Branch was auto-updated.

detections/endpoint/any_powershell_downloadstring.yml

@@ -29,6 +29,7 @@ references:
 - https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-5.0
 - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md
+- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
 tags:
   analytic_story:
   - Winter Vivern
@@ -37,6 +38,7 @@ tags:
   - Malicious PowerShell
   - HAFNIUM Group
   - Data Destruction
+  - IcedID
   asset_type: Endpoint
   confidence: 70
   impact: 80

detections/endpoint/chcp_command_execution.yml

@@ -12,7 +12,7 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=chcp.com
-  Processes.parent_process_name = cmd.exe Processes.parent_process=*/c* by  Processes.process_name
+  Processes.parent_process_name = cmd.exe (Processes.parent_process=*/c* OR Processes.parent_process=*/k*) by  Processes.process_name
   Processes.process Processes.parent_process_name Processes.parent_process Processes.process_id
   Processes.parent_process_id Processes.dest Processes.user | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `chcp_command_execution_filter`'

detections/endpoint/detect_psexec_with_accepteula_flag.yml

@@ -40,6 +40,7 @@ tags:
   - Active Directory Lateral Movement
   - CISA AA22-320A
   - Sandworm Tools
+  - IcedID
   asset_type: Endpoint
   confidence: 70
   impact: 50

detections/endpoint/executable_file_written_in_administrative_smb_share.yml

@@ -7,13 +7,13 @@ status: production
 type: TTP
 description: The following analytic identifies executable files (.exe or .dll) being
   written to Windows administrative SMB shares (Admin$, IPC$, C$). This represents
-  suspicious behavior as its commonly used by tools like like PsExec/PaExec and others
+  suspicious behavior as its commonly used by tools like PsExec/PaExec and others
   to stage service binaries before creating and starting a Windows service on remote
   endpoints. Red Teams and adversaries alike may abuse administrative shares for lateral
   movement and remote code execution. The Trickbot malware family also implements
   this behavior to try to infect other machines in the infected network.
 data_source:
-- Sysmon Event ID 5
+- Windows Security 5145
 search: '`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.exe","*.dll")
   Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask=
   "0x2" | stats min(_time) as firstTime max(_time) as lastTime count by EventCode
@@ -30,6 +30,7 @@ references:
 - https://www.rapid7.com/blog/post/2013/03/09/psexec-demystified/
 - https://labs.vipre.com/trickbot-and-its-modules/
 - https://whitehat.eu/incident-response-case-study-featuring-ryuk-and-trickbot-part-2/
+- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
 tags:
   analytic_story:
   - Industroyer2
@@ -38,6 +39,7 @@ tags:
   - Trickbot
   - Prestige Ransomware
   - Data Destruction
+  - IcedID
   asset_type: Endpoint
   confidence: 100
   impact: 70

detections/endpoint/net_localgroup_discovery.yml

@@ -26,6 +26,7 @@ known_false_positives: False positives may be present. Tune as needed.
 references:
 - https://attack.mitre.org/techniques/T1069/001/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md
+- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -33,6 +34,7 @@ tags:
   - Azorult
   - Windows Post-Exploitation
   - Prestige Ransomware
+  - IcedID
   asset_type: Endpoint
   confidence: 50
   impact: 30

detections/endpoint/network_connection_discovery_with_arp.yml

@@ -22,12 +22,14 @@ how_to_implement: To successfully implement this search you need to be ingesting
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1049/
+- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
 tags:
   analytic_story:
   - Active Directory Discovery
   - Qakbot
   - Windows Post-Exploitation
   - Prestige Ransomware
+  - IcedID
   asset_type: Endpoint
   confidence: 50
   impact: 30

detections/endpoint/network_share_discovery_via_dir_command.yml

@@ -0,0 +1,67 @@
+name: Network Share Discovery Via Dir Command
+id: dc1457d0-1d9b-422e-b5a7-db46c184d9aa
+version: 1
+date: '2023-05-23'
+author: Teoderick Contreras, Splunk
+status: production
+type: Hunting
+data_source:
+- Windows Security 5140
+description: The following analytic identifies object access on Windows administrative SMB shares (Admin$, IPC$, C$). 
+  This represents suspicious behavior as its commonly used by tools like PsExec/PaExec and others
+  to stage service binaries before creating and starting a Windows service on remote
+  endpoints. Red Teams and adversaries alike may abuse administrative shares for lateral
+  movement and remote code execution. The IcedID malware family also implements
+  this behavior to try to infect other machines in the infected network.
+search: '`wineventlog_security` EventCode=5140 ShareName IN("\\\\*\\ADMIN$","\\\\*\\C$","*\\\\*\\IPC$") AccessMask= 0x1 
+  | stats min(_time) as firstTime max(_time) as lastTime count by ShareName IpAddress ObjectType SubjectUserName SubjectDomainName IpPort AccessMask Computer
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `network_share_discovery_via_dir_command_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows Security Event Logs with 5140 EventCode enabled. The Windows TA is also
+  required. Also enable the object Audit access success/failure in your group policy.
+known_false_positives: System Administrators may use looks like net.exe or "dir commandline" for troubleshooting
+  or administrations tasks. However, this will typically come only from certain users
+  and certain systems that can be added to an allow list.
+references:
+- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
+tags:
+  analytic_story:
+  - IcedID
+  asset_type: Endpoint
+  atomic_guid:
+  - 13daa2cf-195a-43df-a8bd-7dd5ffb607b5
+  confidence: 50
+  impact: 50
+  message: $user$ list executable files or directory in known sensitive SMB share.  Share
+    name=$Share_Name$, Access mask=$Access_Mask$
+  mitre_attack_id:
+  - T1135
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 25
+  required_fields:
+  - _time
+  - ShareName 
+  - IpAddress
+  - ObjectType
+  - SubjectUserName
+  - SubjectDomainName
+  - IpPort
+  - AccessMask
+  - Computer
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/net_share_discovery_via_dir/smb_access_security_xml.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml

@@ -35,6 +35,7 @@ references:
 - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
 tags:
   analytic_story:
   - Hermetic Wiper
@@ -42,6 +43,7 @@ tags:
   - Winter Vivern
   - AsyncRAT
   - Data Destruction
+  - IcedID
   confidence: 80
   impact: 70
   message: A suspicious powershell script contains base64 command in $ScriptBlockText$

detections/endpoint/powershell_processing_stream_of_data.yml

@@ -28,12 +28,14 @@ references:
 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
 - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
+- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
 tags:
   analytic_story:
   - Malicious PowerShell
   - AsyncRAT
   - Hermetic Wiper
   - Data Destruction
+  - IcedID
   asset_type: Endpoint
   confidence: 80
   impact: 50

detections/endpoint/powershell_using_memory_as_backing_store.yml

@@ -27,11 +27,13 @@ references:
 - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
 tags:
   analytic_story:
   - Malicious PowerShell
   - Hermetic Wiper
   - Data Destruction
+  - IcedID
   asset_type: Endpoint
   confidence: 80
   impact: 50

detections/endpoint/remote_system_discovery_with_net.yml

@@ -25,9 +25,11 @@ how_to_implement: To successfully implement this search you need to be ingesting
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1018/
+- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
 tags:
   analytic_story:
   - Active Directory Discovery
+  - IcedID
   asset_type: Endpoint
   confidence: 50
   impact: 30

detections/endpoint/remote_wmi_command_attempt.yml

@@ -27,10 +27,12 @@ known_false_positives: Administrators may use this legitimately to gather info f
   remote systems. Filter as needed.
 references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.yaml
+- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
 tags:
   analytic_story:
   - Suspicious WMI Use
   - Living Off The Land
+  - IcedID
   asset_type: Endpoint
   confidence: 60
   impact: 60

detections/endpoint/suspicious_rundll32_dllregisterserver.yml

@@ -40,6 +40,7 @@ tags:
   analytic_story:
   - Suspicious Rundll32 Activity
   - Living Off The Land
+  - IcedID
   asset_type: Endpoint
   confidence: 50
   impact: 70

detections/endpoint/windows_adfind_exe.yml

@@ -26,10 +26,12 @@ references:
 - https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/
 - https://www.mandiant.com/resources/a-nasty-trick-from-credential-theft-malware-to-business-disruption
 - https://www.joeware.net/freetools/tools/adfind/index.htm
+- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
 tags:
   analytic_story:
   - NOBELIUM Group
   - Domain Trust Discovery
+  - IcedID
   asset_type: Endpoint
   confidence: 50
   impact: 50

detections/endpoint/windows_wmi_process_call_create.yml

@@ -28,10 +28,12 @@ known_false_positives: Administrators may execute this command for testing or au
 references:
 - https://github.com/NVISOsecurity/sigma-public/blob/master/rules/windows/process_creation/win_susp_wmi_execution.yml
 - https://github.com/redcanaryco/atomic-red-team/blob/2b804d25418004a5f1ba50e9dc637946ab8733c7/atomics/T1047/T1047.md
+- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
 tags:
   analytic_story:
   - Suspicious WMI Use
   - Qakbot
+  - IcedID
   asset_type: Endpoint
   confidence: 50
   impact: 50