Branch was auto-updated.

detections/endpoint/dns_exfiltration_using_nslookup_app.yml

@@ -0,0 +1,55 @@
+name: DNS Exfiltration Using Nslookup App
+id: 2452e632-9e0d-11eb-bacd-acde48001122
+version: 1
+date: '2021-04-15'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: this search is to detect potential DNS exfiltration using nslookup application.
+  This technique are seen in couple of malware and APT group to exfiltrated collected
+  data in a infected machine or infected network. This detection is looking for unique
+  use of nslookup where it tries to use specific record type, TXT, A, AAAA, that
+  are commonly used by attacker and also the retry parameter which is designed to
+  query C2 DNS multiple tries.
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process
+  values(Processes.process_id) as process_id values(Processes.parent_process)
+  as parent_process count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where Processes.process_name = "nslookup.exe" Processes.process = "*-querytype=*"
+  OR Processes.process="*-qt=*" OR Processes.process="*-q=*" OR Processes.process="-type=*"
+  OR Processes.process="*-retry=*" by Processes.dest Processes.user Processes.process_name  | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dns_exfiltration_using_nslookup_app_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances of nslookup.exe may be used.
+known_false_positives: admin nslookup usage
+references:
+- https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html
+- https://www.varonis.com/blog/dns-tunneling/
+- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
+tags:
+  analytic_story:
+  - Suspicious DNS Traffic
+  - Dynamic DNS
+  - Command and Control
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1048
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log

detections/endpoint/excessive_usage_of_nslookup_app.yml

@@ -0,0 +1,54 @@
+name: Excessive Usage of NSLOOKUP App
+id: 0a69fdaa-a2b8-11eb-b16d-acde48001122
+version: 1
+date: '2021-04-21'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: this search is to detect potential DNS exfiltration using nslookup application.
+  This technique are seen in couple of malware and APT group to exfiltrated collected
+  data in a infected machine or infected network. This detection is looking for unique
+  use of nslookup where it tries to use specific record type (TXT, A, AAAA) that
+  are commonly used by attacker and also the retry parameter which is designed to
+  query C2 DNS multiple tries.
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process
+  values(Processes.process_id) as process_id values(Processes.parent_process)
+  as parent_process count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where Processes.process_name = "nslookup.exe" by Processes.dest Processes.user Processes.process_name
+  | where count >= 30 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`| `excessive_usage_of_nslookup_app_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances of nslookup.exe may be used.
+known_false_positives: unknown
+references:
+- https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html
+- https://www.varonis.com/blog/dns-tunneling/
+- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
+tags:
+  analytic_story:
+  - Suspicious DNS Traffic
+  - Dynamic DNS
+  - Command and Control
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1048
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log

detections/network/multiple_archive_files_http_post_traffic.yml

@@ -0,0 +1,57 @@
+name: Multiple Archive Files Http Post Traffic
+id: 4477f3ea-a28f-11eb-b762-acde48001122
+version: 1
+date: '2021-04-21'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Network_Traffic
+description: This search is designed to detect high frequency of archive files data exfiltration
+  through HTTP POST method protocol. This are one of the common techniques used by
+  APT or trojan spy after doing the data collection like screenshot, recording, sensitive
+  data to the infected machines. The attacker may execute archiving command to the
+  collected data, save it a temp folder with a hidden attribute then send it to its
+  C2 through HTTP POST. Sometimes adversaries will rename the archive files or encode/encrypt to
+  cover their tracks. This detection can detect a renamed archive files transfer to HTTP
+  POST since it checks the request body header. Unfortunately this detection cannot
+  support archive that was encrypted or encoded before doing the exfiltration.
+search: '`stream_http` http_method=POST |eval archive_hdr1=substr(form_data,1,2) |
+  eval archive_hdr2 = substr(form_data,1,4) |stats values(form_data) as http_request_body
+  min(_time) as firstTime max(_time) as lastTime count by http_method http_user_agent
+  uri_path url bytes_in bytes_out archive_hdr1 archive_hdr2 |where count >20 AND (archive_hdr1
+  = "7z" OR archive_hdr1 = "PK" OR archive_hdr2="Rar!") | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `multiple_archive_files_http_post_traffic_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the stream HTTP logs or network logs that catch network traffic. Make
+  sure that the http-request-body, payload, or request field is enabled in stream
+  http configuration.
+known_false_positives: Normal archive transfer via HTTP protocol may trip this detection.
+references:
+- https://attack.mitre.org/techniques/T1560/001/
+- https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html
+- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
+tags:
+  analytic_story:
+  - Command and Control
+  kill_chain_phases:
+  - Exfiltration
+  mitre_attack_id:
+  - T1048.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - http_method
+  - http_user_agent
+  - uri_path
+  - url
+  - bytes_in
+  - bytes_out
+  - archive_hdr1
+  - archive_hdr2
+  security_domain: network
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/archive_http_post/stream_http_events.log

detections/network/plain_http_post_exfiltrated_data.yml

@@ -0,0 +1,45 @@
+name: Plain HTTP POST Exfiltrated Data
+id: e2b36208-a364-11eb-8909-acde48001122
+version: 1
+date: '2021-04-22'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel: []
+description: This search is to detect potential plain HTTP POST method data exfiltration.
+  This network traffic is commonly used by trickbot, trojanspy, keylogger or APT adversary
+  where arguments or commands are sent in plain text to the remote C2 server using HTTP POST method as part of data
+  exfiltration.
+search: '`stream_http` http_method=POST form_data IN ("*wermgr.exe*","*svchost.exe*",
+  "*name=\"proclist\"*","*ipconfig*", "*name=\"sysinfo\"*", "*net view*") |stats values(form_data)
+  as http_request_body min(_time) as firstTime max(_time) as lastTime count by http_method
+  http_user_agent uri_path url bytes_in bytes_out | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `plain_http_post_exfiltrated_data_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the stream HTTP logs or network logs that catch network traffic. Make
+  sure that the http-request-body, payload, or request field is enabled.
+known_false_positives: unknown
+references:
+- https://blog.talosintelligence.com/2020/03/trickbot-primer.html
+tags:
+  analytic_story:
+  - Command and Control
+  kill_chain_phases:
+  - Exfiltration
+  mitre_attack_id:
+  - T1048.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - http_method
+  - http_user_agent
+  - uri_path
+  - url
+  - bytes_in
+  - bytes_out
+  security_domain: network
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/plain_exfil_data/stream_http_events.log

tests/endpoint/dns_exfiltration_using_nslookup_app.test.yml

@@ -0,0 +1,12 @@
+name: DNS Exfiltration Using Nslookup App Unit Test
+tests:
+- name: DNS Exfiltration Using Nslookup App
+  file: endpoint/dns_exfiltration_using_nslookup_app.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/excessive_usage_of_nslookup_app.test.yml

@@ -0,0 +1,12 @@
+name: Excessive Usage of NSLOOKUP App Unit Test
+tests:
+- name: Excessive Usage of NSLOOKUP App
+  file: endpoint/excessive_usage_of_nslookup_app.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/network/multiple_archive_files_http_post_traffic.test.yml

@@ -0,0 +1,14 @@
+name: Multiple Archive Files Http Post Traffic Unit Test
+tests:
+- name: Multiple Archive Files Http Post Traffic
+  file: network/multiple_archive_files_http_post_traffic.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: stream_http_events.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/archive_http_post/stream_http_events.log
+    source: stream
+    sourcetype: stream:http
+
+    

tests/network/plain_http_post_exfiltrated_data.test.yml

@@ -0,0 +1,14 @@
+name: Plain HTTP POST Exfiltrated Data Unit Test
+tests:
+- name: Plain HTTP POST Exfiltrated Data
+  file: network/plain_http_post_exfiltrated_data.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: stream_http_events.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/plain_exfil_data/stream_http_events.log
+    source: stream
+    sourcetype: stream:http
+
+