From 162b9f0cc305c222641acbd23970600389ad528e Mon Sep 17 00:00:00 2001 From: tcontreras Date: Thu, 22 Apr 2021 15:37:09 +0200 Subject: [PATCH 01/14] net_exfil --- .../dns_exfiltration_using_nslookup_app.yml | 52 ++++++++++++++++++ .../excessive_usage_of_nslookup_app.yml | 50 +++++++++++++++++ ...ltiple_archive_files_http_post_traffic.yml | 53 +++++++++++++++++++ .../plain_http_post_exfiltrated_data.yml | 44 +++++++++++++++ ...s_exfiltration_using_nslookup_app.test.yml | 12 +++++ .../excessive_usage_of_nslookup_app.test.yml | 12 +++++ ...e_archive_files_http_post_traffic.test.yml | 12 +++++ .../plain_http_post_exfiltrated_data.test.yml | 14 +++++ 8 files changed, 249 insertions(+) create mode 100644 detections/endpoint/dns_exfiltration_using_nslookup_app.yml create mode 100644 detections/endpoint/excessive_usage_of_nslookup_app.yml create mode 100644 detections/network/multiple_archive_files_http_post_traffic.yml create mode 100644 detections/network/plain_http_post_exfiltrated_data.yml create mode 100644 tests/endpoint/dns_exfiltration_using_nslookup_app.test.yml create mode 100644 tests/endpoint/excessive_usage_of_nslookup_app.test.yml create mode 100644 tests/network/multiple_archive_files_http_post_traffic.test.yml create mode 100644 tests/network/plain_http_post_exfiltrated_data.test.yml diff --git a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml new file mode 100644 index 0000000000..8db0ac6a6a --- /dev/null +++ b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml @@ -0,0 +1,52 @@ +name: DNS Exfiltration Using Nslookup App +id: 2452e632-9e0d-11eb-bacd-acde48001122 +version: 1 +date: '2021-04-15' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is to detect potential dns exfiltration using nslookup application. This technique are seen in couple of malware and + APT group to exfiltrated collected data in a infected machine or infected network. + This detection is looking for unique use of nslookup where it tries to use specific record type like (TXT, A, AAAA) that are commonly used by attacker + and also the retry parameter which is designed to query C2 DNS multiple tries. +search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline values(Processes.process_id) as nslookup_procid + values(Processes.parent_process) as parent_cmdline count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "nslookup.exe" Processes.process = "*-querytype=*" OR Processes.process="*-qt=*" + OR Processes.process="*-q=*" OR Processes.process="-type=*" OR Processes.process="*-retry=*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `dns_exfiltration_using_nslookup_app_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances of nslookup.exe may be used. +known_false_positives: admin nslookup usage +references: +- https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html +- https://www.varonis.com/blog/dns-tunneling/ +- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ +tags: + analytic_story: + - Suspicious DNS Traffic + - Dynamic DNS + - Command and Control + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1048 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml new file mode 100644 index 0000000000..8c440fd9cf --- /dev/null +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -0,0 +1,50 @@ +name: Excessive Usage of NSLOOKUP App +id: 0a69fdaa-a2b8-11eb-b16d-acde48001122 +version: 1 +date: '2021-04-21' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is to detect potential dns exfiltration using nslookup application. This technique are seen in couple of malware and + APT group to exfiltrated collected data in a infected machine or infected network. + This detection is looking for unique use of nslookup where it tries to use specific record type like (TXT, A, AAAA) that are commonly used by attacker + and also the retry parameter which is designed to query C2 DNS multiple tries. +search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline values(Processes.process_id) as nslookup_procid + values(Processes.parent_process) as parent_cmdline count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "nslookup.exe" + by Processes.dest Processes.user Processes.process_name | where count >= 30 + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `excessive_usage_of_nslookup_app_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances of nslookup.exe may be used. +known_false_positives: unknown +references: +- https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html +- https://www.varonis.com/blog/dns-tunneling/ +- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ +tags: + analytic_story: + - Suspicious DNS Traffic + - Dynamic DNS + - Command and Control + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1048 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + security_domain: endpoint \ No newline at end of file diff --git a/detections/network/multiple_archive_files_http_post_traffic.yml b/detections/network/multiple_archive_files_http_post_traffic.yml new file mode 100644 index 0000000000..e3ad6fef26 --- /dev/null +++ b/detections/network/multiple_archive_files_http_post_traffic.yml @@ -0,0 +1,53 @@ +name: Multiple Archive Files Http Post Traffic +id: 4477f3ea-a28f-11eb-b762-acde48001122 +version: 1 +date: '2021-04-21' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Network_Traffic +description: This search is designed to detect high frequecy archive files data exfiltration through HTTP POST method protocol. + This are one of the common techniques used by APT or trojan spy after doing the data collection like screenshot, recording, sensitive data to the infected machines. + The attacker may execute archiving command to the collected data, save it a temp folder with a hidden attribute then send it to its c2 through http post. + Sometimes it rename the archive files or encode/encrypt to cover it tracks. + + This detection can detect a renamed archive files transfer to HTTP POST since it checks the request body header. Unfortunately this detection cannot support archive that + was encrypted or encoded before doing the exfiltration. +search: '`stream_http` http_method=POST + |eval archive_hdr1=substr(form_data,1,2) + | eval archive_hdr2 = substr(form_data,1,4) + |stats values(form_data) as http_request_body min(_time) as firstTime max(_time) as lastTime count by http_method http_user_agent uri_path url bytes_in bytes_out archive_hdr1 archive_hdr2 + |where count >20 AND (archive_hdr1 = "7z" OR archive_hdr1 = "PK" OR archive_hdr2="Rar!") + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `multiple_archive_files_http_post_traffic_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the stream HTTP logs or network logs that catch network traffic. + Make sure that the http-request-body, payload, or request field is enabled in stream http configuration. +known_false_positives: normal archive transfer to HTTP protocol +references: + - https://attack.mitre.org/techniques/T1560/001/ + - https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html + - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ +tags: + analytic_story: + - Command and Control + kill_chain_phases: + - Exfiltration + mitre_attack_id: + - T1048.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - http_method + - http_user_agent + - uri_path + - url + - bytes_in + - bytes_out + - archive_hdr1 + - archive_hdr2 + security_domain: network \ No newline at end of file diff --git a/detections/network/plain_http_post_exfiltrated_data.yml b/detections/network/plain_http_post_exfiltrated_data.yml new file mode 100644 index 0000000000..958669c292 --- /dev/null +++ b/detections/network/plain_http_post_exfiltrated_data.yml @@ -0,0 +1,44 @@ +name: Plain HTTP POST Exfiltrated Data +id: e2b36208-a364-11eb-8909-acde48001122 +version: 1 +date: '2021-04-22' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Network_Traffic +description: This search is to detect potential plain http post method data exfiltration. + This network traffic is commonly used by trickbot, trojanspy, keylogger or APT attacker where they send a plain txt file + C2 server through http post method as part of data exfiltration. +search: '`stream_http` http_method=POST + form_data IN ("*wermgr.exe*","*svchost.exe*", "*name=\"proclist\"*","*ipconfig*", "*name=\"sysinfo\"*", "*net view*") + |stats values(form_data) as http_request_body min(_time) as firstTime max(_time) as lastTime count + by http_method http_user_agent uri_path url bytes_in bytes_out + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `plain_http_post_exfiltrated_data_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the stream HTTP logs or network logs that catch network traffic. + Make sure that the http-request-body, payload, or request field is enabled. +known_false_positives: unknown +references: +- https://blog.talosintelligence.com/2020/03/trickbot-primer.html +tags: + analytic_story: + - Command and Control + kill_chain_phases: + - Exfiltration + mitre_attack_id: + - T1048.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - http_method + - http_user_agent + - uri_path + - url + - bytes_in + - bytes_out + security_domain: network \ No newline at end of file diff --git a/tests/endpoint/dns_exfiltration_using_nslookup_app.test.yml b/tests/endpoint/dns_exfiltration_using_nslookup_app.test.yml new file mode 100644 index 0000000000..ff76336158 --- /dev/null +++ b/tests/endpoint/dns_exfiltration_using_nslookup_app.test.yml @@ -0,0 +1,12 @@ +name: DNS Exfiltration Using Nslookup App Unit Test +tests: +- name: DNS Exfiltration Using Nslookup App + file: endpoint/dns_exfiltration_using_nslookup_app.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/excessive_usage_of_nslookup_app.test.yml b/tests/endpoint/excessive_usage_of_nslookup_app.test.yml new file mode 100644 index 0000000000..632b5978c7 --- /dev/null +++ b/tests/endpoint/excessive_usage_of_nslookup_app.test.yml @@ -0,0 +1,12 @@ +name: Excessive Usage of NSLOOKUP App Unit Test +tests: +- name: Excessive Usage of NSLOOKUP App + file: endpoint/excessive_usage_of_nslookup_app.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/network/multiple_archive_files_http_post_traffic.test.yml b/tests/network/multiple_archive_files_http_post_traffic.test.yml new file mode 100644 index 0000000000..ecda4cc4d2 --- /dev/null +++ b/tests/network/multiple_archive_files_http_post_traffic.test.yml @@ -0,0 +1,12 @@ +name: Multiple Archive Files Http Post Traffic Unit Test +tests: +- name: Multiple Archive Files Http Post Traffic + file: network/multiple_archive_files_http_post_traffic.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: stream_http_events.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/plain_exfil_data/stream_http_events.log + source: stream:http + sourcetype: stream:http \ No newline at end of file diff --git a/tests/network/plain_http_post_exfiltrated_data.test.yml b/tests/network/plain_http_post_exfiltrated_data.test.yml new file mode 100644 index 0000000000..91ad3ce097 --- /dev/null +++ b/tests/network/plain_http_post_exfiltrated_data.test.yml @@ -0,0 +1,14 @@ +name: Plain HTTP POST Exfiltrated Data Unit Test +tests: +- name: Plain HTTP POST Exfiltrated Data + file: network/plain_http_post_exfiltrated_data.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: stream_http_events.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/archive_http_post/stream_http_events.log + source: stream:http + sourcetype: stream:http + + From 6ed8a29e4e568ffc1f7b6fe0e9e44e9b9a8b0240 Mon Sep 17 00:00:00 2001 From: tcontreras Date: Thu, 22 Apr 2021 15:48:54 +0200 Subject: [PATCH 02/14] fix_error --- .../network/multiple_archive_files_http_post_traffic.yml | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/detections/network/multiple_archive_files_http_post_traffic.yml b/detections/network/multiple_archive_files_http_post_traffic.yml index e3ad6fef26..a86ab1b6e4 100644 --- a/detections/network/multiple_archive_files_http_post_traffic.yml +++ b/detections/network/multiple_archive_files_http_post_traffic.yml @@ -9,10 +9,8 @@ datamodel: description: This search is designed to detect high frequecy archive files data exfiltration through HTTP POST method protocol. This are one of the common techniques used by APT or trojan spy after doing the data collection like screenshot, recording, sensitive data to the infected machines. The attacker may execute archiving command to the collected data, save it a temp folder with a hidden attribute then send it to its c2 through http post. - Sometimes it rename the archive files or encode/encrypt to cover it tracks. - - This detection can detect a renamed archive files transfer to HTTP POST since it checks the request body header. Unfortunately this detection cannot support archive that - was encrypted or encoded before doing the exfiltration. + Sometimes it rename the archive files or encode/encrypt to cover it tracks. This detection can detect a renamed archive files transfer to HTTP POST since it checks the request body header. + Unfortunately this detection cannot support archive that was encrypted or encoded before doing the exfiltration. search: '`stream_http` http_method=POST |eval archive_hdr1=substr(form_data,1,2) | eval archive_hdr2 = substr(form_data,1,4) From 9bb6de8ed247bd0b9123089a715bd7dd77f3b476 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 22 Apr 2021 15:29:40 +0000 Subject: [PATCH 03/14] Added detection testing service results inDNS Exfiltration Using Nslookup App --- .../dns_exfiltration_using_nslookup_app.yml | 32 +++++++++++-------- 1 file changed, 18 insertions(+), 14 deletions(-) diff --git a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml index 8db0ac6a6a..150df637fe 100644 --- a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml +++ b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml @@ -6,19 +6,20 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search is to detect potential dns exfiltration using nslookup application. This technique are seen in couple of malware and - APT group to exfiltrated collected data in a infected machine or infected network. - This detection is looking for unique use of nslookup where it tries to use specific record type like (TXT, A, AAAA) that are commonly used by attacker - and also the retry parameter which is designed to query C2 DNS multiple tries. -search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline values(Processes.process_id) as nslookup_procid - values(Processes.parent_process) as parent_cmdline count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = "nslookup.exe" Processes.process = "*-querytype=*" OR Processes.process="*-qt=*" - OR Processes.process="*-q=*" OR Processes.process="-type=*" OR Processes.process="*-retry=*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `dns_exfiltration_using_nslookup_app_filter`' +description: this search is to detect potential dns exfiltration using nslookup application. + This technique are seen in couple of malware and APT group to exfiltrated collected + data in a infected machine or infected network. This detection is looking for unique + use of nslookup where it tries to use specific record type like (TXT, A, AAAA) that + are commonly used by attacker and also the retry parameter which is designed to + query C2 DNS multiple tries. +search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline + values(Processes.process_id) as nslookup_procid values(Processes.parent_process) + as parent_cmdline count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "nslookup.exe" Processes.process = "*-querytype=*" + OR Processes.process="*-qt=*" OR Processes.process="*-q=*" OR Processes.process="-type=*" + OR Processes.process="*-retry=*" by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dns_exfiltration_using_nslookup_app_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -49,4 +50,7 @@ tags: - Processes.process_name - Processes.process - Processes.process_id - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log From 57bfcdaf62231450175fe19a06a85b86ec3e8ea7 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 22 Apr 2021 15:47:09 +0000 Subject: [PATCH 04/14] Added detection testing service results inExcessive Usage of NSLOOKUP App --- .../excessive_usage_of_nslookup_app.yml | 26 +++++++++++-------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml index 8c440fd9cf..3a2e971cc2 100644 --- a/detections/endpoint/excessive_usage_of_nslookup_app.yml +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -6,16 +6,17 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search is to detect potential dns exfiltration using nslookup application. This technique are seen in couple of malware and - APT group to exfiltrated collected data in a infected machine or infected network. - This detection is looking for unique use of nslookup where it tries to use specific record type like (TXT, A, AAAA) that are commonly used by attacker - and also the retry parameter which is designed to query C2 DNS multiple tries. -search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline values(Processes.process_id) as nslookup_procid - values(Processes.parent_process) as parent_cmdline count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = "nslookup.exe" - by Processes.dest Processes.user Processes.process_name | where count >= 30 - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` +description: this search is to detect potential dns exfiltration using nslookup application. + This technique are seen in couple of malware and APT group to exfiltrated collected + data in a infected machine or infected network. This detection is looking for unique + use of nslookup where it tries to use specific record type like (TXT, A, AAAA) that + are commonly used by attacker and also the retry parameter which is designed to + query C2 DNS multiple tries. +search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline + values(Processes.process_id) as nslookup_procid values(Processes.parent_process) + as parent_cmdline count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "nslookup.exe" by Processes.dest Processes.user Processes.process_name + | where count >= 30 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `excessive_usage_of_nslookup_app_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -47,4 +48,7 @@ tags: - Processes.process_name - Processes.process - Processes.process_id - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log From e86eb625fbd24cc19f95774baa1e5a3ad26edb99 Mon Sep 17 00:00:00 2001 From: tcontreras Date: Fri, 23 Apr 2021 14:07:00 +0200 Subject: [PATCH 05/14] stream_source --- tests/network/multiple_archive_files_http_post_traffic.test.yml | 2 +- tests/network/plain_http_post_exfiltrated_data.test.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/network/multiple_archive_files_http_post_traffic.test.yml b/tests/network/multiple_archive_files_http_post_traffic.test.yml index ecda4cc4d2..064a806cb4 100644 --- a/tests/network/multiple_archive_files_http_post_traffic.test.yml +++ b/tests/network/multiple_archive_files_http_post_traffic.test.yml @@ -8,5 +8,5 @@ tests: attack_data: - file_name: stream_http_events.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/plain_exfil_data/stream_http_events.log - source: stream:http + source: stream sourcetype: stream:http \ No newline at end of file diff --git a/tests/network/plain_http_post_exfiltrated_data.test.yml b/tests/network/plain_http_post_exfiltrated_data.test.yml index 91ad3ce097..bba80cefd2 100644 --- a/tests/network/plain_http_post_exfiltrated_data.test.yml +++ b/tests/network/plain_http_post_exfiltrated_data.test.yml @@ -8,7 +8,7 @@ tests: attack_data: - file_name: stream_http_events.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/archive_http_post/stream_http_events.log - source: stream:http + source: stream sourcetype: stream:http From 1488915fcabcf0e088c7eee826ecaec70077a3f4 Mon Sep 17 00:00:00 2001 From: tcontreras Date: Fri, 23 Apr 2021 16:25:28 +0200 Subject: [PATCH 06/14] minor_chg --- .../multiple_archive_files_http_post_traffic.test.yml | 6 ++++-- tests/network/plain_http_post_exfiltrated_data.test.yml | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/tests/network/multiple_archive_files_http_post_traffic.test.yml b/tests/network/multiple_archive_files_http_post_traffic.test.yml index 064a806cb4..3893d51e85 100644 --- a/tests/network/multiple_archive_files_http_post_traffic.test.yml +++ b/tests/network/multiple_archive_files_http_post_traffic.test.yml @@ -7,6 +7,8 @@ tests: latest_time: 'now' attack_data: - file_name: stream_http_events.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/plain_exfil_data/stream_http_events.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/archive_http_post/stream_http_events.log source: stream - sourcetype: stream:http \ No newline at end of file + sourcetype: stream:http + + \ No newline at end of file diff --git a/tests/network/plain_http_post_exfiltrated_data.test.yml b/tests/network/plain_http_post_exfiltrated_data.test.yml index bba80cefd2..f71b877ea1 100644 --- a/tests/network/plain_http_post_exfiltrated_data.test.yml +++ b/tests/network/plain_http_post_exfiltrated_data.test.yml @@ -7,7 +7,7 @@ tests: latest_time: 'now' attack_data: - file_name: stream_http_events.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/archive_http_post/stream_http_events.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/plain_exfil_data/stream_http_events.log source: stream sourcetype: stream:http From 7e31007e973f5ad8fc9730676e20fb7cbebc5772 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 23 Apr 2021 14:49:36 +0000 Subject: [PATCH 07/14] Added detection testing service results inPlain HTTP POST Exfiltrated Data --- .../plain_http_post_exfiltrated_data.yml | 26 ++++++++++--------- 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/detections/network/plain_http_post_exfiltrated_data.yml b/detections/network/plain_http_post_exfiltrated_data.yml index 958669c292..5433169517 100644 --- a/detections/network/plain_http_post_exfiltrated_data.yml +++ b/detections/network/plain_http_post_exfiltrated_data.yml @@ -7,18 +7,17 @@ type: batch datamodel: - Network_Traffic description: This search is to detect potential plain http post method data exfiltration. - This network traffic is commonly used by trickbot, trojanspy, keylogger or APT attacker where they send a plain txt file - C2 server through http post method as part of data exfiltration. -search: '`stream_http` http_method=POST - form_data IN ("*wermgr.exe*","*svchost.exe*", "*name=\"proclist\"*","*ipconfig*", "*name=\"sysinfo\"*", "*net view*") - |stats values(form_data) as http_request_body min(_time) as firstTime max(_time) as lastTime count - by http_method http_user_agent uri_path url bytes_in bytes_out - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `plain_http_post_exfiltrated_data_filter`' + This network traffic is commonly used by trickbot, trojanspy, keylogger or APT attacker + where they send a plain txt file C2 server through http post method as part of data + exfiltration. +search: '`stream_http` http_method=POST form_data IN ("*wermgr.exe*","*svchost.exe*", + "*name=\"proclist\"*","*ipconfig*", "*name=\"sysinfo\"*", "*net view*") |stats values(form_data) + as http_request_body min(_time) as firstTime max(_time) as lastTime count by http_method + http_user_agent uri_path url bytes_in bytes_out | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `plain_http_post_exfiltrated_data_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the stream HTTP logs or network logs that catch network traffic. - Make sure that the http-request-body, payload, or request field is enabled. + logs with the stream HTTP logs or network logs that catch network traffic. Make + sure that the http-request-body, payload, or request field is enabled. known_false_positives: unknown references: - https://blog.talosintelligence.com/2020/03/trickbot-primer.html @@ -41,4 +40,7 @@ tags: - url - bytes_in - bytes_out - security_domain: network \ No newline at end of file + security_domain: network + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/plain_exfil_data/stream_http_events.log From bd66b443114fdb09ad377989acbbe13cde476f11 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 23 Apr 2021 15:06:39 +0000 Subject: [PATCH 08/14] Added detection testing service results inMultiple Archive Files Http Post Traffic --- ...ltiple_archive_files_http_post_traffic.yml | 46 +++++++++++-------- 1 file changed, 26 insertions(+), 20 deletions(-) diff --git a/detections/network/multiple_archive_files_http_post_traffic.yml b/detections/network/multiple_archive_files_http_post_traffic.yml index a86ab1b6e4..684cde447f 100644 --- a/detections/network/multiple_archive_files_http_post_traffic.yml +++ b/detections/network/multiple_archive_files_http_post_traffic.yml @@ -6,27 +6,30 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Network_Traffic -description: This search is designed to detect high frequecy archive files data exfiltration through HTTP POST method protocol. - This are one of the common techniques used by APT or trojan spy after doing the data collection like screenshot, recording, sensitive data to the infected machines. - The attacker may execute archiving command to the collected data, save it a temp folder with a hidden attribute then send it to its c2 through http post. - Sometimes it rename the archive files or encode/encrypt to cover it tracks. This detection can detect a renamed archive files transfer to HTTP POST since it checks the request body header. - Unfortunately this detection cannot support archive that was encrypted or encoded before doing the exfiltration. -search: '`stream_http` http_method=POST - |eval archive_hdr1=substr(form_data,1,2) - | eval archive_hdr2 = substr(form_data,1,4) - |stats values(form_data) as http_request_body min(_time) as firstTime max(_time) as lastTime count by http_method http_user_agent uri_path url bytes_in bytes_out archive_hdr1 archive_hdr2 - |where count >20 AND (archive_hdr1 = "7z" OR archive_hdr1 = "PK" OR archive_hdr2="Rar!") - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `multiple_archive_files_http_post_traffic_filter`' +description: This search is designed to detect high frequecy archive files data exfiltration + through HTTP POST method protocol. This are one of the common techniques used by + APT or trojan spy after doing the data collection like screenshot, recording, sensitive + data to the infected machines. The attacker may execute archiving command to the + collected data, save it a temp folder with a hidden attribute then send it to its + c2 through http post. Sometimes it rename the archive files or encode/encrypt to + cover it tracks. This detection can detect a renamed archive files transfer to HTTP + POST since it checks the request body header. Unfortunately this detection cannot + support archive that was encrypted or encoded before doing the exfiltration. +search: '`stream_http` http_method=POST |eval archive_hdr1=substr(form_data,1,2) | + eval archive_hdr2 = substr(form_data,1,4) |stats values(form_data) as http_request_body + min(_time) as firstTime max(_time) as lastTime count by http_method http_user_agent + uri_path url bytes_in bytes_out archive_hdr1 archive_hdr2 |where count >20 AND (archive_hdr1 + = "7z" OR archive_hdr1 = "PK" OR archive_hdr2="Rar!") | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `multiple_archive_files_http_post_traffic_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the stream HTTP logs or network logs that catch network traffic. - Make sure that the http-request-body, payload, or request field is enabled in stream http configuration. + logs with the stream HTTP logs or network logs that catch network traffic. Make + sure that the http-request-body, payload, or request field is enabled in stream + http configuration. known_false_positives: normal archive transfer to HTTP protocol references: - - https://attack.mitre.org/techniques/T1560/001/ - - https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html - - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ +- https://attack.mitre.org/techniques/T1560/001/ +- https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html +- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ tags: analytic_story: - Command and Control @@ -47,5 +50,8 @@ tags: - bytes_in - bytes_out - archive_hdr1 - - archive_hdr2 - security_domain: network \ No newline at end of file + - archive_hdr2 + security_domain: network + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/archive_http_post/stream_http_events.log From 57bb490c61ec9e47d1c06077327574ce9a4fd315 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 23 Apr 2021 11:38:46 -0600 Subject: [PATCH 09/14] Update dns_exfiltration_using_nslookup_app.yml --- detections/endpoint/dns_exfiltration_using_nslookup_app.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml index 150df637fe..7f3f2b9184 100644 --- a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml +++ b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml @@ -6,10 +6,10 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search is to detect potential dns exfiltration using nslookup application. +description: this search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique - use of nslookup where it tries to use specific record type like (TXT, A, AAAA) that + use of nslookup where it tries to use specific record type, TXT, A, AAAA, that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline From 613374b0c8fc5fd104b4e5d184cfb72a42034798 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 23 Apr 2021 11:39:51 -0600 Subject: [PATCH 10/14] Update excessive_usage_of_nslookup_app.yml --- detections/endpoint/excessive_usage_of_nslookup_app.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml index 3a2e971cc2..dd4226f6d4 100644 --- a/detections/endpoint/excessive_usage_of_nslookup_app.yml +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -6,10 +6,10 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search is to detect potential dns exfiltration using nslookup application. +description: this search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique - use of nslookup where it tries to use specific record type like (TXT, A, AAAA) that + use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline From 84e775e9727376186670afcb4f44d1943245bff4 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 23 Apr 2021 11:44:45 -0600 Subject: [PATCH 11/14] Update multiple_archive_files_http_post_traffic.yml --- .../network/multiple_archive_files_http_post_traffic.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/network/multiple_archive_files_http_post_traffic.yml b/detections/network/multiple_archive_files_http_post_traffic.yml index 684cde447f..7f639622c0 100644 --- a/detections/network/multiple_archive_files_http_post_traffic.yml +++ b/detections/network/multiple_archive_files_http_post_traffic.yml @@ -6,13 +6,13 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Network_Traffic -description: This search is designed to detect high frequecy archive files data exfiltration +description: This search is designed to detect high frequency of archive files data exfiltration through HTTP POST method protocol. This are one of the common techniques used by APT or trojan spy after doing the data collection like screenshot, recording, sensitive data to the infected machines. The attacker may execute archiving command to the collected data, save it a temp folder with a hidden attribute then send it to its - c2 through http post. Sometimes it rename the archive files or encode/encrypt to - cover it tracks. This detection can detect a renamed archive files transfer to HTTP + C2 through HTTP POST. Sometimes adversaries will rename the archive files or encode/encrypt to + cover their tracks. This detection can detect a renamed archive files transfer to HTTP POST since it checks the request body header. Unfortunately this detection cannot support archive that was encrypted or encoded before doing the exfiltration. search: '`stream_http` http_method=POST |eval archive_hdr1=substr(form_data,1,2) | @@ -25,7 +25,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the stream HTTP logs or network logs that catch network traffic. Make sure that the http-request-body, payload, or request field is enabled in stream http configuration. -known_false_positives: normal archive transfer to HTTP protocol +known_false_positives: Normal archive transfer via HTTP protocol may trip this detection. references: - https://attack.mitre.org/techniques/T1560/001/ - https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html From 80904c30932c4c14b8db689a51d278314a1841fd Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 23 Apr 2021 11:48:49 -0600 Subject: [PATCH 12/14] Update plain_http_post_exfiltrated_data.yml --- detections/network/plain_http_post_exfiltrated_data.yml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/detections/network/plain_http_post_exfiltrated_data.yml b/detections/network/plain_http_post_exfiltrated_data.yml index 5433169517..bc4f17ec74 100644 --- a/detections/network/plain_http_post_exfiltrated_data.yml +++ b/detections/network/plain_http_post_exfiltrated_data.yml @@ -4,11 +4,10 @@ version: 1 date: '2021-04-22' author: Teoderick Contreras, Splunk type: batch -datamodel: -- Network_Traffic -description: This search is to detect potential plain http post method data exfiltration. - This network traffic is commonly used by trickbot, trojanspy, keylogger or APT attacker - where they send a plain txt file C2 server through http post method as part of data +datamodel: [] +description: This search is to detect potential plain HTTP POST method data exfiltration. + This network traffic is commonly used by trickbot, trojanspy, keylogger or APT adversary + where arguments or commands are sent in plain text to the remote C2 server using HTTP POST method as part of data exfiltration. search: '`stream_http` http_method=POST form_data IN ("*wermgr.exe*","*svchost.exe*", "*name=\"proclist\"*","*ipconfig*", "*name=\"sysinfo\"*", "*net view*") |stats values(form_data) From d211786d776eb83b196b9ba3f42feeb2c6479fd1 Mon Sep 17 00:00:00 2001 From: tcontreras Date: Mon, 26 Apr 2021 10:32:31 +0200 Subject: [PATCH 13/14] update_net --- .../endpoint/dns_exfiltration_using_nslookup_app.yml | 9 ++++----- detections/endpoint/excessive_usage_of_nslookup_app.yml | 6 +++--- 2 files changed, 7 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml index 7f3f2b9184..3aa78a3a48 100644 --- a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml +++ b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml @@ -12,13 +12,12 @@ description: this search is to detect potential DNS exfiltration using nslookup use of nslookup where it tries to use specific record type, TXT, A, AAAA, that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. -search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline - values(Processes.process_id) as nslookup_procid values(Processes.parent_process) - as parent_cmdline count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id values(Processes.parent_process) + as pare_process count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "nslookup.exe" Processes.process = "*-querytype=*" OR Processes.process="*-qt=*" OR Processes.process="*-q=*" OR Processes.process="-type=*" - OR Processes.process="*-retry=*" by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id | `drop_dm_object_name(Processes)` + OR Processes.process="*-retry=*" by Processes.dest Processes.user Processes.process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dns_exfiltration_using_nslookup_app_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml index dd4226f6d4..eec6b43974 100644 --- a/detections/endpoint/excessive_usage_of_nslookup_app.yml +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -12,9 +12,9 @@ description: this search is to detect potential DNS exfiltration using nslookup use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. -search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline - values(Processes.process_id) as nslookup_procid values(Processes.parent_process) - as parent_cmdline count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id values(Processes.parent_process) + as parent_process count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "nslookup.exe" by Processes.dest Processes.user Processes.process_name | where count >= 30 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `excessive_usage_of_nslookup_app_filter`' From f2b6938726c4805c749ae093fa00e7ba6149f8ae Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 26 Apr 2021 13:15:22 -0700 Subject: [PATCH 14/14] Update dns_exfiltration_using_nslookup_app.yml fixing a minor typo --- detections/endpoint/dns_exfiltration_using_nslookup_app.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml index 3aa78a3a48..9a1f61702a 100644 --- a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml +++ b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml @@ -14,7 +14,7 @@ description: this search is to detect potential DNS exfiltration using nslookup query C2 DNS multiple tries. search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id values(Processes.parent_process) - as pare_process count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + as parent_process count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "nslookup.exe" Processes.process = "*-querytype=*" OR Processes.process="*-qt=*" OR Processes.process="*-q=*" OR Processes.process="-type=*" OR Processes.process="*-retry=*" by Processes.dest Processes.user Processes.process_name | `drop_dm_object_name(Processes)`