same timeframe to identify - source.' + within that process context in memory.\ Upon triage, identify the task scheduled + source. Was it schtasks.exe or via TaskService? Review the job created and the Command + to be executed. Capture any artifacts on disk and review. Identify any parallel + processes within the same timeframe to identify source. search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN ("*powershell.exe*", "*wscript.exe*", "*cscript.exe*", "*cmd.exe*", "*sh.exe*", "*ksh.exe*", "*zsh.exe*", "*bash.exe*", "*scrcons.exe*", "*pwsh.exe*") | stats count @@ -39,8 +37,9 @@ references: - https://docs.microsoft.com/en-us/windows/win32/taskschd/time-trigger-example--scripting-?redirectedfrom=MSDN tags: analytic_story: - - Windows Persistence Techniques - Ransomware + - Windows Persistence Techniques + - Winter Vivern - Ryuk Ransomware - CISA AA22-257A confidence: 100 @@ -80,4 +79,4 @@ tags: - Command risk_score: 70 security_domain: endpoint - asset_type: Endpoint \ No newline at end of file + asset_type: Endpoint diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml index 9f09959223..424659d1d5 100644 --- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -1,29 +1,27 @@ name: WinEvent Scheduled Task Created Within Public Path id: 5d9c6eee-988c-11eb-8253-acde48001122 version: 1 -date: '2021-04-08' +date: '2023-04-05' author: Michael Haag, Splunk type: TTP datamodel: [] -description: 'The following query utilizes Windows Security EventCode 4698, `A scheduled +description: The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed from a user writeable - file path.\ - The search will return the first time and last time the task was registered, as - well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether - it is `Hidden` or not.\ - schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ - The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. - If found loaded by another process, it is possible a scheduled task is being registered - within that process context in memory.\ - Upon triage, identify the task scheduled source. Was it schtasks.exe or was it via - TaskService. Review the job created and the Command to be executed. Capture any - artifacts on disk and review. Identify any parallel processes within the same timeframe - to identify source.' + file path.\ The search will return the first time and last time the task was registered, + as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether + it is `Hidden` or not.\ schtasks.exe is natively found in `C:\Windows\system32` + and `C:\Windows\syswow64`.\ The following DLL(s) are loaded when schtasks.exe or + TaskService is launched -`taskschd.dll`. If found loaded by another process, it + is possible a scheduled task is being registered within that process context in + memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or + was it via TaskService. Review the job created and the Command to be executed. Capture + any artifacts on disk and review. Identify any parallel processes within the same + timeframe to identify source. search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", - "*\\appdata\\*", "*\\perflogs\\*") | stats count min(_time) as firstTime max(_time) as lastTime by - dest, Task_Name, Command, Author, Enabled, Hidden | `security_content_ctime(firstTime)` + "*\\appdata\\*", "*\\perflogs\\*") | stats count min(_time) as firstTime max(_time) + as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winevent_scheduled_task_created_within_public_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also @@ -39,15 +37,16 @@ references: - https://app.any.run/tasks/e26f1b2e-befa-483b-91d2-e18636e2faf3/ tags: analytic_story: - - Windows Persistence Techniques - Ransomware - - Ryuk Ransomware - - IcedID - - Active Directory Lateral Movement - - Industroyer2 - - CISA AA22-257A + - Windows Persistence Techniques + - Winter Vivern - Prestige Ransomware - AsyncRAT + - Ryuk Ransomware + - IcedID + - CISA AA22-257A + - Industroyer2 + - Active Directory Lateral Movement confidence: 100 context: - Source:Endpoint @@ -85,4 +84,4 @@ tags: - Command risk_score: 70 security_domain: endpoint - asset_type: Endpoint \ No newline at end of file + asset_type: Endpoint diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml index f07564c58f..3778ee9004 100644 --- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml +++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml @@ -1,7 +1,7 @@ name: WinEvent Windows Task Scheduler Event Action Started id: b3632472-310b-11ec-9aab-acde48001122 version: 1 -date: '2021-10-19' +date: '2023-04-05' author: Michael Haag, Splunk type: Hunting datamodel: @@ -29,14 +29,15 @@ references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ tags: analytic_story: - - IcedID - - Windows Persistence Techniques - - Industroyer2 - - DarkCrystal RAT - - CISA AA22-257A - Qakbot + - Windows Persistence Techniques + - Winter Vivern - Prestige Ransomware + - DarkCrystal RAT - AsyncRAT + - IcedID + - CISA AA22-257A + - Industroyer2 confidence: 100 context: - Source:Endpoint diff --git a/stories/winter_vivern.yml b/stories/winter_vivern.yml new file mode 100644 index 0000000000..ff41e6bd76 --- /dev/null +++ b/stories/winter_vivern.yml @@ -0,0 +1,24 @@ +name: Winter Vivern +id: 5ce5f311-b311-4568-90ca-0c36781d07a4 +version: 1 +date: '2023-02-16' +author: Teoderick Contreras, Splunk +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the Winter Vivern trojan, including looking for several timeout execution, + schedule task creation, screenshots, downloading filess through powershell and many more. +narrative: Winter Vivern malware was found by cert ua that tried to download and run several powershell script on the + target host that will try to collect several files with specific file extensions like (.edb, .ems, .eme, .emz, .key, .pem, + .ovpn, .bat, .cer, .p12, .cfg, .log, .txt, .pdf, .doc, .docx, .xls, .xlsx, .rdg(=) in desktop directories, taking desktop + screenshots and further exfiltration through HTTP. It will also create a persistence mechanism such as scheduled task to + ensure persistence on the targeted host. +references: +- https://cert.gov.ua/article/3761023 +tags: + analytic_story: Winter Vivern + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/tests/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.test.yml b/tests/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.test.yml new file mode 100644 index 0000000000..b64f8278b4 --- /dev/null +++ b/tests/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.test.yml @@ -0,0 +1,14 @@ +name: Windows Exfiltration Over C2 Via Invoke RestMethod Unit Test +tests: +- name: Windows Exfiltration Over C2 Via Invoke RestMethod + file: endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-powershell-xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog + update_timestamp: true + diff --git a/tests/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.test.yml b/tests/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.test.yml new file mode 100644 index 0000000000..2ed8bb6025 --- /dev/null +++ b/tests/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.test.yml @@ -0,0 +1,13 @@ +name: Windows Exfiltration Over C2 Via Powershell UploadString Unit Test +tests: +- name: Windows Exfiltration Over C2 Via Powershell UploadString + file: endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-powershell-xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_uploadstring/windows-powershell-xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_scheduled_task_created_via_xml.test.yml b/tests/endpoint/windows_scheduled_task_created_via_xml.test.yml new file mode 100644 index 0000000000..77afd5d70c --- /dev/null +++ b/tests/endpoint/windows_scheduled_task_created_via_xml.test.yml @@ -0,0 +1,13 @@ +name: Windows Scheduled Task Created Via XML Unit Test +tests: +- name: Windows Scheduled Task Created Via XML + file: endpoint/windows_scheduled_task_created_via_xml.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/scheduledtask/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_screen_capture_via_powershell.test.yml b/tests/endpoint/windows_screen_capture_via_powershell.test.yml new file mode 100644 index 0000000000..36cd1c9711 --- /dev/null +++ b/tests/endpoint/windows_screen_capture_via_powershell.test.yml @@ -0,0 +1,13 @@ +name: Windows Screen Capture Via Powershell Unit Test +tests: +- name: Windows Screen Capture Via Powershell + file: endpoint/windows_screen_capture_via_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-powershell-xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog + update_timestamp: true From e71ffb6b8c75f6c68e3cdae059abfbae4f16f759 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 5 Apr 2023 15:56:24 +0200 Subject: [PATCH 02/19] winter_vivern_analytics --- detections/endpoint/windows_screen_capture_via_powershell.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_screen_capture_via_powershell.yml b/detections/endpoint/windows_screen_capture_via_powershell.yml index f2a316bfbe..00f3ef4869 100644 --- a/detections/endpoint/windows_screen_capture_via_powershell.yml +++ b/detections/endpoint/windows_screen_capture_via_powershell.yml @@ -10,7 +10,7 @@ description: The following analytic identifies a possible powershell script that This technique was seen in Winter-Vivern malware that tries to capture desktop screen via powershell script and send it to its C2 server as part of its exfiltration technique. This TTP is a good indicator that a powershell process is possibly collecting desktop screenshots to a host system. search: '`powershell` EventCode=4104 ScriptBlockText = "*[Drawing.Graphics]::FromImage(*" AND ScriptBlockText = "*New-Object Drawing.Bitmap*" - AND ScriptBlockText = “*.CopyFromScreen*” + AND ScriptBlockText = "*.CopyFromScreen*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From 3faaaf2f0a8430eb49e017895c486610447b4ffb Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 13 Apr 2023 11:07:18 -0600 Subject: [PATCH 03/19] updates --- ...script_contains_base64_encoded_content.yml | 19 +++++++---------- ...ding_dotnet_into_memory_via_reflection.yml | 21 +++++++++---------- ...ltration_over_c2_via_invoke_restmethod.yml | 7 ++----- ...on_over_c2_via_powershell_uploadstring.yml | 7 ++----- ...windows_scheduled_task_created_via_xml.yml | 8 ++----- .../windows_screen_capture_via_powershell.yml | 6 ++---- stories/winter_vivern.yml | 11 +++------- 7 files changed, 29 insertions(+), 50 deletions(-) diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml index c402541a1e..1126e21f90 100644 --- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml +++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml @@ -1,10 +1,10 @@ name: Powershell Fileless Script Contains Base64 Encoded Content id: 8acbc04c-c882-11eb-b060-acde48001122 -version: 2 +version: 3 date: '2023-04-05' author: Michael Haag, Splunk -status: production type: TTP +datamodel: [] description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output @@ -20,8 +20,6 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.' -data_source: -- Powershell 4104 search: '`powershell` EventCode=4104 ScriptBlockText = "*frombase64string*" OR ScriptBlockText = "*gnirtS46esaBmorF*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` @@ -41,8 +39,12 @@ tags: - Malicious PowerShell - Winter Vivern - AsyncRAT - asset_type: Endpoint confidence: 80 + context: + - Source:Endpoint + - Stage:Execution + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/frombase64string.log impact: 70 kill_chain_phases: - Exploitation @@ -70,9 +72,4 @@ tags: - EventCode risk_score: 56 security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/frombase64string.log - source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: xmlwineventlog + asset_type: Endpoint diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml index 4c5f02487e..dc0e7fb88f 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml @@ -1,10 +1,10 @@ name: PowerShell Loading DotNET into Memory via Reflection id: 85bc3f30-ca28-11eb-bd21-acde48001122 -version: 2 +version: 3 date: '2023-04-05' author: Michael Haag, Splunk -status: production type: TTP +datamodel: [] description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output @@ -19,8 +19,6 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.' -data_source: -- Powershell 4104 search: '`powershell` EventCode=4104 ScriptBlockText IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*", "*reflection.assembly*") | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` @@ -43,9 +41,15 @@ tags: - AsyncRAT - Hermetic Wiper - Malicious PowerShell - asset_type: Endpoint confidence: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reflection.log impact: 70 + kill_chain_phases: + - Exploitation message: A suspicious powershell script contains reflective class assembly command in $ScriptBlockText$ to load .net code in memory with EventCode $EventCode$ in host $Computer$ @@ -74,9 +78,4 @@ tags: - EventCode risk_score: 56 security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reflection.log - source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: xmlwineventlog + asset_type: Endpoint diff --git a/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml b/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml index 04d85e3c55..5a2e7a2c66 100644 --- a/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml +++ b/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml @@ -6,10 +6,7 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies the possible exfiltration of data using powershell Invoke-RestMethod. - This technique was seen in Winter-Vivern malware that upload desktop screenshots and desktop files from compromised or targeted hosts. - This TTP detection can be a good indicator that a process tries to upload files in an external or internal URI link. - We recommend verifying the process, the files it tries to upload and the URL link or C2 where it uploads the data. +description: The following analytic identifies the potential exfiltration of data using PowerShell's Invoke-RestMethod. This technique was observed in the Winter-Vivern malware, which uploads desktop screenshots and files from compromised or targeted hosts. Detecting this TTP can serve as a valuable indicator that a process is attempting to upload files to an external or internal URI link. We recommend examining the process, the files it is trying to upload, and the URL link or C2 destination where the data is being uploaded. search: '`powershell` EventCode=4104 ScriptBlockText = "*Invoke-RestMethod *" AND ScriptBlockText = "* -Uri *" AND ScriptBlockText = "* -Method *" AND ScriptBlockText = "* Post *" AND ScriptBlockText = "* -InFile *" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` @@ -39,7 +36,7 @@ tags: impact: 70 kill_chain_phases: - Command & Control - message: a powershell script tries to upload files in a url link in $Computer$ + message: A PowerShell script on $Computer$ is attempting to transfer files to a remote URL. mitre_attack_id: - T1041 nist: diff --git a/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml b/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml index c35c6ad26f..073c117254 100644 --- a/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml +++ b/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml @@ -6,10 +6,7 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies the possible exfiltration of data using powershell net.webclient command. - This technique was seen in Winter-Vivern malware that upload desktop screenshots and desktop files from compromised or targeted hosts. - This TTP detection can be a good indicator that a process tries to upload files in an external or internal URI link. - We recommend verifying the process, the files it tries to upload and the URL link or C2 where it uploads the data. +description: The following analytic identifies potential data exfiltration using the PowerShell net.webclient command. This technique was observed in the Winter-Vivern malware, which uploads desktop screenshots and files from compromised or targeted hosts. Detecting this TTP can serve as a valuable indicator that a process is attempting to upload files to an external or internal URI link. We recommend examining the process, the files it is trying to upload, and the URL link or C2 destination where the data is being uploaded. search: '`powershell` EventCode=4104 ScriptBlockText = "*Net.webclient*" AND ScriptBlockText = "*.UploadString*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` @@ -39,7 +36,7 @@ tags: impact: 70 kill_chain_phases: - Command & Control - message: a powershell script tries to upload files in a url link in $Computer$ + message: A PowerShell script on $Computer$ is attempting to transfer files to a remote URL. mitre_attack_id: - T1041 nist: diff --git a/detections/endpoint/windows_scheduled_task_created_via_xml.yml b/detections/endpoint/windows_scheduled_task_created_via_xml.yml index 66e00c5631..f10e688ae4 100644 --- a/detections/endpoint/windows_scheduled_task_created_via_xml.yml +++ b/detections/endpoint/windows_scheduled_task_created_via_xml.yml @@ -6,11 +6,7 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies the creation of a scheduled - task using schtasks.exe with flags - create being passed on the command-line with xml parameter. - This has been associated with the threat actor, adversaries and red-teamers to gain persistence or - privilege escalation to targeted hosts. This technique has been seen in trickbot and winter-vivern malware that uses xml file to create - scheduled task. +description: The following analytic identifies the creation of a scheduled task using schtasks.exe, with the flags -create being passed on the command-line along with an XML parameter. This technique has been associated with threat actors, adversaries, and red teamers seeking to gain persistence or achieve privilege escalation on targeted hosts. Notably, the Trickbot and Winter-Vivern malware have been observed employing this method, utilizing an XML file to create scheduled tasks. It is important to monitor and investigate such activity in order to mitigate potential security risks. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe Processes.process=*create* Processes.process="* /xml *" by Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.process_id Processes.parent_process_guid Processes.dest @@ -47,7 +43,7 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: A schedule task process $process_name$ with create or delete commandline + message: A scheduled task process, $process_name$, with 'create' or 'delete' commands present in the command line. mitre_attack_id: - T1053.005 - T1053 diff --git a/detections/endpoint/windows_screen_capture_via_powershell.yml b/detections/endpoint/windows_screen_capture_via_powershell.yml index 00f3ef4869..187838cbf1 100644 --- a/detections/endpoint/windows_screen_capture_via_powershell.yml +++ b/detections/endpoint/windows_screen_capture_via_powershell.yml @@ -6,9 +6,7 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies a possible powershell script that does screen capture in the compromised or targeted hosts. - This technique was seen in Winter-Vivern malware that tries to capture desktop screen via powershell script and send it to its C2 server as part - of its exfiltration technique. This TTP is a good indicator that a powershell process is possibly collecting desktop screenshots to a host system. +description: The following analytic identifies a potential PowerShell script that captures screen images on compromised or targeted hosts. This technique was observed in the Winter-Vivern malware, which attempts to capture desktop screens using a PowerShell script and send the images to its C2 server as part of its exfiltration strategy. This TTP serves as a useful indicator that a PowerShell process may be gathering desktop screenshots from a host system, potentially signaling malicious activity. search: '`powershell` EventCode=4104 ScriptBlockText = "*[Drawing.Graphics]::FromImage(*" AND ScriptBlockText = "*New-Object Drawing.Bitmap*" AND ScriptBlockText = "*.CopyFromScreen*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID @@ -39,7 +37,7 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: a powershell script that possibly doing screen capture on $Computer$ + message: A PowerShell script was identified possibly performing screen captures on $Computer$. mitre_attack_id: - T1113 nist: diff --git a/stories/winter_vivern.yml b/stories/winter_vivern.yml index ff41e6bd76..5ba6d6e542 100644 --- a/stories/winter_vivern.yml +++ b/stories/winter_vivern.yml @@ -3,14 +3,9 @@ id: 5ce5f311-b311-4568-90ca-0c36781d07a4 version: 1 date: '2023-02-16' author: Teoderick Contreras, Splunk -description: Leverage searches that allow you to detect and investigate unusual activities - that might relate to the Winter Vivern trojan, including looking for several timeout execution, - schedule task creation, screenshots, downloading filess through powershell and many more. -narrative: Winter Vivern malware was found by cert ua that tried to download and run several powershell script on the - target host that will try to collect several files with specific file extensions like (.edb, .ems, .eme, .emz, .key, .pem, - .ovpn, .bat, .cer, .p12, .cfg, .log, .txt, .pdf, .doc, .docx, .xls, .xlsx, .rdg(=) in desktop directories, taking desktop - screenshots and further exfiltration through HTTP. It will also create a persistence mechanism such as scheduled task to - ensure persistence on the targeted host. +description: Utilize searches that enable you to detect and investigate unusual activities potentially related to the Winter Vivern malicious software. This includes examining multiple timeout executions, scheduled task creations, screenshots, and downloading files through PowerShell, among other indicators. + +Narrative: The Winter Vivern malware, identified by CERT UA, is designed to download and run multiple PowerShell scripts on targeted hosts. These scripts aim to gather a variety of files with specific extensions, including (.edb, .ems, .eme, .emz, .key, .pem, .ovpn, .bat, .cer, .p12, .cfg, .log, .txt, .pdf, .doc, .docx, .xls, .xlsx, and .rdg), primarily from desktop directories. In addition to this, the malware captures desktop screenshots and performs data exfiltration using HTTP. To maintain its presence on the targeted host, Winter Vivern also establishes a persistence mechanism, such as creating a scheduled task. references: - https://cert.gov.ua/article/3761023 tags: From ec53456c95f2627d5cf57f1da0b57ce85001eba2 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 13 Apr 2023 11:10:02 -0600 Subject: [PATCH 04/19] update --- stories/winter_vivern.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/stories/winter_vivern.yml b/stories/winter_vivern.yml index 5ba6d6e542..772838a631 100644 --- a/stories/winter_vivern.yml +++ b/stories/winter_vivern.yml @@ -4,8 +4,7 @@ version: 1 date: '2023-02-16' author: Teoderick Contreras, Splunk description: Utilize searches that enable you to detect and investigate unusual activities potentially related to the Winter Vivern malicious software. This includes examining multiple timeout executions, scheduled task creations, screenshots, and downloading files through PowerShell, among other indicators. - -Narrative: The Winter Vivern malware, identified by CERT UA, is designed to download and run multiple PowerShell scripts on targeted hosts. These scripts aim to gather a variety of files with specific extensions, including (.edb, .ems, .eme, .emz, .key, .pem, .ovpn, .bat, .cer, .p12, .cfg, .log, .txt, .pdf, .doc, .docx, .xls, .xlsx, and .rdg), primarily from desktop directories. In addition to this, the malware captures desktop screenshots and performs data exfiltration using HTTP. To maintain its presence on the targeted host, Winter Vivern also establishes a persistence mechanism, such as creating a scheduled task. +narrative: The Winter Vivern malware, identified by CERT UA, is designed to download and run multiple PowerShell scripts on targeted hosts. These scripts aim to gather a variety of files with specific extensions, including (.edb, .ems, .eme, .emz, .key, .pem, .ovpn, .bat, .cer, .p12, .cfg, .log, .txt, .pdf, .doc, .docx, .xls, .xlsx, and .rdg), primarily from desktop directories. In addition to this, the malware captures desktop screenshots and performs data exfiltration using HTTP. To maintain its presence on the targeted host, Winter Vivern also establishes a persistence mechanism, such as creating a scheduled task. references: - https://cert.gov.ua/article/3761023 tags: From 9dfc980e115bbd41158ce0cec9597706e1c67d2e Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 13 Apr 2023 19:14:46 +0200 Subject: [PATCH 05/19] Update any_powershell_downloadstring.yml --- detections/endpoint/any_powershell_downloadstring.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml index 4b505f0ac3..a615f7d163 100644 --- a/detections/endpoint/any_powershell_downloadstring.yml +++ b/detections/endpoint/any_powershell_downloadstring.yml @@ -36,6 +36,7 @@ tags: - Hermetic Wiper - Malicious PowerShell - HAFNIUM Group + asset_type: Endpoint confidence: 70 impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified From 6533a9b79ef7d61030eac94609a73dff23ef5a5e Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 13 Apr 2023 19:15:09 +0200 Subject: [PATCH 06/19] Update cmd_carry_out_string_command_parameter.yml --- detections/endpoint/cmd_carry_out_string_command_parameter.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml index 9a66f5815e..c36da25820 100644 --- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml +++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml @@ -44,6 +44,7 @@ tags: - Data Destruction - Living Off The Land - Azorult + asset_type: Endpoint automated_detection_testing: passed confidence: 50 cve: From df412ca5bb316f90394b531a3dec4782634702df Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 13 Apr 2023 19:15:34 +0200 Subject: [PATCH 07/19] Update powershell_fileless_script_contains_base64_encoded_content.yml --- ...owershell_fileless_script_contains_base64_encoded_content.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml index 1126e21f90..860f2b891d 100644 --- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml +++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml @@ -39,6 +39,7 @@ tags: - Malicious PowerShell - Winter Vivern - AsyncRAT + asset_type: Endpoint confidence: 80 context: - Source:Endpoint From 2b51ca5ac8c54cca327be6ad0c29d74b6cb547e9 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 13 Apr 2023 19:15:58 +0200 Subject: [PATCH 08/19] Update powershell_loading_dotnet_into_memory_via_reflection.yml --- .../powershell_loading_dotnet_into_memory_via_reflection.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml index dc0e7fb88f..600e15b489 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml @@ -41,6 +41,7 @@ tags: - AsyncRAT - Hermetic Wiper - Malicious PowerShell + asset_type: Endpoint confidence: 80 context: - Source:Endpoint From fa7ebebdb73e923a9234e3181bda0801f4044631 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 13 Apr 2023 11:29:07 -0600 Subject: [PATCH 09/19] status --- .../windows_exfiltration_over_c2_via_invoke_restmethod.yml | 1 + .../windows_exfiltration_over_c2_via_powershell_uploadstring.yml | 1 + detections/endpoint/windows_scheduled_task_created_via_xml.yml | 1 + detections/endpoint/windows_screen_capture_via_powershell.yml | 1 + 4 files changed, 4 insertions(+) diff --git a/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml b/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml index 5a2e7a2c66..b3f9fa77ca 100644 --- a/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml +++ b/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml @@ -3,6 +3,7 @@ id: 06ade821-f6fa-40d0-80af-15bc1d45b3ba version: 1 date: '2023-04-05' author: Teoderick Contreras, Splunk +status: production type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml b/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml index 073c117254..45a9975bdb 100644 --- a/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml +++ b/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml @@ -3,6 +3,7 @@ id: 59e8bf41-7472-412a-90d3-00f3afa452e9 version: 1 date: '2023-04-05' author: Teoderick Contreras, Splunk +status: production type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/windows_scheduled_task_created_via_xml.yml b/detections/endpoint/windows_scheduled_task_created_via_xml.yml index f10e688ae4..fe7285e7b1 100644 --- a/detections/endpoint/windows_scheduled_task_created_via_xml.yml +++ b/detections/endpoint/windows_scheduled_task_created_via_xml.yml @@ -3,6 +3,7 @@ id: 7e03b682-3965-4598-8e91-a60a40a3f7e4 version: 1 date: '2023-04-05' author: Teoderick Contreras, Splunk +status: production type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/windows_screen_capture_via_powershell.yml b/detections/endpoint/windows_screen_capture_via_powershell.yml index 187838cbf1..0c34f006e1 100644 --- a/detections/endpoint/windows_screen_capture_via_powershell.yml +++ b/detections/endpoint/windows_screen_capture_via_powershell.yml @@ -3,6 +3,7 @@ id: 5e0b1936-8f99-4399-8ee2-9edc5b32e170 version: 1 date: '2023-04-05' author: Teoderick Contreras, Splunk +status: production type: TTP datamodel: - Endpoint From 435f535119d39cc0ce1d75d2c2fb13a1d2a1e60d Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 13 Apr 2023 11:40:53 -0600 Subject: [PATCH 10/19] fixes --- ...ltration_over_c2_via_invoke_restmethod.yml | 25 +++++++------------ ...on_over_c2_via_powershell_uploadstring.yml | 21 ++++++---------- 2 files changed, 17 insertions(+), 29 deletions(-) diff --git a/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml b/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml index b3f9fa77ca..c8dd9daa71 100644 --- a/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml +++ b/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml @@ -5,8 +5,8 @@ date: '2023-04-05' author: Teoderick Contreras, Splunk status: production type: TTP -datamodel: -- Endpoint +data_source: + - Powershell 4104 description: The following analytic identifies the potential exfiltration of data using PowerShell's Invoke-RestMethod. This technique was observed in the Winter-Vivern malware, which uploads desktop screenshots and files from compromised or targeted hosts. Detecting this TTP can serve as a valuable indicator that a process is attempting to upload files to an external or internal URI link. We recommend examining the process, the files it is trying to upload, and the URL link or C2 destination where the data is being uploaded. search: '`powershell` EventCode=4104 ScriptBlockText = "*Invoke-RestMethod *" AND ScriptBlockText = "* -Uri *" AND ScriptBlockText = "* -Method *" AND ScriptBlockText = "* Post *" AND ScriptBlockText = "* -InFile *" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID @@ -24,24 +24,11 @@ tags: analytic_story: - Winter Vivern asset_type: Endpoint - cis20: - - CIS 3 - - CIS 5 - - CIS 16 confidence: 70 - context: - - Source:Endpoint - - Stage:Exfiltration - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml.log impact: 70 - kill_chain_phases: - - Command & Control message: A PowerShell script on $Computer$ is attempting to transfer files to a remote URL. mitre_attack_id: - T1041 - nist: - - DE.CM observable: - name: Computer type: Hostname @@ -58,4 +45,10 @@ tags: - UserID - EventCode risk_score: 49 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml b/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml index 45a9975bdb..1207c50026 100644 --- a/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml +++ b/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml @@ -5,8 +5,8 @@ date: '2023-04-05' author: Teoderick Contreras, Splunk status: production type: TTP -datamodel: -- Endpoint +data_source: + - Powershell 4104 description: The following analytic identifies potential data exfiltration using the PowerShell net.webclient command. This technique was observed in the Winter-Vivern malware, which uploads desktop screenshots and files from compromised or targeted hosts. Detecting this TTP can serve as a valuable indicator that a process is attempting to upload files to an external or internal URI link. We recommend examining the process, the files it is trying to upload, and the URL link or C2 destination where the data is being uploaded. search: '`powershell` EventCode=4104 ScriptBlockText = "*Net.webclient*" AND ScriptBlockText = "*.UploadString*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID @@ -24,24 +24,13 @@ tags: analytic_story: - Winter Vivern asset_type: Endpoint - cis20: - - CIS 3 - - CIS 5 - - CIS 16 confidence: 70 - context: - - Source:Endpoint - - Stage:Exfiltration - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_uploadstring/windows-powershell-xml.log impact: 70 kill_chain_phases: - Command & Control message: A PowerShell script on $Computer$ is attempting to transfer files to a remote URL. mitre_attack_id: - T1041 - nist: - - DE.CM observable: - name: Computer type: Hostname @@ -59,3 +48,9 @@ tags: - EventCode risk_score: 49 security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_uploadstring/windows-powershell-xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 19c67e3d85a3f979e5fe78f4fca4c390d7751a71 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 13 Apr 2023 11:16:43 -0700 Subject: [PATCH 11/19] fixup to match 4.0 --- ...script_contains_base64_encoded_content.yml | 18 +++++++------- ...ding_dotnet_into_memory_via_reflection.yml | 18 +++++++------- ...ltration_over_c2_via_invoke_restmethod.yml | 2 +- ...on_over_c2_via_powershell_uploadstring.yml | 4 +--- ...windows_scheduled_task_created_via_xml.yml | 24 +++++++------------ .../windows_screen_capture_via_powershell.yml | 19 +++++++-------- 6 files changed, 38 insertions(+), 47 deletions(-) diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml index 860f2b891d..7dac11fbc1 100644 --- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml +++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml @@ -3,8 +3,10 @@ id: 8acbc04c-c882-11eb-b060-acde48001122 version: 3 date: '2023-04-05' author: Michael Haag, Splunk +status: production type: TTP -datamodel: [] +data_source: +- Powershell 4104 description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output @@ -39,16 +41,8 @@ tags: - Malicious PowerShell - Winter Vivern - AsyncRAT - asset_type: Endpoint confidence: 80 - context: - - Source:Endpoint - - Stage:Execution - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/frombase64string.log impact: 70 - kill_chain_phases: - - Exploitation message: A suspicious powershell script contains base64 command in $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$ mitre_attack_id: @@ -74,3 +68,9 @@ tags: risk_score: 56 security_domain: endpoint asset_type: Endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/frombase64string.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml index 600e15b489..a66b43b617 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml @@ -3,8 +3,10 @@ id: 85bc3f30-ca28-11eb-bd21-acde48001122 version: 3 date: '2023-04-05' author: Michael Haag, Splunk +status: production type: TTP -datamodel: [] +data_source: +- Powershell 4104 description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output @@ -43,14 +45,7 @@ tags: - Malicious PowerShell asset_type: Endpoint confidence: 80 - context: - - Source:Endpoint - - Stage:Defense Evasion - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reflection.log impact: 70 - kill_chain_phases: - - Exploitation message: A suspicious powershell script contains reflective class assembly command in $ScriptBlockText$ to load .net code in memory with EventCode $EventCode$ in host $Computer$ @@ -79,4 +74,9 @@ tags: - EventCode risk_score: 56 security_domain: endpoint - asset_type: Endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reflection.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml b/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml index c8dd9daa71..2641701a1a 100644 --- a/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml +++ b/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk status: production type: TTP data_source: - - Powershell 4104 +- Powershell 4104 description: The following analytic identifies the potential exfiltration of data using PowerShell's Invoke-RestMethod. This technique was observed in the Winter-Vivern malware, which uploads desktop screenshots and files from compromised or targeted hosts. Detecting this TTP can serve as a valuable indicator that a process is attempting to upload files to an external or internal URI link. We recommend examining the process, the files it is trying to upload, and the URL link or C2 destination where the data is being uploaded. search: '`powershell` EventCode=4104 ScriptBlockText = "*Invoke-RestMethod *" AND ScriptBlockText = "* -Uri *" AND ScriptBlockText = "* -Method *" AND ScriptBlockText = "* Post *" AND ScriptBlockText = "* -InFile *" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID diff --git a/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml b/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml index 1207c50026..8fb28cdc9e 100644 --- a/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml +++ b/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk status: production type: TTP data_source: - - Powershell 4104 +- Powershell 4104 description: The following analytic identifies potential data exfiltration using the PowerShell net.webclient command. This technique was observed in the Winter-Vivern malware, which uploads desktop screenshots and files from compromised or targeted hosts. Detecting this TTP can serve as a valuable indicator that a process is attempting to upload files to an external or internal URI link. We recommend examining the process, the files it is trying to upload, and the URL link or C2 destination where the data is being uploaded. search: '`powershell` EventCode=4104 ScriptBlockText = "*Net.webclient*" AND ScriptBlockText = "*.UploadString*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID @@ -26,8 +26,6 @@ tags: asset_type: Endpoint confidence: 70 impact: 70 - kill_chain_phases: - - Command & Control message: A PowerShell script on $Computer$ is attempting to transfer files to a remote URL. mitre_attack_id: - T1041 diff --git a/detections/endpoint/windows_scheduled_task_created_via_xml.yml b/detections/endpoint/windows_scheduled_task_created_via_xml.yml index fe7285e7b1..83e75bee59 100644 --- a/detections/endpoint/windows_scheduled_task_created_via_xml.yml +++ b/detections/endpoint/windows_scheduled_task_created_via_xml.yml @@ -5,8 +5,8 @@ date: '2023-04-05' author: Teoderick Contreras, Splunk status: production type: TTP -datamodel: -- Endpoint +data_source: +- Sysmon Event ID 1 description: The following analytic identifies the creation of a scheduled task using schtasks.exe, with the flags -create being passed on the command-line along with an XML parameter. This technique has been associated with threat actors, adversaries, and red teamers seeking to gain persistence or achieve privilege escalation on targeted hosts. Notably, the Trickbot and Winter-Vivern malware have been observed employing this method, utilizing an XML file to create scheduled tasks. It is important to monitor and investigate such activity in order to mitigate potential security risks. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe Processes.process=*create* Processes.process="* /xml *" @@ -29,27 +29,14 @@ tags: analytic_story: - Winter Vivern asset_type: Endpoint - cis20: - - CIS 3 - - CIS 5 - - CIS 16 confidence: 70 - context: - - Source:Endpoint - - Stage:Execution - - Stage:Persistence - - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/scheduledtask/sysmon.log impact: 70 - kill_chain_phases: - - Exploitation message: A scheduled task process, $process_name$, with 'create' or 'delete' commands present in the command line. mitre_attack_id: - T1053.005 - T1053 - nist: - - DE.CM observable: - name: dest type: Hostname @@ -76,3 +63,10 @@ tags: - Processes.parent_process_id risk_score: 49 security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/scheduledtask/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true \ No newline at end of file diff --git a/detections/endpoint/windows_screen_capture_via_powershell.yml b/detections/endpoint/windows_screen_capture_via_powershell.yml index 0c34f006e1..ddc619a0b0 100644 --- a/detections/endpoint/windows_screen_capture_via_powershell.yml +++ b/detections/endpoint/windows_screen_capture_via_powershell.yml @@ -5,8 +5,8 @@ date: '2023-04-05' author: Teoderick Contreras, Splunk status: production type: TTP -datamodel: -- Endpoint +data_source: +- Powershell 4104 description: The following analytic identifies a potential PowerShell script that captures screen images on compromised or targeted hosts. This technique was observed in the Winter-Vivern malware, which attempts to capture desktop screens using a PowerShell script and send the images to its C2 server as part of its exfiltration strategy. This TTP serves as a useful indicator that a PowerShell process may be gathering desktop screenshots from a host system, potentially signaling malicious activity. search: '`powershell` EventCode=4104 ScriptBlockText = "*[Drawing.Graphics]::FromImage(*" AND ScriptBlockText = "*New-Object Drawing.Bitmap*" AND ScriptBlockText = "*.CopyFromScreen*" @@ -25,10 +25,6 @@ tags: analytic_story: - Winter Vivern asset_type: Endpoint - cis20: - - CIS 3 - - CIS 5 - - CIS 16 confidence: 70 context: - Source:Endpoint @@ -36,13 +32,9 @@ tags: dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml.log impact: 70 - kill_chain_phases: - - Exploitation message: A PowerShell script was identified possibly performing screen captures on $Computer$. mitre_attack_id: - T1113 - nist: - - DE.CM observable: - name: Computer type: Hostname @@ -60,3 +52,10 @@ tags: - EventCode risk_score: 49 security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog + update_timestamp: true \ No newline at end of file From 5ebf3d64849dba05a01480039b0df40d3c7fe25c Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 13 Apr 2023 11:19:19 -0700 Subject: [PATCH 12/19] remove tests --- ...ltration_over_c2_via_invoke_restmethod.test.yml | 14 -------------- ...on_over_c2_via_powershell_uploadstring.test.yml | 13 ------------- ...windows_scheduled_task_created_via_xml.test.yml | 13 ------------- .../windows_screen_capture_via_powershell.test.yml | 13 ------------- 4 files changed, 53 deletions(-) delete mode 100644 tests/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.test.yml delete mode 100644 tests/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.test.yml delete mode 100644 tests/endpoint/windows_scheduled_task_created_via_xml.test.yml delete mode 100644 tests/endpoint/windows_screen_capture_via_powershell.test.yml diff --git a/tests/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.test.yml b/tests/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.test.yml deleted file mode 100644 index b64f8278b4..0000000000 --- a/tests/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.test.yml +++ /dev/null @@ -1,14 +0,0 @@ -name: Windows Exfiltration Over C2 Via Invoke RestMethod Unit Test -tests: -- name: Windows Exfiltration Over C2 Via Invoke RestMethod - file: endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: windows-powershell-xml.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml.log - source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: xmlwineventlog - update_timestamp: true - diff --git a/tests/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.test.yml b/tests/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.test.yml deleted file mode 100644 index 2ed8bb6025..0000000000 --- a/tests/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.test.yml +++ /dev/null @@ -1,13 +0,0 @@ -name: Windows Exfiltration Over C2 Via Powershell UploadString Unit Test -tests: -- name: Windows Exfiltration Over C2 Via Powershell UploadString - file: endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: windows-powershell-xml.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_uploadstring/windows-powershell-xml.log - source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/tests/endpoint/windows_scheduled_task_created_via_xml.test.yml b/tests/endpoint/windows_scheduled_task_created_via_xml.test.yml deleted file mode 100644 index 77afd5d70c..0000000000 --- a/tests/endpoint/windows_scheduled_task_created_via_xml.test.yml +++ /dev/null @@ -1,13 +0,0 @@ -name: Windows Scheduled Task Created Via XML Unit Test -tests: -- name: Windows Scheduled Task Created Via XML - file: endpoint/windows_scheduled_task_created_via_xml.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/scheduledtask/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/tests/endpoint/windows_screen_capture_via_powershell.test.yml b/tests/endpoint/windows_screen_capture_via_powershell.test.yml deleted file mode 100644 index 36cd1c9711..0000000000 --- a/tests/endpoint/windows_screen_capture_via_powershell.test.yml +++ /dev/null @@ -1,13 +0,0 @@ -name: Windows Screen Capture Via Powershell Unit Test -tests: -- name: Windows Screen Capture Via Powershell - file: endpoint/windows_screen_capture_via_powershell.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: windows-powershell-xml.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml.log - source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: xmlwineventlog - update_timestamp: true From d460df3354ae67a2c216b265062829144c42e538 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 14 Apr 2023 10:33:19 +0200 Subject: [PATCH 13/19] Update any_powershell_downloadstring.yml --- detections/endpoint/any_powershell_downloadstring.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml index a615f7d163..5a15de9e89 100644 --- a/detections/endpoint/any_powershell_downloadstring.yml +++ b/detections/endpoint/any_powershell_downloadstring.yml @@ -36,6 +36,7 @@ tags: - Hermetic Wiper - Malicious PowerShell - HAFNIUM Group + - Data Destruction asset_type: Endpoint confidence: 70 impact: 80 From 53b7dc49e91c7f16b022e4a33cfe8cfb214f6f43 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 14 Apr 2023 10:34:44 +0200 Subject: [PATCH 14/19] Update cmd_carry_out_string_command_parameter.yml --- detections/endpoint/cmd_carry_out_string_command_parameter.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml index c36da25820..049ae23f0e 100644 --- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml +++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml @@ -44,6 +44,7 @@ tags: - Data Destruction - Living Off The Land - Azorult + - Data Destruction asset_type: Endpoint automated_detection_testing: passed confidence: 50 From 60ec2a1c2c606aeb22561e0a71d2d4b23f33e2da Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 14 Apr 2023 10:35:54 +0200 Subject: [PATCH 15/19] Update powershell_fileless_script_contains_base64_encoded_content.yml --- ...ershell_fileless_script_contains_base64_encoded_content.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml index 7dac11fbc1..21772ba8f0 100644 --- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml +++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml @@ -41,6 +41,7 @@ tags: - Malicious PowerShell - Winter Vivern - AsyncRAT + - Data Destruction confidence: 80 impact: 70 message: A suspicious powershell script contains base64 command in $ScriptBlockText$ @@ -73,4 +74,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/frombase64string.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: xmlwineventlog \ No newline at end of file + sourcetype: xmlwineventlog From 357de299b35ca51c775eca585b798c68568aa47c Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 14 Apr 2023 10:36:29 +0200 Subject: [PATCH 16/19] Update powershell_loading_dotnet_into_memory_via_reflection.yml --- .../powershell_loading_dotnet_into_memory_via_reflection.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml index a66b43b617..8a03336f65 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml @@ -43,6 +43,7 @@ tags: - AsyncRAT - Hermetic Wiper - Malicious PowerShell + - Data Destruction asset_type: Endpoint confidence: 80 impact: 70 @@ -79,4 +80,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reflection.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: xmlwineventlog \ No newline at end of file + sourcetype: xmlwineventlog From bf4daef2cae9a7a80a47f2de49b7e7e50b16c2f1 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 14 Apr 2023 10:38:20 +0200 Subject: [PATCH 17/19] Update winevent_scheduled_task_created_within_public_path.yml --- .../winevent_scheduled_task_created_within_public_path.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml index 0ca0986712..8255cb753a 100644 --- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -50,6 +50,7 @@ tags: - CISA AA22-257A - Industroyer2 - Active Directory Lateral Movement + - Data Destruction asset_type: Endpoint confidence: 100 impact: 70 From e1c4580b9c4a9a6b1fb77da179daa6042db0174b Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 14 Apr 2023 10:39:01 +0200 Subject: [PATCH 18/19] Update winevent_windows_task_scheduler_event_action_started.yml --- .../winevent_windows_task_scheduler_event_action_started.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml index 2ef90145ad..3bc6e5026d 100644 --- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml +++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml @@ -38,6 +38,7 @@ tags: - IcedID - CISA AA22-257A - Industroyer2 + - Data Destruction asset_type: Endpoint confidence: 100 impact: 80 From 033c45858cb78e6c1ecefb7455735769228b94fa Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 14 Apr 2023 10:45:52 +0200 Subject: [PATCH 19/19] Update winevent_windows_task_scheduler_event_action_started.yml --- .../winevent_windows_task_scheduler_event_action_started.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml index 3bc6e5026d..d34328ff6b 100644 --- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml +++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml @@ -38,6 +38,7 @@ tags: - IcedID - CISA AA22-257A - Industroyer2 + - Sandworm Tools - Data Destruction asset_type: Endpoint confidence: 100