diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml index 5a15de9e89..5a093ff3b4 100644 --- a/detections/endpoint/any_powershell_downloadstring.yml +++ b/detections/endpoint/any_powershell_downloadstring.yml @@ -29,6 +29,7 @@ references: - https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-5.0 - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md +- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ tags: analytic_story: - Winter Vivern @@ -37,6 +38,7 @@ tags: - Malicious PowerShell - HAFNIUM Group - Data Destruction + - IcedID asset_type: Endpoint confidence: 70 impact: 80 diff --git a/detections/endpoint/chcp_command_execution.yml b/detections/endpoint/chcp_command_execution.yml index f7b0404322..639afc2d6a 100644 --- a/detections/endpoint/chcp_command_execution.yml +++ b/detections/endpoint/chcp_command_execution.yml @@ -12,7 +12,7 @@ data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=chcp.com - Processes.parent_process_name = cmd.exe Processes.parent_process=*/c* by Processes.process_name + Processes.parent_process_name = cmd.exe (Processes.parent_process=*/c* OR Processes.parent_process=*/k*) by Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `chcp_command_execution_filter`' diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml index b1d8c8ee72..b0d20be749 100644 --- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml +++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml @@ -40,6 +40,7 @@ tags: - Active Directory Lateral Movement - CISA AA22-320A - Sandworm Tools + - IcedID asset_type: Endpoint confidence: 70 impact: 50 diff --git a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml index 0425c497a8..5a001336d5 100644 --- a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml +++ b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml @@ -7,13 +7,13 @@ status: production type: TTP description: The following analytic identifies executable files (.exe or .dll) being written to Windows administrative SMB shares (Admin$, IPC$, C$). This represents - suspicious behavior as its commonly used by tools like like PsExec/PaExec and others + suspicious behavior as its commonly used by tools like PsExec/PaExec and others to stage service binaries before creating and starting a Windows service on remote endpoints. Red Teams and adversaries alike may abuse administrative shares for lateral movement and remote code execution. The Trickbot malware family also implements this behavior to try to infect other machines in the infected network. data_source: -- Sysmon Event ID 5 +- Windows Security 5145 search: '`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.exe","*.dll") Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask= "0x2" | stats min(_time) as firstTime max(_time) as lastTime count by EventCode @@ -30,6 +30,7 @@ references: - https://www.rapid7.com/blog/post/2013/03/09/psexec-demystified/ - https://labs.vipre.com/trickbot-and-its-modules/ - https://whitehat.eu/incident-response-case-study-featuring-ryuk-and-trickbot-part-2/ +- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ tags: analytic_story: - Industroyer2 @@ -38,6 +39,7 @@ tags: - Trickbot - Prestige Ransomware - Data Destruction + - IcedID asset_type: Endpoint confidence: 100 impact: 70 diff --git a/detections/endpoint/net_localgroup_discovery.yml b/detections/endpoint/net_localgroup_discovery.yml index 6766944d33..fa899e50e5 100644 --- a/detections/endpoint/net_localgroup_discovery.yml +++ b/detections/endpoint/net_localgroup_discovery.yml @@ -26,6 +26,7 @@ known_false_positives: False positives may be present. Tune as needed. references: - https://attack.mitre.org/techniques/T1069/001/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md +- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ tags: analytic_story: - Active Directory Discovery @@ -33,6 +34,7 @@ tags: - Azorult - Windows Post-Exploitation - Prestige Ransomware + - IcedID asset_type: Endpoint confidence: 50 impact: 30 diff --git a/detections/endpoint/network_connection_discovery_with_arp.yml b/detections/endpoint/network_connection_discovery_with_arp.yml index a554919d35..e65170ef0c 100644 --- a/detections/endpoint/network_connection_discovery_with_arp.yml +++ b/detections/endpoint/network_connection_discovery_with_arp.yml @@ -22,12 +22,14 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://attack.mitre.org/techniques/T1049/ +- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ tags: analytic_story: - Active Directory Discovery - Qakbot - Windows Post-Exploitation - Prestige Ransomware + - IcedID asset_type: Endpoint confidence: 50 impact: 30 diff --git a/detections/endpoint/network_share_discovery_via_dir_command.yml b/detections/endpoint/network_share_discovery_via_dir_command.yml new file mode 100644 index 0000000000..5239d08a16 --- /dev/null +++ b/detections/endpoint/network_share_discovery_via_dir_command.yml @@ -0,0 +1,67 @@ +name: Network Share Discovery Via Dir Command +id: dc1457d0-1d9b-422e-b5a7-db46c184d9aa +version: 1 +date: '2023-05-23' +author: Teoderick Contreras, Splunk +status: production +type: Hunting +data_source: +- Windows Security 5140 +description: The following analytic identifies object access on Windows administrative SMB shares (Admin$, IPC$, C$). + This represents suspicious behavior as its commonly used by tools like PsExec/PaExec and others + to stage service binaries before creating and starting a Windows service on remote + endpoints. Red Teams and adversaries alike may abuse administrative shares for lateral + movement and remote code execution. The IcedID malware family also implements + this behavior to try to infect other machines in the infected network. +search: '`wineventlog_security` EventCode=5140 ShareName IN("\\\\*\\ADMIN$","\\\\*\\C$","*\\\\*\\IPC$") AccessMask= 0x1 + | stats min(_time) as firstTime max(_time) as lastTime count by ShareName IpAddress ObjectType SubjectUserName SubjectDomainName IpPort AccessMask Computer + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `network_share_discovery_via_dir_command_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows Security Event Logs with 5140 EventCode enabled. The Windows TA is also + required. Also enable the object Audit access success/failure in your group policy. +known_false_positives: System Administrators may use looks like net.exe or "dir commandline" for troubleshooting + or administrations tasks. However, this will typically come only from certain users + and certain systems that can be added to an allow list. +references: +- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ +tags: + analytic_story: + - IcedID + asset_type: Endpoint + atomic_guid: + - 13daa2cf-195a-43df-a8bd-7dd5ffb607b5 + confidence: 50 + impact: 50 + message: $user$ list executable files or directory in known sensitive SMB share. Share + name=$Share_Name$, Access mask=$Access_Mask$ + mitre_attack_id: + - T1135 + observable: + - name: Computer + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 25 + required_fields: + - _time + - ShareName + - IpAddress + - ObjectType + - SubjectUserName + - SubjectDomainName + - IpPort + - AccessMask + - Computer + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/net_share_discovery_via_dir/smb_access_security_xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml index 21772ba8f0..f1bfcbf548 100644 --- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml +++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml @@ -35,6 +35,7 @@ references: - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ +- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ tags: analytic_story: - Hermetic Wiper @@ -42,6 +43,7 @@ tags: - Winter Vivern - AsyncRAT - Data Destruction + - IcedID confidence: 80 impact: 70 message: A suspicious powershell script contains base64 command in $ScriptBlockText$ diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml index b3506a2b45..d7a806e40a 100644 --- a/detections/endpoint/powershell_processing_stream_of_data.yml +++ b/detections/endpoint/powershell_processing_stream_of_data.yml @@ -28,12 +28,14 @@ references: - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html +- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ tags: analytic_story: - Malicious PowerShell - AsyncRAT - Hermetic Wiper - Data Destruction + - IcedID asset_type: Endpoint confidence: 80 impact: 50 diff --git a/detections/endpoint/powershell_using_memory_as_backing_store.yml b/detections/endpoint/powershell_using_memory_as_backing_store.yml index b4b75a94fc..dc79d49367 100644 --- a/detections/endpoint/powershell_using_memory_as_backing_store.yml +++ b/detections/endpoint/powershell_using_memory_as_backing_store.yml @@ -27,11 +27,13 @@ references: - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ +- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ tags: analytic_story: - Malicious PowerShell - Hermetic Wiper - Data Destruction + - IcedID asset_type: Endpoint confidence: 80 impact: 50 diff --git a/detections/endpoint/remote_system_discovery_with_net.yml b/detections/endpoint/remote_system_discovery_with_net.yml index 43cab9ca73..2de7076d43 100644 --- a/detections/endpoint/remote_system_discovery_with_net.yml +++ b/detections/endpoint/remote_system_discovery_with_net.yml @@ -25,9 +25,11 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://attack.mitre.org/techniques/T1018/ +- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ tags: analytic_story: - Active Directory Discovery + - IcedID asset_type: Endpoint confidence: 50 impact: 30 diff --git a/detections/endpoint/remote_wmi_command_attempt.yml b/detections/endpoint/remote_wmi_command_attempt.yml index 07e0adf9d7..6784fbecb0 100644 --- a/detections/endpoint/remote_wmi_command_attempt.yml +++ b/detections/endpoint/remote_wmi_command_attempt.yml @@ -27,10 +27,12 @@ known_false_positives: Administrators may use this legitimately to gather info f remote systems. Filter as needed. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.yaml +- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ tags: analytic_story: - Suspicious WMI Use - Living Off The Land + - IcedID asset_type: Endpoint confidence: 60 impact: 60 diff --git a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml index f1cba72a75..1d8c98c32f 100644 --- a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml +++ b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml @@ -40,6 +40,7 @@ tags: analytic_story: - Suspicious Rundll32 Activity - Living Off The Land + - IcedID asset_type: Endpoint confidence: 50 impact: 70 diff --git a/detections/endpoint/windows_adfind_exe.yml b/detections/endpoint/windows_adfind_exe.yml index fcb9447740..0354123c20 100644 --- a/detections/endpoint/windows_adfind_exe.yml +++ b/detections/endpoint/windows_adfind_exe.yml @@ -26,10 +26,12 @@ references: - https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/ - https://www.mandiant.com/resources/a-nasty-trick-from-credential-theft-malware-to-business-disruption - https://www.joeware.net/freetools/tools/adfind/index.htm +- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ tags: analytic_story: - NOBELIUM Group - Domain Trust Discovery + - IcedID asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/windows_wmi_process_call_create.yml b/detections/endpoint/windows_wmi_process_call_create.yml index f0f143cdd3..7d54c6e02e 100644 --- a/detections/endpoint/windows_wmi_process_call_create.yml +++ b/detections/endpoint/windows_wmi_process_call_create.yml @@ -28,10 +28,12 @@ known_false_positives: Administrators may execute this command for testing or au references: - https://github.com/NVISOsecurity/sigma-public/blob/master/rules/windows/process_creation/win_susp_wmi_execution.yml - https://github.com/redcanaryco/atomic-red-team/blob/2b804d25418004a5f1ba50e9dc637946ab8733c7/atomics/T1047/T1047.md +- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ tags: analytic_story: - Suspicious WMI Use - Qakbot + - IcedID asset_type: Endpoint confidence: 50 impact: 50