diff --git a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml index 67ac89ff4d..3b64b015eb 100644 --- a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml +++ b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml @@ -6,12 +6,12 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a suspicious parent process execution of commandline - tool not in shell commandline. This technique was seen in FIN7 JSSLoader .net compile - payload where it run ipconfig.exe and systeminfo.exe using .net application. This - event cause some good TTP since those tool are commonly run in commandline not by - another application. This TTP is a good indicator for application gather host information - either an attacker or an automated tool made by admin. +description: This search is to detect a suspicious non-command shell process (e.g. cmd.exe, powershell.exe) + spawning windows console application (e.g ipconfig.exe, systeminfo.exe). + This technique was seen in FIN7 loader implant that executes existing windows console tools or application + to gather system information from the compromised host. + This TTP is a good indicator for possible advesaries implant, malware doing a recon on a target host + or a third party application run by administrator for audit purposes. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = "ipconfig.exe" OR Processes.process_name = "systeminfo.exe") AND NOT (Processes.parent_process_name diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml index 28228cc7b7..68ca92df2d 100644 --- a/detections/endpoint/office_application_spawn_rundll32_process.yml +++ b/detections/endpoint/office_application_spawn_rundll32_process.yml @@ -10,12 +10,12 @@ description: this detection was designed to identifies suspicious spawned proces of known MS office application due to macro or malicious code. this technique can be seen in so many malware like trickbot that used MS office as its weapon or attack vector to initially infect the machines. -search: '| tstats `security_content_summariesonly` count values(Processes.process) - min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name - = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe") `process_rundll32` by - Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid - Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe") AND `process_rundll32` + by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest + | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `office_application_spawn_rundll32_process_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/detections/endpoint/regsvr32_silent_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml similarity index 94% rename from detections/endpoint/regsvr32_silent_param_dll_loading.yml rename to detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml index 0a2c1bb9ea..818b641c0f 100644 --- a/detections/endpoint/regsvr32_silent_param_dll_loading.yml +++ b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml @@ -1,4 +1,4 @@ -name: Regsvr32 Silent Param Dll Loading +name: Regsvr32 Silent and Install Param Dll Loading id: f421c250-24e7-11ec-bc43-acde48001122 version: 1 date: '2021-10-04' @@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process="*/i*" Processes.process="*/s*" by Processes.dest Processes.parent_process Processes.process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `regsvr32_silent_param_dll_loading_filter`' + | `security_content_ctime(lastTime)` | `regsvr32_silent_and_install_param_dll_loading_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml similarity index 81% rename from detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml rename to detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml index 2e9fe3108a..5f19e7df8a 100644 --- a/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml +++ b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml @@ -1,4 +1,4 @@ -name: Suspicious IcedID Regsvr32 Cmdline +name: Regsvr32 with Known Silent Switch Cmdline id: c9ef7dc4-eeaf-11eb-b2b6-acde48001122 version: 2 date: '2021-07-27' @@ -11,11 +11,13 @@ description: this search is to detect a suspicious regsvr32 commandline "-s" to dll that will download the 2nd stage loader that will download and decrypt the config payload. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` Processes.process=*-s* - by Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name - Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest - Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `suspicious_icedid_regsvr32_cmdline_filter`' + as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` + (Processes.process="*/i*" AND Processes.process="*/s*") OR Processes.process="*/si*" OR Processes.process="*-si*" by Processes.dest Processes.parent_process + Processes.process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `regsvr32_with_known_silent_switch_cmdline_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/tests/endpoint/regsvr32_silent_param_dll_loading.test.yml b/tests/endpoint/regsvr32_silent_and_install_param_dll_loading.test.yml similarity index 67% rename from tests/endpoint/regsvr32_silent_param_dll_loading.test.yml rename to tests/endpoint/regsvr32_silent_and_install_param_dll_loading.test.yml index a28aa579c6..11f1f4e2ab 100644 --- a/tests/endpoint/regsvr32_silent_param_dll_loading.test.yml +++ b/tests/endpoint/regsvr32_silent_and_install_param_dll_loading.test.yml @@ -1,7 +1,7 @@ -name: Regsvr32 Silent Param Dll Loading Unit Test +name: Regsvr32 Silent and Install Param Dll Loading Unit Test tests: -- name: Regsvr32 Silent Param Dll Loading - file: endpoint/regsvr32_silent_param_dll_loading.yml +- name: Regsvr32 Silent and Install Param Dll Loading + file: endpoint/regsvr32_silent_and_install_param_dll_loading.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' diff --git a/tests/endpoint/suspicious_icedid_regsvr32_cmdline.test.yml b/tests/endpoint/regsvr32_with_known_silent_switch_cmdline.test.yml similarity index 68% rename from tests/endpoint/suspicious_icedid_regsvr32_cmdline.test.yml rename to tests/endpoint/regsvr32_with_known_silent_switch_cmdline.test.yml index 6d0535e5e8..227303b0e9 100644 --- a/tests/endpoint/suspicious_icedid_regsvr32_cmdline.test.yml +++ b/tests/endpoint/regsvr32_with_known_silent_switch_cmdline.test.yml @@ -1,7 +1,7 @@ -name: Suspicious IcedID Regsvr32 Cmdline Unit Test +name: Regsvr32 with Known Silent Switch Cmdline Unit Test tests: -- name: Suspicious IcedID Regsvr32 Cmdline - file: endpoint/suspicious_icedid_regsvr32_cmdline.yml +- name: Regsvr32 with Known Silent Switch Cmdline + file: endpoint/regsvr32_with_known_silent_switch_cmdline.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now'