diff --git a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml new file mode 100644 index 0000000000..9a1f61702a --- /dev/null +++ b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml @@ -0,0 +1,55 @@ +name: DNS Exfiltration Using Nslookup App +id: 2452e632-9e0d-11eb-bacd-acde48001122 +version: 1 +date: '2021-04-15' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is to detect potential DNS exfiltration using nslookup application. + This technique are seen in couple of malware and APT group to exfiltrated collected + data in a infected machine or infected network. This detection is looking for unique + use of nslookup where it tries to use specific record type, TXT, A, AAAA, that + are commonly used by attacker and also the retry parameter which is designed to + query C2 DNS multiple tries. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id values(Processes.parent_process) + as parent_process count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "nslookup.exe" Processes.process = "*-querytype=*" + OR Processes.process="*-qt=*" OR Processes.process="*-q=*" OR Processes.process="-type=*" + OR Processes.process="*-retry=*" by Processes.dest Processes.user Processes.process_name | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dns_exfiltration_using_nslookup_app_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances of nslookup.exe may be used. +known_false_positives: admin nslookup usage +references: +- https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html +- https://www.varonis.com/blog/dns-tunneling/ +- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ +tags: + analytic_story: + - Suspicious DNS Traffic + - Dynamic DNS + - Command and Control + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1048 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml new file mode 100644 index 0000000000..eec6b43974 --- /dev/null +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -0,0 +1,54 @@ +name: Excessive Usage of NSLOOKUP App +id: 0a69fdaa-a2b8-11eb-b16d-acde48001122 +version: 1 +date: '2021-04-21' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is to detect potential DNS exfiltration using nslookup application. + This technique are seen in couple of malware and APT group to exfiltrated collected + data in a infected machine or infected network. This detection is looking for unique + use of nslookup where it tries to use specific record type (TXT, A, AAAA) that + are commonly used by attacker and also the retry parameter which is designed to + query C2 DNS multiple tries. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id values(Processes.parent_process) + as parent_process count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "nslookup.exe" by Processes.dest Processes.user Processes.process_name + | where count >= 30 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `excessive_usage_of_nslookup_app_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances of nslookup.exe may be used. +known_false_positives: unknown +references: +- https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html +- https://www.varonis.com/blog/dns-tunneling/ +- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ +tags: + analytic_story: + - Suspicious DNS Traffic + - Dynamic DNS + - Command and Control + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1048 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log diff --git a/detections/network/multiple_archive_files_http_post_traffic.yml b/detections/network/multiple_archive_files_http_post_traffic.yml new file mode 100644 index 0000000000..7f639622c0 --- /dev/null +++ b/detections/network/multiple_archive_files_http_post_traffic.yml @@ -0,0 +1,57 @@ +name: Multiple Archive Files Http Post Traffic +id: 4477f3ea-a28f-11eb-b762-acde48001122 +version: 1 +date: '2021-04-21' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Network_Traffic +description: This search is designed to detect high frequency of archive files data exfiltration + through HTTP POST method protocol. This are one of the common techniques used by + APT or trojan spy after doing the data collection like screenshot, recording, sensitive + data to the infected machines. The attacker may execute archiving command to the + collected data, save it a temp folder with a hidden attribute then send it to its + C2 through HTTP POST. Sometimes adversaries will rename the archive files or encode/encrypt to + cover their tracks. This detection can detect a renamed archive files transfer to HTTP + POST since it checks the request body header. Unfortunately this detection cannot + support archive that was encrypted or encoded before doing the exfiltration. +search: '`stream_http` http_method=POST |eval archive_hdr1=substr(form_data,1,2) | + eval archive_hdr2 = substr(form_data,1,4) |stats values(form_data) as http_request_body + min(_time) as firstTime max(_time) as lastTime count by http_method http_user_agent + uri_path url bytes_in bytes_out archive_hdr1 archive_hdr2 |where count >20 AND (archive_hdr1 + = "7z" OR archive_hdr1 = "PK" OR archive_hdr2="Rar!") | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `multiple_archive_files_http_post_traffic_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the stream HTTP logs or network logs that catch network traffic. Make + sure that the http-request-body, payload, or request field is enabled in stream + http configuration. +known_false_positives: Normal archive transfer via HTTP protocol may trip this detection. +references: +- https://attack.mitre.org/techniques/T1560/001/ +- https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html +- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ +tags: + analytic_story: + - Command and Control + kill_chain_phases: + - Exfiltration + mitre_attack_id: + - T1048.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - http_method + - http_user_agent + - uri_path + - url + - bytes_in + - bytes_out + - archive_hdr1 + - archive_hdr2 + security_domain: network + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/archive_http_post/stream_http_events.log diff --git a/detections/network/plain_http_post_exfiltrated_data.yml b/detections/network/plain_http_post_exfiltrated_data.yml new file mode 100644 index 0000000000..bc4f17ec74 --- /dev/null +++ b/detections/network/plain_http_post_exfiltrated_data.yml @@ -0,0 +1,45 @@ +name: Plain HTTP POST Exfiltrated Data +id: e2b36208-a364-11eb-8909-acde48001122 +version: 1 +date: '2021-04-22' +author: Teoderick Contreras, Splunk +type: batch +datamodel: [] +description: This search is to detect potential plain HTTP POST method data exfiltration. + This network traffic is commonly used by trickbot, trojanspy, keylogger or APT adversary + where arguments or commands are sent in plain text to the remote C2 server using HTTP POST method as part of data + exfiltration. +search: '`stream_http` http_method=POST form_data IN ("*wermgr.exe*","*svchost.exe*", + "*name=\"proclist\"*","*ipconfig*", "*name=\"sysinfo\"*", "*net view*") |stats values(form_data) + as http_request_body min(_time) as firstTime max(_time) as lastTime count by http_method + http_user_agent uri_path url bytes_in bytes_out | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `plain_http_post_exfiltrated_data_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the stream HTTP logs or network logs that catch network traffic. Make + sure that the http-request-body, payload, or request field is enabled. +known_false_positives: unknown +references: +- https://blog.talosintelligence.com/2020/03/trickbot-primer.html +tags: + analytic_story: + - Command and Control + kill_chain_phases: + - Exfiltration + mitre_attack_id: + - T1048.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - http_method + - http_user_agent + - uri_path + - url + - bytes_in + - bytes_out + security_domain: network + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/plain_exfil_data/stream_http_events.log diff --git a/tests/endpoint/dns_exfiltration_using_nslookup_app.test.yml b/tests/endpoint/dns_exfiltration_using_nslookup_app.test.yml new file mode 100644 index 0000000000..ff76336158 --- /dev/null +++ b/tests/endpoint/dns_exfiltration_using_nslookup_app.test.yml @@ -0,0 +1,12 @@ +name: DNS Exfiltration Using Nslookup App Unit Test +tests: +- name: DNS Exfiltration Using Nslookup App + file: endpoint/dns_exfiltration_using_nslookup_app.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/excessive_usage_of_nslookup_app.test.yml b/tests/endpoint/excessive_usage_of_nslookup_app.test.yml new file mode 100644 index 0000000000..632b5978c7 --- /dev/null +++ b/tests/endpoint/excessive_usage_of_nslookup_app.test.yml @@ -0,0 +1,12 @@ +name: Excessive Usage of NSLOOKUP App Unit Test +tests: +- name: Excessive Usage of NSLOOKUP App + file: endpoint/excessive_usage_of_nslookup_app.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/network/multiple_archive_files_http_post_traffic.test.yml b/tests/network/multiple_archive_files_http_post_traffic.test.yml new file mode 100644 index 0000000000..3893d51e85 --- /dev/null +++ b/tests/network/multiple_archive_files_http_post_traffic.test.yml @@ -0,0 +1,14 @@ +name: Multiple Archive Files Http Post Traffic Unit Test +tests: +- name: Multiple Archive Files Http Post Traffic + file: network/multiple_archive_files_http_post_traffic.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: stream_http_events.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/archive_http_post/stream_http_events.log + source: stream + sourcetype: stream:http + + \ No newline at end of file diff --git a/tests/network/plain_http_post_exfiltrated_data.test.yml b/tests/network/plain_http_post_exfiltrated_data.test.yml new file mode 100644 index 0000000000..f71b877ea1 --- /dev/null +++ b/tests/network/plain_http_post_exfiltrated_data.test.yml @@ -0,0 +1,14 @@ +name: Plain HTTP POST Exfiltrated Data Unit Test +tests: +- name: Plain HTTP POST Exfiltrated Data + file: network/plain_http_post_exfiltrated_data.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: stream_http_events.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/plain_exfil_data/stream_http_events.log + source: stream + sourcetype: stream:http + +