diff --git a/detections/cloud/baseline_of_cloud_infrastructure_api_calls_per_user.yml b/detections/cloud/baseline_of_cloud_infrastructure_api_calls_per_user.yml index e671f14d72..d6947cd85e 100644 --- a/detections/cloud/baseline_of_cloud_infrastructure_api_calls_per_user.yml +++ b/detections/cloud/baseline_of_cloud_infrastructure_api_calls_per_user.yml @@ -1,13 +1,25 @@ +name: Baseline Of Cloud Infrastructure API Calls Per User +id: 1da5d5ea-4382-447d-98a9-87c358c95fcb +version: 1 +date: '2020-09-07' author: David Dorsey, Splunk +type: Baseline datamodel: - Change -date: '2020-09-07' description: This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. +search: '| tstats count as api_calls from datamodel=Change.All_Changes where All_Changes.user!=unknown + All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` + | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval + DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek + <= 5, 0, 1) | table _time api_calls, user, HourOfDay, isWeekend | eventstats dc(api_calls) + as api_calls by user, HourOfDay, isWeekend | where api_calls >= 1 | fit DensityFunction + api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_api_calls_v1 dist=norm + show_density=true' how_to_implement: You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users @@ -17,18 +29,8 @@ how_to_implement: You must have Enterprise Security 6.0 or later, if not you wil 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. -id: 1da5d5ea-4382-447d-98a9-87c358c95fcb known_false_positives: none -name: Baseline Of Cloud Infrastructure API Calls Per User references: [] -search: '| tstats count as api_calls from datamodel=Change.All_Changes where All_Changes.user!=unknown - All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` - | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval - DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek - <= 5, 0, 1) | table _time api_calls, user, HourOfDay, isWeekend | eventstats dc(api_calls) - as api_calls by user, HourOfDay, isWeekend | where api_calls >= 1 | fit DensityFunction - api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_api_calls_v1 dist=norm - show_density=true' tags: analytic_story: - Suspicious Cloud User Activities @@ -46,5 +48,3 @@ tags: - Change.All_Changes.user - _time security_domain: network -type: Baseline -version: 1 diff --git a/detections/cloud/baseline_of_cloud_instances_destroyed.yml b/detections/cloud/baseline_of_cloud_instances_destroyed.yml index a7e1cccdae..251c26349d 100644 --- a/detections/cloud/baseline_of_cloud_instances_destroyed.yml +++ b/detections/cloud/baseline_of_cloud_instances_destroyed.yml @@ -1,13 +1,25 @@ +name: Baseline Of Cloud Instances Destroyed +id: a2f701f8-5296-4d74-829c-0b7eb346d549 +version: 1 +date: '2020-08-25' author: David Dorsey, Splunk +type: Baseline datamodel: - Change -date: '2020-08-25' description: This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are destroyed in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances destroyed in a small time window. +search: '| tstats count as instances_destroyed from datamodel=Change.All_Changes where + All_Changes.action=deleted AND All_Changes.status=success AND All_Changes.object_category=instance + by _time span=1h | makecontinuous span=1h _time | eval instances_destroyed=coalesce(instances_destroyed, + (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 + | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek + <= 5, 0, 1) | table _time instances_destroyed, HourOfDay, isWeekend | fit DensityFunction + instances_destroyed by "HourOfDay,isWeekend" into cloud_excessive_instances_destroyed_v1 + dist=expon show_density=true' how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users @@ -19,18 +31,8 @@ how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you wi re-run this search to rebuild the model with the latest data.\ More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.' -id: a2f701f8-5296-4d74-829c-0b7eb346d549 known_false_positives: none -name: Baseline Of Cloud Instances Destroyed references: [] -search: '| tstats count as instances_destroyed from datamodel=Change.All_Changes where - All_Changes.action=deleted AND All_Changes.status=success AND All_Changes.object_category=instance - by _time span=1h | makecontinuous span=1h _time | eval instances_destroyed=coalesce(instances_destroyed, - (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 - | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek - <= 5, 0, 1) | table _time instances_destroyed, HourOfDay, isWeekend | fit DensityFunction - instances_destroyed by "HourOfDay,isWeekend" into cloud_excessive_instances_destroyed_v1 - dist=expon show_density=true' tags: analytic_story: - Suspicious Cloud Instance Activities @@ -50,5 +52,3 @@ tags: - Change.All_Changes.status - _time security_domain: network -type: Baseline -version: 1 diff --git a/detections/cloud/baseline_of_cloud_instances_launched.yml b/detections/cloud/baseline_of_cloud_instances_launched.yml index a78593c503..655722626f 100644 --- a/detections/cloud/baseline_of_cloud_instances_launched.yml +++ b/detections/cloud/baseline_of_cloud_instances_launched.yml @@ -1,13 +1,25 @@ +name: Baseline Of Cloud Instances Launched +id: b01bd274-f661-4f9c-bd9f-cf23ff6ae0bc +version: 1 +date: '2020-08-14' author: David Dorsey, Splunk +type: Baseline datamodel: - Change -date: '2020-08-14' description: This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are created in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. +search: '| tstats count as instances_launched from datamodel=Change.All_Changes where + (All_Changes.action=created) AND All_Changes.status=success AND All_Changes.object_category=instance + by _time span=1h | makecontinuous span=1h _time | eval instances_launched=coalesce(instances_launched, + (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 + | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek + <= 5, 0, 1) | table _time instances_launched, HourOfDay, isWeekend | fit DensityFunction + instances_launched by "HourOfDay,isWeekend" into cloud_excessive_instances_created_v1 + dist=expon show_density=true' how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users @@ -19,18 +31,8 @@ how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you wi re-run this search to rebuild the model with the latest data.\ More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.' -id: b01bd274-f661-4f9c-bd9f-cf23ff6ae0bc known_false_positives: none -name: Baseline Of Cloud Instances Launched references: [] -search: '| tstats count as instances_launched from datamodel=Change.All_Changes where - (All_Changes.action=created) AND All_Changes.status=success AND All_Changes.object_category=instance - by _time span=1h | makecontinuous span=1h _time | eval instances_launched=coalesce(instances_launched, - (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 - | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek - <= 5, 0, 1) | table _time instances_launched, HourOfDay, isWeekend | fit DensityFunction - instances_launched by "HourOfDay,isWeekend" into cloud_excessive_instances_created_v1 - dist=expon show_density=true' tags: analytic_story: - Cloud Cryptomining @@ -50,5 +52,3 @@ tags: - Change.All_Changes.status - _time security_domain: network -type: Baseline -version: 1 diff --git a/detections/cloud/baseline_of_cloud_security_group_api_calls_per_user.yml b/detections/cloud/baseline_of_cloud_security_group_api_calls_per_user.yml index 558eeba815..3410996e44 100644 --- a/detections/cloud/baseline_of_cloud_security_group_api_calls_per_user.yml +++ b/detections/cloud/baseline_of_cloud_security_group_api_calls_per_user.yml @@ -1,24 +1,15 @@ +name: Baseline Of Cloud Security Group API Calls Per User +id: 67b84d51-8329-4909-849f-8d38ce54260a +version: 1 +date: '2020-09-07' author: David Dorsey, Splunk +type: Baseline datamodel: - Change -date: '2020-09-07' description: This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls for security groups are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. -how_to_implement: You must have Enterprise Security 6.0 or later, if not you will - need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is - installed, along with any required dependencies. Depending on the number of users - in your environment, you may also need to adjust the value for max_inputs in the - MLTK settings for the DensityFunction algorithm, then ensure that the search completes - in a reasonable timeframe. By default, the search builds the model using the past - 90 days of data. You can modify the search window to build the model over a longer - period of time, which may give you better results. You may also want to periodically - re-run this search to rebuild the model with the latest data. -id: 67b84d51-8329-4909-849f-8d38ce54260a -known_false_positives: none -name: Baseline Of Cloud Security Group API Calls Per User -references: [] search: '| tstats count as security_group_api_calls from datamodel=Change.All_Changes where All_Changes.object_category=firewall All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, @@ -28,6 +19,17 @@ search: '| tstats count as security_group_api_calls from datamodel=Change.All_Ch by user, HourOfDay, isWeekend | where security_group_api_calls >= 1 | fit DensityFunction security_group_api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_security_group_api_calls_v1 dist=norm show_density=true' +how_to_implement: You must have Enterprise Security 6.0 or later, if not you will + need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is + installed, along with any required dependencies. Depending on the number of users + in your environment, you may also need to adjust the value for max_inputs in the + MLTK settings for the DensityFunction algorithm, then ensure that the search completes + in a reasonable timeframe. By default, the search builds the model using the past + 90 days of data. You can modify the search window to build the model over a longer + period of time, which may give you better results. You may also want to periodically + re-run this search to rebuild the model with the latest data. +known_false_positives: none +references: [] tags: analytic_story: - Suspicious Cloud User Activities @@ -46,5 +48,3 @@ tags: - Change.All_Changes.user - _time security_domain: network -type: Baseline -version: 1 diff --git a/detections/cloud/baseline_of_network_acl_activity_by_arn.yml b/detections/cloud/baseline_of_network_acl_activity_by_arn.yml index 75dceeb83a..fbd6859696 100644 --- a/detections/cloud/baseline_of_network_acl_activity_by_arn.yml +++ b/detections/cloud/baseline_of_network_acl_activity_by_arn.yml @@ -1,23 +1,25 @@ -author: Bhavin Patel, Splunk -datamodel: [] +name: Baseline of Network ACL Activity by ARN +id: fc0edd96-ff2b-4810-9f1f-63da3783fd63 +version: 1 date: '2018-05-21' +author: Bhavin Patel, Splunk +type: Baseline +datamodel: [] description: This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls that were related to network ACLs made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail - inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`. -id: fc0edd96-ff2b-4810-9f1f-63da3783fd63 -known_false_positives: none -name: Baseline of Network ACL Activity by ARN -references: [] search: '`cloudtrail` `network_acl_events` | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup network_acl_activity_baseline | stats count' +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail + inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`. +known_false_positives: none +references: [] tags: analytic_story: - AWS Network ACL Activity @@ -32,5 +34,3 @@ tags: required_fields: - _time security_domain: network -type: Baseline -version: 1 diff --git a/detections/cloud/baseline_of_s3_bucket_deletion_activity_by_arn.yml b/detections/cloud/baseline_of_s3_bucket_deletion_activity_by_arn.yml index 77e80588b3..a987df344b 100644 --- a/detections/cloud/baseline_of_s3_bucket_deletion_activity_by_arn.yml +++ b/detections/cloud/baseline_of_s3_bucket_deletion_activity_by_arn.yml @@ -1,22 +1,24 @@ -author: Bhavin Patel, Splunk -datamodel: [] +name: Baseline of S3 Bucket deletion activity by ARN +id: fc0edd96-ff2b-48b0-9f1f-63eq3783fd63 +version: 1 date: '2018-07-17' +author: Bhavin Patel, Splunk +type: Baseline +datamodel: [] description: This search establishes, on a per-hour basis, the average and standard deviation for the number of API calls related to deleting an S3 bucket by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail - inputs. -id: fc0edd96-ff2b-48b0-9f1f-63eq3783fd63 -known_false_positives: none -name: Baseline of S3 Bucket deletion activity by ARN -references: [] search: '`cloudtrail` eventName=DeleteBucket | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup s3_deletion_baseline | stats count' +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail + inputs. +known_false_positives: none +references: [] tags: analytic_story: - Suspicious AWS S3 Activities @@ -31,5 +33,3 @@ tags: required_fields: - _time security_domain: network -type: Baseline -version: 1 diff --git a/detections/cloud/baseline_of_security_group_activity_by_arn.yml b/detections/cloud/baseline_of_security_group_activity_by_arn.yml index 8a1f0738c1..7affa2d965 100644 --- a/detections/cloud/baseline_of_security_group_activity_by_arn.yml +++ b/detections/cloud/baseline_of_security_group_activity_by_arn.yml @@ -1,23 +1,25 @@ -author: Bhavin Patel, Splunk -datamodel: [] +name: Baseline of Security Group Activity by ARN +id: fc0edd96-ff2b-48b0-9f1f-63da3783fd63 +version: 1 date: '2018-04-17' +author: Bhavin Patel, Splunk +type: Baseline +datamodel: [] description: This search establishes, on a per-hour basis, the average and the standard deviation for the number of API calls related to security groups made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail - inputs. To add or remove API event names for security groups, edit the macro `security_group_api_calls`. -id: fc0edd96-ff2b-48b0-9f1f-63da3783fd63 -known_false_positives: none -name: Baseline of Security Group Activity by ARN -references: [] search: '`cloudtrail` `security_group_api_calls` | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup security_group_activity_baseline | stats count' +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail + inputs. To add or remove API event names for security groups, edit the macro `security_group_api_calls`. +known_false_positives: none +references: [] tags: analytic_story: - AWS User Monitoring @@ -32,5 +34,3 @@ tags: required_fields: - _time security_domain: network -type: Baseline -version: 1 diff --git a/detections/cloud/circle_ci_disable_security_job.yml b/detections/cloud/circle_ci_disable_security_job.yml index 6834065f97..764064a4f7 100644 --- a/detections/cloud/circle_ci_disable_security_job.yml +++ b/detections/cloud/circle_ci_disable_security_job.yml @@ -1,12 +1,11 @@ -author: Patrick Bareiss, Splunk -datamodel: [] -date: '2021-09-02' -description: This search looks for disable security job in CircleCI pipeline. -how_to_implement: You must index CircleCI logs. -id: 4a2fdd41-c578-4cd4-9ef7-980e352517f2 -known_false_positives: unknown name: Circle CI Disable Security Job -references: [] +id: 4a2fdd41-c578-4cd4-9ef7-980e352517f2 +version: 1 +date: '2021-09-02' +author: Patrick Bareiss, Splunk +type: Anomaly +datamodel: [] +description: This search looks for disable security job in CircleCI pipeline. search: '`circleci` | rename vcs.committer_name as user vcs.subject as commit_message vcs.url as url workflows.* as * | stats values(job_name) as job_names by workflow_id workflow_name user commit_message url branch | lookup mandatory_job_for_workflow @@ -14,6 +13,9 @@ search: '`circleci` | rename vcs.committer_name as user vcs.subject as commit_me mandatory_job_executed=if(like(job_names, "%".mandatory_job."%"), 1, 0) | where mandatory_job_executed=0 | eval phase="build" | rex field=url "(?[^\/]*\/[^\/]*)$" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `circle_ci_disable_security_job_filter`' +how_to_implement: You must index CircleCI logs. +known_false_positives: unknown +references: [] tags: analytic_story: - Dev Sec Ops @@ -48,5 +50,3 @@ tags: required_fields: [] risk_score: 72 security_domain: network -type: Anomaly -version: 1 diff --git a/detections/cloud/circle_ci_disable_security_step.yml b/detections/cloud/circle_ci_disable_security_step.yml index 39935b2d0b..9d36d9cfbc 100644 --- a/detections/cloud/circle_ci_disable_security_step.yml +++ b/detections/cloud/circle_ci_disable_security_step.yml @@ -1,12 +1,11 @@ -author: Patrick Bareiss, Splunk -datamodel: [] -date: '2021-09-01' -description: This search looks for disable security step in CircleCI pipeline. -how_to_implement: You must index CircleCI logs. -id: 72cb9de9-e98b-4ac9-80b2-5331bba6ea97 -known_false_positives: unknown name: Circle CI Disable Security Step -references: [] +id: 72cb9de9-e98b-4ac9-80b2-5331bba6ea97 +version: 1 +date: '2021-09-01' +author: Patrick Bareiss, Splunk +type: Anomaly +datamodel: [] +description: This search looks for disable security step in CircleCI pipeline. search: '`circleci` | rename workflows.job_id AS job_id | join job_id [ | search `circleci` | stats values(name) as step_names count by job_id job_name ] | stats count by step_names job_id job_name vcs.committer_name vcs.subject vcs.url owners{} | rename vcs.* as @@ -15,6 +14,9 @@ search: '`circleci` | rename workflows.job_id AS job_id | join job_id [ | search "%".mandatory_step."%"), 1, 0) | where mandatory_step_executed=0 | rex field=url "(?[^\/]*\/[^\/]*)$" | eval phase="build" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `circle_ci_disable_security_step_filter`' +how_to_implement: You must index CircleCI logs. +known_false_positives: unknown +references: [] tags: analytic_story: - Dev Sec Ops @@ -48,5 +50,3 @@ tags: required_fields: [] risk_score: 72 security_domain: network -type: Anomaly -version: 1 diff --git a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml index e5f1cd9144..39c08d8c85 100644 --- a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml +++ b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml @@ -1,20 +1,12 @@ +name: Cloud API Calls From Previously Unseen User Roles +id: 2181ad1f-1e73-4d0c-9780-e8880482a08f +version: 1 +date: '2020-09-04' author: David Dorsey, Splunk +type: Anomaly datamodel: - Change -date: '2020-09-04' description: This search looks for new commands from each user role. -how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud - provider. You should run the baseline search `Previously Seen Cloud API Calls Per - User Role - Initial` to build the initial table of user roles, commands, and times. - You must also enable the second baseline search `Previously Seen Cloud API Calls - Per User Role - Update` to keep this table up to date and to age out old data. You - can adjust the time window for this search by updating the `cloud_api_calls_from_previously_unseen_user_roles_activity_window` - macro. You can also provide additional filtering for this search by customizing - the `cloud_api_calls_from_previously_unseen_user_roles_filter` -id: 2181ad1f-1e73-4d0c-9780-e8880482a08f -known_false_positives: . -name: Cloud API Calls From Previously Unseen User Roles -references: [] search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command All_Changes.object | `drop_dm_object_name("All_Changes")` | @@ -24,6 +16,16 @@ search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from d OR firstTimeSeenUserApiCall > relative_time(now(),"-24h@h") | table firstTime, user, object, command |`security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `cloud_api_calls_from_previously_unseen_user_roles_filter`' +how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud + provider. You should run the baseline search `Previously Seen Cloud API Calls Per + User Role - Initial` to build the initial table of user roles, commands, and times. + You must also enable the second baseline search `Previously Seen Cloud API Calls + Per User Role - Update` to keep this table up to date and to age out old data. You + can adjust the time window for this search by updating the `cloud_api_calls_from_previously_unseen_user_roles_activity_window` + macro. You can also provide additional filtering for this search by customizing + the `cloud_api_calls_from_previously_unseen_user_roles_filter` +known_false_positives: . +references: [] tags: analytic_story: - Suspicious Cloud User Activities @@ -66,5 +68,3 @@ tags: - _time risk_score: 36 security_domain: threat -type: Anomaly -version: 1 diff --git a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml index e5ee505d2f..66dd94ca2e 100644 --- a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml +++ b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml @@ -1,18 +1,13 @@ +name: Cloud Compute Instance Created By Previously Unseen User +id: 37a0ec8d-827e-4d6d-8025-cedf31f3a149 +version: 2 +date: '2021-07-13' author: Rico Valdez, Splunk +type: Anomaly datamodel: - Change -date: '2021-07-13' description: This search looks for cloud compute instances created by users who have not created them before. -how_to_implement: You must be ingesting the appropriate cloud-infrastructure logs - Run the "Previously Seen Cloud Compute Creations By User" support search to create - of baseline of previously seen users. -id: 37a0ec8d-827e-4d6d-8025-cedf31f3a149 -known_false_positives: It's possible that a user will start to create compute instances - for the first time, for any number of reasons. Verify with the user launching instances - that this is the intended behavior. -name: Cloud Compute Instance Created By Previously Unseen User -references: [] search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object) as dest from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.user All_Changes.vendor_region | @@ -22,6 +17,13 @@ search: '| tstats `security_content_summariesonly` count earliest(_time) as firs | where isnull(firstTimeSeenUser) OR firstTimeSeenUser > relative_time(now(), "-24h@h") | table firstTime, user, dest, count vendor_region | `security_content_ctime(firstTime)` | `cloud_compute_instance_created_by_previously_unseen_user_filter`' +how_to_implement: You must be ingesting the appropriate cloud-infrastructure logs + Run the "Previously Seen Cloud Compute Creations By User" support search to create + of baseline of previously seen users. +known_false_positives: It's possible that a user will start to create compute instances + for the first time, for any number of reasons. Verify with the user launching instances + that this is the intended behavior. +references: [] tags: analytic_story: - Cloud Cryptomining @@ -67,5 +69,3 @@ tags: - _time risk_score: 18 security_domain: threat -type: Anomaly -version: 2 diff --git a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml index 9379a61db4..dffeae0885 100644 --- a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml +++ b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml @@ -1,22 +1,14 @@ +name: Cloud Compute Instance Created In Previously Unused Region +id: fa4089e2-50e3-40f7-8469-d2cc1564ca59 +version: 1 +date: '2020-09-02' author: David Dorsey, Splunk +type: Anomaly datamodel: - Change -date: '2020-09-02' description: This search looks at cloud-infrastructure events where an instance is created in any region within the last hour and then compares it to a lookup file of previously seen regions where instances have been created. -how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud - provider. You should run the baseline search `Previously Seen Cloud Regions - Initial` - to build the initial table of images observed and times. You must also enable the - second baseline search `Previously Seen Cloud Regions - Update` to keep this table - up to date and to age out old data. You can also provide additional filtering for - this search by customizing the `cloud_compute_instance_created_in_previously_unused_region_filter` - macro. -id: fa4089e2-50e3-40f7-8469-d2cc1564ca59 -known_false_positives: It's possible that a user has unknowingly started an instance - in a new region. Please verify that this activity is legitimate. -name: Cloud Compute Instance Created In Previously Unused Region -references: [] search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime values(All_Changes.object_id) as dest, count from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.vendor_region, All_Changes.user | `drop_dm_object_name("All_Changes")` @@ -25,6 +17,16 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime values( enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) | where isnull(firstTimeSeenRegion) OR firstTimeSeenRegion > relative_time(now(), "-24h@h") | table firstTime, user, dest, count , vendor_region | `security_content_ctime(firstTime)` | `cloud_compute_instance_created_in_previously_unused_region_filter`' +how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud + provider. You should run the baseline search `Previously Seen Cloud Regions - Initial` + to build the initial table of images observed and times. You must also enable the + second baseline search `Previously Seen Cloud Regions - Update` to keep this table + up to date and to age out old data. You can also provide additional filtering for + this search by customizing the `cloud_compute_instance_created_in_previously_unused_region_filter` + macro. +known_false_positives: It's possible that a user has unknowingly started an instance + in a new region. Please verify that this activity is legitimate. +references: [] tags: analytic_story: - Cloud Cryptomining @@ -72,5 +74,3 @@ tags: - _time risk_score: 42 security_domain: threat -type: Anomaly -version: 1 diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml index 94106c2411..1561a1e258 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml @@ -1,22 +1,13 @@ +name: Cloud Compute Instance Created With Previously Unseen Image +id: bc24922d-987c-4645-b288-f8c73ec194c4 +version: 1 +date: '2018-10-12' author: David Dorsey, Splunk +type: Anomaly datamodel: - Change -date: '2018-10-12' description: This search looks for cloud compute instances being created with previously unseen image IDs. -how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud - provider. You should run the baseline search `Previously Seen Cloud Compute Images - - Initial` to build the initial table of images observed and times. You must also - enable the second baseline search `Previously Seen Cloud Compute Images - Update` - to keep this table up to date and to age out old data. You can also provide additional - filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_image_filter` - macro. -id: bc24922d-987c-4645-b288-f8c73ec194c4 -known_false_positives: After a new image is created, the first systems created with - that image will cause this alert to fire. Verify that the image being used was - created by a legitimate user. -name: Cloud Compute Instance Created With Previously Unseen Image -references: [] search: '| tstats count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as dest from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.Instance_Changes.image_id, All_Changes.user | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")` @@ -25,6 +16,17 @@ search: '| tstats count earliest(_time) as firstTime, latest(_time) as lastTime | where enough_data=1 | eval firstTimeSeenImage=min(firstTimeSeen) | where isnull(firstTimeSeenImage) OR firstTimeSeenImage > relative_time(now(), "-24h@h") | table firstTime, user, image_id, count, dest | `security_content_ctime(firstTime)` | `cloud_compute_instance_created_with_previously_unseen_image_filter`' +how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud + provider. You should run the baseline search `Previously Seen Cloud Compute Images + - Initial` to build the initial table of images observed and times. You must also + enable the second baseline search `Previously Seen Cloud Compute Images - Update` + to keep this table up to date and to age out old data. You can also provide additional + filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_image_filter` + macro. +known_false_positives: After a new image is created, the first systems created with + that image will cause this alert to fire. Verify that the image being used was + created by a legitimate user. +references: [] tags: analytic_story: - Cloud Cryptomining @@ -66,5 +68,3 @@ tags: - _time risk_score: 36 security_domain: threat -type: Anomaly -version: 1 diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml index c487851af3..be8b33db71 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml @@ -1,21 +1,12 @@ +name: Cloud Compute Instance Created With Previously Unseen Instance Type +id: c6ddbf53-9715-49f3-bb4c-fb2e8a309cda +version: 1 +date: '2020-09-12' author: David Dorsey, Splunk +type: Anomaly datamodel: - Change -date: '2020-09-12' description: Find EC2 instances being created with previously unseen instance types. -how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud - provider. You should run the baseline search `Previously Seen Cloud Compute Instance - Types - Initial` to build the initial table of instance types observed and times. - You must also enable the second baseline search `Previously Seen Cloud Compute Instance - Types - Update` to keep this table up to date and to age out old data. You can also - provide additional filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_instance_type_filter` - macro. -id: c6ddbf53-9715-49f3-bb4c-fb2e8a309cda -known_false_positives: It is possible that an admin will create a new system using - a new instance type that has never been used before. Verify with the creator that - they intended to create the system with the new instance type. -name: Cloud Compute Instance Created With Previously Unseen Instance Type -references: [] search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as dest, count from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.Instance_Changes.instance_type, All_Changes.user | `drop_dm_object_name("All_Changes")` @@ -26,6 +17,17 @@ search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime values isnull(firstTimeSeenInstanceType) OR firstTimeSeenInstanceType > relative_time(now(), "-24h@h") | table firstTime, user, dest, count, instance_type | `security_content_ctime(firstTime)` | `cloud_compute_instance_created_with_previously_unseen_instance_type_filter`' +how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud + provider. You should run the baseline search `Previously Seen Cloud Compute Instance + Types - Initial` to build the initial table of instance types observed and times. + You must also enable the second baseline search `Previously Seen Cloud Compute Instance + Types - Update` to keep this table up to date and to age out old data. You can also + provide additional filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_instance_type_filter` + macro. +known_false_positives: It is possible that an admin will create a new system using + a new instance type that has never been used before. Verify with the creator that + they intended to create the system with the new instance type. +references: [] tags: analytic_story: - Cloud Cryptomining @@ -67,5 +69,3 @@ tags: - _time risk_score: 30 security_domain: threat -type: Anomaly -version: 1 diff --git a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml index 95dc6d5b65..3d2f6e5e46 100644 --- a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml +++ b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml @@ -1,19 +1,13 @@ +name: Cloud Instance Modified By Previously Unseen User +id: 7fb15084-b14e-405a-bd61-a6de15a40722 +version: 1 +date: '2020-07-29' author: Rico Valdez, Splunk +type: Anomaly datamodel: - Change -date: '2020-07-29' description: This search looks for cloud instances being modified by users who have not previously modified them. -how_to_implement: This search has a dependency on other searches to create and update - a baseline of users observed to be associated with this activity. The search "Previously - Seen Cloud Instance Modifications By User - Update" should be enabled for this detection - to properly work. -id: 7fb15084-b14e-405a-bd61-a6de15a40722 -known_false_positives: It's possible that a new user will start to modify EC2 instances - when they haven't before for any number of reasons. Verify with the user that is - modifying instances that this is the intended behavior. -name: Cloud Instance Modified By Previously Unseen User -references: [] search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as object_id values(All_Changes.command) as command from datamodel=Change.All_Changes where All_Changes.action=modified All_Changes.change_type=EC2 @@ -23,6 +17,14 @@ search: '| tstats `security_content_summariesonly` count earliest(_time) as firs enough_data=1 | eval firstTimeSeenUser=min(firstTimeSeen) | where isnull(firstTimeSeenUser) OR firstTimeSeenUser > relative_time(now(), "-24h@h") | table firstTime user command object_id count | `security_content_ctime(firstTime)` | `cloud_instance_modified_by_previously_unseen_user_filter`' +how_to_implement: This search has a dependency on other searches to create and update + a baseline of users observed to be associated with this activity. The search "Previously + Seen Cloud Instance Modifications By User - Update" should be enabled for this detection + to properly work. +known_false_positives: It's possible that a new user will start to modify EC2 instances + when they haven't before for any number of reasons. Verify with the user that is + modifying instances that this is the intended behavior. +references: [] tags: analytic_story: - Suspicious Cloud Instance Activities @@ -69,5 +71,3 @@ tags: - _time risk_score: 42 security_domain: threat -type: Anomaly -version: 1 diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml index 2d34edc5c1..5c8ef69c86 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml @@ -1,10 +1,24 @@ +name: Cloud Provisioning Activity From Previously Unseen City +id: e7ecc5e0-88df-48b9-91af-51104c68f02f +version: 1 +date: '2020-10-09' author: Rico Valdez, Bhavin Patel, Splunk +type: Anomaly datamodel: - Change -date: '2020-10-09' description: This search looks for cloud provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that runs or creates something. +search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes + where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success + by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | + `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(City) | + lookup previously_seen_cloud_provisioning_activity_sources City as City OUTPUT firstTimeSeen, + enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | + eval firstTimeSeenCity=min(firstTimeSeen) | where isnull(firstTimeSeenCity) OR firstTimeSeenCity + > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) | + table firstTime, src, City, user, object, command | `cloud_provisioning_activity_from_previously_unseen_city_filter` + | `security_content_ctime(firstTime)`' how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic @@ -14,7 +28,6 @@ how_to_implement: You must be ingesting your cloud infrastructure logs from your the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_city_filter` macro. -id: e7ecc5e0-88df-48b9-91af-51104c68f02f known_false_positives: "This is a strictly behavioral search, so we define \"false\ \ positive\" slightly differently. Every time this fires, it will accurately reflect\ \ the first occurrence in the time period you're searching within, plus what is\ @@ -26,18 +39,7 @@ known_false_positives: "This is a strictly behavioral search, so we define \"fal \ where the free version of **MaxMind GeoIP** that ships by default with Splunk\ \ has weak resolution (particularly small countries in less economically powerful\ \ regions), this may be much less valuable to you." -name: Cloud Provisioning Activity From Previously Unseen City references: [] -search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes - where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success - by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | - `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(City) | - lookup previously_seen_cloud_provisioning_activity_sources City as City OUTPUT firstTimeSeen, - enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | - eval firstTimeSeenCity=min(firstTimeSeen) | where isnull(firstTimeSeenCity) OR firstTimeSeenCity - > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) | - table firstTime, src, City, user, object, command | `cloud_provisioning_activity_from_previously_unseen_city_filter` - | `security_content_ctime(firstTime)`' tags: analytic_story: - Suspicious Cloud Provisioning Activities @@ -88,5 +90,3 @@ tags: - _time risk_score: 18 security_domain: threat -type: Anomaly -version: 1 diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml index d8c1937871..a53f69ccc4 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml @@ -1,10 +1,24 @@ +name: Cloud Provisioning Activity From Previously Unseen Country +id: 94994255-3acf-4213-9b3f-0494df03bb31 +version: 1 +date: '2020-10-09' author: Rico Valdez, Bhavin Patel, Splunk +type: Anomaly datamodel: - Change -date: '2020-10-09' description: This search looks for cloud provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that runs or creates something. +search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes + where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success + by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | + `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country) + | lookup previously_seen_cloud_provisioning_activity_sources Country as Country + OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | + where enough_data=1 | eval firstTimeSeenCountry=min(firstTimeSeen) | where isnull(firstTimeSeenCountry) + OR firstTimeSeenCountry > relative_time(now(), "-24h@h") | table firstTime, src, + Country, user, object, command | `cloud_provisioning_activity_from_previously_unseen_country_filter` + | `security_content_ctime(firstTime)`' how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic @@ -14,7 +28,6 @@ how_to_implement: You must be ingesting your cloud infrastructure logs from your the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_country_filter` macro. -id: 94994255-3acf-4213-9b3f-0494df03bb31 known_false_positives: "This is a strictly behavioral search, so we define \"false\ \ positive\" slightly differently. Every time this fires, it will accurately reflect\ \ the first occurrence in the time period you're searching within, plus what is\ @@ -26,18 +39,7 @@ known_false_positives: "This is a strictly behavioral search, so we define \"fal \ where the free version of **MaxMind GeoIP** that ships by default with Splunk\ \ has weak resolution (particularly small countries in less economically powerful\ \ regions), this may be much less valuable to you." -name: Cloud Provisioning Activity From Previously Unseen Country references: [] -search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes - where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success - by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | - `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country) - | lookup previously_seen_cloud_provisioning_activity_sources Country as Country - OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | - where enough_data=1 | eval firstTimeSeenCountry=min(firstTimeSeen) | where isnull(firstTimeSeenCountry) - OR firstTimeSeenCountry > relative_time(now(), "-24h@h") | table firstTime, src, - Country, user, object, command | `cloud_provisioning_activity_from_previously_unseen_country_filter` - | `security_content_ctime(firstTime)`' tags: analytic_story: - Suspicious Cloud Provisioning Activities @@ -88,5 +90,3 @@ tags: - _time risk_score: 42 security_domain: threat -type: Anomaly -version: 1 diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml index f77387d358..e5c8a92572 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml @@ -1,10 +1,23 @@ +name: Cloud Provisioning Activity From Previously Unseen IP Address +id: f86a8ec9-b042-45eb-92f4-e9ed1d781078 +version: 1 +date: '2020-08-16' author: Rico Valdez, Splunk +type: Anomaly datamodel: - Change -date: '2020-08-16' description: This search looks for cloud provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that runs or creates something. +search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime, values(All_Changes.object_id) + as object_id from datamodel=Change.All_Changes where (All_Changes.action=started + OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, + All_Changes.command | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_provisioning_activity_sources + src as src OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data + | where enough_data=1 | eval firstTimeSeenSrc=min(firstTimeSeen) | where isnull(firstTimeSeenSrc) + OR firstTimeSeenSrc > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) + | table firstTime, src, user, object_id, command | `cloud_provisioning_activity_from_previously_unseen_ip_address_filter` + | `security_content_ctime(firstTime)`' how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic @@ -14,7 +27,6 @@ how_to_implement: You must be ingesting your cloud infrastructure logs from your the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_ip_address_filter` macro. -id: f86a8ec9-b042-45eb-92f4-e9ed1d781078 known_false_positives: "This is a strictly behavioral search, so we define \"false\ \ positive\" slightly differently. Every time this fires, it will accurately reflect\ \ the first occurrence in the time period you're searching within, plus what is\ @@ -26,17 +38,7 @@ known_false_positives: "This is a strictly behavioral search, so we define \"fal \ where the free version of **MaxMind GeoIP** that ships by default with Splunk\ \ has weak resolution (particularly small countries in less economically powerful\ \ regions), this may be much less valuable to you." -name: Cloud Provisioning Activity From Previously Unseen IP Address references: [] -search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime, values(All_Changes.object_id) - as object_id from datamodel=Change.All_Changes where (All_Changes.action=started - OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, - All_Changes.command | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_provisioning_activity_sources - src as src OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data - | where enough_data=1 | eval firstTimeSeenSrc=min(firstTimeSeen) | where isnull(firstTimeSeenSrc) - OR firstTimeSeenSrc > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) - | table firstTime, src, user, object_id, command | `cloud_provisioning_activity_from_previously_unseen_ip_address_filter` - | `security_content_ctime(firstTime)`' tags: analytic_story: - Suspicious Cloud Provisioning Activities @@ -87,5 +89,3 @@ tags: - _time risk_score: 42 security_domain: threat -type: Anomaly -version: 1 diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml index ece2e930ce..b93709ed46 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml @@ -1,10 +1,24 @@ +name: Cloud Provisioning Activity From Previously Unseen Region +id: 5aba1860-9617-4af9-b19d-aecac16fe4f2 +version: 1 +date: '2020-08-16' author: Rico Valdez, Bhavin Patel, Splunk +type: Anomaly datamodel: - Change -date: '2020-08-16' description: This search looks for cloud provisioning activities from previously unseen regions. Provisioning activities are defined broadly as any event that runs or creates something. +search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes + where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success + by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | + `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Region) + | lookup previously_seen_cloud_provisioning_activity_sources Region as Region OUTPUT + firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where + enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) | where isnull(firstTimeSeenRegion) + OR firstTimeSeenRegion > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) + | table firstTime, src, Region, user, object, command | `cloud_provisioning_activity_from_previously_unseen_region_filter` + | `security_content_ctime(firstTime)`' how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic @@ -14,7 +28,6 @@ how_to_implement: You must be ingesting your cloud infrastructure logs from your the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_region_filter` macro. -id: 5aba1860-9617-4af9-b19d-aecac16fe4f2 known_false_positives: "This is a strictly behavioral search, so we define \"false\ \ positive\" slightly differently. Every time this fires, it will accurately reflect\ \ the first occurrence in the time period you're searching within, plus what is\ @@ -26,18 +39,7 @@ known_false_positives: "This is a strictly behavioral search, so we define \"fal \ where the free version of **MaxMind GeoIP** that ships by default with Splunk\ \ has weak resolution (particularly small countries in less economically powerful\ \ regions), this may be much less valuable to you." -name: Cloud Provisioning Activity From Previously Unseen Region references: [] -search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes - where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success - by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | - `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Region) - | lookup previously_seen_cloud_provisioning_activity_sources Region as Region OUTPUT - firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where - enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) | where isnull(firstTimeSeenRegion) - OR firstTimeSeenRegion > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) - | table firstTime, src, Region, user, object, command | `cloud_provisioning_activity_from_previously_unseen_region_filter` - | `security_content_ctime(firstTime)`' tags: analytic_story: - Suspicious Cloud Provisioning Activities @@ -88,5 +90,3 @@ tags: - _time risk_score: 42 security_domain: threat -type: Anomaly -version: 1 diff --git a/detections/cloud/correlation_by_repository_and_risk.yml b/detections/cloud/correlation_by_repository_and_risk.yml index d0e83c1b20..8416613cd9 100644 --- a/detections/cloud/correlation_by_repository_and_risk.yml +++ b/detections/cloud/correlation_by_repository_and_risk.yml @@ -1,15 +1,17 @@ -author: Patrick Bareiss, Splunk -datamodel: [] -date: '2021-09-06' -description: This search correlations detections by repository and risk_score -how_to_implement: For Dev Sec Ops POC -id: 8da9fdd9-6a1b-4ae0-8a34-8c25e6be9687 -known_false_positives: unknown name: Correlation by Repository and Risk -references: [] +id: 8da9fdd9-6a1b-4ae0-8a34-8c25e6be9687 +version: 1 +date: '2021-09-06' +author: Patrick Bareiss, Splunk +type: Correlation +datamodel: [] +description: This search correlations detections by repository and risk_score search: '`signals` | fillnull | stats sum(risk_score) as risk_score values(source) as signals values(user) as user by repository | sort - risk_score | where risk_score > 80 | `correlation_by_repository_and_risk_filter`' +how_to_implement: For Dev Sec Ops POC +known_false_positives: unknown +references: [] tags: analytic_story: - Dev Sec Ops @@ -43,5 +45,3 @@ tags: required_fields: [] risk_score: 70 security_domain: network -type: Correlation -version: 1 diff --git a/detections/cloud/correlation_by_user_and_risk.yml b/detections/cloud/correlation_by_user_and_risk.yml index ab6fb71f9f..38a63ec529 100644 --- a/detections/cloud/correlation_by_user_and_risk.yml +++ b/detections/cloud/correlation_by_user_and_risk.yml @@ -1,15 +1,17 @@ -author: Patrick Bareiss, Splunk -datamodel: [] -date: '2021-09-06' -description: This search correlations detections by user and risk_score -how_to_implement: For Dev Sec Ops POC -id: 610e12dc-b6fa-4541-825e-4a0b3b6f6773 -known_false_positives: unknown name: Correlation by User and Risk -references: [] +id: 610e12dc-b6fa-4541-825e-4a0b3b6f6773 +version: 1 +date: '2021-09-06' +author: Patrick Bareiss, Splunk +type: Correlation +datamodel: [] +description: This search correlations detections by user and risk_score search: '`signals` | fillnull | stats sum(risk_score) as risk_score values(source) as signals values(repository) as repository by user | sort - risk_score | where risk_score > 80 | `correlation_by_user_and_risk_filter`' +how_to_implement: For Dev Sec Ops POC +known_false_positives: unknown +references: [] tags: analytic_story: - Dev Sec Ops @@ -43,5 +45,3 @@ tags: required_fields: [] risk_score: 70 security_domain: network -type: Correlation -version: 1 diff --git a/detections/cloud/create_a_list_of_approved_aws_service_accounts.yml b/detections/cloud/create_a_list_of_approved_aws_service_accounts.yml index 7b012247fe..65b4c76a41 100644 --- a/detections/cloud/create_a_list_of_approved_aws_service_accounts.yml +++ b/detections/cloud/create_a_list_of_approved_aws_service_accounts.yml @@ -1,21 +1,23 @@ -author: Bhavin Patel, Splunk -datamodel: [] +name: Create a list of approved AWS service accounts +id: fc0edc95-ff2b-48b1-5f6f-63ga3789fd43 +version: 2 date: '2018-12-03' +author: Bhavin Patel, Splunk +type: Baseline +datamodel: [] description: This search looks for successful API activity in CloudTrail within the last 30 days, filters out known users from the identity table, and outputs values of users into `aws_service_accounts.csv` lookup file. +search: '`cloudtrail` errorCode=success | rename userName as identity | search NOT + [inputlookup identity_lookup_expanded | fields identity] | stats count by identity + | table identity | outputlookup aws_service_accounts | stats count' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the service account entires in `aws_service_accounts.csv`, which is a lookup file created as a result of running this support search. Please remove the entries of service accounts that are not legitimate. -id: fc0edc95-ff2b-48b1-5f6f-63ga3789fd43 known_false_positives: none -name: Create a list of approved AWS service accounts references: [] -search: '`cloudtrail` errorCode=success | rename userName as identity | search NOT - [inputlookup identity_lookup_expanded | fields identity] | stats count by identity - | table identity | outputlookup aws_service_accounts | stats count' tags: analytic_story: - AWS User Monitoring @@ -31,5 +33,3 @@ tags: - errorCode - userName security_domain: network -type: Baseline -version: 2 diff --git a/detections/cloud/detect_aws_console_login_by_new_user.yml b/detections/cloud/detect_aws_console_login_by_new_user.yml index 41bdc4acb5..fbc71c3f4f 100644 --- a/detections/cloud/detect_aws_console_login_by_new_user.yml +++ b/detections/cloud/detect_aws_console_login_by_new_user.yml @@ -1,25 +1,16 @@ +name: Detect AWS Console Login by New User +id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71 +version: 1 +date: '2020-05-28' author: Rico Valdez, Splunk +type: Hunting datamodel: - Authentication -date: '2020-05-28' description: This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -how_to_implement: You must install and configure the Splunk Add-on for AWS (version - 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates - to the Authentication data model for cloud use cases. Run the `Previously Seen Users - in AWS CloudTrail - Initial` support search only once to create a baseline of previously - seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - - Update` hourly (or more frequently depending on how often you run the detection - searches) to refresh the baselines. -id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71 -known_false_positives: When a legitimate new user logins for the first time, this - activity will be detected. Check how old the account is and verify that the user - activity is legitimate. -name: Detect AWS Console Login by New User -references: [] search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication where Authentication.signature=ConsoleLogin by Authentication.user | `drop_dm_object_name(Authentication)` | join user type=outer [ inputlookup previously_seen_users_console_logins | stats @@ -27,6 +18,17 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da "-24h@h") OR isnull(earliestseen), "First Time Logging into AWS Console", "Previously Seen User") | where userStatus="First Time Logging into AWS Console" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_aws_console_login_by_new_user_filter`' +how_to_implement: You must install and configure the Splunk Add-on for AWS (version + 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates + to the Authentication data model for cloud use cases. Run the `Previously Seen Users + in AWS CloudTrail - Initial` support search only once to create a baseline of previously + seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail + - Update` hourly (or more frequently depending on how often you run the detection + searches) to refresh the baselines. +known_false_positives: When a legitimate new user logins for the first time, this + activity will be detected. Check how old the account is and verify that the user + activity is legitimate. +references: [] tags: analytic_story: - Suspicious Cloud Authentication Activities @@ -65,5 +67,3 @@ tags: - _time risk_score: 30 security_domain: threat -type: Hunting -version: 1 diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml index 56801f4ed3..78a2f6cd03 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml @@ -1,27 +1,16 @@ +name: Detect AWS Console Login by User from New City +id: 121b0b11-f8ac-4ed6-a132-3800ca4fc07a +version: 1 +date: '2020-10-07' author: Bhavin Patel, Splunk +type: Hunting datamodel: - Authentication -date: '2020-10-07' description: This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -how_to_implement: You must install and configure the Splunk Add-on for AWS (version - 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates - to the Authentication data model for cloud use cases. Run the `Previously Seen Users - in AWS CloudTrail - Initial` support search only once to create a baseline of previously - seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - - Update` hourly (or more frequently depending on how often you run the detection - searches) to refresh the baselines. You can also provide additional filtering for - this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter` - macro. -id: 121b0b11-f8ac-4ed6-a132-3800ca4fc07a -known_false_positives: When a legitimate new user logins for the first time, this - activity will be detected. Check how old the account is and verify that the user - activity is legitimate. -name: Detect AWS Console Login by User from New City -references: [] search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table @@ -32,6 +21,19 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da OR isnull(earliestseen), "New User","Old User") | where userCity = "New City" AND userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table firstTime lastTime user City userStatus userCity | `detect_aws_console_login_by_user_from_new_city_filter`' +how_to_implement: You must install and configure the Splunk Add-on for AWS (version + 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates + to the Authentication data model for cloud use cases. Run the `Previously Seen Users + in AWS CloudTrail - Initial` support search only once to create a baseline of previously + seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail + - Update` hourly (or more frequently depending on how often you run the detection + searches) to refresh the baselines. You can also provide additional filtering for + this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter` + macro. +known_false_positives: When a legitimate new user logins for the first time, this + activity will be detected. Check how old the account is and verify that the user + activity is legitimate. +references: [] tags: analytic_story: - Suspicious AWS Login Activities @@ -75,5 +77,3 @@ tags: - _time risk_score: 18 security_domain: threat -type: Hunting -version: 1 diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml index afd1ef9878..d8e3fdaa21 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml @@ -1,27 +1,16 @@ +name: Detect AWS Console Login by User from New Country +id: 67bd3def-c41c-4bf6-837b-ae196b4257c6 +version: 1 +date: '2020-10-07' author: Bhavin Patel, Splunk +type: Hunting datamodel: - Authentication -date: '2020-10-07' description: This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -how_to_implement: You must install and configure the Splunk Add-on for AWS (version - 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates - to the Authentication data model for cloud use cases. Run the `Previously Seen Users - in AWS CloudTrail - Initial` support search only once to create a baseline of previously - seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - - Update` hourly (or more frequently depending on how often you run the detection - searches) to refresh the baselines. You can also provide additional filtering for - this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter` - macro. -id: 67bd3def-c41c-4bf6-837b-ae196b4257c6 -known_false_positives: When a legitimate new user logins for the first time, this - activity will be detected. Check how old the account is and verify that the user - activity is legitimate. -name: Detect AWS Console Login by User from New Country -references: [] search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table @@ -32,6 +21,19 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da OR isnull(earliestseen), "New User","Old User") | where userCountry = "New Country" AND userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table firstTime lastTime user Country userStatus userCountry | `detect_aws_console_login_by_user_from_new_country_filter`' +how_to_implement: You must install and configure the Splunk Add-on for AWS (version + 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates + to the Authentication data model for cloud use cases. Run the `Previously Seen Users + in AWS CloudTrail - Initial` support search only once to create a baseline of previously + seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail + - Update` hourly (or more frequently depending on how often you run the detection + searches) to refresh the baselines. You can also provide additional filtering for + this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter` + macro. +known_false_positives: When a legitimate new user logins for the first time, this + activity will be detected. Check how old the account is and verify that the user + activity is legitimate. +references: [] tags: analytic_story: - Suspicious AWS Login Activities @@ -75,5 +77,3 @@ tags: - _time risk_score: 42 security_domain: threat -type: Hunting -version: 1 diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml index 2cb0094cf4..e5da161414 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml @@ -1,27 +1,16 @@ +name: Detect AWS Console Login by User from New Region +id: 9f31aa8e-e37c-46bc-bce1-8b3be646d026 +version: 1 +date: '2020-10-07' author: Bhavin Patel, Splunk +type: Hunting datamodel: - Authentication -date: '2020-10-07' description: This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -how_to_implement: You must install and configure the Splunk Add-on for AWS (version - 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates - to the Authentication data model for cloud use cases. Run the `Previously Seen Users - in AWS CloudTrail - Initial` support search only once to create a baseline of previously - seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - - Update` hourly (or more frequently depending on how often you run the detection - searches) to refresh the baselines. You can also provide additional filtering for - this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter` - macro. -id: 9f31aa8e-e37c-46bc-bce1-8b3be646d026 -known_false_positives: When a legitimate new user logins for the first time, this - activity will be detected. Check how old the account is and verify that the user - activity is legitimate. -name: Detect AWS Console Login by User from New Region -references: [] search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table @@ -32,6 +21,19 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da OR isnull(earliestseen), "New User","Old User") | where userRegion = "New Region" AND userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table firstTime lastTime user Region userStatus userRegion | `detect_aws_console_login_by_user_from_new_region_filter`' +how_to_implement: You must install and configure the Splunk Add-on for AWS (version + 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates + to the Authentication data model for cloud use cases. Run the `Previously Seen Users + in AWS CloudTrail - Initial` support search only once to create a baseline of previously + seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail + - Update` hourly (or more frequently depending on how often you run the detection + searches) to refresh the baselines. You can also provide additional filtering for + this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter` + macro. +known_false_positives: When a legitimate new user logins for the first time, this + activity will be detected. Check how old the account is and verify that the user + activity is legitimate. +references: [] tags: analytic_story: - Suspicious AWS Login Activities @@ -75,5 +77,3 @@ tags: - _time risk_score: 36 security_domain: threat -type: Hunting -version: 1 diff --git a/detections/cloud/detect_new_open_s3_buckets.yml b/detections/cloud/detect_new_open_s3_buckets.yml index aaf848bbde..48ddeb8e96 100644 --- a/detections/cloud/detect_new_open_s3_buckets.yml +++ b/detections/cloud/detect_new_open_s3_buckets.yml @@ -1,16 +1,12 @@ -author: Bhavin Patel, Patrick Bareiss, Splunk -datamodel: [] +name: Detect New Open S3 buckets +id: 2a9b80d3-6340-4345-b5ad-290bf3d0dac4 +version: 3 date: '2021-07-19' +author: Bhavin Patel, Patrick Bareiss, Splunk +type: TTP +datamodel: [] description: This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket. -how_to_implement: You must install the AWS App for Splunk. -id: 2a9b80d3-6340-4345-b5ad-290bf3d0dac4 -known_false_positives: While this search has no known false positives, it is possible - that an AWS admin has legitimately created a public bucket for a specific purpose. - That said, AWS strongly advises against granting full control to the "All Users" - group. -name: Detect New Open S3 buckets -references: [] search: '`cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex field=_raw "(?{.+})" | spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{} | search grantees=* | mvexpand grantees | spath input=grantees output=uri path=Grantee.URI @@ -20,6 +16,12 @@ search: '`cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex max(_time) as lastTime by user_arn userIdentity.principalId userAgent uri permission bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_filter` ' +how_to_implement: You must install the AWS App for Splunk. +known_false_positives: While this search has no known false positives, it is possible + that an AWS admin has legitimately created a public bucket for a specific purpose. + That said, AWS strongly advises against granting full control to the "All Users" + group. +references: [] tags: analytic_story: - Suspicious AWS S3 Activities @@ -70,5 +72,3 @@ tags: - user_arn risk_score: 48 security_domain: threat -type: TTP -version: 3 diff --git a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml index 5dc6ba9855..a61a171257 100644 --- a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml +++ b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml @@ -1,16 +1,12 @@ -author: Patrick Bareiss, Splunk -datamodel: [] +name: Detect New Open S3 Buckets over AWS CLI +id: 39c61d09-8b30-4154-922b-2d0a694ecc22 +version: 2 date: '2021-07-19' +author: Patrick Bareiss, Splunk +type: TTP +datamodel: [] description: This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. -how_to_implement: '' -id: 39c61d09-8b30-4154-922b-2d0a694ecc22 -known_false_positives: While this search has no known false positives, it is possible - that an AWS admin has legitimately created a public bucket for a specific purpose. - That said, AWS strongly advises against granting full control to the "All Users" - group. -name: Detect New Open S3 Buckets over AWS CLI -references: [] search: '`cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write @@ -22,6 +18,12 @@ search: '`cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR u requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_over_aws_cli_filter` ' +how_to_implement: '' +known_false_positives: While this search has no known false positives, it is possible + that an AWS admin has legitimately created a public bucket for a specific purpose. + That said, AWS strongly advises against granting full control to the "All Users" + group. +references: [] tags: analytic_story: - Suspicious AWS S3 Activities @@ -72,5 +74,3 @@ tags: - userAgent risk_score: 48 security_domain: threat -type: TTP -version: 2 diff --git a/detections/cloud/detect_shared_ec2_snapshot.yml b/detections/cloud/detect_shared_ec2_snapshot.yml index 326095953b..5d53d17510 100644 --- a/detections/cloud/detect_shared_ec2_snapshot.yml +++ b/detections/cloud/detect_shared_ec2_snapshot.yml @@ -1,21 +1,23 @@ -author: Bhavin Patel, Splunk -datamodel: [] +name: Detect shared ec2 snapshot +id: 2a9b80d3-6340-4345-b5ad-290bf3d222c4 +version: 2 date: '2021-07-20' +author: Bhavin Patel, Splunk +type: TTP +datamodel: [] description: The following analytic utilizes AWS CloudTrail events to identify when an EC2 snapshot permissions are modified to be shared with a different AWS account. This method is used by adversaries to exfiltrate the EC2 snapshot. -how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This - search works with AWS CloudTrail logs. -id: 2a9b80d3-6340-4345-b5ad-290bf3d222c4 -known_false_positives: It is possible that an AWS admin has legitimately shared a - snapshot with others for a specific purpose. -name: Detect shared ec2 snapshot -references: -- https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/ search: '`cloudtrail` eventName=ModifySnapshotAttribute | rename requestParameters.createVolumePermission.add.items{}.userId as requested_account_id | search requested_account_id != NULL | eval match=if(requested_account_id==aws_account_id,"Match","No Match") | table _time user_arn src_ip requestParameters.attributeType requested_account_id aws_account_id match vendor_region user_agent | where match = "No Match" | `detect_shared_ec2_snapshot_filter` ' +how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This + search works with AWS CloudTrail logs. +known_false_positives: It is possible that an AWS admin has legitimately shared a + snapshot with others for a specific purpose. +references: +- https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/ tags: analytic_story: - Suspicious Cloud Instance Activities @@ -68,5 +70,3 @@ tags: - vendor_region risk_score: 48 security_domain: threat -type: TTP -version: 2 diff --git a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml index 825e339f96..cafbddc4fe 100644 --- a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml +++ b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml @@ -1,16 +1,12 @@ -author: Bhavin Patel, Splunk -datamodel: [] +name: Detect Spike in AWS Security Hub Alerts for EC2 Instance +id: 2a9b80d3-6340-4345-b5ad-290bf5d0d222 +version: 3 date: '2021-01-26' +author: Bhavin Patel, Splunk +type: Anomaly +datamodel: [] description: This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals -how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security - Hub inputs. The threshold_value should be tuned to your environment and schedule - these searches according to the bucket span interval. -id: 2a9b80d3-6340-4345-b5ad-290bf5d0d222 -known_false_positives: None -name: Detect Spike in AWS Security Hub Alerts for EC2 Instance -references: [] search: '`aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance | bucket span=4h _time | stats count AS alerts values(Title) as Title values(Types{}) as Types values(vendor_account) as vendor_account values(vendor_region) as vendor_region values(severity) as severity @@ -18,6 +14,12 @@ search: '`aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance | bucket sp | eval threshold_value = 3 | eval isOutlier=if(alerts > total_alerts_avg+(total_alerts_stdev * threshold_value), 1, 0) | search isOutlier=1 | table _time dest alerts Title Types vendor_account vendor_region severity isOutlier total_alerts_avg | `detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter`' +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security + Hub inputs. The threshold_value should be tuned to your environment and schedule + these searches according to the bucket span interval. +known_false_positives: None +references: [] tags: analytic_story: - AWS Security Hub Alerts @@ -55,5 +57,3 @@ tags: - vendor_region risk_score: 15 security_domain: endpoint -type: Anomaly -version: 3 diff --git a/detections/cloud/gcp_kubernetes_activity_by_src_ip.yml b/detections/cloud/gcp_kubernetes_activity_by_src_ip.yml index e156968f7c..1e042e33da 100644 --- a/detections/cloud/gcp_kubernetes_activity_by_src_ip.yml +++ b/detections/cloud/gcp_kubernetes_activity_by_src_ip.yml @@ -1,17 +1,13 @@ -author: Rod Soto, Splunk -datamodel: [] +name: GCP Kubernetes activity by src ip +id: c00e7626-92cc-4e06-9a51-b6db0a50bd1f +version: 1 date: '2020-04-13' +author: Rod Soto, Splunk +type: Investigation +datamodel: [] description: This search provides investigation data about requests via user agent, authentication request URI, resource path and cluster name data against Kubernetes cluster from a specific IP address -how_to_implement: You must install the GCP App for Splunk (version 2.0.0 or later), - then configure stackdriver and set a Pub/Sub subscription to be imported to Splunk. - You must also install Cloud Infrastructure data model.Customize the macro kubernetes_gcp_scan_fingerprint_attack_detection - to filter out FPs. -id: c00e7626-92cc-4e06-9a51-b6db0a50bd1f -known_false_positives: '' -name: GCP Kubernetes activity by src ip -references: [] search: '`google_gcp_pubsub_message` | rename data.protoPayload.requestMetadata.callerIp as src_ip | search src_ip =$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(data.protoPayload.methodName) as method_names values(data.protoPayload.resourceName) @@ -19,6 +15,12 @@ search: '`google_gcp_pubsub_message` | rename data.protoPayload.requestMetadata. as http_user_agent values(data.protoPayload.authenticationInfo.principalEmail) as user values(data.protoPayload.status.message) by src_ip data.resource.labels.cluster_name data.resource.type' +how_to_implement: You must install the GCP App for Splunk (version 2.0.0 or later), + then configure stackdriver and set a Pub/Sub subscription to be imported to Splunk. + You must also install Cloud Infrastructure data model.Customize the macro kubernetes_gcp_scan_fingerprint_attack_detection + to filter out FPs. +known_false_positives: '' +references: [] tags: analytic_story: - Kubernetes Scanning Activity @@ -27,5 +29,3 @@ tags: required_fields: - _time security_domain: network -type: Investigation -version: 1 diff --git a/detections/cloud/get_all_aws_activity_from_city.yml b/detections/cloud/get_all_aws_activity_from_city.yml index 8b5125f3f9..50ab762d8a 100644 --- a/detections/cloud/get_all_aws_activity_from_city.yml +++ b/detections/cloud/get_all_aws_activity_from_city.yml @@ -1,21 +1,23 @@ -author: David Dorsey, Splunk -datamodel: [] +name: Get All AWS Activity From City +id: 0abeeb40-1255-4b68-91d1-7a7eb410c4b8 +version: 1 date: '2018-03-19' +author: David Dorsey, Splunk +type: Investigation +datamodel: [] description: This search retrieves all the activity from a specific city and will create a table containing the time, city, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful. -how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail - inputs. -id: 0abeeb40-1255-4b68-91d1-7a7eb410c4b8 -known_false_positives: '' -name: Get All AWS Activity From City -references: [] search: '`cloudtrail` | iplocation sourceIPAddress | search City=$City$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, City, user, userName, userType, src_ip, awsRegion, eventName, errorCode' +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + inputs. +known_false_positives: '' +references: [] tags: analytic_story: - AWS Suspicious Provisioning Activities @@ -29,5 +31,3 @@ tags: - eventName - sourceIPAddress security_domain: network -type: Investigation -version: 1 diff --git a/detections/cloud/get_all_aws_activity_from_country.yml b/detections/cloud/get_all_aws_activity_from_country.yml index 83d2f42736..61100acb51 100644 --- a/detections/cloud/get_all_aws_activity_from_country.yml +++ b/detections/cloud/get_all_aws_activity_from_country.yml @@ -1,22 +1,24 @@ -author: David Dorsey, Splunk -datamodel: [] +name: Get All AWS Activity From Country +id: e763cdb9-00da-41e0-9bda-444debc9501a +version: 1 date: '2018-03-19' +author: David Dorsey, Splunk +type: Investigation +datamodel: [] description: This search retrieves all the activity from a specific country and will create a table containing the time, country, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful. -how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail - inputs. -id: e763cdb9-00da-41e0-9bda-444debc9501a -known_false_positives: '' -name: Get All AWS Activity From Country -references: [] search: '`cloudtrail` | iplocation sourceIPAddress | search Country=$Country$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, Country, user, userName, userType, src_ip, awsRegion, eventName, errorCode' +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + inputs. +known_false_positives: '' +references: [] tags: analytic_story: - AWS Suspicious Provisioning Activities @@ -30,5 +32,3 @@ tags: - eventName - sourceIPAddress security_domain: network -type: Investigation -version: 1 diff --git a/detections/cloud/get_all_aws_activity_from_ip_address.yml b/detections/cloud/get_all_aws_activity_from_ip_address.yml index f8e4177fb2..79d4b68802 100644 --- a/detections/cloud/get_all_aws_activity_from_ip_address.yml +++ b/detections/cloud/get_all_aws_activity_from_ip_address.yml @@ -1,21 +1,23 @@ -author: David Dorsey, Splunk -datamodel: [] +name: Get All AWS Activity From IP Address +id: 446ec87a-85c6-40d4-b060-bea4498281d6 +version: 1 date: '2018-03-19' +author: David Dorsey, Splunk +type: Investigation +datamodel: [] description: This search retrieves all the activity from a specific IP address and will create a table containing the time, ARN, username, the type of user, the IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful. -how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail - inputs. -id: 446ec87a-85c6-40d4-b060-bea4498281d6 -known_false_positives: '' -name: Get All AWS Activity From IP Address -references: [] search: '`cloudtrail` | iplocation sourceIPAddress | search src_ip=$src_ip$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, user, userName, userType, src_ip, awsRegion, eventName, errorCode' +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + inputs. +known_false_positives: '' +references: [] tags: analytic_story: - AWS Network ACL Activity @@ -34,5 +36,3 @@ tags: - eventName - sourceIPAddress security_domain: network -type: Investigation -version: 1 diff --git a/detections/cloud/get_all_aws_activity_from_region.yml b/detections/cloud/get_all_aws_activity_from_region.yml index 7bc7a44294..0707bc7195 100644 --- a/detections/cloud/get_all_aws_activity_from_region.yml +++ b/detections/cloud/get_all_aws_activity_from_region.yml @@ -1,21 +1,23 @@ -author: David Dorsey, Splunk -datamodel: [] +name: Get All AWS Activity From Region +id: 5b794bef-1743-4f6f-804a-43915a2702ff +version: 1 date: '2018-03-19' +author: David Dorsey, Splunk +type: Investigation +datamodel: [] description: This search retrieves all the activity from a specific geographic region and will create a table containing the time, geographic region, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful. -how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail - inputs. -id: 5b794bef-1743-4f6f-804a-43915a2702ff -known_false_positives: '' -name: Get All AWS Activity From Region -references: [] search: '`cloudtrail` | iplocation sourceIPAddress | search Region=$Region$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, Region, user, userName, userType, src_ip, awsRegion, eventName, errorCode' +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + inputs. +known_false_positives: '' +references: [] tags: analytic_story: - AWS Suspicious Provisioning Activities @@ -29,5 +31,3 @@ tags: - eventName - sourceIPAddress security_domain: network -type: Investigation -version: 1 diff --git a/detections/cloud/get_ec2_launch_details.yml b/detections/cloud/get_ec2_launch_details.yml index c6696c8fba..dab6372468 100644 --- a/detections/cloud/get_ec2_launch_details.yml +++ b/detections/cloud/get_ec2_launch_details.yml @@ -1,19 +1,21 @@ -author: Bhavin Patel, Splunk -datamodel: [] -date: '2018-03-12' -description: This search returns some of the launch details for a EC2 instance. -how_to_implement: In order to implement this search, you must install the AWS App - for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later) - and configure your AWS description inputs. -id: 0e40fe83-3edb-4d86-8206-8fed36529ca6 -known_false_positives: '' name: Get EC2 Launch Details -references: [] +id: 0e40fe83-3edb-4d86-8206-8fed36529ca6 +version: 1 +date: '2018-03-12' +author: Bhavin Patel, Splunk +type: Investigation +datamodel: [] +description: This search returns some of the launch details for a EC2 instance. search: '`cloudtrail` dest=$dest$ |rename userIdentity.arn as arn, responseElements.instancesSet.items{}.instanceId as dest, responseElements.instancesSet.items{}.privateIpAddress as privateIpAddress, responseElements.instancesSet.items{}.imageId as amiID, responseElements.instancesSet.items{}.architecture as architecture, responseElements.instancesSet.items{}.keyName as keyName | table arn, awsRegion, dest, architecture, privateIpAddress, amiID, keyName' +how_to_implement: In order to implement this search, you must install the AWS App + for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later) + and configure your AWS description inputs. +known_false_positives: '' +references: [] tags: analytic_story: - AWS Cryptomining @@ -26,5 +28,3 @@ tags: required_fields: - dest security_domain: network -type: Investigation -version: 1 diff --git a/detections/cloud/github_commit_changes_in_master.yml b/detections/cloud/github_commit_changes_in_master.yml index 9475fcad55..8258c74035 100644 --- a/detections/cloud/github_commit_changes_in_master.yml +++ b/detections/cloud/github_commit_changes_in_master.yml @@ -39,9 +39,9 @@ tags: - T1199 observable: - name: commit.commit.author.email - type: User role: - attacker + type: User product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/github_commit_in_develop.yml b/detections/cloud/github_commit_in_develop.yml index e069f8de60..7fab7c24a2 100644 --- a/detections/cloud/github_commit_in_develop.yml +++ b/detections/cloud/github_commit_in_develop.yml @@ -38,9 +38,9 @@ tags: - T1199 observable: - name: commit.commit.author.email - type: User role: - attacker + type: User product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/github_dependabot_alert.yml b/detections/cloud/github_dependabot_alert.yml index 0ba893e275..0bc99f5dac 100644 --- a/detections/cloud/github_dependabot_alert.yml +++ b/detections/cloud/github_dependabot_alert.yml @@ -1,20 +1,22 @@ -author: Patrick Bareiss, Splunk -datamodel: [] -date: '2021-09-01' -description: This search looks for Dependabot Alerts in Github logs. -how_to_implement: You must index GitHub logs. You can follow the url in reference - to onboard GitHub logs. -id: 05032b04-4469-4034-9df7-05f607d75cba -known_false_positives: unknown name: GitHub Dependabot Alert -references: -- https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html +id: 05032b04-4469-4034-9df7-05f607d75cba +version: 1 +date: '2021-09-01' +author: Patrick Bareiss, Splunk +type: Anomaly +datamodel: [] +description: This search looks for Dependabot Alerts in Github logs. search: '`github` alert.id=* action=create | rename repository.full_name as repository, repository.html_url as repository_url sender.login as user | stats min(_time) as firstTime max(_time) as lastTime by action alert.affected_package_name alert.affected_range alert.created_at alert.external_identifier alert.external_reference alert.fixed_in alert.severity repository repository_url user | eval phase="code" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_dependabot_alert_filter`' +how_to_implement: You must index GitHub logs. You can follow the url in reference + to onboard GitHub logs. +known_false_positives: unknown +references: +- https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html tags: analytic_story: - Dev Sec Ops @@ -51,5 +53,3 @@ tags: - action risk_score: 27 security_domain: network -type: Anomaly -version: 1 diff --git a/detections/cloud/github_pull_request_from_unknown_user.yml b/detections/cloud/github_pull_request_from_unknown_user.yml index 2ef298e96d..62686a4652 100644 --- a/detections/cloud/github_pull_request_from_unknown_user.yml +++ b/detections/cloud/github_pull_request_from_unknown_user.yml @@ -1,20 +1,22 @@ -author: Patrick Bareiss, Splunk -datamodel: [] -date: '2021-09-01' -description: This search looks for Pull Request from unknown user. -how_to_implement: You must index GitHub logs. You can follow the url in reference - to onboard GitHub logs. -id: 9d7b9100-8878-4404-914e-ca5e551a641e -known_false_positives: unknown name: GitHub Pull Request from Unknown User -references: -- https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html +id: 9d7b9100-8878-4404-914e-ca5e551a641e +version: 1 +date: '2021-09-01' +author: Patrick Bareiss, Splunk +type: Anomaly +datamodel: [] +description: This search looks for Pull Request from unknown user. search: '`github` check_suite.pull_requests{}.id=* | stats count by check_suite.head_commit.author.name repository.full_name check_suite.pull_requests{}.head.ref check_suite.head_commit.message | rename check_suite.head_commit.author.name as user repository.full_name as repository check_suite.pull_requests{}.head.ref as ref_head check_suite.head_commit.message as commit_message | search NOT `github_known_users` | eval phase="code" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_pull_request_from_unknown_user_filter`' +how_to_implement: You must index GitHub logs. You can follow the url in reference + to onboard GitHub logs. +known_false_positives: unknown +references: +- https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html tags: analytic_story: - Dev Sec Ops @@ -49,5 +51,3 @@ tags: required_fields: [] risk_score: 27 security_domain: network -type: Anomaly -version: 1 diff --git a/detections/cloud/gsuite_drive_share_in_external_email.yml b/detections/cloud/gsuite_drive_share_in_external_email.yml index 22f7be9295..9a7d14e8f8 100644 --- a/detections/cloud/gsuite_drive_share_in_external_email.yml +++ b/detections/cloud/gsuite_drive_share_in_external_email.yml @@ -1,20 +1,13 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Gsuite Drive Share In External Email +id: f6ee02d6-fea0-11eb-b2c2-acde48001122 +version: 1 date: '2021-08-16' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: [] description: This search is to detect suspicious google drive or google docs files shared outside or externally. This behavior might be a good hunting query to monitor exfitration of data made by an attacker or insider to a targetted machine. -how_to_implement: To successfully implement this search, you need to be ingesting - logs related to gsuite having the file attachment metadata like file type, file - extension, source email, destination email, num of attachment and etc. In order - for the search to work for your environment, please edit the query to use your company - specific email domain instead of `internal_test_email.com`. -id: f6ee02d6-fea0-11eb-b2c2-acde48001122 -known_false_positives: network admin or normal user may share files to customer and - external team. -name: Gsuite Drive Share In External Email -references: -- https://www.redhat.com/en/topics/devops/what-is-devsecops search: '`gsuite_drive` NOT (email IN("", "null")) | rex field=parameters.owner "[^@]+@(?[^@]+)" | rex field=email "[^@]+@(?[^@]+)" | where src_domain = "internal_test_email.com" and not dest_domain = "internal_test_email.com" | eval phase="plan" | eval severity="low" @@ -24,6 +17,15 @@ search: '`gsuite_drive` NOT (email IN("", "null")) | rex field=parameters.owner lastTime by parameters.owner ip_address phase severity | rename parameters.owner as user ip_address as src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_drive_share_in_external_email_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs related to gsuite having the file attachment metadata like file type, file + extension, source email, destination email, num of attachment and etc. In order + for the search to work for your environment, please edit the query to use your company + specific email domain instead of `internal_test_email.com`. +known_false_positives: network admin or normal user may share files to customer and + external team. +references: +- https://www.redhat.com/en/topics/devops/what-is-devsecops tags: analytic_story: - Dev Sec Ops @@ -63,5 +65,3 @@ tags: - src_domain risk_score: 72 security_domain: endpoint -type: Anomaly -version: 1 diff --git a/detections/cloud/gsuite_email_suspicious_attachment.yml b/detections/cloud/gsuite_email_suspicious_attachment.yml index 4e7708da6a..ad8af456d0 100644 --- a/detections/cloud/gsuite_email_suspicious_attachment.yml +++ b/detections/cloud/gsuite_email_suspicious_attachment.yml @@ -1,21 +1,15 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: GSuite Email Suspicious Attachment +id: 6d663014-fe92-11eb-ab07-acde48001122 +version: 1 date: '2021-08-16' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: [] description: This search is to detect a suspicious attachment file extension in Gsuite email that may related to spear phishing attack. This file type is commonly used by malware to lure user to click on it to execute malicious code to compromised targetted machine. But this search can also catch some normal files related to this file type that maybe send by employee or network admin. -how_to_implement: To successfully implement this search, you need to be ingesting - logs related to gsuite having the file attachment metadata like file type, file - extension, source email, destination email, num of attachment and etc. -id: 6d663014-fe92-11eb-ab07-acde48001122 -known_false_positives: network admin and normal user may send this file attachment - as part of their day to day work. having a good protocol in attaching this file - type to an e-mail may reduce the risk of having a spear phishing attack. -name: GSuite Email Suspicious Attachment -references: -- https://www.redhat.com/en/topics/devops/what-is-devsecops search: '`gsuite_gmail` "attachment{}.file_extension_type" IN ("pl", "py", "rb", "sh", "bat", "exe", "dll", "cpl", "com", "js", "vbs", "ps1", "reg","swf", "cmd", "go") | eval phase="plan" | eval severity="medium" | stats count min(_time) as firstTime @@ -24,6 +18,14 @@ search: '`gsuite_gmail` "attachment{}.file_extension_type" IN ("pl", "py", "rb", by destination{}.service num_message_attachments subject destination{}.address source.address phase severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_email_suspicious_attachment_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs related to gsuite having the file attachment metadata like file type, file + extension, source email, destination email, num of attachment and etc. +known_false_positives: network admin and normal user may send this file attachment + as part of their day to day work. having a good protocol in attaching this file + type to an e-mail may reduce the risk of having a spear phishing attack. +references: +- https://www.redhat.com/en/topics/devops/what-is-devsecops tags: analytic_story: - Dev Sec Ops @@ -61,5 +63,3 @@ tags: - subject risk_score: 49 security_domain: endpoint -type: Anomaly -version: 1 diff --git a/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml b/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml index c8c2b596d6..82b1f167bd 100644 --- a/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml +++ b/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml @@ -43,13 +43,13 @@ tags: - T1048 observable: - name: source.address - type: User role: - attacker - - name: destination{}.address type: User + - name: destination{}.address role: - Victim + type: User product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/gsuite_suspicious_shared_file_name.yml b/detections/cloud/gsuite_suspicious_shared_file_name.yml index 4d8fb879c4..213dfb3060 100644 --- a/detections/cloud/gsuite_suspicious_shared_file_name.yml +++ b/detections/cloud/gsuite_suspicious_shared_file_name.yml @@ -1,24 +1,16 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Gsuite Suspicious Shared File Name +id: 07eed200-03f5-11ec-98fb-acde48001122 +version: 1 date: '2021-08-23' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: [] description: This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website. This detection can also catch some normal email communication between organization and its external customer. -how_to_implement: To successfully implement this search, you need to be ingesting - logs related to gsuite having the file attachment metadata like file type, file - extension, source email, destination email, num of attachment and etc. In order - for the search to work for your environment, please edit the query to use your company - specific email domain instead of `internal_test_email.com`. -id: 07eed200-03f5-11ec-98fb-acde48001122 -known_false_positives: normal user or normal transaction may contain the subject and - file type attachment that this detection try to search -name: Gsuite Suspicious Shared File Name -references: -- https://www.redhat.com/en/topics/devops/what-is-devsecops -- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_title" IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", @@ -30,6 +22,16 @@ search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_tit parameters.target_user parameters.doc_title parameters.doc_type phase severity | rename parameters.target_user AS user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_suspicious_shared_file_name_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs related to gsuite having the file attachment metadata like file type, file + extension, source email, destination email, num of attachment and etc. In order + for the search to work for your environment, please edit the query to use your company + specific email domain instead of `internal_test_email.com`. +known_false_positives: normal user or normal transaction may contain the subject and + file type attachment that this detection try to search +references: +- https://www.redhat.com/en/topics/devops/what-is-devsecops +- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf tags: analytic_story: - Dev Sec Ops @@ -67,5 +69,3 @@ tags: - email risk_score: 21 security_domain: endpoint -type: Anomaly -version: 1 diff --git a/detections/cloud/investigate_aws_activities_via_region_name.yml b/detections/cloud/investigate_aws_activities_via_region_name.yml index 599ea946cb..e558bae7cb 100644 --- a/detections/cloud/investigate_aws_activities_via_region_name.yml +++ b/detections/cloud/investigate_aws_activities_via_region_name.yml @@ -1,18 +1,20 @@ -author: Bhavin Patel, Splunk -datamodel: [] +name: Investigate AWS activities via region name +id: bc91a8cd-35e7-4bb2-6140-e756cc46fd11 +version: 1 date: '2018-02-09' +author: Bhavin Patel, Splunk +type: Investigation +datamodel: [] description: This search lists all the user activities logged by CloudTrail for a specific region in question and will create a table of the values of parameters requested, the type of the event and the response from the AWS API by each user +search: '`cloudtrail` vendor_region=$vendor_region$| rename requestParameters.instancesSet.items{}.instanceId + as instanceId | stats values(eventName) by user instanceId vendor_region' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. -id: bc91a8cd-35e7-4bb2-6140-e756cc46fd11 known_false_positives: '' -name: Investigate AWS activities via region name references: [] -search: '`cloudtrail` vendor_region=$vendor_region$| rename requestParameters.instancesSet.items{}.instanceId - as instanceId | stats values(eventName) by user instanceId vendor_region' tags: analytic_story: - AWS Cryptomining @@ -27,5 +29,3 @@ tags: - user - vendor_region security_domain: network -type: Investigation -version: 1 diff --git a/detections/cloud/investigate_aws_user_activities_by_user_field.yml b/detections/cloud/investigate_aws_user_activities_by_user_field.yml index 7cd2b5a623..9ed4cec2e7 100644 --- a/detections/cloud/investigate_aws_user_activities_by_user_field.yml +++ b/detections/cloud/investigate_aws_user_activities_by_user_field.yml @@ -1,19 +1,21 @@ -author: Bhavin Patel, Splunk -datamodel: [] +name: Investigate AWS User Activities by user field +id: bc91a8cd-35e7-4bb2-6140-e756cc46fd76 +version: 1 date: '2018-03-12' +author: Bhavin Patel, Splunk +type: Investigation +datamodel: [] description: This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user's identity information. +search: '`cloudtrail` user=$user$ | table _time userIdentity.type userIdentity.userName + userIdentity.arn aws_account_id src awsRegion eventName eventType ' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. -id: bc91a8cd-35e7-4bb2-6140-e756cc46fd76 known_false_positives: '' -name: Investigate AWS User Activities by user field references: [] -search: '`cloudtrail` user=$user$ | table _time userIdentity.type userIdentity.userName - userIdentity.arn aws_account_id src awsRegion eventName eventType ' tags: analytic_story: - AWS User Monitoring @@ -30,5 +32,3 @@ tags: - src - user security_domain: network -type: Investigation -version: 1 diff --git a/detections/cloud/investigate_okta_activity_by_app.yml b/detections/cloud/investigate_okta_activity_by_app.yml index bd4a63d0b7..ada587e49c 100644 --- a/detections/cloud/investigate_okta_activity_by_app.yml +++ b/detections/cloud/investigate_okta_activity_by_app.yml @@ -1,15 +1,17 @@ -author: Rico Valdez, Splunk -datamodel: [] -date: '2020-04-02' -description: This search returns all okta events associated with a specific app -how_to_implement: You must be ingesting Okta logs -id: 420eb1b8-2992-45d1-80cf-0b1b2759524d -known_false_positives: '' name: Investigate Okta Activity by app -references: [] +id: 420eb1b8-2992-45d1-80cf-0b1b2759524d +version: 1 +date: '2020-04-02' +author: Rico Valdez, Splunk +type: Investigation +datamodel: [] +description: This search returns all okta events associated with a specific app search: '`okta` app=$app$ | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason' +how_to_implement: You must be ingesting Okta logs +known_false_positives: '' +references: [] tags: analytic_story: - Suspicious Okta Activity @@ -23,5 +25,3 @@ tags: - src_ip - user security_domain: network -type: Investigation -version: 1 diff --git a/detections/cloud/investigate_okta_activity_by_ip_address.yml b/detections/cloud/investigate_okta_activity_by_ip_address.yml index 491a6e5dd9..4a172bd1a7 100644 --- a/detections/cloud/investigate_okta_activity_by_ip_address.yml +++ b/detections/cloud/investigate_okta_activity_by_ip_address.yml @@ -1,15 +1,17 @@ -author: Rico Valdez, Splunk -datamodel: [] -date: '2020-04-02' -description: This search returns all okta events from a specific IP address. -how_to_implement: You must be ingesting Okta logs -id: 56aae066-d619-477c-93e3-3fb83b2d23c3 -known_false_positives: '' name: Investigate Okta Activity by IP Address -references: [] +id: 56aae066-d619-477c-93e3-3fb83b2d23c3 +version: 1 +date: '2020-04-02' +author: Rico Valdez, Splunk +type: Investigation +datamodel: [] +description: This search returns all okta events from a specific IP address. search: '`okta` src_ip={src_ip} | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason' +how_to_implement: You must be ingesting Okta logs +known_false_positives: '' +references: [] tags: analytic_story: - Suspicious Okta Activity @@ -23,5 +25,3 @@ tags: - src_ip - user security_domain: network -type: Investigation -version: 1 diff --git a/detections/cloud/investigate_user_activities_in_okta.yml b/detections/cloud/investigate_user_activities_in_okta.yml index e61152ec94..c3f2feec9f 100644 --- a/detections/cloud/investigate_user_activities_in_okta.yml +++ b/detections/cloud/investigate_user_activities_in_okta.yml @@ -1,15 +1,17 @@ -author: Rico Valdez, Splunk -datamodel: [] -date: '2020-04-02' -description: This search returns all okta events by a specific user -how_to_implement: You must be ingesting Okta logs -id: 24ff145d-4d16-420a-b047-480f2a51c403 -known_false_positives: '' name: Investigate User Activities In Okta -references: [] +id: 24ff145d-4d16-420a-b047-480f2a51c403 +version: 1 +date: '2020-04-02' +author: Rico Valdez, Splunk +type: Investigation +datamodel: [] +description: This search returns all okta events by a specific user search: '`okta` user=$user$ | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason' +how_to_implement: You must be ingesting Okta logs +known_false_positives: '' +references: [] tags: analytic_story: - Suspicious Okta Activity @@ -22,5 +24,3 @@ tags: - src_ip - user security_domain: network -type: Investigation -version: 1 diff --git a/detections/cloud/kubernetes_nginx_ingress_lfi.yml b/detections/cloud/kubernetes_nginx_ingress_lfi.yml index 65fa5a1ad8..b396b51d59 100644 --- a/detections/cloud/kubernetes_nginx_ingress_lfi.yml +++ b/detections/cloud/kubernetes_nginx_ingress_lfi.yml @@ -44,9 +44,9 @@ tags: - DE.CM observable: - name: src_ip - type: IP Address role: - Attacker + type: IP Address product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/kubernetes_nginx_ingress_rfi.yml b/detections/cloud/kubernetes_nginx_ingress_rfi.yml index f94a66cb29..b23ddf7844 100644 --- a/detections/cloud/kubernetes_nginx_ingress_rfi.yml +++ b/detections/cloud/kubernetes_nginx_ingress_rfi.yml @@ -43,9 +43,9 @@ tags: - DE.CM observable: - name: src_ip - type: IP Address role: - Attacker + type: IP Address product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/kubernetes_scanner_image_pulling.yml b/detections/cloud/kubernetes_scanner_image_pulling.yml index d1a0bd8e52..dca89a3004 100644 --- a/detections/cloud/kubernetes_scanner_image_pulling.yml +++ b/detections/cloud/kubernetes_scanner_image_pulling.yml @@ -1,20 +1,22 @@ -author: Patrick Bareiss, Splunk -datamodel: [] +name: Kubernetes Scanner Image Pulling +id: 4890cd6b-0112-4974-a272-c5c153aee551 +version: 1 date: '2021-08-24' +author: Patrick Bareiss, Splunk +type: TTP +datamodel: [] description: This search uses the Kubernetes logs from Splunk Connect from Kubernetes to detect Kubernetes Security Scanner. -how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes. -id: 4890cd6b-0112-4974-a272-c5c153aee551 -known_false_positives: unknown -name: Kubernetes Scanner Image Pulling -references: -- https://github.com/splunk/splunk-connect-for-kubernetes search: '`kube_objects_events` object.message IN ("Pulling image *kube-hunter*", "Pulling image *kube-bench*", "Pulling image *kube-recon*", "Pulling image *kube-recon*") | rename object.* AS * | rename involvedObject.* AS * | rename source.host AS host | eval phase="operate" | eval severity="high" | stats min(_time) as firstTime max(_time) as lastTime count by host, name, namespace, kind, reason, message, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_scanner_image_pulling_filter`' +how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes. +known_false_positives: unknown +references: +- https://github.com/splunk/splunk-connect-for-kubernetes tags: analytic_story: - Dev Sec Ops @@ -48,5 +50,3 @@ tags: required_fields: [] risk_score: 81 security_domain: network -type: TTP -version: 1 diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml index f4d48de0c8..95dd603861 100644 --- a/detections/cloud/o365_add_app_role_assignment_grant_user.yml +++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml @@ -1,23 +1,25 @@ -author: Rod Soto, Splunk -datamodel: [] +name: O365 Add App Role Assignment Grant User +id: b2c81cc6-6040-11eb-ae93-0242ac130002 +version: 1 date: '2021-01-26' +author: Rod Soto, Splunk +type: TTP +datamodel: [] description: This search detects the creation of a new Federation setting by alerting about an specific event related to its creation. -how_to_implement: You must install splunk Microsoft Office 365 add-on. This search - works with o365:management:activity -id: b2c81cc6-6040-11eb-ae93-0242ac130002 -known_false_positives: The creation of a new Federation is not necessarily malicious, - however this events need to be followed closely, as it may indicate federated credential - abuse or backdoor via federated identities at a different cloud provider. -name: O365 Add App Role Assignment Grant User -references: -- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf -- https://us-cert.cisa.gov/ncas/alerts/aa21-008a search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="Add app role assignment grant to user." | stats count min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) as Actor.ID values(Actor{}.Type) as Actor.Type by ActorIpAddress dest ResultStatus | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `o365_add_app_role_assignment_grant_user_filter`' +how_to_implement: You must install splunk Microsoft Office 365 add-on. This search + works with o365:management:activity +known_false_positives: The creation of a new Federation is not necessarily malicious, + however this events need to be followed closely, as it may indicate federated credential + abuse or backdoor via federated identities at a different cloud provider. +references: +- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf +- https://us-cert.cisa.gov/ncas/alerts/aa21-008a tags: analytic_story: - Office 365 Detections @@ -67,5 +69,3 @@ tags: - dest risk_score: 18 security_domain: threat -type: TTP -version: 1 diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml index 8ae114f85c..54933281d8 100644 --- a/detections/cloud/o365_added_service_principal.yml +++ b/detections/cloud/o365_added_service_principal.yml @@ -1,26 +1,28 @@ -author: Rod Soto, Splunk -datamodel: [] +name: O365 Added Service Principal +id: 1668812a-6047-11eb-ae93-0242ac130002 +version: 1 date: '2021-01-26' +author: Rod Soto, Splunk +type: TTP +datamodel: [] description: This search detects the creation of a new Federation setting by alerting about an specific event related to its creation. -how_to_implement: You must install splunk Microsoft Office 365 add-on. This search - works with o365:management:activity -id: 1668812a-6047-11eb-ae93-0242ac130002 -known_false_positives: The creation of a new Federation is not necessarily malicious, - however these events need to be followed closely, as it may indicate federated credential - abuse or backdoor via federated identities at a different cloud provider. -name: O365 Added Service Principal -references: -- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf -- https://us-cert.cisa.gov/ncas/alerts/aa21-008a -- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html -- https://www.sygnia.co/golden-saml-advisory search: '`o365_management_activity` Workload=AzureActiveDirectory signature="Add service principal credentials." | stats min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) as Actor.ID values(ModifiedProperties{}.Name) as ModifiedProperties.Name values(ModifiedProperties{}.NewValue) as ModifiedProperties.NewValue values(Target{}.ID) as Target.ID by ActorIpAddress signature | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `o365_added_service_principal_filter`' +how_to_implement: You must install splunk Microsoft Office 365 add-on. This search + works with o365:management:activity +known_false_positives: The creation of a new Federation is not necessarily malicious, + however these events need to be followed closely, as it may indicate federated credential + abuse or backdoor via federated identities at a different cloud provider. +references: +- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf +- https://us-cert.cisa.gov/ncas/alerts/aa21-008a +- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html +- https://www.sygnia.co/golden-saml-advisory tags: analytic_story: - Office 365 Detections @@ -64,5 +66,3 @@ tags: - signature risk_score: 42 security_domain: threat -type: TTP -version: 1 diff --git a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml index b540d2db29..b2223ccfc0 100644 --- a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml +++ b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml @@ -1,18 +1,13 @@ -author: Bhavin Patel, Splunk -datamodel: [] +name: O365 Bypass MFA via Trusted IP +id: c783dd98-c703-4252-9e8a-f19d9f66949e +version: 2 date: '2021-07-19' +author: Bhavin Patel, Splunk +type: TTP +datamodel: [] description: This search detects newly added IP addresses/CIDR blocks to the list of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known to use this technique so that they can bypass the MFA system. -how_to_implement: You must install Splunk Microsoft Office 365 add-on. This search - works with o365:management:activity -id: c783dd98-c703-4252-9e8a-f19d9f66949e -known_false_positives: Unless it is a special case, it is uncommon to continually - update Trusted IPs to MFA configuration. -name: O365 Bypass MFA via Trusted IP -references: -- https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf -- https://attack.mitre.org/techniques/T1562/007/ search: '`o365_management_activity` signature="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy | rex max_match=100 field=ModifiedProperties{}.NewValue "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" | rex max_match=100 field=ModifiedProperties{}.OldValue "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" @@ -22,6 +17,13 @@ search: '`o365_management_activity` signature="Set Company Information." Modifie as ip_addresses_old by user ip_addresses_new_added signature Workload vendor_account status user_id action | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `o365_bypass_mfa_via_trusted_ip_filter`' +how_to_implement: You must install Splunk Microsoft Office 365 add-on. This search + works with o365:management:activity +known_false_positives: Unless it is a special case, it is uncommon to continually + update Trusted IPs to MFA configuration. +references: +- https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf +- https://attack.mitre.org/techniques/T1562/007/ tags: analytic_story: - Office 365 Detections @@ -68,5 +70,3 @@ tags: - vendor_account risk_score: 42 security_domain: threat -type: TTP -version: 2 diff --git a/detections/cloud/o365_disable_mfa.yml b/detections/cloud/o365_disable_mfa.yml index b80ab26505..184369abf9 100644 --- a/detections/cloud/o365_disable_mfa.yml +++ b/detections/cloud/o365_disable_mfa.yml @@ -40,13 +40,13 @@ tags: - T1556 observable: - name: dest - type: Endpoint role: - Victim + type: Endpoint - name: user - type: User role: - Attacker + type: User product: - Splunk Security Analytics for AWS - Splunk Enterprise diff --git a/detections/cloud/o365_excessive_authentication_failures_alert.yml b/detections/cloud/o365_excessive_authentication_failures_alert.yml index 73c75b0e8c..083ca092fe 100644 --- a/detections/cloud/o365_excessive_authentication_failures_alert.yml +++ b/detections/cloud/o365_excessive_authentication_failures_alert.yml @@ -41,13 +41,13 @@ tags: - T1110 observable: - name: src_ip - type: IP Address role: - Attacker + type: IP Address - name: user - type: User role: - Victim + type: User product: - Splunk Security Analytics for AWS - Splunk Enterprise diff --git a/detections/cloud/o365_excessive_sso_logon_errors.yml b/detections/cloud/o365_excessive_sso_logon_errors.yml index e0e0cb4c8e..8db1208cb5 100644 --- a/detections/cloud/o365_excessive_sso_logon_errors.yml +++ b/detections/cloud/o365_excessive_sso_logon_errors.yml @@ -42,13 +42,13 @@ tags: - T1556 observable: - name: ActorIpAddress - type: IP Address role: - Attacker + type: IP Address - name: UserId - type: User role: - Victim + type: User product: - Splunk Security Analytics for AWS - Splunk Enterprise diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index 0c321f337b..e10b6e5786 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -1,25 +1,27 @@ -author: Rod Soto, Splunk -datamodel: [] +name: O365 New Federated Domain Added +id: e155876a-6048-11eb-ae93-0242ac130002 +version: 1 date: '2021-01-26' +author: Rod Soto, Splunk +type: TTP +datamodel: [] description: This search detects the addition of a new Federated domain. +search: '`o365_management_activity` Workload=Exchange Operation="Add-FederatedDomain" + | stats count min(_time) as firstTime max(_time) as lastTime values(Parameters{}.Value) + as Parameters.Value by ObjectId Operation OrganizationName OriginatingServer UserId + UserKey | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `o365_new_federated_domain_added_filter`' how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity. -id: e155876a-6048-11eb-ae93-0242ac130002 known_false_positives: The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider. -name: O365 New Federated Domain Added references: - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf - https://us-cert.cisa.gov/ncas/alerts/aa21-008a - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html - https://www.sygnia.co/golden-saml-advisory - https://o365blog.com/post/aadbackdoor/ -search: '`o365_management_activity` Workload=Exchange Operation="Add-FederatedDomain" - | stats count min(_time) as firstTime max(_time) as lastTime values(Parameters{}.Value) - as Parameters.Value by ObjectId Operation OrganizationName OriginatingServer UserId - UserKey | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `o365_new_federated_domain_added_filter`' tags: analytic_story: - Office 365 Detections @@ -68,5 +70,3 @@ tags: - _time risk_score: 64 security_domain: threat -type: TTP -version: 1 diff --git a/detections/cloud/o365_pst_export_alert.yml b/detections/cloud/o365_pst_export_alert.yml index 759f3095c9..bb566e5b17 100644 --- a/detections/cloud/o365_pst_export_alert.yml +++ b/detections/cloud/o365_pst_export_alert.yml @@ -41,9 +41,9 @@ tags: - T1114 observable: - name: Source - type: User role: - Attacker + type: User product: - Splunk Security Analytics for AWS - Splunk Enterprise diff --git a/detections/cloud/o365_suspicious_admin_email_forwarding.yml b/detections/cloud/o365_suspicious_admin_email_forwarding.yml index cbb85e57e6..a53c120df9 100644 --- a/detections/cloud/o365_suspicious_admin_email_forwarding.yml +++ b/detections/cloud/o365_suspicious_admin_email_forwarding.yml @@ -45,9 +45,9 @@ tags: - DE.AE observable: - name: user - type: User role: - Attacker + type: User product: - Splunk Security Analytics for AWS - Splunk Enterprise diff --git a/detections/cloud/o365_suspicious_rights_delegation.yml b/detections/cloud/o365_suspicious_rights_delegation.yml index be8f002199..822c5d04fa 100644 --- a/detections/cloud/o365_suspicious_rights_delegation.yml +++ b/detections/cloud/o365_suspicious_rights_delegation.yml @@ -44,9 +44,9 @@ tags: - DE.AE observable: - name: user - type: User role: - Attacker + type: User product: - Splunk Security Analytics for AWS - Splunk Enterprise diff --git a/detections/cloud/o365_suspicious_user_email_forwarding.yml b/detections/cloud/o365_suspicious_user_email_forwarding.yml index 7644ef34f2..011ce9af7b 100644 --- a/detections/cloud/o365_suspicious_user_email_forwarding.yml +++ b/detections/cloud/o365_suspicious_user_email_forwarding.yml @@ -45,13 +45,13 @@ tags: - DE.AE observable: - name: user - type: User role: - Attacker + type: User - name: ForwardingSmtpAddress - type: Email Address role: - Other + type: Email Address product: - Splunk Security Analytics for AWS - Splunk Enterprise diff --git a/detections/cloud/previously_seen_aws_cross_account_activity.yml b/detections/cloud/previously_seen_aws_cross_account_activity.yml index 64dc2501b3..be81302987 100644 --- a/detections/cloud/previously_seen_aws_cross_account_activity.yml +++ b/detections/cloud/previously_seen_aws_cross_account_activity.yml @@ -1,22 +1,24 @@ -author: David Dorsey, Splunk -datamodel: [] +name: Previously Seen AWS Cross Account Activity +id: 1cc22b09-c867-416e-a511-cb36ac44aee2 +version: 1 date: '2018-06-04' +author: David Dorsey, Splunk +type: Baseline +datamodel: [] description: This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. -how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail - inputs. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, - a lookup file created by this support search. -id: 1cc22b09-c867-416e-a511-cb36ac44aee2 -known_false_positives: none -name: Previously Seen AWS Cross Account Activity -references: [] search: '`cloudtrail` eventName=AssumeRole | spath output=requestingAccountId path=userIdentity.accountId | spath output=requestedAccountId path=resources{}.accountId | search requestingAccountId=* | where requestingAccountId!=requestedAccountId | stats earliest(_time) as firstTime latest(_time) as lastTime by requestingAccountId, requestedAccountId | outputlookup previously_seen_aws_cross_account_activity | stats count' +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + inputs. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, + a lookup file created by this support search. +known_false_positives: none +references: [] tags: analytic_story: - AWS Cross Account Activity @@ -32,5 +34,3 @@ tags: - _time - eventName security_domain: network -type: Baseline -version: 1 diff --git a/detections/cloud/previously_seen_aws_cross_account_activity_initial.yml b/detections/cloud/previously_seen_aws_cross_account_activity_initial.yml index 36593a0c4a..62ff52a63a 100644 --- a/detections/cloud/previously_seen_aws_cross_account_activity_initial.yml +++ b/detections/cloud/previously_seen_aws_cross_account_activity_initial.yml @@ -1,19 +1,14 @@ +name: Previously Seen AWS Cross Account Activity - Initial +id: 82af2ed9-8f4b-4785-a152-ba61e6a23bbf +version: 1 +date: '2020-08-15' author: Rico Valdez, Splunk +type: Baseline datamodel: - Authentication -date: '2020-08-15' description: This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. -how_to_implement: You must install and configure the Splunk Add-on for AWS (version - 5.1.0 or later)and Enterprise Security 6.2, which contains the required updates - to the Authentication data model for cloud use cases. Validate the user name entries - in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this - support search. -id: 82af2ed9-8f4b-4785-a152-ba61e6a23bbf -known_false_positives: none -name: Previously Seen AWS Cross Account Activity - Initial -references: [] search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role | `drop_dm_object_name(Authentication)` @@ -21,6 +16,13 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da != dest_account | rename vendor_account as requestingAccountId dest_account as requestedAccountId | table requestingAccountId requestedAccountId firstTime lastTime | outputlookup previously_seen_aws_cross_account_activity' +how_to_implement: You must install and configure the Splunk Add-on for AWS (version + 5.1.0 or later)and Enterprise Security 6.2, which contains the required updates + to the Authentication data model for cloud use cases. Validate the user name entries + in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this + support search. +known_false_positives: none +references: [] tags: analytic_story: - Suspicious Cloud Authentication Activities @@ -41,5 +43,3 @@ tags: - Authentication.Authentication.vendor_account - _time security_domain: network -type: Baseline -version: 1 diff --git a/detections/cloud/previously_seen_aws_cross_account_activity_update.yml b/detections/cloud/previously_seen_aws_cross_account_activity_update.yml index e35851ba87..62d559f355 100644 --- a/detections/cloud/previously_seen_aws_cross_account_activity_update.yml +++ b/detections/cloud/previously_seen_aws_cross_account_activity_update.yml @@ -1,19 +1,14 @@ +name: Previously Seen AWS Cross Account Activity - Update +id: dd6fb3a9-4906-48cb-8626-c88a25a056c3 +version: 1 +date: '2020-08-15' author: Rico Valdez, Splunk +type: Baseline datamodel: - Authentication -date: '2020-08-15' description: This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. -how_to_implement: You must install and configure the Splunk Add-on for AWS (version - 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates - to the Authentication data model for cloud use cases. Validate the user name entries - in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this - support search. -id: dd6fb3a9-4906-48cb-8626-c88a25a056c3 -known_false_positives: none -name: Previously Seen AWS Cross Account Activity - Update -references: [] search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role | `drop_dm_object_name(Authentication)` @@ -22,6 +17,13 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da | inputlookup append=t previously_seen_aws_cross_account_activity | stats min(firstTime) as firstTime max(lastTime) as lastTime by requestingAccountId requestedAccountId | outputlookup previously_seen_aws_cross_account_activity' +how_to_implement: You must install and configure the Splunk Add-on for AWS (version + 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates + to the Authentication data model for cloud use cases. Validate the user name entries + in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this + support search. +known_false_positives: none +references: [] tags: analytic_story: - Suspicious Cloud Authentication Activities @@ -42,5 +44,3 @@ tags: - Authentication.Authentication.vendor_account - _time security_domain: network -type: Baseline -version: 1 diff --git a/detections/cloud/previously_seen_cloud_api_calls_per_user_role_initial.yml b/detections/cloud/previously_seen_cloud_api_calls_per_user_role_initial.yml index bbfebe63ea..8a3ef0b25a 100644 --- a/detections/cloud/previously_seen_cloud_api_calls_per_user_role_initial.yml +++ b/detections/cloud/previously_seen_cloud_api_calls_per_user_role_initial.yml @@ -1,22 +1,24 @@ +name: Previously Seen Cloud API Calls Per User Role - Initial +id: 69d75f4b-b794-4a66-a777-730357b886b4 +version: 1 +date: '2020-09-03' author: David Dorsey, Splunk +type: Baseline datamodel: - Change -date: '2020-09-03' description: This search builds a table of the first and last times seen for every user role and command combination. This is broadly defined as any event that runs or creates something. This table is then cached. -how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud - provider. -id: 69d75f4b-b794-4a66-a777-730357b886b4 -known_false_positives: none -name: Previously Seen Cloud API Calls Per User Role - Initial -references: [] search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change.All_Changes where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")` | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table user, command, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_api_calls_per_user_role' +how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud + provider. +known_false_positives: none +references: [] tags: analytic_story: - Suspicious Cloud User Activities @@ -36,5 +38,3 @@ tags: - Change.All_Changes.user_type - _time security_domain: network -type: Baseline -version: 1 diff --git a/detections/cloud/previously_seen_cloud_api_calls_per_user_role_update.yml b/detections/cloud/previously_seen_cloud_api_calls_per_user_role_update.yml index 331c43a970..952a200bc2 100644 --- a/detections/cloud/previously_seen_cloud_api_calls_per_user_role_update.yml +++ b/detections/cloud/previously_seen_cloud_api_calls_per_user_role_update.yml @@ -1,15 +1,13 @@ +name: Previously Seen Cloud API Calls Per User Role - Update +id: c4b760a0-6a97-47e9-b089-8ae9e57f210e +version: 1 +date: '2020-09-03' author: David Dorsey, Splunk +type: Baseline datamodel: - Change -date: '2020-09-03' description: This search updates the table of the first and last times seen for every user role and command combination. -how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud - provider. -id: c4b760a0-6a97-47e9-b089-8ae9e57f210e -known_false_positives: none -name: Previously Seen Cloud API Calls Per User Role - Update -references: [] search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change.All_Changes where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")` @@ -19,6 +17,10 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table user, command, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_api_calls_per_user_role' +how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud + provider. +known_false_positives: none +references: [] tags: analytic_story: - Suspicious Cloud User Activities @@ -38,5 +40,3 @@ tags: - Change.All_Changes.user_type - _time security_domain: network -type: Baseline -version: 1 diff --git a/detections/cloud/previously_seen_cloud_compute_creations_by_user_initial.yml b/detections/cloud/previously_seen_cloud_compute_creations_by_user_initial.yml index 01e0644a87..9bb0230931 100644 --- a/detections/cloud/previously_seen_cloud_compute_creations_by_user_initial.yml +++ b/detections/cloud/previously_seen_cloud_compute_creations_by_user_initial.yml @@ -1,19 +1,21 @@ +name: Previously Seen Cloud Compute Creations By User - Initial +id: dd4ced8a-15a9-4285-94ac-7e4134673bf8 +version: 1 +date: '2020-08-15' author: Rico Valdez, Splunk +type: Baseline datamodel: - Change -date: '2020-08-15' description: This search builds a table of previously seen users that have launched a cloud compute instance. -how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs - and have the proper TAs installed. -id: dd4ced8a-15a9-4285-94ac-7e4134673bf8 -known_false_positives: none -name: Previously Seen Cloud Compute Creations By User - Initial -references: [] search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change.All_Changes where All_Changes.action=created AND All_Changes.object_category=instance by All_Changes.user | `drop_dm_object_name("All_Changes")` | outputlookup previously_seen_cloud_compute_creations_by_user | stats count' +how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs + and have the proper TAs installed. +known_false_positives: none +references: [] tags: analytic_story: - Cloud Cryptomining @@ -32,5 +34,3 @@ tags: - Change.All_Changes.user - _time security_domain: network -type: Baseline -version: 1 diff --git a/detections/cloud/previously_seen_cloud_compute_creations_by_user_update.yml b/detections/cloud/previously_seen_cloud_compute_creations_by_user_update.yml index 17313f9be9..f17d73d090 100644 --- a/detections/cloud/previously_seen_cloud_compute_creations_by_user_update.yml +++ b/detections/cloud/previously_seen_cloud_compute_creations_by_user_update.yml @@ -1,15 +1,13 @@ +name: Previously Seen Cloud Compute Creations By User - Update +id: 6bf75d69-7766-47bc-8097-e41696807a6f +version: 1 +date: '2020-08-15' author: Rico Valdez, Splunk +type: Baseline datamodel: - Change -date: '2020-08-15' description: This search builds a table of previously seen users that have launched a cloud compute instance. -how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs - and have the proper TAs installed. -id: 6bf75d69-7766-47bc-8097-e41696807a6f -known_false_positives: none -name: Previously Seen Cloud Compute Creations By User - Update -references: [] search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change.All_Changes where All_Changes.action=created AND All_Changes.object_category=instance by All_Changes.user| `drop_dm_object_name("All_Changes")` | inputlookup append=t @@ -17,6 +15,10 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee max(lastTimeSeen) as lastTimeSeen by user | where lastTimeSeen > relative_time(now(), "-90d@d") | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_creations_by_user' +how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs + and have the proper TAs installed. +known_false_positives: none +references: [] tags: analytic_story: - Cloud Cryptomining @@ -35,5 +37,3 @@ tags: - Change.All_Changes.user - _time security_domain: network -type: Baseline -version: 1 diff --git a/detections/cloud/previously_seen_cloud_compute_images_initial.yml b/detections/cloud/previously_seen_cloud_compute_images_initial.yml index e4a552647b..ce821ae363 100644 --- a/detections/cloud/previously_seen_cloud_compute_images_initial.yml +++ b/detections/cloud/previously_seen_cloud_compute_images_initial.yml @@ -1,21 +1,23 @@ +name: Previously Seen Cloud Compute Images - Initial +id: 7744597f-d07a-4cea-94a7-e0f8aaebc410 +version: 1 +date: '2020-10-08' author: David Dorsey, Splunk +type: Baseline datamodel: - Change -date: '2020-10-08' description: This search builds a table of previously seen images used to launch cloud compute instances -how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs - and have the latest Change Datamodel accelerated -id: 7744597f-d07a-4cea-94a7-e0f8aaebc410 -known_false_positives: none -name: Previously Seen Cloud Compute Images - Initial -references: [] search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.Instance_Changes.image_id | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")` | where image_id != "unknown" | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_images' +how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs + and have the latest Change Datamodel accelerated +known_false_positives: none +references: [] tags: analytic_story: - Cloud Cryptomining @@ -32,5 +34,3 @@ tags: - Change.All_Changes.action - _time security_domain: network -type: Baseline -version: 1 diff --git a/detections/cloud/previously_seen_cloud_compute_images_update.yml b/detections/cloud/previously_seen_cloud_compute_images_update.yml index 2b7dcc7d14..7134fcbf56 100644 --- a/detections/cloud/previously_seen_cloud_compute_images_update.yml +++ b/detections/cloud/previously_seen_cloud_compute_images_update.yml @@ -1,14 +1,13 @@ +name: Previously Seen Cloud Compute Images - Update +id: 6f1ca5dc-e445-401c-9845-a96d2b6ba184 +version: 1 +date: '2020-08-12' author: David Dorsey, Splunk +type: Baseline datamodel: - Change -date: '2020-08-12' description: This search builds a table of previously seen images used to launch cloud compute instances -how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs -id: 6f1ca5dc-e445-401c-9845-a96d2b6ba184 -known_false_positives: none -name: Previously Seen Cloud Compute Images - Update -references: [] search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.Instance_Changes.image_id | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")` @@ -17,6 +16,9 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee image_id | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_images_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_images' +how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs +known_false_positives: none +references: [] tags: analytic_story: - Cloud Cryptomining @@ -33,5 +35,3 @@ tags: - Change.All_Changes.action - _time security_domain: network -type: Baseline -version: 1 diff --git a/detections/cloud/previously_seen_cloud_compute_instance_types_initial.yml b/detections/cloud/previously_seen_cloud_compute_instance_types_initial.yml index cfba9f1c23..4157d01305 100644 --- a/detections/cloud/previously_seen_cloud_compute_instance_types_initial.yml +++ b/detections/cloud/previously_seen_cloud_compute_instance_types_initial.yml @@ -1,20 +1,22 @@ +name: Previously Seen Cloud Compute Instance Types - Initial +id: 3c78025c-1ffe-4976-a640-75ef604842be +version: 1 +date: 2020-9-03 author: David Dorsey, Splunk +type: Baseline datamodel: - Change -date: 2020-9-03 description: This search builds a table of previously seen cloud compute instance types -how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs - and have the Security Research cloud data model installed. -id: 3c78025c-1ffe-4976-a640-75ef604842be -known_false_positives: none -name: Previously Seen Cloud Compute Instance Types - Initial -references: [] search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.Instance_Changes.instance_type | `drop_dm_object_name("All_Changes.Instance_Changes")` | where instance_type != "unknown" | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_instance_types' +how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs + and have the Security Research cloud data model installed. +known_false_positives: none +references: [] tags: analytic_story: - Cloud Cryptomining @@ -31,5 +33,3 @@ tags: - Change.All_Changes.action - _time security_domain: network -type: Baseline -version: 1 diff --git a/detections/cloud/previously_seen_cloud_compute_instance_types_update.yml b/detections/cloud/previously_seen_cloud_compute_instance_types_update.yml index 628c58053a..f576a92fa0 100644 --- a/detections/cloud/previously_seen_cloud_compute_instance_types_update.yml +++ b/detections/cloud/previously_seen_cloud_compute_instance_types_update.yml @@ -1,14 +1,13 @@ +name: Previously Seen Cloud Compute Instance Types - Update +id: 7b7ef9ab-acb9-4e07-af76-4cf1e722885c +version: 1 +date: 2020-9-03 author: David Dorsey, Splunk +type: Baseline datamodel: - Change -date: 2020-9-03 description: This search builds a table of previously seen cloud compute instance types -how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs -id: 7b7ef9ab-acb9-4e07-af76-4cf1e722885c -known_false_positives: none -name: Previously Seen Cloud Compute Instance Types - Update -references: [] search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.Instance_Changes.instance_type | `drop_dm_object_name("All_Changes.Instance_Changes")` | where instance_type != @@ -17,6 +16,9 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_instance_type_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_instance_types' +how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs +known_false_positives: none +references: [] tags: analytic_story: - Cloud Cryptomining @@ -33,5 +35,3 @@ tags: - Change.All_Changes.action - _time security_domain: network -type: Baseline -version: 1 diff --git a/detections/cloud/previously_seen_cloud_instance_modifications_by_user_initial.yml b/detections/cloud/previously_seen_cloud_instance_modifications_by_user_initial.yml index d3f5a225c9..926f9321c0 100644 --- a/detections/cloud/previously_seen_cloud_instance_modifications_by_user_initial.yml +++ b/detections/cloud/previously_seen_cloud_instance_modifications_by_user_initial.yml @@ -1,20 +1,22 @@ +name: Previously Seen Cloud Instance Modifications By User - Initial +id: f36dc403-739d-42f3-83a3-49237d8654c5 +version: 1 +date: '2020-07-29' author: Rico Valdez, Splunk +type: Baseline datamodel: - Change -date: '2020-07-29' description: This search builds a table of previously seen users that have modified a cloud instance. -how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs - and have the latest Change Datamodel accelerated. -id: f36dc403-739d-42f3-83a3-49237d8654c5 -known_false_positives: none -name: Previously Seen Cloud Instance Modifications By User - Initial -references: [] search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change.All_Changes where All_Changes.action=modified All_Changes.change_type=EC2 c=success by All_Changes.user | `drop_dm_object_name("All_Changes")` | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user' +how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs + and have the latest Change Datamodel accelerated. +known_false_positives: none +references: [] tags: analytic_story: - Suspicious Cloud Instance Activities @@ -33,5 +35,3 @@ tags: - Change.All_Changes.user - _time security_domain: network -type: Baseline -version: 1 diff --git a/detections/cloud/previously_seen_cloud_instance_modifications_by_user_update.yml b/detections/cloud/previously_seen_cloud_instance_modifications_by_user_update.yml index 400effcf2c..1c7cef5114 100644 --- a/detections/cloud/previously_seen_cloud_instance_modifications_by_user_update.yml +++ b/detections/cloud/previously_seen_cloud_instance_modifications_by_user_update.yml @@ -1,16 +1,13 @@ +name: Previously Seen Cloud Instance Modifications By User - Update +id: 534b7d30-7b0c-4510-8f55-65439850d58d +version: 1 +date: '2020-07-29' author: Rico Valdez, Splunk +type: Baseline datamodel: - Change -date: '2020-07-29' description: This search updates a table of previously seen Cloud Instance modifications that have been made by a user -how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail - inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. -id: 534b7d30-7b0c-4510-8f55-65439850d58d -known_false_positives: none -name: Previously Seen Cloud Instance Modifications By User - Update -references: [] search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change.All_Changes where All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success by All_Changes.user | `drop_dm_object_name("All_Changes")` @@ -19,6 +16,11 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_images_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user' +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail + inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. +known_false_positives: none +references: [] tags: analytic_story: - Suspicious Cloud Instance Activities @@ -38,5 +40,3 @@ tags: - Change.All_Changes.user - _time security_domain: network -type: Baseline -version: 1 diff --git a/detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml b/detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml index 4bf7e131d7..6e25bb46dd 100644 --- a/detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml +++ b/detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml @@ -1,17 +1,15 @@ +name: Previously Seen Cloud Provisioning Activity Sources - Initial +id: 4ce865fc-f43e-4521-a8ed-ab8af99052d7 +version: 1 +date: '2020-08-19' author: Rico Valdez, Splunk +type: Baseline datamodel: - Change -date: '2020-08-19' description: This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. This table is then cached. -how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud - provider. -id: 4ce865fc-f43e-4521-a8ed-ab8af99052d7 -known_false_positives: none -name: Previously Seen Cloud Provisioning Activity Sources - Initial -references: [] search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change.All_Changes where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src | `drop_dm_object_name("All_Changes")` @@ -19,6 +17,10 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_provisioning_activity_sources' +how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud + provider. +known_false_positives: none +references: [] tags: analytic_story: - Suspicious Cloud Provisioning Activities @@ -40,5 +42,3 @@ tags: - Change.All_Changes.status - _time security_domain: network -type: Baseline -version: 1 diff --git a/detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml b/detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml index 7b09899465..d2f483fa4d 100644 --- a/detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml +++ b/detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml @@ -1,19 +1,17 @@ +name: Previously Seen Cloud Provisioning Activity Sources - Update +id: 9830abb9-be80-4563-b232-09bf1f628cf3 +version: 1 +date: '2020-08-20' author: David Dorsey, Splunk +type: Baseline datamodel: - Change -date: '2020-08-20' description: This returns the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity within the last day. Cloud provisioning is broadly defined as any event that runs or creates something. It then updates this information with historical data and filters out locations that have not been seen within the specified time window. This updated table is then cached. -how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud - provider. -id: 9830abb9-be80-4563-b232-09bf1f628cf3 -known_false_positives: none -name: Previously Seen Cloud Provisioning Activity Sources - Update -references: [] search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change.All_Changes where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src | `drop_dm_object_name("All_Changes")` @@ -24,6 +22,10 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_provisioning_activity_sources' +how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud + provider. +known_false_positives: none +references: [] tags: analytic_story: - Suspicious Cloud Provisioning Activities @@ -45,5 +47,3 @@ tags: - Change.All_Changes.status - _time security_domain: network -type: Baseline -version: 1 diff --git a/detections/cloud/previously_seen_cloud_regions_initial.yml b/detections/cloud/previously_seen_cloud_regions_initial.yml index 8e235d08d9..5641ea4aeb 100644 --- a/detections/cloud/previously_seen_cloud_regions_initial.yml +++ b/detections/cloud/previously_seen_cloud_regions_initial.yml @@ -1,22 +1,24 @@ +name: Previously Seen Cloud Regions - Initial +id: b5e232db-dec6-4db8-aaa1-dd5474521e40 +version: 1 +date: '2020-09-02' author: David Dorsey, Splunk +type: Baseline datamodel: - Change -date: '2020-09-02' description: This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days -how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs - and have the Security Research cloud data model installed. -id: b5e232db-dec6-4db8-aaa1-dd5474521e40 -known_false_positives: none -name: Previously Seen Cloud Regions - Initial -references: [] search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.vendor_region | `drop_dm_object_name("All_Changes")` | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_regions' +how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs + and have the Security Research cloud data model installed. +known_false_positives: none +references: [] tags: analytic_story: - Cloud Cryptomining @@ -34,5 +36,3 @@ tags: - Change.All_Changes.vendor_region - _time security_domain: network -type: Baseline -version: 1 diff --git a/detections/cloud/previously_seen_cloud_regions_update.yml b/detections/cloud/previously_seen_cloud_regions_update.yml index 0e0217b112..00a7f6888a 100644 --- a/detections/cloud/previously_seen_cloud_regions_update.yml +++ b/detections/cloud/previously_seen_cloud_regions_update.yml @@ -1,17 +1,15 @@ +name: Previously Seen Cloud Regions - Update +id: 512f928a-a461-41b4-8984-db4dd2c472e4 +version: 1 +date: '2020-09-02' author: David Dorsey, Splunk +type: Baseline datamodel: - Change -date: '2020-09-02' description: This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days -how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs - and have the Security Research cloud data model installed. -id: 512f928a-a461-41b4-8984-db4dd2c472e4 -known_false_positives: none -name: Previously Seen Cloud Regions - Update -references: [] search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.vendor_region | `drop_dm_object_name("All_Changes")` | inputlookup append=t previously_seen_cloud_regions @@ -20,6 +18,10 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_regions | stats count' +how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs + and have the Security Research cloud data model installed. +known_false_positives: none +references: [] tags: analytic_story: - Cloud Cryptomining @@ -37,5 +39,3 @@ tags: - Change.All_Changes.vendor_region - _time security_domain: network -type: Baseline -version: 1 diff --git a/detections/cloud/previously_seen_ec2_modifications_by_user.yml b/detections/cloud/previously_seen_ec2_modifications_by_user.yml index 7bb015ce9f..805f15fcfb 100644 --- a/detections/cloud/previously_seen_ec2_modifications_by_user.yml +++ b/detections/cloud/previously_seen_ec2_modifications_by_user.yml @@ -1,18 +1,20 @@ -author: David Dorsey, Splunk -datamodel: [] +name: Previously Seen EC2 Modifications By User +id: 4d69091b-d975-4267-85df-888bd41034eb +version: 1 date: '2018-04-05' +author: David Dorsey, Splunk +type: Baseline +datamodel: [] description: This search builds a table of previously seen ARNs that have launched a EC2 instance. -how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail - inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. -id: 4d69091b-d975-4267-85df-888bd41034eb -known_false_positives: none -name: Previously Seen EC2 Modifications By User -references: [] search: '`cloudtrail` `ec2_modification_api_calls` errorCode=success | spath output=arn userIdentity.arn | stats earliest(_time) as firstTime latest(_time) as lastTime by arn | outputlookup previously_seen_ec2_modifications_by_user | stats count' +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail + inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. +known_false_positives: none +references: [] tags: analytic_story: - Unusual AWS EC2 Modifications @@ -28,5 +30,3 @@ tags: - _time - errorCode security_domain: network -type: Baseline -version: 1 diff --git a/detections/cloud/previously_seen_users_in_cloudtrail_initial.yml b/detections/cloud/previously_seen_users_in_cloudtrail_initial.yml index 028c8c7aa2..f5b6f0b96b 100644 --- a/detections/cloud/previously_seen_users_in_cloudtrail_initial.yml +++ b/detections/cloud/previously_seen_users_in_cloudtrail_initial.yml @@ -1,25 +1,27 @@ +name: Previously Seen Users in CloudTrail - Initial +id: 0a87ecf9-dc6a-43af-861a-205e75a09bf5 +version: 1 +date: '2020-05-28' author: Rico Valdez, Splunk +type: Baseline datamodel: - Authentication -date: '2020-05-28' description: This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by username, within the last 30 days. -how_to_implement: You must install and configure the Splunk Add-on for AWS (version - 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates - to the Authentication data model for cloud use cases. Validate the user name entries - in `previously_seen_users_console_logins`, which is a lookup file created by this - support search. -id: 0a87ecf9-dc6a-43af-861a-205e75a09bf5 -known_false_positives: none -name: Previously Seen Users in CloudTrail - Initial -references: [] search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | outputlookup previously_seen_users_console_logins | stats count' +how_to_implement: You must install and configure the Splunk Add-on for AWS (version + 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates + to the Authentication data model for cloud use cases. Validate the user name entries + in `previously_seen_users_console_logins`, which is a lookup file created by this + support search. +known_false_positives: none +references: [] tags: analytic_story: - Suspicious Cloud Authentication Activities @@ -41,5 +43,3 @@ tags: - Authentication.Authentication.user - _time security_domain: network -type: Baseline -version: 1 diff --git a/detections/cloud/previously_seen_users_in_cloudtrail_update.yml b/detections/cloud/previously_seen_users_in_cloudtrail_update.yml index d483afbe08..7d9d15f092 100644 --- a/detections/cloud/previously_seen_users_in_cloudtrail_update.yml +++ b/detections/cloud/previously_seen_users_in_cloudtrail_update.yml @@ -1,25 +1,27 @@ +name: Previously Seen Users In CloudTrail - Update +id: 66ff71c2-7e01-47dd-a041-906688c9d322 +version: 1 +date: '2020-05-28' author: Rico Valdez, Splunk +type: Baseline datamodel: - Authentication -date: '2020-05-28' description: This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour. -how_to_implement: You must install and configure the Splunk Add-on for AWS (version - 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates - to the Authentication data model for cloud use cases. Validate the user name entries - in `previously_seen_users_console_logins`, which is a lookup file created by this - support search. -id: 66ff71c2-7e01-47dd-a041-906688c9d322 -known_false_positives: none -name: Previously Seen Users In CloudTrail - Update -references: [] search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins' +how_to_implement: You must install and configure the Splunk Add-on for AWS (version + 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates + to the Authentication data model for cloud use cases. Validate the user name entries + in `previously_seen_users_console_logins`, which is a lookup file created by this + support search. +known_false_positives: none +references: [] tags: analytic_story: - Suspicious Cloud Authentication Activities @@ -41,5 +43,3 @@ tags: - Authentication.Authentication.user - _time security_domain: network -type: Baseline -version: 1 diff --git a/detections/endpoint/7zip_commandline_to_smb_share_path.yml b/detections/endpoint/7zip_commandline_to_smb_share_path.yml index 1de7e6ec85..40b7f5f648 100644 --- a/detections/endpoint/7zip_commandline_to_smb_share_path.yml +++ b/detections/endpoint/7zip_commandline_to_smb_share_path.yml @@ -1,21 +1,16 @@ +name: 7zip CommandLine To SMB Share Path +id: 01d29b48-ff6f-11eb-b81e-acde48001122 +version: 1 +date: '2021-08-17' author: Teoderick Contreras, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-08-17' description: This search is to detect a suspicious 7z process with commandline pointing to SMB network share. This technique was seen in CONTI LEAK tools where it use 7z to archive a sensitive files and place it in network share tmp folder. This search is a good hunting query that may give analyst a hint why specific user try to archive a file pointing to SMB user which is un usual. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed 7z.exe may be used. -id: 01d29b48-ff6f-11eb-b81e-acde48001122 -known_false_positives: unknown -name: 7zip CommandLine To SMB Share Path -references: -- https://threadreaderapp.com/thread/1423361119926816776.html search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name ="7z.exe" OR Processes.process_name = "7za.exe" OR Processes.original_file_name = "7z.exe" @@ -25,6 +20,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.parent_process_id Processes.process_id Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `7zip_commandline_to_smb_share_path_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed 7z.exe may be used. +known_false_positives: unknown +references: +- https://threadreaderapp.com/thread/1423361119926816776.html tags: analytic_story: - Ransomware @@ -69,5 +71,3 @@ tags: - _time risk_score: 25 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/baseline_of_command_line_length___mltk.yml b/detections/endpoint/baseline_of_command_line_length___mltk.yml index 691679cba9..eb06bde5d3 100644 --- a/detections/endpoint/baseline_of_command_line_length___mltk.yml +++ b/detections/endpoint/baseline_of_command_line_length___mltk.yml @@ -1,12 +1,21 @@ +name: Baseline of Command Line Length - MLTK +id: d2a4d85b-fc6a-47a0-82f6-bc1ec2ebc459 +version: 1 +date: '2019-05-08' author: Rico Valdez, Splunk +type: Baseline datamodel: - Endpoint -date: '2019-05-08' description: This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the command lines observed for each user in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies outliers in the length of the command line. +search: '| tstats `security_content_summariesonly` count min(_time) as start_time + max(_time) as end_time FROM datamodel=Endpoint.Processes by Processes.user Processes.dest + Processes.process_name Processes.process | `drop_dm_object_name(Processes)` | search + user!=unknown | `security_content_ctime(start_time)`| `security_content_ctime(end_time)`| + eval processlen=len(process) | fit DensityFunction processlen by user into cmdline_pdfmodel' how_to_implement: You must be ingesting endpoint data and populating the Endpoint data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number @@ -17,15 +26,8 @@ how_to_implement: You must be ingesting endpoint data and populating the Endpoin a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -id: d2a4d85b-fc6a-47a0-82f6-bc1ec2ebc459 known_false_positives: none -name: Baseline of Command Line Length - MLTK references: [] -search: '| tstats `security_content_summariesonly` count min(_time) as start_time - max(_time) as end_time FROM datamodel=Endpoint.Processes by Processes.user Processes.dest - Processes.process_name Processes.process | `drop_dm_object_name(Processes)` | search - user!=unknown | `security_content_ctime(start_time)`| `security_content_ctime(end_time)`| - eval processlen=len(process) | fit DensityFunction processlen by user into cmdline_pdfmodel' tags: analytic_story: - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns @@ -49,5 +51,3 @@ tags: - Endpoint.Processes.user - _time security_domain: endpoint -type: Baseline -version: 1 diff --git a/detections/endpoint/batch_file_write_to_system32.yml b/detections/endpoint/batch_file_write_to_system32.yml index b58780149d..b85fe1809e 100644 --- a/detections/endpoint/batch_file_write_to_system32.yml +++ b/detections/endpoint/batch_file_write_to_system32.yml @@ -1,24 +1,13 @@ +name: Batch File Write to System32 +id: 503d17cb-9eab-4cf8-a20e-01d5c6987ae3 +version: 2 +date: '2021-09-16' author: Michael Haag, Rico Valdez, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-16' description: The search looks for a batch file (.bat) written to the Windows system directory tree. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 503d17cb-9eab-4cf8-a20e-01d5c6987ae3 -known_false_positives: It is possible for this search to generate a notable event - for a batch file write to a path that includes the string "system32", but is not - the actual Windows system directory. As such, you should confirm the path of the - batch file identified by the search. In addition, a false positive may be generated - by an administrator copying a legitimate batch file in this directory tree. You - should confirm that the activity is legitimate and modify the search to add exclusions, - as necessary. -name: Batch File Write to System32 -references: [] search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=* by _time span=1h Processes.process_id Processes.process_name Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| @@ -29,6 +18,19 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint | fields _time dest file_create_time file_name file_path process_name process_path process] | dedup file_create_time | table dest file_create_time, file_name, file_path, process_name | `batch_file_write_to_system32_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: It is possible for this search to generate a notable event + for a batch file write to a path that includes the string "system32", but is not + the actual Windows system directory. As such, you should confirm the path of the + batch file identified by the search. In addition, a false positive may be generated + by an administrator copying a legitimate batch file in this directory tree. You + should confirm that the activity is legitimate and modify the search to add exclusions, + as necessary. +references: [] tags: analytic_story: - SamSam Ransomware @@ -81,5 +83,3 @@ tags: - _time risk_score: 63 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml index a59a365aa9..186e2cfd28 100644 --- a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml +++ b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml @@ -1,28 +1,30 @@ +name: Bcdedit Command Back To Normal Mode Boot +id: dc7a8004-0f18-11ec-8c54-acde48001122 +version: 1 +date: '2021-09-06' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-06' description: This search is to detect a suspicious bcdedit commandline to configure the host from safe mode back to normal boot configuration. This technique was seen in blackMatter ransomware where it force the compromised host to boot in safe mode to continue its encryption and bring back to normal boot using bcdedit deletevalue command. This TTP can be a good alert for host that booted from safe mode forcefully since it need to modify the boot configuration to bring it back to normal. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -id: dc7a8004-0f18-11ec-8c54-acde48001122 -known_false_positives: unknown -name: Bcdedit Command Back To Normal Mode Boot -references: -- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="bcdedit.exe" Processes.process="*/deletevalue*" Processes.process="*{current}*" Processes.process="*safeboot*" by Processes.process_name Processes.process Processes.parent_process_name Processes.dest Processes.user |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `bcdedit_command_back_to_normal_mode_boot_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: unknown +references: +- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ tags: analytic_story: - BlackMatter Ransomware @@ -62,5 +64,3 @@ tags: - _time risk_score: 35 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/bcdedit_failure_recovery_modification.yml b/detections/endpoint/bcdedit_failure_recovery_modification.yml index 232ddec8a8..1c640c7923 100644 --- a/detections/endpoint/bcdedit_failure_recovery_modification.yml +++ b/detections/endpoint/bcdedit_failure_recovery_modification.yml @@ -1,24 +1,26 @@ +name: BCDEdit Failure Recovery Modification +id: 809b31d2-5462-11eb-ae93-0242ac130002 +version: 1 +date: '2020-12-21' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2020-12-21' description: This search looks for flags passed to bcdedit.exe modifications to the built-in Windows error recovery boot configurations. This is typically used by ransomware to prevent recovery. -how_to_implement: You must be ingesting endpoint data that tracks process activity, - including parent-child relationships from your endpoints to populate the Endpoint - data model in the Processes node. Tune based on parent process names. -id: 809b31d2-5462-11eb-ae93-0242ac130002 -known_false_positives: Administrators may modify the boot configuration. -name: BCDEdit Failure Recovery Modification -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="bcdedit.exe" Processes.process="*recoveryenabled*" (Processes.process="* no*") by Processes.process_name Processes.process Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `bcdedit_failure_recovery_modification_filter`' +how_to_implement: You must be ingesting endpoint data that tracks process activity, + including parent-child relationships from your endpoints to populate the Endpoint + data model in the Processes node. Tune based on parent process names. +known_false_positives: Administrators may modify the boot configuration. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair tags: analytic_story: - Ryuk Ransomware @@ -73,5 +75,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml index 17df0f2edd..42074a7c1f 100644 --- a/detections/endpoint/bits_job_persistence.yml +++ b/detections/endpoint/bits_job_persistence.yml @@ -1,7 +1,11 @@ +name: BITS Job Persistence +id: e97a5ffe-90bf-11eb-928a-acde48001122 +version: 2 +date: '2021-09-16' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-16' description: The following query identifies Microsoft Background Intelligent Transfer Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint. The query identifies the parameters used to create, resume or add a file to a BITS @@ -9,21 +13,6 @@ description: The following query identifies Microsoft Background Intelligent Tra the BITS job created and capture any files written to disk. It is possible for BITS to be used to upload files and this may require further network data analysis to identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: e97a5ffe-90bf-11eb-928a-acde48001122 -known_false_positives: Limited false positives will be present. Typically, applications - will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments - (legitimate applications) or parent process. -name: BITS Job Persistence -references: -- https://attack.mitre.org/techniques/T1197/ -- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute -- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_bitsadmin` Processes.process IN (*create*, *addfile*, *setnotifyflags*, *setnotifycmdline*, *setminretrydelay*, @@ -31,6 +20,19 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `bits_job_persistence_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Limited false positives will be present. Typically, applications + will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments + (legitimate applications) or parent process. +references: +- https://attack.mitre.org/techniques/T1197/ +- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute +- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ tags: analytic_story: - BITS Jobs @@ -81,5 +83,3 @@ tags: - _time risk_score: 56 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml index ccb620d8b6..82b4b14efc 100644 --- a/detections/endpoint/bitsadmin_download_file.yml +++ b/detections/endpoint/bitsadmin_download_file.yml @@ -1,7 +1,11 @@ +name: BITSAdmin Download File +id: 80630ff4-8e4c-11eb-aab5-acde48001122 +version: 2 +date: '2021-09-16' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-16' description: The following query identifies Microsoft Background Intelligent Transfer Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote object. In addition, look for `download` or `upload` on the command-line, the switches @@ -14,26 +18,24 @@ description: The following query identifies Microsoft Background Intelligent Tra and child processes to capture any behaviors and artifacts. In some suspicious and malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 80630ff4-8e4c-11eb-aab5-acde48001122 -known_false_positives: Limited false positives, however it may be required to filter - based on parent process name or network connection. -name: BITSAdmin Download File -references: -- https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download -- https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md -- https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool -- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_bitsadmin` Processes.process=*transfer* by Processes.dest Processes.user Processes.parent_process Processes.original_file_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `bitsadmin_download_file_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Limited false positives, however it may be required to filter + based on parent process name or network connection. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download +- https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md +- https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool +- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ tags: analytic_story: - Ingress Tool Transfer @@ -87,5 +89,3 @@ tags: - _time risk_score: 49 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml index a4b3aa7b90..f6ffe16ac5 100644 --- a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml +++ b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml @@ -1,7 +1,11 @@ +name: CertUtil Download With URLCache and Split Arguments +id: 415b4306-8bfb-11eb-85c4-acde48001122 +version: 2 +date: '2021-03-23' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-03-23' description: Certutil.exe may download a file from a remote destination using `-urlcache`. This behavior does require a URL to be passed on the command-line. In addition, `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will @@ -9,25 +13,23 @@ description: Certutil.exe may download a file from a remote destination using `- However, it is uncommon for `certutil.exe` to write files to world writeable paths.\ During triage, capture any files on disk and review. Review the reputation of the remote IP or domain in question. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 415b4306-8bfb-11eb-85c4-acde48001122 -known_false_positives: Limited false positives in most environments, however tune - as needed based on parent-child relationship or network connection. -name: CertUtil Download With URLCache and Split Arguments -references: -- https://attack.mitre.org/techniques/T1105/ -- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats -- https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*urlcache* Processes.process=*split* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.original_file_name Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_download_with_urlcache_and_split_arguments_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Limited false positives in most environments, however tune + as needed based on parent-child relationship or network connection. +references: +- https://attack.mitre.org/techniques/T1105/ +- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats +- https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html tags: analytic_story: - Ingress Tool Transfer @@ -79,5 +81,3 @@ tags: - _time risk_score: 90 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml index 8645184424..bd24afd97b 100644 --- a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml +++ b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml @@ -1,7 +1,11 @@ +name: CertUtil Download With VerifyCtl and Split Arguments +id: 801ad9e4-8bfb-11eb-8b31-acde48001122 +version: 2 +date: '2021-03-23' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-03-23' description: 'Certutil.exe may download a file from a remote destination using `-VerifyCtl`. This behavior does require a URL to be passed on the command-line. In addition, `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will @@ -9,26 +13,24 @@ description: 'Certutil.exe may download a file from a remote destination using ` \ During triage, capture any files on disk and review. Review the reputation of the remote IP or domain in question. Using `-VerifyCtl`, the file will either be written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\`. ' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 801ad9e4-8bfb-11eb-8b31-acde48001122 -known_false_positives: Limited false positives in most environments, however tune - as needed based on parent-child relationship or network connection. -name: CertUtil Download With VerifyCtl and Split Arguments -references: -- https://attack.mitre.org/techniques/T1105/ -- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/ -- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl -- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*verifyctl* Processes.process=*split* by Processes.dest Processes.user Processes.original_file_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_download_with_verifyctl_and_split_arguments_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Limited false positives in most environments, however tune + as needed based on parent-child relationship or network connection. +references: +- https://attack.mitre.org/techniques/T1105/ +- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/ +- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl +- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats tags: analytic_story: - Ingress Tool Transfer @@ -80,5 +82,3 @@ tags: - _time risk_score: 90 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/certutil_exe_certificate_extraction.yml b/detections/endpoint/certutil_exe_certificate_extraction.yml index b2b2de6860..e87e112d97 100644 --- a/detections/endpoint/certutil_exe_certificate_extraction.yml +++ b/detections/endpoint/certutil_exe_certificate_extraction.yml @@ -1,24 +1,26 @@ +name: Certutil exe certificate extraction +id: 337a46be-600f-11eb-ae93-0242ac130002 +version: 1 +date: '2021-01-26' author: Rod Soto, Splunk +type: TTP datamodel: - Endpoint -date: '2021-01-26' description: This search looks for arguments to certutil.exe indicating the manipulation or extraction of Certificate. This certificate can then be used to sign new authentication tokens specially inside Federated environments such as Windows ADFS. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: 337a46be-600f-11eb-ae93-0242ac130002 -known_false_positives: Unless there are specific use cases, manipulating or exporting - certificates using certutil is uncommon. Extraction of certificate has been observed - during attacks such as Golden SAML and other campaigns targeting Federated services. -name: Certutil exe certificate extraction -references: [] search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="certutil.exe" Processes.process = "*-exportPFX*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `certutil_exe_certificate_extraction_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Unless there are specific use cases, manipulating or exporting + certificates using certutil is uncommon. Extraction of certificate has been observed + during attacks such as Golden SAML and other campaigns targeting Federated services. +references: [] tags: analytic_story: - Windows Persistence Techniques @@ -68,5 +70,3 @@ tags: - _time risk_score: 63 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/certutil_with_decode_argument.yml b/detections/endpoint/certutil_with_decode_argument.yml index ef04e68a31..ebd099d47d 100644 --- a/detections/endpoint/certutil_with_decode_argument.yml +++ b/detections/endpoint/certutil_with_decode_argument.yml @@ -1,7 +1,11 @@ +name: CertUtil With Decode Argument +id: bfe94226-8c10-11eb-a4b3-acde48001122 +version: 2 +date: '2021-03-23' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-03-23' description: CertUtil.exe may be used to `encode` and `decode` a file, including PE and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded @@ -10,26 +14,24 @@ description: CertUtil.exe may be used to `encode` and `decode` a file, including and `decodehex`. Similarly, the file will be encoded in HEX and later decoded for further execution. During triage, identify the source of the file being decoded. Review its contents or execution behavior for further analysis. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: bfe94226-8c10-11eb-a4b3-acde48001122 -known_false_positives: Typically seen used to `encode` files, but it is possible to - see legitimate use of `decode`. Filter based on parent-child relationship, file - paths, endpoint or user. -name: CertUtil With Decode Argument -references: -- https://attack.mitre.org/techniques/T1140/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1140/T1140.md -- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil -- https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*decode* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_with_decode_argument_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Typically seen used to `encode` files, but it is possible to + see legitimate use of `decode`. Filter based on parent-child relationship, file + paths, endpoint or user. +references: +- https://attack.mitre.org/techniques/T1140/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1140/T1140.md +- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil +- https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/ tags: analytic_story: - Deobfuscate-Decode Files or Information @@ -79,5 +81,3 @@ tags: - _time risk_score: 40 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/change_default_file_association.yml b/detections/endpoint/change_default_file_association.yml index 1837144693..150a53340e 100644 --- a/detections/endpoint/change_default_file_association.yml +++ b/detections/endpoint/change_default_file_association.yml @@ -1,29 +1,31 @@ +name: Change Default File Association +id: 462d17d8-1f71-11ec-ad07-acde48001122 +version: 1 +date: '2021-09-27' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-27' description: This analytic is developed to detect suspicious registry modification to change the default file association of windows to malicious payload. This techninique was seen in some APT where it modify the default process to run file association, like .txt to notepad.exe. Instead notepad.exe it will point to a Script or other payload that will load malicious command to the compromised host. -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -id: 462d17d8-1f71-11ec-ad07-acde48001122 -known_false_positives: unknown -name: Change Default File Association -references: -- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path ="*\\shell\\open\\command\\*" Registry.registry_path = "*HKCR\\*" by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `change_default_file_association_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: unknown +references: +- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features tags: analytic_story: - Windows Persistence Techniques @@ -64,5 +66,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/change_to_safe_mode_with_network_config.yml b/detections/endpoint/change_to_safe_mode_with_network_config.yml index 404164be10..ecb4415fac 100644 --- a/detections/endpoint/change_to_safe_mode_with_network_config.yml +++ b/detections/endpoint/change_to_safe_mode_with_network_config.yml @@ -1,28 +1,30 @@ +name: Change To Safe Mode With Network Config +id: 81f1dce0-0f18-11ec-a5d7-acde48001122 +version: 1 +date: '2021-09-06' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-06' description: This search is to detect a suspicious bcdedit commandline to configure the host to boot in safe mode with network config. This technique was seen in blackMatter ransomware where it force the compromised host to boot in safe mode to continue its encryption and bring back to normal boot using bcdedit deletevalue command. This TTP can be a good alert for host that booted from safe mode forcefully since it need to modify the boot configuration to bring it back to normal. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -id: 81f1dce0-0f18-11ec-a5d7-acde48001122 -known_false_positives: unknown -name: Change To Safe Mode With Network Config -references: -- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="bcdedit.exe" Processes.process="*/set*" Processes.process="*{current}*" Processes.process="*safeboot*" Processes.process="*network*" by Processes.process_name Processes.process Processes.parent_process_name Processes.dest Processes.user |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `change_to_safe_mode_with_network_config_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: unknown +references: +- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ tags: analytic_story: - BlackMatter Ransomware @@ -61,5 +63,3 @@ tags: - _time risk_score: 25 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/chcp_command_execution.yml b/detections/endpoint/chcp_command_execution.yml index cac6dedf6c..a9e12976f3 100644 --- a/detections/endpoint/chcp_command_execution.yml +++ b/detections/endpoint/chcp_command_execution.yml @@ -1,27 +1,29 @@ +name: CHCP Command Execution +id: 21d236ec-eec1-11eb-b23e-acde48001122 +version: 1 +date: '2021-07-27' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-07-27' description: This search is to detect execution of chcp.exe application. this utility is used to change the active code page of the console. This technique was seen in icedid malware to know the locale region/language/country of the compromise host. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed chcp.com may be used. -id: 21d236ec-eec1-11eb-b23e-acde48001122 -known_false_positives: other tools or script may used this to change code page to - UTF-* or others -name: CHCP Command Execution -references: -- https://ss64.com/nt/chcp.html -- https://twitter.com/tccontre18/status/1419941156633329665?s=20 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="chcp.com" Processes.parent_process_name="cmd.exe" Processes.parent_process="*/c*" by Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `chcp_command_execution_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed chcp.com may be used. +known_false_positives: other tools or script may used this to change code page to + UTF-* or others +references: +- https://ss64.com/nt/chcp.html +- https://twitter.com/tccontre18/status/1419941156633329665?s=20 tags: analytic_story: - IcedID @@ -72,5 +74,3 @@ tags: - user risk_score: 9 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/check_elevated_cmd_using_whoami.yml b/detections/endpoint/check_elevated_cmd_using_whoami.yml index 687e017e96..0d7e213553 100644 --- a/detections/endpoint/check_elevated_cmd_using_whoami.yml +++ b/detections/endpoint/check_elevated_cmd_using_whoami.yml @@ -1,7 +1,11 @@ +name: Check Elevated CMD using whoami +id: a9079b18-1633-11ec-859c-acde48001122 +version: 1 +date: '2021-09-15' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-15' description: This search is to detect a suspicious whoami execution to check if the cmd or shell instance process is with elevated privileges. This technique was seen in FIN7 js implant where it execute this as part of its data collection to the infected @@ -9,20 +13,18 @@ description: This search is to detect a suspicious whoami execution to check if really a good alert for known attacker that recon on the targetted host. This command is not so commonly executed by a normal user or even an admin to check if a process is elevated. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -id: a9079b18-1633-11ec-859c-acde48001122 -known_false_positives: unknown -name: Check Elevated CMD using whoami -references: [] search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*whoami*" Processes.process = "*/group*" Processes.process = "* find *" Processes.process = "*12288*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `check_elevated_cmd_using_whoami_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: unknown +references: [] tags: analytic_story: - FIN7 @@ -63,5 +65,3 @@ tags: - _time risk_score: 56 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml index b45f3bcdc4..500cd9ea19 100644 --- a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml +++ b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml @@ -1,25 +1,27 @@ +name: Clear Unallocated Sector Using Cipher App +id: cd80a6ac-c9d9-11eb-8839-acde48001122 +version: 1 +date: '2021-06-10' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-06-10' description: this search is to detect execution of `cipher.exe` to clear the unallocated sectors of a specific disk. This technique was seen in some ransomware to make it impossible to forensically recover deleted files. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: cd80a6ac-c9d9-11eb-8839-acde48001122 -known_false_positives: administrator may execute this app to manage disk -name: Clear Unallocated Sector Using Cipher App -references: -- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/ -- https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "cipher.exe" Processes.process = "*/w:*" by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `clear_unallocated_sector_using_cipher_app_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: administrator may execute this app to manage disk +references: +- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/ +- https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf tags: analytic_story: - Ransomware @@ -72,5 +74,3 @@ tags: - _time risk_score: 90 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/clop_common_exec_parameter.yml b/detections/endpoint/clop_common_exec_parameter.yml index 39a5f3bcba..a3f9064aca 100644 --- a/detections/endpoint/clop_common_exec_parameter.yml +++ b/detections/endpoint/clop_common_exec_parameter.yml @@ -1,7 +1,11 @@ +name: Clop Common Exec Parameter +id: 5a8a2a72-8322-11eb-9ee9-acde48001122 +version: 1 +date: '2021-03-17' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-03-17' description: The following analytics are designed to identifies some CLOP ransomware variant that using arguments to execute its main code or feature of its code. In this variant if the parameter is "runrun", CLOP ransomware will try to encrypt files @@ -9,15 +13,6 @@ description: The following analytics are designed to identifies some CLOP ransom pipe or file start encrypting files within the infected local machines. This technique can be also identified as an anti-sandbox technique to make its code non-responsive since it is waiting for some parameter to execute properly. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: 5a8a2a72-8322-11eb-9ee9-acde48001122 -known_false_positives: Operators can execute third party tools using these parameters. -name: Clop Common Exec Parameter -references: -- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html -- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline values(Processes.parent_process_name) as parent_process values(Processes.process_name) count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes @@ -25,6 +20,13 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as = "*temp.dat*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `clop_common_exec_parameter_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Operators can execute third party tools using these parameters. +references: +- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html +- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html tags: analytic_story: - Clop Ransomware @@ -76,5 +78,3 @@ tags: - _time risk_score: 100 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/clop_ransomware_known_service_name.yml b/detections/endpoint/clop_ransomware_known_service_name.yml index fb451606ea..4391879ed3 100644 --- a/detections/endpoint/clop_ransomware_known_service_name.yml +++ b/detections/endpoint/clop_ransomware_known_service_name.yml @@ -1,23 +1,25 @@ -author: Teoderick Contreras -datamodel: [] +name: Clop Ransomware Known Service Name +id: 07e08a12-870c-11eb-b5f9-acde48001122 +version: 1 date: '2021-03-17' +author: Teoderick Contreras +type: TTP +datamodel: [] description: This detection is to identify the common service name created by the CLOP ransomware as part of its persistence and high privilege code execution in the infected machine. Ussually CLOP ransomware use StartServiceCtrlDispatcherW API in creating this service entry. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the Service name, Service File Name Service Start type, and Service Type - from your endpoints. -id: 07e08a12-870c-11eb-b5f9-acde48001122 -known_false_positives: unknown -name: Clop Ransomware Known Service Name -references: -- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html -- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html search: '`wineventlog_system` EventCode=7045 Service_Name IN ("SecurityCenterIBM", "WinCheckDRVs") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `clop_ransomware_known_service_name_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the Service name, Service File Name Service Start type, and Service Type + from your endpoints. +known_false_positives: unknown +references: +- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html +- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html tags: analytic_story: - Clop Ransomware @@ -61,5 +63,3 @@ tags: - _time risk_score: 100 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml index 3c993eb02e..893cb10c8b 100644 --- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml +++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml @@ -1,30 +1,32 @@ +name: CMD Carry Out String Command Parameter +id: 54a6ed00-3256-11ec-b031-acde48001122 +version: 2 +date: '2021-12-13' author: Teoderick Contreras, Bhavin Patel, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-12-13' description: The following analytic identifies command-line arguments where `cmd.exe /c` is used to execute a program. `cmd /c` is used to run commands in MS-DOS and terminate after command or process completion. This technique is commonly seen in adversaries and malware to execute batch command using different shell like PowerShell or different process other than `cmd.exe`. This is a good hunting query for suspicious command-line made by a script or relative process execute it. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 54a6ed00-3256-11ec-b031-acde48001122 -known_false_positives: False positives may be high based on legitimate scripted code - in any environment. Filter as needed. -name: CMD Carry Out String Command Parameter -references: -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_cmd` AND Processes.process="* /c *" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmd_carry_out_string_command_parameter_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives may be high based on legitimate scripted code + in any environment. Filter as needed. +references: +- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ tags: analytic_story: - IcedID @@ -71,5 +73,3 @@ tags: - _time risk_score: 30 security_domain: endpoint -type: Hunting -version: 2 diff --git a/detections/endpoint/cmd_echo_pipe___escalation.yml b/detections/endpoint/cmd_echo_pipe___escalation.yml index 1f485ca00f..3961fb303b 100644 --- a/detections/endpoint/cmd_echo_pipe___escalation.yml +++ b/detections/endpoint/cmd_echo_pipe___escalation.yml @@ -1,29 +1,31 @@ +name: CMD Echo Pipe - Escalation +id: eb277ba0-b96b-11eb-b00e-acde48001122 +version: 2 +date: '2021-05-20' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-05-20' description: This analytic identifies a common behavior by Cobalt Strike and other frameworks where the adversary will escalate privileges, either via `jump` (Cobalt Strike PTH) or `getsystem`, using named-pipe impersonation. A suspicious event will look like `cmd.exe /c echo 4sgryt3436 > \\.\Pipe\5erg53`. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: eb277ba0-b96b-11eb-b00e-acde48001122 -known_false_positives: Unknown. It is possible filtering may be required to ensure - fidelity. -name: CMD Echo Pipe - Escalation -references: -- https://redcanary.com/threat-detection-report/threats/cobalt-strike/ -- https://github.com/rapid7/meterpreter/blob/master/source/extensions/priv/server/elevate/namedpipe.c search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_cmd` OR Processes.process=*%comspec%* (Processes.process=*echo* AND Processes.process=*pipe*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmd_echo_pipe___escalation_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Unknown. It is possible filtering may be required to ensure + fidelity. +references: +- https://redcanary.com/threat-detection-report/threats/cobalt-strike/ +- https://github.com/rapid7/meterpreter/blob/master/source/extensions/priv/server/elevate/namedpipe.c tags: analytic_story: - Cobalt Strike @@ -79,5 +81,3 @@ tags: - _time risk_score: 64 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml index 7ee68e6c34..d13e2be130 100644 --- a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml +++ b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml @@ -1,7 +1,11 @@ +name: Cmdline Tool Not Executed In CMD Shell +id: 6c3f7dd8-153c-11ec-ac2d-acde48001122 +version: 1 +date: '2021-09-14' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-14' description: The following analytic identifies a non-standard parent process (not matching CMD, PowerShell, or Explorer) spawning `ipconfig.exe` or `systeminfo.exe`. This particular behavior was seen in FIN7's JSSLoader .NET payload. This is also @@ -10,19 +14,6 @@ description: The following analytic identifies a non-standard parent process (no executed with a shell application or Explorer parent, and not by another application. This TTP is a good indicator for an adversary gathering host information, but one possible false positive might be an automated tool used by a system administator. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 6c3f7dd8-153c-11ec-ac2d-acde48001122 -known_false_positives: A network operator or systems administrator may utilize an - automated host discovery application that may generate false positives. Filter as - needed. -name: Cmdline Tool Not Executed In CMD Shell -references: -- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html -- https://attack.mitre.org/groups/G0046/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = "ipconfig.exe" OR Processes.process_name = "systeminfo.exe") AND NOT (Processes.parent_process_name @@ -31,6 +22,17 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.parent_process Processes.process_name Processes.original_file_name Processes.process_id Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmdline_tool_not_executed_in_cmd_shell_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: A network operator or systems administrator may utilize an + automated host discovery application that may generate false positives. Filter as + needed. +references: +- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html +- https://attack.mitre.org/groups/G0046/ tags: analytic_story: - FIN7 @@ -82,5 +84,3 @@ tags: - _time risk_score: 56 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml index 68a2f8ddd1..6baedd2f70 100644 --- a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml +++ b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml @@ -1,23 +1,25 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: CMLUA Or CMSTPLUA UAC Bypass +id: f87b5062-b405-11eb-a889-acde48001122 +version: 1 date: '2021-05-13' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: [] description: This analytic detects a potential process using COM Object like CMLUA or CMSTPLUA to bypass UAC. This technique has been used by ransomware adversaries to gain administrative privileges to its running process. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name and imageloaded executions from your endpoints. If you - are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -id: f87b5062-b405-11eb-a889-acde48001122 -known_false_positives: Legitimate windows application that are not on the list loading - this dll. Filter as needed. -name: CMLUA Or CMSTPLUA UAC Bypass -references: -- https://attack.mitre.org/techniques/T1218/003/ search: '`sysmon` EventCode=7 ImageLoaded IN ("*\\CMLUA.dll", "*\\CMSTPLUA.dll", "*\\CMLUAUTIL.dll") NOT(process_name IN("CMSTP.exe", "CMMGR32.exe")) NOT(Image IN("*\\windows\\*", "*\\program files*")) | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmlua_or_cmstplua_uac_bypass_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name and imageloaded executions from your endpoints. If you + are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: Legitimate windows application that are not on the list loading + this dll. Filter as needed. +references: +- https://attack.mitre.org/techniques/T1218/003/ tags: analytic_story: - DarkSide Ransomware @@ -65,5 +67,3 @@ tags: - ProcessId risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/cobalt_strike_named_pipes.yml b/detections/endpoint/cobalt_strike_named_pipes.yml index cb5159dc7b..b848f8b02f 100644 --- a/detections/endpoint/cobalt_strike_named_pipes.yml +++ b/detections/endpoint/cobalt_strike_named_pipes.yml @@ -64,17 +64,17 @@ tags: - DE.CM observable: - name: user + role: + - Victim type: User - role: - - Victim - name: Computer - type: Hostname role: - Victim + type: Hostname - name: process_name - type: Process role: - Parent Process + type: Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index 13ac6125dd..15cda376b7 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -1,9 +1,18 @@ +name: Common Ransomware Extensions +id: a9e5c5db-db11-43ca-86a8-c852d1b2c0ec +version: 4 +date: '2020-11-09' author: David Dorsey, Splunk +type: Hunting datamodel: - Endpoint -date: '2020-11-09' description: The search looks for file modifications with extensions commonly used by Ransomware +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) + as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`| rex + field=file_name "(?\.[^\.]+)$" | `ransomware_extensions` | `common_ransomware_extensions_filter`' how_to_implement: 'You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which @@ -22,17 +31,10 @@ how_to_implement: 'You must be ingesting data that records the filesystem activi Detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`' -id: a9e5c5db-db11-43ca-86a8-c852d1b2c0ec known_false_positives: It is possible for a legitimate file with these extensions to be created. If this is a true ransomware attack, there will be a large number of files created with these extensions. -name: Common Ransomware Extensions references: [] -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) - as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name | `drop_dm_object_name(Filesystem)` - | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`| rex - field=file_name "(?\.[^\.]+)$" | `ransomware_extensions` | `common_ransomware_extensions_filter`' tags: Consequence: Data Destruction analytic_story: @@ -86,5 +88,3 @@ tags: - _time risk_score: 90 security_domain: endpoint -type: Hunting -version: 4 diff --git a/detections/endpoint/common_ransomware_notes.yml b/detections/endpoint/common_ransomware_notes.yml index 097c898126..50fd01d858 100644 --- a/detections/endpoint/common_ransomware_notes.yml +++ b/detections/endpoint/common_ransomware_notes.yml @@ -1,24 +1,26 @@ +name: Common Ransomware Notes +id: ada0f478-84a8-4641-a3f1-d82362d6bd71 +version: 4 +date: '2020-11-09' author: David Dorsey, Splunk +type: Hunting datamodel: - Endpoint -date: '2020-11-09' description: The search looks for files created with names matching those typically used in ransomware notes that tell the victim how to get their data back. -how_to_implement: You must be ingesting data that records file-system activity from - your hosts to populate the Endpoint Filesystem data-model node. This is typically - populated via endpoint detection-and-response product, such as Carbon Black, or - via other endpoint data sources, such as Sysmon. The data used for this search is - typically generated via logs that report file-system reads and writes. -id: ada0f478-84a8-4641-a3f1-d82362d6bd71 -known_false_positives: It's possible that a legitimate file could be created with - the same name used by ransomware note files. -name: Common Ransomware Notes -references: [] search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `ransomware_notes` | `common_ransomware_notes_filter`' +how_to_implement: You must be ingesting data that records file-system activity from + your hosts to populate the Endpoint Filesystem data-model node. This is typically + populated via endpoint detection-and-response product, such as Carbon Black, or + via other endpoint data sources, such as Sysmon. The data used for this search is + typically generated via logs that report file-system reads and writes. +known_false_positives: It's possible that a legitimate file could be created with + the same name used by ransomware note files. +references: [] tags: Consequence: Data Destruction analytic_story: @@ -71,5 +73,3 @@ tags: - _time risk_score: 90 security_domain: endpoint -type: Hunting -version: 4 diff --git a/detections/endpoint/conti_common_exec_parameter.yml b/detections/endpoint/conti_common_exec_parameter.yml index a14055549b..9eef1fa7a9 100644 --- a/detections/endpoint/conti_common_exec_parameter.yml +++ b/detections/endpoint/conti_common_exec_parameter.yml @@ -1,20 +1,14 @@ +name: Conti Common Exec parameter +id: 624919bc-c382-11eb-adcc-acde48001122 +version: 1 +date: '2021-06-02' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-06-02' description: This search detects the suspicious commandline argument of revil ransomware to encrypt specific or all local drive and network shares of the compromised machine or host. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: 624919bc-c382-11eb-adcc-acde48001122 -known_false_positives: 3rd party tool may have commandline parameter that can trigger - this detection. -name: Conti Common Exec parameter -references: -- https://malpedia.caad.fkie.fraunhofer.de/details/win.conti search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*-m local*" OR Processes.process = "*-m net*" OR Processes.process = "*-m all*" OR Processes.process @@ -22,6 +16,14 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `conti_common_exec_parameter_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: 3rd party tool may have commandline parameter that can trigger + this detection. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.conti tags: analytic_story: - Ransomware @@ -73,5 +75,3 @@ tags: - _time risk_score: 64 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/control_loading_from_world_writable_directory.yml b/detections/endpoint/control_loading_from_world_writable_directory.yml index 4eaf052e47..3be0c2c450 100644 --- a/detections/endpoint/control_loading_from_world_writable_directory.yml +++ b/detections/endpoint/control_loading_from_world_writable_directory.yml @@ -1,27 +1,15 @@ +name: Control Loading from World Writable Directory +id: 10423ac4-10c9-11ec-8dc4-acde48001122 +version: 1 +date: '2021-09-08' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-08' description: The following detection identifies control.exe loading either a .cpl or .inf from a writable directory. This is related to CVE-2021-40444. During triage, review parallel processes, parent and child, for further suspicious behaviors. In addition, capture file modifications and analyze. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 10423ac4-10c9-11ec-8dc4-acde48001122 -known_false_positives: Limited false positives will be present as control.exe does - not natively load from writable paths as defined. One may add .cpl or .inf to the - command-line if there is any false positives. Tune as needed. -name: Control Loading from World Writable Directory -references: -- https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html -- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ -- https://attack.mitre.org/techniques/T1218/011/ -- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="control.exe" OR Processes.original_file_name="CONTROL.EXE") AND Processes.process IN ("*\\appdata\\*", @@ -29,6 +17,20 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `control_loading_from_world_writable_directory_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Limited false positives will be present as control.exe does + not natively load from writable paths as defined. One may add .cpl or .inf to the + command-line if there is any false positives. Tune as needed. +references: +- https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html +- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ +- https://attack.mitre.org/techniques/T1218/011/ +- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml tags: analytic_story: - Microsoft MSHTML Remote Code Execution CVE-2021-40444 @@ -81,5 +83,3 @@ tags: - Endpoint.Processes.user risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml index 9672d62e30..141dde040a 100644 --- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml +++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml @@ -1,26 +1,29 @@ +name: Create local admin accounts using net exe +id: b89919ed-fe5f-492c-b139-151bb162040e +version: 6 +date: '2021-09-08' author: Bhavin Patel, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-08' description: This search looks for the creation of local administrator accounts using net.exe . +search: '| tstats `security_content_summariesonly` count values(Processes.user) as + user values(Processes.parent_process) as parent_process min(_time) as firstTime + max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" + OR Processes.process_name="net1.exe") AND Processes.process="*/add*" AND (Processes.process="*administrators*" + OR Processes.process="*administratoren*" OR Processes.process="*administrateurs*" + OR Processes.process="*administrador*" OR Processes.process="*amministratori*" OR + Processes.process="*administratorer*") by Processes.process Processes.process_name + Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `create_local_admin_accounts_using_net_exe_filter`' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. -id: b89919ed-fe5f-492c-b139-151bb162040e known_false_positives: Administrators often leverage net.exe to create admin accounts. -name: Create local admin accounts using net exe references: [] -search: '| tstats `security_content_summariesonly` count values(Processes.user) as - user values(Processes.parent_process) as parent_process min(_time) as firstTime - max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" - OR Processes.process_name="net1.exe") AND Processes.process="*/add*" AND (Processes.process="*administrators*" - OR Processes.process="*administratoren*" OR Processes.process="*administrateurs*" OR - Processes.process="*administrador*" OR Processes.process="*amministratori*" OR Processes.process="*administratorer*") - by Processes.process Processes.process_name Processes.dest | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `create_local_admin_accounts_using_net_exe_filter`' tags: analytic_story: - DHS Report TA18-074A @@ -78,5 +81,3 @@ tags: - _time risk_score: 30 security_domain: endpoint -type: TTP -version: 6 diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml index 8633968cac..465688a51d 100644 --- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml +++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml @@ -1,26 +1,28 @@ +name: Create or delete windows shares using net exe +id: qw9919ed-fe5f-492c-b139-151bb162140e +version: 6 +date: '2020-09-16' author: Bhavin Patel, Splunk +type: TTP datamodel: - Endpoint -date: '2020-09-16' description: This search looks for the creation or deletion of hidden shares using net.exe. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: qw9919ed-fe5f-492c-b139-151bb162140e -known_false_positives: Administrators often leverage net.exe to create or delete network - shares. You should verify that the activity was intentional and is legitimate. -name: Create or delete windows shares using net exe -references: -- https://attack.mitre.org/techniques/T1070/005 search: '| tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` by Processes.process Processes.process_name Processes.original_file_name Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | search process=*share* | `create_or_delete_windows_shares_using_net_exe_filter` ' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Administrators often leverage net.exe to create or delete network + shares. You should verify that the activity was intentional and is legitimate. +references: +- https://attack.mitre.org/techniques/T1070/005 tags: analytic_story: - Hidden Cobra Malware @@ -76,5 +78,3 @@ tags: - _time risk_score: 25 security_domain: endpoint -type: TTP -version: 6 diff --git a/detections/endpoint/create_remote_thread_in_shell_application.yml b/detections/endpoint/create_remote_thread_in_shell_application.yml index 786a1997ea..ac11b50508 100644 --- a/detections/endpoint/create_remote_thread_in_shell_application.yml +++ b/detections/endpoint/create_remote_thread_in_shell_application.yml @@ -1,23 +1,25 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Create Remote Thread In Shell Application +id: 10399c1e-f51e-11eb-b920-acde48001122 +version: 1 date: '2021-08-04' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: [] description: This search is to detect suspicious process injection in command shell. This technique was seen in IcedID where it execute cmd.exe process to inject its shellcode as part of its execution as banking trojan. It is really uncommon to have a create remote thread execution in the following application. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: 10399c1e-f51e-11eb-b920-acde48001122 -known_false_positives: unknown -name: Create Remote Thread In Shell Application -references: -- https://thedfirreport.com/2021/07/19/icedid-and-cobalt-strike-vs-antivirus/ search: '`sysmon` EventCode=8 TargetImage IN ("*\\cmd.exe", "*\\powershell*") | stats count min(_time) as firstTime max(_time) as lastTime by TargetImage TargetProcessId SourceProcessId EventCode StartAddress SourceImage Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `create_remote_thread_in_shell_application_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://thedfirreport.com/2021/07/19/icedid-and-cobalt-strike-vs-antivirus/ tags: analytic_story: - IcedID @@ -59,5 +61,3 @@ tags: - Computer risk_score: 70 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/create_remote_thread_into_lsass.yml b/detections/endpoint/create_remote_thread_into_lsass.yml index a14767b732..d8442ef5b0 100644 --- a/detections/endpoint/create_remote_thread_into_lsass.yml +++ b/detections/endpoint/create_remote_thread_into_lsass.yml @@ -46,13 +46,13 @@ tags: - DE.CM observable: - name: TargetImage - type: Other role: - Other + type: Other - name: dest - type: Hostname role: - Victim + type: Hostname product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml index e497bf35aa..b82f44f845 100644 --- a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml +++ b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml @@ -52,21 +52,21 @@ tags: - DE.CM observable: - name: user + role: + - Victim type: User - role: - - Victim - name: Computer + role: + - Victim type: Hostname - role: - - Victim - name: TargetFilename - type: File Name role: - Victim + type: File Name - name: process_name - type: Process role: - Child Process + type: Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml index 269d5a5aa7..b144bf3b75 100644 --- a/detections/endpoint/creation_of_shadow_copy.yml +++ b/detections/endpoint/creation_of_shadow_copy.yml @@ -1,26 +1,28 @@ +name: Creation of Shadow Copy +id: eb120f5f-b879-4a63-97c1-93352b5df844 +version: 1 +date: '2019-12-10' author: Patrick Bareiss, Splunk +type: TTP datamodel: - Endpoint -date: '2019-12-10' description: Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="vssadmin.exe" + Processes.process="*create*" Processes.process="*shadow*") OR (Processes.process_name="wmic.exe" + Processes.process="*shadowcopy*" Processes.process="*create*") by Processes.dest + Processes.user Processes.process_name Processes.process Processes.parent_process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `creation_of_shadow_copy_filter`' how_to_implement: You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. -id: eb120f5f-b879-4a63-97c1-93352b5df844 known_false_positives: Legitimate administrator usage of Vssadmin or Wmic will create false positives. -name: Creation of Shadow Copy references: - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="vssadmin.exe" - Processes.process="*create*" Processes.process="*shadow*") OR (Processes.process_name="wmic.exe" - Processes.process="*shadowcopy*" Processes.process="*create*") by Processes.dest Processes.user - Processes.process_name Processes.process Processes.parent_process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)` | `creation_of_shadow_copy_filter`' tags: analytic_story: - Credential Dumping @@ -78,5 +80,3 @@ tags: - _time risk_score: 81 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml index d40728ea08..977ae0252b 100644 --- a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml +++ b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml @@ -1,24 +1,26 @@ +name: Creation of Shadow Copy with wmic and powershell +id: 2ed8b538-d284-449a-be1d-82ad1dbd186b +version: 3 +date: '2021-09-16' author: Patrick Bareiss, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-16' description: This search detects the use of wmic and Powershell to create a shadow copy. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 2ed8b538-d284-449a-be1d-82ad1dbd186b -known_false_positives: Legtimate administrator usage of wmic to create a shadow copy. -name: Creation of Shadow Copy with wmic and powershell -references: -- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_wmic` OR `process_powershell` Processes.process=*shadowcopy* Processes.process=*create* by Processes.user Processes.process_name Processes.original_file_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `creation_of_shadow_copy_with_wmic_and_powershell_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Legtimate administrator usage of wmic to create a shadow copy. +references: +- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf tags: analytic_story: - Credential Dumping @@ -74,5 +76,3 @@ tags: - _time risk_score: 81 security_domain: endpoint -type: TTP -version: 3 diff --git a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml index c88d47cdde..80383eb141 100644 --- a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml @@ -1,19 +1,13 @@ +name: Credential Dumping via Copy Command from Shadow Copy +id: d8c406fe-23d2-45f3-a983-1abe7b83ff3b +version: 2 +date: '2021-09-16' author: Patrick Bareiss, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-16' description: This search detects credential dumping using copy command from a shadow copy. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: d8c406fe-23d2-45f3-a983-1abe7b83ff3b -known_false_positives: unknown -name: Credential Dumping via Copy Command from Shadow Copy -references: -- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_cmd` (Processes.process="*\\system32\\config\\sam*" OR Processes.process="*\\system32\\config\\security*" OR Processes.process="*\\system32\\config\\system*" @@ -21,6 +15,14 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_name Processes.process Processes.parent_process Processes.original_file_name Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `credential_dumping_via_copy_command_from_shadow_copy_filter` ' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: unknown +references: +- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf tags: analytic_story: - Credential Dumping @@ -79,5 +81,3 @@ tags: - _time risk_score: 81 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml index 67bb615773..9edfc1d999 100644 --- a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml @@ -1,24 +1,26 @@ +name: Credential Dumping via Symlink to Shadow Copy +id: c5eac648-fae0-4263-91a6-773df1f4c903 +version: 2 +date: '2021-09-16' author: Patrick Bareiss, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-16' description: This search detects the creation of a symlink to a shadow copy. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: c5eac648-fae0-4263-91a6-773df1f4c903 -known_false_positives: unknown -name: Credential Dumping via Symlink to Shadow Copy -references: -- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_cmd` Processes.process=*mklink* Processes.process=*HarddiskVolumeShadowCopy* by Processes.dest Processes.user Processes.process_name Processes.process Processes.parent_process Processes.original_file_name Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `credential_dumping_via_symlink_to_shadow_copy_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: unknown +references: +- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf tags: analytic_story: - Credential Dumping @@ -77,5 +79,3 @@ tags: - _time risk_score: 81 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/csc_net_on_the_fly_compilation.yml b/detections/endpoint/csc_net_on_the_fly_compilation.yml index aee1e85f1e..7527409db1 100644 --- a/detections/endpoint/csc_net_on_the_fly_compilation.yml +++ b/detections/endpoint/csc_net_on_the_fly_compilation.yml @@ -1,7 +1,11 @@ +name: CSC Net On The Fly Compilation +id: ea73128a-43ab-11ec-9753-acde48001122 +version: 1 +date: '2021-11-12' author: Teoderick Contreras, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-11-12' description: this analytic is to detect a suspicious compile before delivery approach of .net compiler csc.exe. This technique was seen in several adversaries, malware and even in red teams to take advantage the csc.exe .net compiler tool to compile @@ -10,19 +14,6 @@ description: this analytic is to detect a suspicious compile before delivery app event and check the file path that passed to csc.exe which is the .net code. Aside from that, powershell is capable of using this compiler in executing .net code in a powershell script so filter on that case is needed. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: ea73128a-43ab-11ec-9753-acde48001122 -known_false_positives: A network operator or systems administrator may utilize an - automated powershell script taht execute .net code that may generate false positive. - filter is needed. -name: CSC Net On The Fly Compilation -references: -- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/ -- https://tccontre.blogspot.com/2019/06/maicious-macro-that-compile-c-code-as.html search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_csc` Processes.process = "*/noconfig*" Processes.process = "*/fullpaths*" Processes.process = "*@*" by @@ -30,6 +21,17 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `csc_net_on_the_fly_compilation_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: A network operator or systems administrator may utilize an + automated powershell script taht execute .net code that may generate false positive. + filter is needed. +references: +- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/ +- https://tccontre.blogspot.com/2019/06/maicious-macro-that-compile-c-code-as.html tags: analytic_story: - Windows Defense Evasion Tactics @@ -68,5 +70,3 @@ tags: - _time risk_score: 25 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/curl_download_and_bash_execution.yml b/detections/endpoint/curl_download_and_bash_execution.yml index 3067a4696b..560527d720 100644 --- a/detections/endpoint/curl_download_and_bash_execution.yml +++ b/detections/endpoint/curl_download_and_bash_execution.yml @@ -1,30 +1,32 @@ +name: Curl Download and Bash Execution +id: 900bc324-59f3-11ec-9fb4-acde48001122 +version: 1 +date: '2021-12-10' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-12-10' description: The following analytic identifies the use of curl on Linux or MacOS attempting to download a file from a remote source and pipe it to bash. This is typically found with coinminers and most recently with CVE-2021-44228, a vulnerability in Log4j. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon for Linux, you will need to ensure mapping is - occurring correctly. If the EDR is not parsing the pipe bash in the command-line, - modifying the analytic will be required. Add parent process name (Processes.parent_process_name) - as needed to filter. -id: 900bc324-59f3-11ec-9fb4-acde48001122 -known_false_positives: False positives should be limited, however filtering may be - required. -name: Curl Download and Bash Execution -references: -- https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java -- https://www.lunasec.io/docs/blog/log4j-zero-day/ -- https://gist.github.com/nathanqthai/01808c569903f41a52e7e7b575caa890 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=curl (Processes.process="*-s *") OR (Processes.process="*|*" AND Processes.process="*bash*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `curl_download_and_bash_execution_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon for Linux, you will need to ensure mapping is + occurring correctly. If the EDR is not parsing the pipe bash in the command-line, + modifying the analytic will be required. Add parent process name (Processes.parent_process_name) + as needed to filter. +known_false_positives: False positives should be limited, however filtering may be + required. +references: +- https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java +- https://www.lunasec.io/docs/blog/log4j-zero-day/ +- https://gist.github.com/nathanqthai/01808c569903f41a52e7e7b575caa890 tags: analytic_story: - Ingress Tool Transfer @@ -72,5 +74,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml index b8ac403b35..eaeacca0ea 100644 --- a/detections/endpoint/delete_shadowcopy_with_powershell.yml +++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml @@ -1,24 +1,26 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Delete ShadowCopy With PowerShell +id: 5ee2bcd0-b2ff-11eb-bb34-acde48001122 +version: 1 date: '2021-05-12' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: [] description: This following analytic detects PowerShell command to delete shadow copy using the WMIC PowerShell module. This technique was seen used by a recent adversary to deploy DarkSide Ransomware where it executed a child process of PowerShell to execute a hex encoded command to delete shadow copy. This hex encoded command was able to be decrypted by PowerShell log. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the powershell logs from your endpoints. make sure you enable needed - registry to monitor this event. -id: 5ee2bcd0-b2ff-11eb-bb34-acde48001122 -known_false_positives: unknown -name: Delete ShadowCopy With PowerShell -references: -- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html -- https://searchwindowsserver.techtarget.com/tutorial/Set-up-PowerShell-script-block-logging-for-added-security search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" (Message = "*Delete*" OR Message = "*Remove*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `delete_shadowcopy_with_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the powershell logs from your endpoints. make sure you enable needed + registry to monitor this event. +known_false_positives: unknown +references: +- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html +- https://searchwindowsserver.techtarget.com/tutorial/Set-up-PowerShell-script-block-logging-for-added-security tags: analytic_story: - DarkSide Ransomware @@ -59,5 +61,3 @@ tags: - User risk_score: 81 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/deleting_of_net_users.yml b/detections/endpoint/deleting_of_net_users.yml index a21ed4da67..91531baa79 100644 --- a/detections/endpoint/deleting_of_net_users.yml +++ b/detections/endpoint/deleting_of_net_users.yml @@ -1,24 +1,17 @@ +name: Deleting Of Net Users +id: 1c8c6f66-acce-11eb-aafb-acde48001122 +version: 2 +date: '2021-05-04' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-05-04' description: This analytic will detect a suspicious net.exe/net1.exe command-line to delete a user on a system. This technique may be use by an administrator for legitimate purposes, however this behavior has been used in the wild to impair some user or deleting adversaries tracks created during its lateral movement additional systems. During triage, review parallel processes for additional behavior. Identify any other user accounts created before or after. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 1c8c6f66-acce-11eb-aafb-acde48001122 -known_false_positives: System administrators or scripts may delete user accounts via - this technique. Filter as needed. -name: Deleting Of Net Users -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes @@ -26,6 +19,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as by Processes.process_name Processes.original_file_name Processes.dest Processes.user Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `deleting_of_net_users_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: System administrators or scripts may delete user accounts via + this technique. Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - XMRig @@ -76,5 +78,3 @@ tags: - _time risk_score: 25 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/deleting_shadow_copies.yml b/detections/endpoint/deleting_shadow_copies.yml index 3b4141ba51..1d3096daa9 100644 --- a/detections/endpoint/deleting_shadow_copies.yml +++ b/detections/endpoint/deleting_shadow_copies.yml @@ -1,20 +1,14 @@ +name: Deleting Shadow Copies +id: b89919ed-ee5f-492c-b139-95dbb162039e +version: 4 +date: '2020-11-09' author: David Dorsey, Splunk +type: TTP datamodel: - Endpoint -date: '2020-11-09' description: The vssadmin.exe utility is used to interact with the Volume Shadow Copy Service. Wmic is an interface to the Windows Management Instrumentation. This search looks for either of these tools being used to delete shadow copies. -how_to_implement: You must be ingesting endpoint data that tracks process activity, - including parent-child relationships from your endpoints to populate the Endpoint - data model in the Processes node. The command-line arguments are mapped to the "process" - field in the Endpoint data model. -id: b89919ed-ee5f-492c-b139-95dbb162039e -known_false_positives: vssadmin.exe and wmic.exe are standard applications shipped - with modern versions of windows. They may be used by administrators to legitimately - delete old backup copies, although this is typically rare. -name: Deleting Shadow Copies -references: [] search: '| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="vssadmin.exe" @@ -22,6 +16,14 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces by Processes.user Processes.process_name Processes.parent_process_name Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `deleting_shadow_copies_filter`' +how_to_implement: You must be ingesting endpoint data that tracks process activity, + including parent-child relationships from your endpoints to populate the Endpoint + data model in the Processes node. The command-line arguments are mapped to the "process" + field in the Endpoint data model. +known_false_positives: vssadmin.exe and wmic.exe are standard applications shipped + with modern versions of windows. They may be used by administrators to legitimately + delete old backup copies, although this is typically rare. +references: [] tags: analytic_story: - Windows Log Manipulation @@ -81,5 +83,3 @@ tags: - _time risk_score: 81 security_domain: endpoint -type: TTP -version: 4 diff --git a/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml b/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml index d4993baf2c..a2305b516b 100644 --- a/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml +++ b/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml @@ -47,17 +47,17 @@ tags: - PR.IP observable: - name: user + role: + - Victim type: User - role: - - Victim - name: dest - type: Hostname role: - Victim + type: Hostname - name: EventCode - type: Other role: - Other + type: Other product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/detect_azurehound_command_line_arguments.yml b/detections/endpoint/detect_azurehound_command_line_arguments.yml index 63bdad1776..a6c9c7af66 100644 --- a/detections/endpoint/detect_azurehound_command_line_arguments.yml +++ b/detections/endpoint/detect_azurehound_command_line_arguments.yml @@ -1,28 +1,30 @@ +name: Detect AzureHound Command-Line Arguments +id: 26f02e96-c300-11eb-b611-acde48001122 +version: 1 +date: '2021-06-01' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-06-01' description: The following analytic identifies the common command-line argument used by AzureHound `Invoke-AzureHound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances the defaults are used. This analytic works to identify the common command-line attributes used. It does not cover the entirety of every argument in order to avoid false positives. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: 26f02e96-c300-11eb-b611-acde48001122 -known_false_positives: Unknown. -name: Detect AzureHound Command-Line Arguments -references: -- https://attack.mitre.org/software/S0521/ -- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors -- https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350 -- https://github.com/BloodHoundAD/BloodHound/blob/master/Collectors/AzureHound.ps1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*invoke-azurehound*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_azurehound_command_line_arguments_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Unknown. +references: +- https://attack.mitre.org/software/S0521/ +- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors +- https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350 +- https://github.com/BloodHoundAD/BloodHound/blob/master/Collectors/AzureHound.ps1 tags: analytic_story: - Discovery Techniques @@ -78,5 +80,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/detect_azurehound_file_modifications.yml b/detections/endpoint/detect_azurehound_file_modifications.yml index d5eacfdbf4..60e8cccfd5 100644 --- a/detections/endpoint/detect_azurehound_file_modifications.yml +++ b/detections/endpoint/detect_azurehound_file_modifications.yml @@ -1,7 +1,11 @@ +name: Detect AzureHound File Modifications +id: 1c34549e-c31b-11eb-996b-acde48001122 +version: 1 +date: '2021-06-01' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-06-01' description: The following analytic is similar to SharpHound file modifications, but this instance covers the use of Invoke-AzureHound. AzureHound is the SharpHound equivilent but for Azure. It's possible this may never be seen in an environment @@ -9,23 +13,21 @@ description: The following analytic is similar to SharpHound file modifications, zip file with a similar name will drop `20210601090751-azurecollection.zip`. In addition to the zip, multiple .json files will be written to disk, which are in the zip. -how_to_implement: To successfully implement this search you need to be ingesting information - on file modifications that include the name of the process, and file, responsible - for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` - node. -id: 1c34549e-c31b-11eb-996b-acde48001122 -known_false_positives: False positives should be limited as the analytic is specific - to a filename with extension .zip. Filter as needed. -name: Detect AzureHound File Modifications -references: -- https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350 -- https://raw.githubusercontent.com/BloodHoundAD/BloodHound/master/Collectors/AzureHound.ps1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*-azurecollection.zip", "*-azprivroleadminrights.json", "*-azglobaladminrights.json", "*-azcloudappadmins.json", "*-azapplicationadmins.json") by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_azurehound_file_modifications_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on file modifications that include the name of the process, and file, responsible + for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` + node. +known_false_positives: False positives should be limited as the analytic is specific + to a filename with extension .zip. Filter as needed. +references: +- https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350 +- https://raw.githubusercontent.com/BloodHoundAD/BloodHound/master/Collectors/AzureHound.ps1 tags: analytic_story: - Discovery Techniques @@ -80,5 +82,3 @@ tags: - process_id risk_score: 63 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml index e7285779a9..f7d496cbdb 100644 --- a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml +++ b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml @@ -54,13 +54,13 @@ tags: - T1003 observable: - name: user + role: + - Victim type: User - role: - - Victim - name: ComputerName - type: Hostname role: - Victim + type: Hostname product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml index 91d192b29d..568e54a83e 100644 --- a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml +++ b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml @@ -54,17 +54,17 @@ tags: - DE.CM observable: - name: source_image - type: Other role: - Victim + type: Other - name: Computer + role: + - Victim type: Hostname - role: - - Victim - name: TargetImage - type: Other role: - Victim + type: Other product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml index 8bb5dffc0e..b288d4da15 100644 --- a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml @@ -55,13 +55,13 @@ tags: - T1059.001 observable: - name: User + role: + - Victim type: User - role: - - Victim - name: ComputerName - type: Hostname role: - Victim + type: Hostname product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml index ae249cd2b4..1e7622c94e 100644 --- a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml +++ b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml @@ -1,9 +1,19 @@ +name: Detect Excessive Account Lockouts From Endpoint +id: c026e3dd-7e18-4abb-8f41-929e836efe74 +version: 5 +date: '2020-11-09' author: David Dorsey, Splunk +type: Anomaly datamodel: - Change -date: '2020-11-09' description: This search identifies endpoints that have caused a relatively high number of account lockouts in a short period. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime values(All_Changes.user) as user from datamodel=Change.All_Changes where + nodename=All_Changes.Account_Management All_Changes.result="lockout" by All_Changes.dest + All_Changes.result |`drop_dm_object_name("All_Changes")` |`drop_dm_object_name("Account_Management")`| + `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search + count > 5 | `detect_excessive_account_lockouts_from_endpoint_filter`' how_to_implement: "You must ingest your Windows security event logs in the `Change`\ \ datamodel under the nodename is `Account_Management`, for this search to execute\ \ successfully. Please consider updating the cron schedule and the count of lockouts\ @@ -18,17 +28,9 @@ how_to_implement: "You must ingest your Windows security event logs in the `Chan \ Actions when configuring this detection search, and set the corresponding Playbook\ \ to active. \\\n(Playbook Link:`https://my.phantom.us/4.1/playbook/excessive-account-lockouts-enrichment-and-response/`).\\\ \n" -id: c026e3dd-7e18-4abb-8f41-929e836efe74 known_false_positives: It's possible that a widely used system, such as a kiosk, could cause a large number of account lockouts. -name: Detect Excessive Account Lockouts From Endpoint references: [] -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime values(All_Changes.user) as user from datamodel=Change.All_Changes where - nodename=All_Changes.Account_Management All_Changes.result="lockout" by All_Changes.dest - All_Changes.result |`drop_dm_object_name("All_Changes")` |`drop_dm_object_name("Account_Management")`| - `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search - count > 5 | `detect_excessive_account_lockouts_from_endpoint_filter`' tags: analytic_story: - Account Monitoring and Controls @@ -72,5 +74,3 @@ tags: - nodename risk_score: 36 security_domain: access -type: Anomaly -version: 5 diff --git a/detections/endpoint/detect_excessive_user_account_lockouts.yml b/detections/endpoint/detect_excessive_user_account_lockouts.yml index b4304c6f02..e48514eda7 100644 --- a/detections/endpoint/detect_excessive_user_account_lockouts.yml +++ b/detections/endpoint/detect_excessive_user_account_lockouts.yml @@ -1,23 +1,25 @@ +name: Detect Excessive User Account Lockouts +id: 95a7f9a5-6096-437e-a19e-86f42ac609bd +version: 3 +date: '2020-07-21' author: David Dorsey, Splunk +type: Anomaly datamodel: - Change -date: '2020-07-21' description: This search detects user accounts that have been locked out a relatively high number of times in a short period. -how_to_implement: ou must ingest your Windows security event logs in the `Change` - datamodel under the nodename is `Account_Management`, for this search to execute - successfully. Please consider updating the cron schedule and the count of lockouts - you want to monitor, according to your environment. -id: 95a7f9a5-6096-437e-a19e-86f42ac609bd -known_false_positives: It is possible that a legitimate user is experiencing an issue - causing multiple account login failures leading to lockouts. -name: Detect Excessive User Account Lockouts -references: [] search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Change.All_Changes where nodename=All_Changes.Account_Management All_Changes.result="lockout" by All_Changes.user All_Changes.result |`drop_dm_object_name("All_Changes")` |`drop_dm_object_name("Account_Management")`| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search count > 5 | `detect_excessive_user_account_lockouts_filter`' +how_to_implement: ou must ingest your Windows security event logs in the `Change` + datamodel under the nodename is `Account_Management`, for this search to execute + successfully. Please consider updating the cron schedule and the count of lockouts + you want to monitor, according to your environment. +known_false_positives: It is possible that a legitimate user is experiencing an issue + causing multiple account login failures leading to lockouts. +references: [] tags: analytic_story: - Account Monitoring and Controls @@ -60,5 +62,3 @@ tags: - nodename risk_score: 36 security_domain: access -type: Anomaly -version: 3 diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml index 97aac3883f..d809f82a93 100644 --- a/detections/endpoint/detect_exchange_web_shell.yml +++ b/detections/endpoint/detect_exchange_web_shell.yml @@ -1,7 +1,11 @@ +name: Detect Exchange Web Shell +id: 8c14eeee-2af1-4a4b-bda8-228da0f4862a +version: 3 +date: '2021-10-05' author: Michael Haag, Shannon Davis, David Dorsey, Splunk +type: TTP datamodel: - Endpoint -date: '2021-10-05' description: 'The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`, @@ -21,20 +25,6 @@ description: 'The following query identifies suspicious .aspx created in 3 paths untenable. However, using the asset information to limit this analytic to just the Exchange servers will reduce the noise allowing the hunter to focus only on the systems where this behavioral change is relevant.' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` - node. -id: 8c14eeee-2af1-4a4b-bda8-228da0f4862a -known_false_positives: The query is structured in a way that `action` (read, create) - is not defined. Review the results of this query, filter, and tune as necessary. - It may be necessary to generate this query specific to your endpoint product. -name: Detect Exchange Web Shell -references: -- https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv -- https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell -- https://www.youtube.com/watch?v=FC6iHw258RI -- https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=System by _time span=1h Processes.process_id Processes.process_name Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| @@ -45,6 +35,18 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time file_name file_path process_name process_path process] | dedup file_create_time | table dest file_create_time, file_name, file_path, process_name | `detect_exchange_web_shell_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` + node. +known_false_positives: The query is structured in a way that `action` (read, create) + is not defined. Review the results of this query, filter, and tune as necessary. + It may be necessary to generate this query specific to your endpoint product. +references: +- https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv +- https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell +- https://www.youtube.com/watch?v=FC6iHw258RI +- https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do tags: analytic_story: - HAFNIUM Group @@ -93,5 +95,3 @@ tags: - _time risk_score: 81 security_domain: endpoint -type: TTP -version: 3 diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml index 0952401a25..a91d80a30c 100644 --- a/detections/endpoint/detect_html_help_renamed.yml +++ b/detections/endpoint/detect_html_help_renamed.yml @@ -1,7 +1,11 @@ +name: Detect HTML Help Renamed +id: 62fed254-513b-460e-953d-79771493a9f3 +version: 3 +date: '2021-09-16' author: Michael Haag, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-09-16' description: The following analytic identifies a renamed instance of hh.exe (HTML Help) executing a Compiled HTML Help (CHM). This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any @@ -13,24 +17,22 @@ description: The following analytic identifies a renamed instance of hh.exe (HTM or WSH script code. During investigation, identify script content origination. Validate it is the legitimate version of hh.exe by reviewing the PE metadata. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 62fed254-513b-460e-953d-79771493a9f3 -known_false_positives: Although unlikely a renamed instance of hh.exe will be used - legitimately, filter as needed. -name: Detect HTML Help Renamed -references: -- https://attack.mitre.org/techniques/T1218/001/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md -- https://lolbas-project.github.io/lolbas/Binaries/Hh/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_hh` by Processes.dest Processes.user Processes.parent_process_name Processes.original_file_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_html_help_renamed_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Although unlikely a renamed instance of hh.exe will be used + legitimately, filter as needed. +references: +- https://attack.mitre.org/techniques/T1218/001/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md +- https://lolbas-project.github.io/lolbas/Binaries/Hh/ tags: analytic_story: - Suspicious Compiled HTML Activity @@ -88,5 +90,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: Hunting -version: 3 diff --git a/detections/endpoint/detect_html_help_spawn_child_process.yml b/detections/endpoint/detect_html_help_spawn_child_process.yml index 822e6015d6..ba96500e61 100644 --- a/detections/endpoint/detect_html_help_spawn_child_process.yml +++ b/detections/endpoint/detect_html_help_spawn_child_process.yml @@ -1,7 +1,11 @@ +name: Detect HTML Help Spawn Child Process +id: 723716de-ee55-4cd4-9759-c44e7e55ba4b +version: 1 +date: '2021-02-11' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-02-11' description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) that spawns a child process. This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any @@ -13,24 +17,22 @@ description: The following analytic identifies hh.exe (HTML Help) execution of a or WSH script code. During investigation, identify script content origination. Review child process events and investigate further. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="hh.exe" + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_html_help_spawn_child_process_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: 723716de-ee55-4cd4-9759-c44e7e55ba4b known_false_positives: Although unlikely, some legitimate applications (ex. web browsers) may spawn a child process. Filter as needed. -name: Detect HTML Help Spawn Child Process references: - https://attack.mitre.org/techniques/T1218/001/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md - https://lolbas-project.github.io/lolbas/Binaries/Hh/ - https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7 - https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="hh.exe" - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_html_help_spawn_child_process_filter`' tags: analytic_story: - Suspicious Compiled HTML Activity @@ -89,5 +91,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/detect_html_help_url_in_command_line.yml b/detections/endpoint/detect_html_help_url_in_command_line.yml index 21baaee019..85301a2b80 100644 --- a/detections/endpoint/detect_html_help_url_in_command_line.yml +++ b/detections/endpoint/detect_html_help_url_in_command_line.yml @@ -1,7 +1,11 @@ +name: Detect HTML Help URL in Command Line +id: 8c5835b9-39d9-438b-817c-95f14c69a31e +version: 2 +date: '2021-09-16' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-16' description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file from a remote url. This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type @@ -13,15 +17,19 @@ description: The following analytic identifies hh.exe (HTML Help) execution of a investigation, identify script content origination. Review reputation of remote IP and domain. Some instances, it is worth decompiling the .chm file to review its original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_hh` Processes.process=*http* + by Processes.dest Processes.user Processes.parent_process Processes.original_file_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `detect_html_help_url_in_command_line_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -id: 8c5835b9-39d9-438b-817c-95f14c69a31e known_false_positives: Although unlikely, some legitimate applications may retrieve a CHM remotely, filter as needed. -name: Detect HTML Help URL in Command Line references: - https://attack.mitre.org/techniques/T1218/001/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md @@ -29,12 +37,6 @@ references: - https://blog.sevagas.com/?Hacking-around-HTA-files - https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7 - https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_hh` Processes.process=*http* - by Processes.dest Processes.user Processes.parent_process Processes.original_file_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `detect_html_help_url_in_command_line_filter`' tags: analytic_story: - Suspicious Compiled HTML Activity @@ -93,5 +95,3 @@ tags: - _time risk_score: 90 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml index 0ad418e197..b029903a34 100644 --- a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml +++ b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml @@ -1,7 +1,11 @@ +name: Detect HTML Help Using InfoTech Storage Handlers +id: 0b2eefa5-5508-450d-b970-3dd2fb761aec +version: 2 +date: '2021-09-16' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-16' description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique will load Windows script code from a compiled help file, using InfoTech Storage @@ -15,15 +19,19 @@ description: The following analytic identifies hh.exe (HTML Help) execution of a the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_hh` Processes.process + IN ("*its:*", "*mk:@MSITStore:*") by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `detect_html_help_using_infotech_storage_handlers_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -id: 0b2eefa5-5508-450d-b970-3dd2fb761aec known_false_positives: It is rare to see instances of InfoTech Storage Handlers being used, but it does happen in some legitimate instances. Filter as needed. -name: Detect HTML Help Using InfoTech Storage Handlers references: - https://attack.mitre.org/techniques/T1218/001/ - https://www.kb.cert.org/vuls/id/851869 @@ -31,12 +39,6 @@ references: - https://lolbas-project.github.io/lolbas/Binaries/Hh/ - https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7 - https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_hh` Processes.process - IN ("*its:*", "*mk:@MSITStore:*") by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `detect_html_help_using_infotech_storage_handlers_filter`' tags: analytic_story: - Suspicious Compiled HTML Activity @@ -89,5 +91,3 @@ tags: - _time risk_score: 72 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/detect_mimikatz_using_loaded_images.yml b/detections/endpoint/detect_mimikatz_using_loaded_images.yml index bba8e5fc5c..1112ce5184 100644 --- a/detections/endpoint/detect_mimikatz_using_loaded_images.yml +++ b/detections/endpoint/detect_mimikatz_using_loaded_images.yml @@ -1,27 +1,29 @@ -author: Patrick Bareiss, Splunk -datamodel: [] +name: Detect Mimikatz Using Loaded Images +id: 29e307ba-40af-4ab2-91b2-3c6b392bbba0 +version: 1 date: '2019-12-03' +author: Patrick Bareiss, Splunk +type: TTP +datamodel: [] description: This search looks for reading loaded Images unique to credential dumping with Mimikatz. Deprecated because mimikatz libraries changed and very noisy sysmon Event Code. +search: '`sysmon` EventCode=7 | stats values(ImageLoaded) as ImageLoaded values(ProcessId) + as ProcessId by Computer, Image | search ImageLoaded=*WinSCard.dll ImageLoaded=*cryptdll.dll + ImageLoaded=*hid.dll ImageLoaded=*samlib.dll ImageLoaded=*vaultcli.dll | rename + Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `detect_mimikatz_using_loaded_images_filter`' how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 7 with powershell.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. -id: 29e307ba-40af-4ab2-91b2-3c6b392bbba0 known_false_positives: Other tools can import the same DLLs. These tools should be part of a whitelist. False positives may be present with any process that authenticates or uses credentials, PowerShell included. Filter based on parent process. -name: Detect Mimikatz Using Loaded Images references: - https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html -search: '`sysmon` EventCode=7 | stats values(ImageLoaded) as ImageLoaded values(ProcessId) - as ProcessId by Computer, Image | search ImageLoaded=*WinSCard.dll ImageLoaded=*cryptdll.dll - ImageLoaded=*hid.dll ImageLoaded=*samlib.dll ImageLoaded=*vaultcli.dll | rename - Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` - | `detect_mimikatz_using_loaded_images_filter`' tags: analytic_story: - Credential Dumping @@ -79,5 +81,3 @@ tags: - ProcessId risk_score: 64 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml index 543d762e98..90d8f214c7 100644 --- a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml @@ -51,13 +51,13 @@ tags: - T1003 observable: - name: User + role: + - Victim type: User - role: - - Victim - name: ComputerName - type: Hostname role: - Victim + type: Hostname product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/detect_mshta_inline_hta_execution.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml index c87d6772b8..147a1836a7 100644 --- a/detections/endpoint/detect_mshta_inline_hta_execution.yml +++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml @@ -1,25 +1,16 @@ +name: Detect mshta inline hta execution +id: a0873b32-5b68-11eb-ae93-0242ac130002 +version: 6 +date: '2021-09-16' author: Bhavin Patel, Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-16' description: The following analytic identifies "mshta.exe" execution with inline protocol handlers. "JavaScript", "VBScript", and "About" are the only supported options when invoking HTA content directly on the command-line. The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "mshta.exe" and its parent process. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: a0873b32-5b68-11eb-ae93-0242ac130002 -known_false_positives: Although unlikely, some legitimate applications may exhibit - this behavior, triggering a false positive. -name: Detect mshta inline hta execution -references: -- https://github.com/redcanaryco/AtomicTestHarnesses -- https://redcanary.com/blog/introducing-atomictestharnesses/ -- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing search: '| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_mshta` (Processes.process=*vbscript* @@ -27,6 +18,17 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces Processes.process_name Processes.original_file_name Processes.parent_process_name Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_mshta_inline_hta_execution_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Although unlikely, some legitimate applications may exhibit + this behavior, triggering a false positive. +references: +- https://github.com/redcanaryco/AtomicTestHarnesses +- https://redcanary.com/blog/introducing-atomictestharnesses/ +- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing tags: analytic_story: - Suspicious MSHTA Activity @@ -84,5 +86,3 @@ tags: - _time risk_score: 90 security_domain: endpoint -type: TTP -version: 6 diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/endpoint/detect_mshta_renamed.yml index f0def59389..daa7a25936 100644 --- a/detections/endpoint/detect_mshta_renamed.yml +++ b/detections/endpoint/detect_mshta_renamed.yml @@ -1,30 +1,32 @@ +name: Detect mshta renamed +id: 8f45fcf0-5b68-11eb-ae93-0242ac130002 +version: 2 +date: '2021-09-16' author: Michael Haag, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-09-16' description: The following analytic identifies renamed instances of mshta.exe executing. Mshta.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. This analytic utilizes the internal name of the PE to identify if is the legitimate mshta binary. Further analysis should be performed to review the executed content and validation it is the real mshta. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 8f45fcf0-5b68-11eb-ae93-0242ac130002 -known_false_positives: Although unlikely, some legitimate applications may use a moved - copy of mshta.exe, but never renamed, triggering a false positive. -name: Detect mshta renamed -references: -- https://github.com/redcanaryco/AtomicTestHarnesses -- https://redcanary.com/blog/introducing-atomictestharnesses/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_mshta` by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_mshta_renamed_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Although unlikely, some legitimate applications may use a moved + copy of mshta.exe, but never renamed, triggering a false positive. +references: +- https://github.com/redcanaryco/AtomicTestHarnesses +- https://redcanary.com/blog/introducing-atomictestharnesses/ tags: analytic_story: - Suspicious MSHTA Activity @@ -82,5 +84,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: Hunting -version: 2 diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml index 02dce6e06d..e6227cc442 100644 --- a/detections/endpoint/detect_mshta_url_in_command_line.yml +++ b/detections/endpoint/detect_mshta_url_in_command_line.yml @@ -1,7 +1,11 @@ +name: Detect MSHTA Url in Command Line +id: 9b3af1e6-5b68-11eb-ae93-0242ac130002 +version: 2 +date: '2021-09-16' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-16' description: This analytic identifies when Microsoft HTML Application Host (mshta.exe) utility is used to make remote http connections. Adversaries may use mshta.exe to proxy the download and execution of remote .hta files. The analytic identifies command @@ -9,25 +13,23 @@ description: This analytic identifies when Microsoft HTML Application Host (msht malicious software to bypass preventative controls. The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "rundll32.exe" and its parent process. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 9b3af1e6-5b68-11eb-ae93-0242ac130002 -known_false_positives: It is possible legitimate applications may perform this behavior - and will need to be filtered. -name: Detect MSHTA Url in Command Line -references: -- https://github.com/redcanaryco/AtomicTestHarnesses -- https://redcanary.com/blog/introducing-atomictestharnesses/ -- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing search: '| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_mshta` (Processes.process="*http://*" OR Processes.process="*https://*") by Processes.user Processes.process_name Processes.parent_process_name Processes.original_file_name Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_mshta_url_in_command_line_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: It is possible legitimate applications may perform this behavior + and will need to be filtered. +references: +- https://github.com/redcanaryco/AtomicTestHarnesses +- https://redcanary.com/blog/introducing-atomictestharnesses/ +- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing tags: analytic_story: - Suspicious MSHTA Activity @@ -85,5 +87,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/detect_new_local_admin_account.yml b/detections/endpoint/detect_new_local_admin_account.yml index e1152726bf..ef89613677 100644 --- a/detections/endpoint/detect_new_local_admin_account.yml +++ b/detections/endpoint/detect_new_local_admin_account.yml @@ -48,13 +48,13 @@ tags: - DE.CM observable: - name: user + role: + - Victim type: User - role: - - Victim - name: dest - type: Hostname role: - Victim + type: Hostname product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml index 9ead0a9a0a..53b4ab1a86 100644 --- a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml +++ b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml @@ -1,20 +1,14 @@ +name: Detect Path Interception By Creation Of program exe +id: c77162d3-f93c-45cc-80c8-22f6v5264g9f +version: 3 +date: '2020-07-03' author: Patrick Bareiss, Splunk +type: TTP datamodel: - Endpoint -date: '2020-07-03' description: 'The detection Detect Path Interception By Creation Of program exe is detecting the abuse of unquoted service paths, which is a popular technique for privilege escalation. ' -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. -id: c77162d3-f93c-45cc-80c8-22f6v5264g9f -known_false_positives: unknown -name: Detect Path Interception By Creation Of program exe -references: -- https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="services.exe" by Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` @@ -22,6 +16,14 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | eval process_name = lower(process_name) | eval service_process = lower(service_process) | where process_name != service_process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_path_interception_by_creation_of_program_exe_filter`' +how_to_implement: You must be ingesting data that records process activity from your + hosts to populate the Endpoint data model in the Processes node. You must also be + ingesting logs with both the process name and command line from your endpoints. + The command-line arguments are mapped to the "process" field in the Endpoint data + model. +known_false_positives: unknown +references: +- https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae tags: analytic_story: - Windows Persistence Techniques @@ -77,5 +79,3 @@ tags: - _time risk_score: 49 security_domain: endpoint -type: TTP -version: 3 diff --git a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml index 33fc97d950..4470f851aa 100644 --- a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml +++ b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml @@ -1,21 +1,13 @@ +name: Detect processes used for System Network Configuration Discovery +id: a51bfe1a-94f0-48cc-b1e4-16ae10145893 +version: 2 +date: '2020-11-10' author: Bhavin Patel, Splunk +type: TTP datamodel: - Endpoint -date: '2020-11-10' description: This search looks for fast execution of processes used for system network configuration discovery on the endpoint. -how_to_implement: You must be ingesting data that records registry activity from your - hosts to populate the Endpoint data model in the processes node. This is typically - populated via endpoint detection-and-response product, such as Carbon Black, or - endpoint data sources, such as Sysmon. The data used for this search is usually - generated via logs that report reads and writes to the registry or that are populated - via Windows event logs, after enabling process tracking in your Windows audit settings. -id: a51bfe1a-94f0-48cc-b1e4-16ae10145893 -known_false_positives: It is uncommon for normal users to execute a series of commands - used for network discovery. System administrators often use scripts to execute these - commands. These can generate false positives. -name: Detect processes used for System Network Configuration Discovery -references: [] search: '| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where NOT Processes.user @@ -24,6 +16,16 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces | search `system_network_configuration_discovery_tools` | transaction dest connected=false maxpause=5m |where eventcount>=5 | table firstTime lastTime dest user process_name process parent_process eventcount | `detect_processes_used_for_system_network_configuration_discovery_filter`' +how_to_implement: You must be ingesting data that records registry activity from your + hosts to populate the Endpoint data model in the processes node. This is typically + populated via endpoint detection-and-response product, such as Carbon Black, or + endpoint data sources, such as Sysmon. The data used for this search is usually + generated via logs that report reads and writes to the registry or that are populated + via Windows event logs, after enabling process tracking in your Windows audit settings. +known_false_positives: It is uncommon for normal users to execute a series of commands + used for network discovery. System administrators often use scripts to execute these + commands. These can generate false positives. +references: [] tags: analytic_story: - Unusual Processes @@ -80,5 +82,3 @@ tags: - _time risk_score: 32 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml index ea53a2a39c..fce22ca3db 100644 --- a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml +++ b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml @@ -1,9 +1,18 @@ +name: Detect Prohibited Applications Spawning cmd exe +id: dcfd6b40-42f9-469d-a433-2e53f7486664 +version: 6 +date: '2020-11-10' author: Bhavin Patel, Splunk +type: Hunting datamodel: - Endpoint -date: '2020-11-10' description: This search looks for executions of cmd.exe spawned by a process that is often abused by attackers and that does not typically launch cmd.exe. +search: '| tstats `security_content_summariesonly` count values(Processes.process) + as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where `process_cmd` by Processes.parent_process_name Processes.process_name Processes.original_file_name + Processes.dest Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)` |search [`prohibited_apps_launching_cmd`] | `detect_prohibited_applications_spawning_cmd_exe_filter`' how_to_implement: You must be ingesting data that records process activity from your hosts and populates the Endpoint data model with the resultant dataset. This search includes a lookup file, `prohibited_apps_launching_cmd.csv`, that contains a list @@ -13,17 +22,10 @@ how_to_implement: You must be ingesting data that records process activity from for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -id: dcfd6b40-42f9-469d-a433-2e53f7486664 known_false_positives: There are circumstances where an application may legitimately execute and interact with the Windows command-line interface. Investigate and modify the lookup file, as appropriate. -name: Detect Prohibited Applications Spawning cmd exe references: [] -search: '| tstats `security_content_summariesonly` count values(Processes.process) - as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where `process_cmd` by Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.dest Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)` |search [`prohibited_apps_launching_cmd`] | `detect_prohibited_applications_spawning_cmd_exe_filter`' tags: analytic_story: - Suspicious Command-Line Executions @@ -82,5 +84,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: Hunting -version: 6 diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml index 37bc7fce0c..0676f21b23 100644 --- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml +++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml @@ -1,7 +1,11 @@ +name: Detect PsExec With accepteula Flag +id: b89919ed-fe5f-492c-b139-151xb162040e +version: 4 +date: '2021-09-16' author: Bhavin Patel, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-16' description: This search looks for events where `PsExec.exe` is run with the `accepteula` flag in the command line. PsExec is a built-in Windows utility that enables you to execute processes on other systems. It is fully interactive for console applications. @@ -10,24 +14,22 @@ description: This search looks for events where `PsExec.exe` is run with the `ac If an attacker is running PsExec for the first time, they will be prompted to accept the end-user license agreement (EULA), which can be passed as the argument `accepteula` within the command line. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: b89919ed-fe5f-492c-b139-151xb162040e -known_false_positives: Administrators can leverage PsExec for accessing remote systems - and might pass `accepteula` as an argument if they are running this tool for the - first time. However, it is not likely that you'd see multiple occurrences of this - event on a machine -name: Detect PsExec With accepteula Flag -references: [] search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_psexec` Processes.process=*accepteula* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_psexec_with_accepteula_flag_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Administrators can leverage PsExec for accessing remote systems + and might pass `accepteula` as an argument if they are running this tool for the + first time. However, it is not likely that you'd see multiple occurrences of this + event on a machine +references: [] tags: analytic_story: - SamSam Ransomware @@ -88,5 +90,3 @@ tags: - _time risk_score: 35 security_domain: endpoint -type: TTP -version: 4 diff --git a/detections/endpoint/detect_rclone_command_line_usage.yml b/detections/endpoint/detect_rclone_command_line_usage.yml index e6c72be135..cb73f77634 100644 --- a/detections/endpoint/detect_rclone_command_line_usage.yml +++ b/detections/endpoint/detect_rclone_command_line_usage.yml @@ -1,7 +1,11 @@ +name: Detect RClone Command-Line Usage +id: 32e0baea-b3f1-11eb-a2ce-acde48001122 +version: 2 +date: '2021-11-29' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-11-29' description: This analytic identifies commonly used command-line arguments used by `rclone.exe` to initiate a file transfer. Some arguments were negated as they are specific to the configuration used by adversaries. In particular, an adversary may @@ -9,20 +13,6 @@ description: This analytic identifies commonly used command-line arguments used is not indicative of malicious behavior. During triage, at this stage of a ransomware event, exfiltration is about to occur or has already. Isolate the endpoint and continue investigating by review file modifications and parallel processes. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 32e0baea-b3f1-11eb-a2ce-acde48001122 -known_false_positives: False positives should be limited as this is restricted to - the Rclone process name. Filter or tune the analytic as needed. -name: Detect RClone Command-Line Usage -references: -- https://redcanary.com/blog/rclone-mega-extortion/ -- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html -- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ -- https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rclone` Processes.process IN ("*copy*", "*mega*", "*pcloud*", "*ftp*", "*--config*", "*--progress*", "*--no-check-certificate*", @@ -30,6 +20,18 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rclone_command_line_usage_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives should be limited as this is restricted to + the Rclone process name. Filter or tune the analytic as needed. +references: +- https://redcanary.com/blog/rclone-mega-extortion/ +- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html +- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ +- https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/ tags: analytic_story: - DarkSide Ransomware @@ -81,5 +83,3 @@ tags: - _time risk_score: 35 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/detect_regasm_spawning_a_process.yml b/detections/endpoint/detect_regasm_spawning_a_process.yml index 5797c229c6..6e7c3c8a29 100644 --- a/detections/endpoint/detect_regasm_spawning_a_process.yml +++ b/detections/endpoint/detect_regasm_spawning_a_process.yml @@ -1,7 +1,11 @@ +name: Detect Regasm Spawning a Process +id: 72170ec5-f7d2-42f5-aefb-2b8be6aad15f +version: 1 +date: '2021-02-12' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-02-12' description: The following analytic identifies regasm.exe spawning a process. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process @@ -10,24 +14,22 @@ description: The following analytic identifies regasm.exe spawning a process. Th suspicious behavior. Gather any other file modifications and review accordingly. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: 72170ec5-f7d2-42f5-aefb-2b8be6aad15f -known_false_positives: Although unlikely, limited instances of regasm.exe or regsvcs.exe - may cause a false positive. Filter based endpoint usage, command line arguments, - or process lineage. -name: Detect Regasm Spawning a Process -references: -- https://attack.mitre.org/techniques/T1218/009/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md -- https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/ -- https://lolbas-project.github.io/lolbas/Binaries/Regasm/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="regasm.exe" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regasm_spawning_a_process_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Although unlikely, limited instances of regasm.exe or regsvcs.exe + may cause a false positive. Filter based endpoint usage, command line arguments, + or process lineage. +references: +- https://attack.mitre.org/techniques/T1218/009/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md +- https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/ +- https://lolbas-project.github.io/lolbas/Binaries/Regasm/ tags: analytic_story: - Suspicious Regsvcs Regasm Activity @@ -86,5 +88,3 @@ tags: - _time risk_score: 64 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/detect_regasm_with_network_connection.yml b/detections/endpoint/detect_regasm_with_network_connection.yml index bbcab20120..369e4d94ba 100644 --- a/detections/endpoint/detect_regasm_with_network_connection.yml +++ b/detections/endpoint/detect_regasm_with_network_connection.yml @@ -56,17 +56,17 @@ tags: - DE.CM observable: - name: user + role: + - Victim type: User - role: - - Victim - name: Computer - type: Hostname role: - Victim + type: Hostname - name: process_name - type: Process role: - Child Process + type: Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml index 06db7e959a..d6f180f7b6 100644 --- a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml @@ -1,32 +1,34 @@ +name: Detect Regasm with no Command Line Arguments +id: c3bc1430-04e7-4178-835f-047d8e6e97df +version: 2 +date: '2021-09-20' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-20' description: The following analytic identifies regasm.exe with no command line arguments. This particular behavior occurs when another process injects into regasm.exe, no command line arguments will be present. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Regasm.exe are natively found in `C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe` and `C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe`. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: c3bc1430-04e7-4178-835f-047d8e6e97df -known_false_positives: Although unlikely, limited instances of regasm.exe or may cause - a false positive. Filter based endpoint usage, command line arguments, or process - lineage. -name: Detect Regasm with no Command Line Arguments -references: -- https://attack.mitre.org/techniques/T1218/009/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md -- https://lolbas-project.github.io/lolbas/Binaries/Regasm/ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_regasm` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(regasm\.exe.{0,4}$)" | `detect_regasm_with_no_command_line_arguments_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Although unlikely, limited instances of regasm.exe or may cause + a false positive. Filter based endpoint usage, command line arguments, or process + lineage. +references: +- https://attack.mitre.org/techniques/T1218/009/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md +- https://lolbas-project.github.io/lolbas/Binaries/Regasm/ tags: analytic_story: - Suspicious Regsvcs Regasm Activity @@ -82,5 +84,3 @@ tags: - _time risk_score: 49 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/detect_regsvcs_spawning_a_process.yml b/detections/endpoint/detect_regsvcs_spawning_a_process.yml index 56c420e079..46d7ec8899 100644 --- a/detections/endpoint/detect_regsvcs_spawning_a_process.yml +++ b/detections/endpoint/detect_regsvcs_spawning_a_process.yml @@ -1,7 +1,11 @@ +name: Detect Regsvcs Spawning a Process +id: bc477b57-5c21-4ab6-9c33-668772e7f114 +version: 1 +date: '2021-02-12' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-02-12' description: The following analytic identifies regsvcs.exe spawning a process. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process @@ -10,23 +14,21 @@ description: The following analytic identifies regsvcs.exe spawning a process. T suspicious behavior. Gather any other file modifications and review accordingly. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: bc477b57-5c21-4ab6-9c33-668772e7f114 -known_false_positives: Although unlikely, limited instances of regasm.exe or regsvcs.exe - may cause a false positive. Filter based endpoint usage, command line arguments, - or process lineage. -name: Detect Regsvcs Spawning a Process -references: -- https://attack.mitre.org/techniques/T1218/009/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md -- https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="regsvcs.exe" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regsvcs_spawning_a_process_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Although unlikely, limited instances of regasm.exe or regsvcs.exe + may cause a false positive. Filter based endpoint usage, command line arguments, + or process lineage. +references: +- https://attack.mitre.org/techniques/T1218/009/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md +- https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/ tags: analytic_story: - Suspicious Regsvcs Regasm Activity @@ -84,5 +86,3 @@ tags: - _time risk_score: 64 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/detect_regsvcs_with_network_connection.yml b/detections/endpoint/detect_regsvcs_with_network_connection.yml index 7329369714..35221f9ddf 100644 --- a/detections/endpoint/detect_regsvcs_with_network_connection.yml +++ b/detections/endpoint/detect_regsvcs_with_network_connection.yml @@ -56,17 +56,17 @@ tags: - DE.CM observable: - name: user + role: + - Victim type: User - role: - - Victim - name: Computer - type: Hostname role: - Victim + type: Hostname - name: process_name - type: Process role: - Child Process + type: Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml index 8cb4558991..3b9a7dccb4 100644 --- a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml @@ -1,32 +1,34 @@ +name: Detect Regsvcs with No Command Line Arguments +id: 6b74d578-a02e-4e94-a0d1-39440d0bf254 +version: 2 +date: '2021-09-20' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-20' description: The following analytic identifies regsvcs.exe with no command line arguments. This particular behavior occurs when another process injects into regsvcs.exe, no command line arguments will be present. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 6b74d578-a02e-4e94-a0d1-39440d0bf254 -known_false_positives: Although unlikely, limited instances of regsvcs.exe may cause - a false positive. Filter based endpoint usage, command line arguments, or process - lineage. -name: Detect Regsvcs with No Command Line Arguments -references: -- https://attack.mitre.org/techniques/T1218/009/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md -- https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_regsvcs` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(regsvcs\.exe.{0,4}$)"| `detect_regsvcs_with_no_command_line_arguments_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Although unlikely, limited instances of regsvcs.exe may cause + a false positive. Filter based endpoint usage, command line arguments, or process + lineage. +references: +- https://attack.mitre.org/techniques/T1218/009/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md +- https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/ tags: analytic_story: - Suspicious Regsvcs Regasm Activity @@ -82,5 +84,3 @@ tags: - _time risk_score: 49 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml index d50a86eafc..50e1595432 100644 --- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml +++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml @@ -1,7 +1,11 @@ +name: Detect Regsvr32 Application Control Bypass +id: 070e9b80-6252-11eb-ae93-0242ac130002 +version: 2 +date: '2021-01-28' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-01-28' description: 'Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. @@ -12,26 +16,24 @@ description: 'Adversaries may abuse Regsvr32.exe to proxy execution of malicious or external). Be cautious to modify the query to look for "scrobj.dll", the ".dll" is not required to load scrobj. "scrobj.dll" will be loaded by "regsvr32.exe" upon execution. ' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 070e9b80-6252-11eb-ae93-0242ac130002 -known_false_positives: Limited false positives related to third party software registering - .DLL's. -name: Detect Regsvr32 Application Control Bypass -references: -- https://attack.mitre.org/techniques/T1218/010/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md -- https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/ -- https://support.microsoft.com/en-us/topic/how-to-use-the-regsvr32-tool-and-troubleshoot-regsvr32-error-messages-a98d960a-7392-e6fe-d90a-3f4e0cb543e5 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` Processes.process=*scrobj* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_regsvr32_application_control_bypass_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Limited false positives related to third party software registering + .DLL's. +references: +- https://attack.mitre.org/techniques/T1218/010/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md +- https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/ +- https://support.microsoft.com/en-us/topic/how-to-use-the-regsvr32-tool-and-troubleshoot-regsvr32-error-messages-a98d960a-7392-e6fe-d90a-3f4e0cb543e5 tags: analytic_story: - Suspicious Regsvr32 Activity @@ -91,5 +93,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/detect_renamed_7_zip.yml b/detections/endpoint/detect_renamed_7_zip.yml index 2b2418fdec..4dc3ee7885 100644 --- a/detections/endpoint/detect_renamed_7_zip.yml +++ b/detections/endpoint/detect_renamed_7_zip.yml @@ -1,28 +1,30 @@ +name: Detect Renamed 7-Zip +id: 4057291a-b8cf-11eb-95fe-acde48001122 +version: 2 +date: '2021-09-16' author: Michael Haag, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-09-16' description: The following analytic identifies renamed 7-Zip usage using Sysmon. At this stage of an attack, review parallel processes and file modifications for data that is staged or potentially have been exfiltrated. This analytic utilizes the OriginalFileName to capture the renamed process. During triage, validate this is the legitimate version of `7zip` by reviewing the PE metadata. In addition, review parallel processes for further suspicious behavior. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: 4057291a-b8cf-11eb-95fe-acde48001122 -known_false_positives: Limited false positives, however this analytic will need to - be modified for each environment if Sysmon is not used. -name: Detect Renamed 7-Zip -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=7z*.exe AND Processes.process_name!=7z*.exe) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_renamed_7_zip_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Limited false positives, however this analytic will need to + be modified for each environment if Sysmon is not used. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md tags: analytic_story: - Collection and Staging @@ -74,5 +76,3 @@ tags: - _time risk_score: 27 security_domain: endpoint -type: Hunting -version: 2 diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml index 7298826106..a1aeb749cd 100644 --- a/detections/endpoint/detect_renamed_psexec.yml +++ b/detections/endpoint/detect_renamed_psexec.yml @@ -1,30 +1,32 @@ +name: Detect Renamed PSExec +id: 683e6196-b8e8-11eb-9a79-acde48001122 +version: 3 +date: '2021-09-16' author: Michael Haag, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-09-16' description: The following analytic identifies renamed instances of `PsExec.exe` being utilized on an endpoint. Most instances, it is highly probable to capture `Psexec.exe` or other SysInternal utility usage with the command-line argument of `-accepteula`. During triage, validate this is the legitimate version of `PsExec` by reviewing the PE metadata. In addition, review parallel processes for further suspicious behavior. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 683e6196-b8e8-11eb-9a79-acde48001122 -known_false_positives: Limited false positives should be present. It is possible some - third party applications may use older versions of PsExec, filter as needed. -name: Detect Renamed PSExec -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1569.002/T1569.002.yaml -- https://redcanary.com/blog/threat-hunting-psexec-lateral-movement/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_psexec` by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_renamed_psexec_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Limited false positives should be present. It is possible some + third party applications may use older versions of PsExec, filter as needed. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1569.002/T1569.002.yaml +- https://redcanary.com/blog/threat-hunting-psexec-lateral-movement/ tags: analytic_story: - SamSam Ransomware @@ -82,5 +84,3 @@ tags: - _time risk_score: 27 security_domain: endpoint -type: Hunting -version: 3 diff --git a/detections/endpoint/detect_renamed_rclone.yml b/detections/endpoint/detect_renamed_rclone.yml index fd29349871..54c40dfa96 100644 --- a/detections/endpoint/detect_renamed_rclone.yml +++ b/detections/endpoint/detect_renamed_rclone.yml @@ -1,33 +1,35 @@ +name: Detect Renamed RClone +id: 6dca1124-b3ec-11eb-9328-acde48001122 +version: 2 +date: '2021-09-16' author: Michael Haag, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-09-16' description: The following analytic identifies the usage of `rclone.exe`, renamed, being used to exfiltrate data to a remote destination. RClone has been used by multiple ransomware groups to exfiltrate data. In many instances, it will be downloaded from the legitimate site and executed accordingly. During triage, isolate the endpoint and begin to review parallel processes for additional behavior. At this stage, the adversary may have staged data to be exfiltrated. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 6dca1124-b3ec-11eb-9328-acde48001122 -known_false_positives: False positives should be limited as this analytic identifies - renamed instances of `rclone.exe`. Filter as needed if there is a legitimate business - use case. -name: Detect Renamed RClone -references: -- https://redcanary.com/blog/rclone-mega-extortion/ -- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html -- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name="rclone.exe" AND Processes.process_name!="rclone.exe") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_renamed_rclone_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives should be limited as this analytic identifies + renamed instances of `rclone.exe`. Filter as needed if there is a legitimate business + use case. +references: +- https://redcanary.com/blog/rclone-mega-extortion/ +- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html +- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ tags: analytic_story: - DarkSide Ransomware @@ -79,5 +81,3 @@ tags: - _time risk_score: 27 security_domain: endpoint -type: Hunting -version: 2 diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml index afd90587df..e5d3d697a8 100644 --- a/detections/endpoint/detect_renamed_winrar.yml +++ b/detections/endpoint/detect_renamed_winrar.yml @@ -1,23 +1,16 @@ +name: Detect Renamed WinRAR +id: 1b7bfb2c-b8e6-11eb-99ac-acde48001122 +version: 3 +date: '2021-09-16' author: Michael Haag, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-09-16' description: The following analtyic identifies renamed instances of `WinRAR.exe`. In most cases, it is not common for WinRAR to be used renamed, however it is common to be installed by a third party application and executed from a non-standard path. During triage, validate additional metadata from the binary that this is `WinRAR`. Review parallel processes and file modifications. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 1b7bfb2c-b8e6-11eb-99ac-acde48001122 -known_false_positives: Unknown. It is possible third party applications use renamed - instances of WinRAR. -name: Detect Renamed WinRAR -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.original_file_name="WinRAR.exe" (Processes.process_name!="rar.exe" OR Processes.process_name!="winrar.exe") by Processes.dest @@ -25,6 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_renamed_winrar_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Unknown. It is possible third party applications use renamed + instances of WinRAR. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md tags: analytic_story: - Collection and Staging @@ -77,5 +79,3 @@ tags: - _time risk_score: 27 security_domain: endpoint -type: Hunting -version: 3 diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml index 08bc909795..2f35b3035d 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml @@ -1,7 +1,11 @@ +name: Detect Rundll32 Application Control Bypass - advpack +id: 4aefadfe-9abd-4bf8-b3fd-867e9ef95bf8 +version: 2 +date: '2021-02-04' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-02-04' description: The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, @@ -11,27 +15,25 @@ description: The following analytic identifies rundll32.exe loading advpack.dll Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 4aefadfe-9abd-4bf8-b3fd-867e9ef95bf8 -known_false_positives: Although unlikely, some legitimate applications may use advpack.dll - or ieadvpack.dll, triggering a false positive. -name: Detect Rundll32 Application Control Bypass - advpack -references: -- https://attack.mitre.org/techniques/T1218/011/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md -- https://lolbas-project.github.io/lolbas/Binaries/Rundll32 -- https://lolbas-project.github.io/lolbas/Libraries/Advpack/ -- https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*advpack* by Processes.dest Processes.user Processes.parent_process_name Processes.original_file_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___advpack_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Although unlikely, some legitimate applications may use advpack.dll + or ieadvpack.dll, triggering a false positive. +references: +- https://attack.mitre.org/techniques/T1218/011/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md +- https://lolbas-project.github.io/lolbas/Binaries/Rundll32 +- https://lolbas-project.github.io/lolbas/Libraries/Advpack/ +- https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/ tags: analytic_story: - Suspicious Rundll32 Activity @@ -90,5 +92,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml index adfe20b5af..0ccfe82e18 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml @@ -1,7 +1,11 @@ +name: Detect Rundll32 Application Control Bypass - setupapi +id: 61e7b44a-6088-4f26-b788-9a96ba13b37a +version: 2 +date: '2021-02-04' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-02-04' description: The following analytic identifies rundll32.exe loading setupapi.dll and iesetupapi.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, @@ -11,25 +15,23 @@ description: The following analytic identifies rundll32.exe loading setupapi.dll Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: 61e7b44a-6088-4f26-b788-9a96ba13b37a -known_false_positives: Although unlikely, some legitimate applications may use setupapi - triggering a false positive. -name: Detect Rundll32 Application Control Bypass - setupapi -references: -- https://attack.mitre.org/techniques/T1218/011/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md -- https://lolbas-project.github.io/lolbas/Binaries/Rundll32 -- https://lolbas-project.github.io/lolbas/Libraries/Setupapi/ -- https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*setupapi* by Processes.dest Processes.user Processes.parent_process_name Processes.original_file_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___setupapi_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Although unlikely, some legitimate applications may use setupapi + triggering a false positive. +references: +- https://attack.mitre.org/techniques/T1218/011/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md +- https://lolbas-project.github.io/lolbas/Binaries/Rundll32 +- https://lolbas-project.github.io/lolbas/Libraries/Setupapi/ +- https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/ tags: analytic_story: - Suspicious Rundll32 Activity @@ -88,5 +90,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml index 7fcd6b6b73..c4e30caef7 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml @@ -1,7 +1,11 @@ +name: Detect Rundll32 Application Control Bypass - syssetup +id: 71b9bf37-cde1-45fb-b899-1b0aa6fa1183 +version: 2 +date: '2021-02-04' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-02-04' description: The following analytic identifies rundll32.exe loading syssetup.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module @@ -11,27 +15,25 @@ description: The following analytic identifies rundll32.exe loading syssetup.dll found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 71b9bf37-cde1-45fb-b899-1b0aa6fa1183 -known_false_positives: Although unlikely, some legitimate applications may use syssetup.dll, - triggering a false positive. -name: Detect Rundll32 Application Control Bypass - syssetup -references: -- https://attack.mitre.org/techniques/T1218/011/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md -- https://lolbas-project.github.io/lolbas/Binaries/Rundll32 -- https://lolbas-project.github.io/lolbas/Libraries/Syssetup/ -- https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*syssetup* by Processes.dest Processes.user Processes.parent_process_name Processes.original_file_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___syssetup_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Although unlikely, some legitimate applications may use syssetup.dll, + triggering a false positive. +references: +- https://attack.mitre.org/techniques/T1218/011/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md +- https://lolbas-project.github.io/lolbas/Binaries/Rundll32 +- https://lolbas-project.github.io/lolbas/Libraries/Syssetup/ +- https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/ tags: analytic_story: - Suspicious Rundll32 Activity @@ -90,5 +92,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/detect_rundll32_inline_hta_execution.yml b/detections/endpoint/detect_rundll32_inline_hta_execution.yml index 545ec96f08..1c34b2ebd3 100644 --- a/detections/endpoint/detect_rundll32_inline_hta_execution.yml +++ b/detections/endpoint/detect_rundll32_inline_hta_execution.yml @@ -1,7 +1,11 @@ +name: Detect Rundll32 Inline HTA Execution +id: 91c79f14-5b41-11eb-ae93-0242ac130002 +version: 2 +date: '2021-01-20' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-01-20' description: The following analytic identifies "rundll32.exe" execution with inline protocol handlers. "JavaScript", "VBScript", and "About" are the only supported options when invoking HTA content directly on the command-line. This type of behavior @@ -9,19 +13,6 @@ description: The following analytic identifies "rundll32.exe" execution with inl The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "rundll32.exe" and its parent process. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 91c79f14-5b41-11eb-ae93-0242ac130002 -known_false_positives: Although unlikely, some legitimate applications may exhibit - this behavior, triggering a false positive. -name: Detect Rundll32 Inline HTA Execution -references: -- https://github.com/redcanaryco/AtomicTestHarnesses -- https://redcanary.com/blog/introducing-atomictestharnesses/ -- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing search: '| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` @@ -29,6 +20,17 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces by Processes.user Processes.process_name Processes.parent_process_name Processes.original_file_name Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_rundll32_inline_hta_execution_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Although unlikely, some legitimate applications may exhibit + this behavior, triggering a false positive. +references: +- https://github.com/redcanaryco/AtomicTestHarnesses +- https://redcanary.com/blog/introducing-atomictestharnesses/ +- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing tags: analytic_story: - Suspicious MSHTA Activity @@ -75,5 +77,3 @@ tags: - _time risk_score: 56 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/detect_sharphound_command_line_arguments.yml b/detections/endpoint/detect_sharphound_command_line_arguments.yml index e85ca20a40..525dea0e37 100644 --- a/detections/endpoint/detect_sharphound_command_line_arguments.yml +++ b/detections/endpoint/detect_sharphound_command_line_arguments.yml @@ -1,31 +1,33 @@ +name: Detect SharpHound Command-Line Arguments +id: a0bdd2f6-c2ff-11eb-b918-acde48001122 +version: 1 +date: '2021-06-01' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-06-01' description: The following analytic identifies common command-line arguments used by SharpHound `-collectionMethod` and `invoke-bloodhound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances the defaults are used. This analytic works to identify the common command-line attributes used. It does not cover the entirety of every argument in order to avoid false positives. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*-collectionMethod*","*invoke-bloodhound*") + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_sharphound_command_line_arguments_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: a0bdd2f6-c2ff-11eb-b918-acde48001122 known_false_positives: False positives should be limited as the arguments used are specific to SharpHound. Filter as needed or add more command-line arguments as needed. -name: Detect SharpHound Command-Line Arguments references: - https://attack.mitre.org/software/S0521/ - https://thedfirreport.com/?s=bloodhound - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors - https://github.com/BloodHoundAD/SharpHound3 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*-collectionMethod*","*invoke-bloodhound*") - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_sharphound_command_line_arguments_filter`' tags: analytic_story: - Discovery Techniques @@ -69,5 +71,3 @@ tags: - _time risk_score: 24 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/detect_sharphound_file_modifications.yml b/detections/endpoint/detect_sharphound_file_modifications.yml index efaee4aee1..2e932d7f8e 100644 --- a/detections/endpoint/detect_sharphound_file_modifications.yml +++ b/detections/endpoint/detect_sharphound_file_modifications.yml @@ -1,7 +1,11 @@ +name: Detect SharpHound File Modifications +id: 42b4b438-beed-11eb-ba1d-acde48001122 +version: 1 +date: '2021-05-27' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-05-27' description: SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. SharpHound will query the domain controller and begin gathering all the data related to the domain and trusts. For output, it will drop a .zip file upon completion following @@ -16,26 +20,24 @@ description: SharpHound is used as a reconnaissance collector, ingestor, for Blo or remove these json's entirely if it is too noisy. During traige, review parallel processes for further suspicious behavior. Typically, the process executing the `.ps1` ingestor will be PowerShell. -how_to_implement: To successfully implement this search you need to be ingesting information - on file modifications that include the name of the process, and file, responsible - for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` - node. -id: 42b4b438-beed-11eb-ba1d-acde48001122 -known_false_positives: False positives should be limited as the analytic is specific - to a filename with extension .zip. Filter as needed. -name: Detect SharpHound File Modifications -references: -- https://attack.mitre.org/software/S0521/ -- https://thedfirreport.com/?s=bloodhound -- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors -- https://github.com/BloodHoundAD/SharpHound3 -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*bloodhound.zip", "*_computers.json", "*_gpos.json", "*_domains.json", "*_users.json", "*_groups.json") by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_sharphound_file_modifications_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on file modifications that include the name of the process, and file, responsible + for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` + node. +known_false_positives: False positives should be limited as the analytic is specific + to a filename with extension .zip. Filter as needed. +references: +- https://attack.mitre.org/software/S0521/ +- https://thedfirreport.com/?s=bloodhound +- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors +- https://github.com/BloodHoundAD/SharpHound3 +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk tags: analytic_story: - Discovery Techniques @@ -86,5 +88,3 @@ tags: - process_id risk_score: 24 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/detect_sharphound_usage.yml b/detections/endpoint/detect_sharphound_usage.yml index c1d86496d5..7f263401b2 100644 --- a/detections/endpoint/detect_sharphound_usage.yml +++ b/detections/endpoint/detect_sharphound_usage.yml @@ -1,7 +1,11 @@ +name: Detect SharpHound Usage +id: dd04b29a-beed-11eb-87bc-acde48001122 +version: 2 +date: '2021-05-27' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-05-27' description: The following analytic identifies SharpHound binary usage by using the original filena,e. In addition to renaming the PE, other coverage is available to detect command-line arguments. This particular analytic looks for the original_file_name @@ -10,27 +14,25 @@ description: The following analytic identifies SharpHound binary usage by using re-compiled and the attributes removed or changed to anything else. During triage, review the metadata of the binary in question. Review parallel processes for suspicious behavior. Identify the source of this binary. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: dd04b29a-beed-11eb-87bc-acde48001122 -known_false_positives: False positives should be limited as this is specific to a - file attribute not used by anything else. Filter as needed. -name: Detect SharpHound Usage -references: -- https://attack.mitre.org/software/S0521/ -- https://thedfirreport.com/?s=bloodhound -- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors -- https://github.com/BloodHoundAD/SharpHound3 -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="sharphound.exe" OR Processes.original_file_name="SharpHound.exe") by Processes.dest Processes.user Processes.parent_process_name Processes.original_file_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_sharphound_usage_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives should be limited as this is specific to a + file attribute not used by anything else. Filter as needed. +references: +- https://attack.mitre.org/software/S0521/ +- https://thedfirreport.com/?s=bloodhound +- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors +- https://github.com/BloodHoundAD/SharpHound3 +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk tags: analytic_story: - Discovery Techniques @@ -75,5 +77,3 @@ tags: - _time risk_score: 24 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml index 7e2e82386e..c0f652a801 100644 --- a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml +++ b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml @@ -1,25 +1,27 @@ +name: Detect Use of cmd exe to Launch Script Interpreters +id: b89919ed-fe5f-492c-b139-95dbb162039e +version: 4 +date: '2020-07-21' author: Bhavin Patel, Mauricio Velazco, Splunk +type: TTP datamodel: - Endpoint -date: '2020-07-21' description: This search looks for the execution of the cscript.exe or wscript.exe processes, with a parent of cmd.exe. The search will return the count, the first and last time this execution was seen on a machine, the user, and the destination of the machine -how_to_implement: To successfully implement this search, you must be ingesting data - that records process activity from your hosts to populate the endpoint data model - in the processes node. If you are using Sysmon, you must have at least version 6.0.4 - of the Sysmon TA. -id: b89919ed-fe5f-492c-b139-95dbb162039e -known_false_positives: Some legitimate applications may exhibit this behavior. -name: Detect Use of cmd exe to Launch Script Interpreters -references: [] search: '| tstats `security_content_summariesonly` count values(Processes.process) min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="cmd.exe" (Processes.process_name="cscript.exe" OR Processes.process_name="wscript.exe") by Processes.parent_process Processes.process_name Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | `detect_use_of_cmd_exe_to_launch_script_interpreters_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records process activity from your hosts to populate the endpoint data model + in the processes node. If you are using Sysmon, you must have at least version 6.0.4 + of the Sysmon TA. +known_false_positives: Some legitimate applications may exhibit this behavior. +references: [] tags: analytic_story: - 'Emotet Malware DHS Report TA18-201A ' @@ -65,5 +67,3 @@ tags: - _time risk_score: 35 security_domain: endpoint -type: TTP -version: 4 diff --git a/detections/endpoint/detect_wmi_event_subscription_persistence.yml b/detections/endpoint/detect_wmi_event_subscription_persistence.yml index 158adc2573..24e1375ca2 100644 --- a/detections/endpoint/detect_wmi_event_subscription_persistence.yml +++ b/detections/endpoint/detect_wmi_event_subscription_persistence.yml @@ -60,9 +60,9 @@ tags: - T1546 observable: - name: dest - type: Endpoint role: - Victim + type: Endpoint product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml index 114df3f4e6..35232f9c75 100644 --- a/detections/endpoint/disable_amsi_through_registry.yml +++ b/detections/endpoint/disable_amsi_through_registry.yml @@ -1,27 +1,29 @@ +name: Disable AMSI Through Registry +id: 9c27ec42-d338-11eb-9044-acde48001122 +version: 1 +date: '2021-06-22' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-06-22' description: this search is to identify modification in registry to disable AMSI windows feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute payload with minimal alert as much as possible. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -id: 9c27ec42-d338-11eb-9044-acde48001122 -known_false_positives: network operator may disable this feature of windows but not - so common. -name: Disable AMSI Through Registry -references: -- https://blog.f-secure.com/hunting-for-amsi-bypasses/ -- https://gist.github.com/rxwx/8955e5abf18dc258fd6b43a3a7f4dbf9 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\AmsiEnable" Registry.registry_value_data = "0x00000000" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disable_amsi_through_registry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: network operator may disable this feature of windows but not + so common. +references: +- https://blog.f-secure.com/hunting-for-amsi-bypasses/ +- https://gist.github.com/rxwx/8955e5abf18dc258fd6b43a3a7f4dbf9 tags: analytic_story: - Ransomware @@ -44,5 +46,3 @@ tags: - Endpoint.Registry.registry_value_data - _time security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml index 00ea81586b..06cec42bd9 100644 --- a/detections/endpoint/disable_defender_antivirus_registry.yml +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -1,27 +1,29 @@ +name: Disable Defender AntiVirus Registry +id: aa4f695a-3024-11ec-9987-acde48001122 +version: 1 +date: '2021-10-18' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-10-18' description: This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the registry value name, registry path, and registry value data from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: aa4f695a-3024-11ec-9987-acde48001122 -known_false_positives: admin or user may choose to disable windows defender product -name: Disable Defender AntiVirus Registry -references: -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender*" Registry.registry_value_name = DisableAntiVirus Registry.registry_value_data = 0x00000001 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `disable_defender_antivirus_registry_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: admin or user may choose to disable windows defender product +references: +- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ tags: analytic_story: - IceID @@ -61,5 +63,3 @@ tags: - _time risk_score: 49 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml index 45bda560aa..94dedc5667 100644 --- a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml +++ b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml @@ -1,26 +1,28 @@ +name: Disable Defender BlockAtFirstSeen Feature +id: 2dd719ac-3021-11ec-97b4-acde48001122 +version: 1 +date: '2021-10-18' author: Teoderick Contreras +type: TTP datamodel: - Endpoint -date: '2021-10-18' description: This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the BlockAtFirstSeen feature where it block suspicious file first seen in the host. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the registry value name, registry path, and registry value data from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: 2dd719ac-3021-11ec-97b4-acde48001122 -known_false_positives: admin or user may choose to disable windows defender product -name: Disable Defender BlockAtFirstSeen Feature -references: -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = DisableBlockAtFirstSeen Registry.registry_value_data = 0x00000001 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `disable_defender_blockatfirstseen_feature_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: admin or user may choose to disable windows defender product +references: +- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ tags: analytic_story: - IceID @@ -60,5 +62,3 @@ tags: - _time risk_score: 49 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml index e98a4ab282..3f84392043 100644 --- a/detections/endpoint/disable_defender_enhanced_notification.yml +++ b/detections/endpoint/disable_defender_enhanced_notification.yml @@ -1,26 +1,28 @@ +name: Disable Defender Enhanced Notification +id: dc65678c-301f-11ec-8e30-acde48001122 +version: 1 +date: '2021-10-18' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-10-18' description: This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the Enhanced Notification feature wher user or admin set to show or display alerts. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the registry value name, registry path, and registry value data executions - from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 - of the Sysmon TA. -id: dc65678c-301f-11ec-8e30-acde48001122 -known_false_positives: user may choose to disable windows defender AV -name: Disable Defender Enhanced Notification -references: -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*Microsoft\\Windows Defender\\Reporting*" Registry.registry_value_name = DisableEnhancedNotifications Registry.registry_value_data = 0x00000001 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `disable_defender_enhanced_notification_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data executions + from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 + of the Sysmon TA. +known_false_positives: user may choose to disable windows defender AV +references: +- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ tags: analytic_story: - IceID @@ -60,5 +62,3 @@ tags: - _time risk_score: 49 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/disable_defender_mpengine_registry.yml b/detections/endpoint/disable_defender_mpengine_registry.yml index 87aa7d8a03..ad8487f71a 100644 --- a/detections/endpoint/disable_defender_mpengine_registry.yml +++ b/detections/endpoint/disable_defender_mpengine_registry.yml @@ -1,27 +1,29 @@ +name: Disable Defender MpEngine Registry +id: cc391750-3024-11ec-955a-acde48001122 +version: 1 +date: '2021-10-18' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-10-18' description: This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the registry value name, registry path, and registry value data from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: cc391750-3024-11ec-955a-acde48001122 -known_false_positives: admin or user may choose to disable windows defender product -name: Disable Defender MpEngine Registry -references: -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender\\MpEngine*" Registry.registry_value_name = MpEnablePus Registry.registry_value_data = 0x00000000 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `disable_defender_mpengine_registry_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: admin or user may choose to disable windows defender product +references: +- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ tags: analytic_story: - IceID @@ -61,5 +63,3 @@ tags: - _time risk_score: 49 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml index 6a598f7dd2..dc37a43a3b 100644 --- a/detections/endpoint/disable_defender_spynet_reporting.yml +++ b/detections/endpoint/disable_defender_spynet_reporting.yml @@ -1,25 +1,27 @@ +name: Disable Defender Spynet Reporting +id: 898debf4-3021-11ec-ba7c-acde48001122 +version: 1 +date: '2021-10-18' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-10-18' description: This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the spynet reporting for its telemetry. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the registry value name, registry path, and registry value data from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: 898debf4-3021-11ec-ba7c-acde48001122 -known_false_positives: admin or user may choose to disable windows defender product -name: Disable Defender Spynet Reporting -references: -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = SpynetReporting Registry.registry_value_data = 0x00000000 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `disable_defender_spynet_reporting_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: admin or user may choose to disable windows defender product +references: +- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ tags: analytic_story: - IceID @@ -59,5 +61,3 @@ tags: - _time risk_score: 49 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml index 6261705ec1..409f77b732 100644 --- a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml +++ b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml @@ -1,25 +1,27 @@ +name: Disable Defender Submit Samples Consent Feature +id: 73922ff8-3022-11ec-bf5e-acde48001122 +version: 1 +date: '2021-10-18' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-10-18' description: his analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis.. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the registry value name, registry path, and registry value data from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: 73922ff8-3022-11ec-bf5e-acde48001122 -known_false_positives: admin or user may choose to disable windows defender product -name: Disable Defender Submit Samples Consent Feature -references: -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = SubmitSamplesConsent Registry.registry_value_data = 0x00000000 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `disable_defender_submit_samples_consent_feature_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: admin or user may choose to disable windows defender product +references: +- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ tags: analytic_story: - IceID @@ -59,5 +61,3 @@ tags: - _time risk_score: 49 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/disable_etw_through_registry.yml b/detections/endpoint/disable_etw_through_registry.yml index bc7f1e6578..4072952240 100644 --- a/detections/endpoint/disable_etw_through_registry.yml +++ b/detections/endpoint/disable_etw_through_registry.yml @@ -1,26 +1,28 @@ +name: Disable ETW Through Registry +id: f0eacfa4-d33f-11eb-8f9d-acde48001122 +version: 1 +date: '2021-06-22' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-06-22' description: this search is to identify modification in registry to disable ETW windows feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute payload with minimal alert as much as possible. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -id: f0eacfa4-d33f-11eb-8f9d-acde48001122 -known_false_positives: network operator may disable this feature of windows but not - so common. -name: Disable ETW Through Registry -references: -- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled" Registry.registry_value_data = "0x00000000" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disable_etw_through_registry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: network operator may disable this feature of windows but not + so common. +references: +- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ tags: analytic_story: - Ransomware @@ -43,5 +45,3 @@ tags: - Endpoint.Registry.registry_value_data - _time security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/disable_logs_using_wevtutil.yml b/detections/endpoint/disable_logs_using_wevtutil.yml index f8b16490cf..bbd942ff76 100644 --- a/detections/endpoint/disable_logs_using_wevtutil.yml +++ b/detections/endpoint/disable_logs_using_wevtutil.yml @@ -1,26 +1,28 @@ +name: Disable Logs Using WevtUtil +id: 236e7c8e-c9d9-11eb-a824-acde48001122 +version: 1 +date: '2021-06-10' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-06-10' description: This search is to detect execution of wevtutil.exe to disable logs. This technique was seen in several ransomware to disable the event logs to evade alerts and detections. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: 236e7c8e-c9d9-11eb-a824-acde48001122 -known_false_positives: network operator may disable audit event logs for debugging - purposes. -name: Disable Logs Using WevtUtil -references: -- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "wevtutil.exe" Processes.process = "*sl*" Processes.process = "*/e:false*" by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_logs_using_wevtutil_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: network operator may disable audit event logs for debugging + purposes. +references: +- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/ tags: analytic_story: - Ransomware @@ -59,5 +61,3 @@ tags: - _time risk_score: 24 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index 87a60023d4..076e1ed4e2 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -1,26 +1,28 @@ +name: Disable Registry Tool +id: cd2cf33c-9201-11eb-a10a-acde48001122 +version: 1 +date: '2021-03-31' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-03-31' description: This search identifies modification of registry to disable the regedit or registry tools of the windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -id: cd2cf33c-9201-11eb-a10a-acde48001122 -known_false_positives: admin may disable this application for non technical user. -name: Disable Registry Tool -references: -- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disable_registry_tool_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin may disable this application for non technical user. +references: +- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry tags: analytic_story: - Windows Defense Evasion Tactics @@ -57,5 +59,3 @@ tags: - _time risk_score: 40 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/disable_schedule_task.yml b/detections/endpoint/disable_schedule_task.yml index 9b2b928340..6e8ce4b7bf 100644 --- a/detections/endpoint/disable_schedule_task.yml +++ b/detections/endpoint/disable_schedule_task.yml @@ -1,28 +1,30 @@ +name: Disable Schedule Task +id: db596056-3019-11ec-a9ff-acde48001122 +version: 1 +date: '2021-10-18' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-10-18' description: This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IceID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime + max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="schtasks.exe" + Processes.process="*/change*" Processes.process="*/disable*" by Processes.user + Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process + Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `disable_schedule_task_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -id: db596056-3019-11ec-a9ff-acde48001122 known_false_positives: admin may disable problematic schedule task -name: Disable Schedule Task references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime - max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="schtasks.exe" - Processes.process="*/change*" Processes.process="*/disable*" by Processes.user Processes.process_name - Processes.process Processes.parent_process_name Processes.parent_process Processes.dest - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `disable_schedule_task_filter`' tags: analytic_story: - IcedID @@ -60,5 +62,3 @@ tags: - _time risk_score: 56 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/disable_security_logs_using_minint_registry.yml b/detections/endpoint/disable_security_logs_using_minint_registry.yml index f7c027e8e8..023a421c3d 100644 --- a/detections/endpoint/disable_security_logs_using_minint_registry.yml +++ b/detections/endpoint/disable_security_logs_using_minint_registry.yml @@ -1,27 +1,29 @@ +name: Disable Security Logs Using MiniNt Registry +id: 39ebdc68-25b9-11ec-aec7-acde48001122 +version: 1 +date: '2021-10-05' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-10-05' description: This analytic is to detect a suspicious registry modification to disable security audit logs. This technique was shared by a researcher to disable Security logs of windows by adding this registry. The Windows will think it is WinPE and will not log any event to the Security Log +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime + max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Control\\MiniNt\\*" + by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name + Registry.registry_path Registry.registry_value_data | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `disable_security_logs_using_minint_registry_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. -id: 39ebdc68-25b9-11ec-aec7-acde48001122 known_false_positives: Unknown. -name: Disable Security Logs Using MiniNt Registry references: - https://twitter.com/0gtweet/status/1182516740955226112 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime - max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Control\\MiniNt\\*" - by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name - Registry.registry_path Registry.registry_value_data | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` | `disable_security_logs_using_minint_registry_filter`' tags: analytic_story: - Windows Defense Evasion Tactics @@ -61,5 +63,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml index 64b02a62ba..3252c6f308 100644 --- a/detections/endpoint/disable_show_hidden_files.yml +++ b/detections/endpoint/disable_show_hidden_files.yml @@ -1,20 +1,15 @@ +name: Disable Show Hidden Files +id: 6f3ccfa2-91fe-11eb-8f9b-acde48001122 +version: 1 +date: '2021-03-31' author: Teoderick Contreras, Mauricio Velazco, Splunk +type: TTP datamodel: - Endpoint -date: '2021-03-31' description: The following analytic is to identify a modification in the Windows registry to prevent users from seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -id: 6f3ccfa2-91fe-11eb-8f9b-acde48001122 -known_false_positives: unknown -name: Disable Show Hidden Files -references: -- https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis.aspx search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" @@ -22,6 +17,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Registry.registry_value_data = "0x00000000") by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disable_show_hidden_files_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: unknown +references: +- https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis.aspx tags: analytic_story: - Windows Defense Evasion Tactics @@ -60,5 +62,3 @@ tags: - _time risk_score: 40 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/disable_uac_remote_restriction.yml b/detections/endpoint/disable_uac_remote_restriction.yml index 5a2307c7b7..32a026ddc5 100644 --- a/detections/endpoint/disable_uac_remote_restriction.yml +++ b/detections/endpoint/disable_uac_remote_restriction.yml @@ -1,23 +1,16 @@ +name: Disable UAC Remote Restriction +id: 9928b732-210e-11ec-b65e-acde48001122 +version: 1 +date: '2021-09-29' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-29' description: This analytic is to detect a suspicious modification of registry to disable UAC remote restriction. This technique was well documented in Microsoft page where attacker may modify this registry value to bypassed UAC feature of windows host. This is a good indicator that some tries to bypassed UAC to suspicious process or gain privilege escalation. -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -id: 9928b732-210e-11ec-b65e-acde48001122 -known_false_positives: admin may set this policy for non-critical machine. -name: Disable UAC Remote Restriction -references: -- https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/user-account-control-and-remote-restriction search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path ="*\\CurrentVersion\\Policies\\System*" Registry.registry_value_name="LocalAccountTokenFilterPolicy" @@ -25,6 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTim Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `disable_uac_remote_restriction_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: admin may set this policy for non-critical machine. +references: +- https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/user-account-control-and-remote-restriction tags: analytic_story: - Windows Defense Evasion Tactics @@ -66,5 +68,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml index 644125b4aa..38753bf02c 100644 --- a/detections/endpoint/disable_windows_app_hotkeys.yml +++ b/detections/endpoint/disable_windows_app_hotkeys.yml @@ -1,23 +1,16 @@ +name: Disable Windows App Hotkeys +id: 1490f224-ad8b-11eb-8c4f-acde48001122 +version: 1 +date: '2021-05-05' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-05-05' description: This analytic detects a suspicious registry modification to disable Windows hotkey (shortcut keys) for native Windows applications. This technique is commonly used to disable certain or several Windows applications like `taskmgr.exe` and `cmd.exe`. This technique is used to impair the analyst in analyzing and removing the attacker implant in compromised systems. -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -id: 1490f224-ad8b-11eb-8c4f-acde48001122 -known_false_positives: unknown -name: Disable Windows App Hotkeys -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows @@ -25,6 +18,15 @@ search: '| tstats `security_content_summariesonly` count values(Registry.registr = "HotKey Disabled" AND Registry.registry_key_name = "Debugger" by Registry.dest Registry.user Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `disable_windows_app_hotkeys_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: unknown +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - XMRig @@ -60,5 +62,3 @@ tags: - _time risk_score: 40 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index dc15011749..9d29048ec1 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -1,19 +1,14 @@ +name: Disable Windows Behavior Monitoring +id: 79439cae-9200-11eb-a4d3-acde48001122 +version: 1 +date: '2021-03-31' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-03-31' description: This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -id: 79439cae-9200-11eb-a4d3-acde48001122 -known_false_positives: admin or user may choose to disable this windows features. -name: Disable Windows Behavior Monitoring -references: -- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR Registry.registry_path= @@ -27,6 +22,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disable_windows_behavior_monitoring_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin or user may choose to disable this windows features. +references: +- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html tags: analytic_story: - Windows Defense Evasion Tactics @@ -65,5 +67,3 @@ tags: - _time risk_score: 40 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/disable_windows_smartscreen_protection.yml b/detections/endpoint/disable_windows_smartscreen_protection.yml index b756e10ba5..d0afad6ae7 100644 --- a/detections/endpoint/disable_windows_smartscreen_protection.yml +++ b/detections/endpoint/disable_windows_smartscreen_protection.yml @@ -1,26 +1,28 @@ +name: Disable Windows SmartScreen Protection +id: 664f0fd0-91ff-11eb-a56f-acde48001122 +version: 1 +date: '2021-03-31' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-03-31' description: The following search identifies a modification of registry to disable the smartscreen protection of windows machine. This is windows feature provide an early warning system against website that might engage in phishing attack or malware distribution. This modification are seen in RAT malware to cover their tracks upon downloading other of its component or other payload. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -id: 664f0fd0-91ff-11eb-a56f-acde48001122 -known_false_positives: admin or user may choose to disable this windows features. -name: Disable Windows SmartScreen Protection -references: -- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled" Registry.registry_value_name = "Off" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disable_windows_smartscreen_protection_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin or user may choose to disable this windows features. +references: +- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html tags: analytic_story: - Windows Defense Evasion Tactics @@ -61,5 +63,3 @@ tags: - _time risk_score: 25 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index e664d4c594..95e449f777 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -1,25 +1,27 @@ +name: Disabling CMD Application +id: ff86077c-9212-11eb-a1e6-acde48001122 +version: 1 +date: '2021-03-31' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-03-31' description: this search is to identify modification in registry to disable cmd prompt application. This technique is commonly seen in RAT, Trojan or WORM to prevent triaging or deleting there samples through cmd application which is one of the tool of analyst to traverse on directory and files. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -id: ff86077c-9212-11eb-a1e6-acde48001122 -known_false_positives: admin may disable this application for non technical user. -name: Disabling CMD Application -references: -- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD" Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disabling_cmd_application_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin may disable this application for non technical user. +references: +- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry tags: analytic_story: - Windows Defense Evasion Tactics @@ -60,5 +62,3 @@ tags: - _time risk_score: 25 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml index 7df8159b3d..532e65ad1b 100644 --- a/detections/endpoint/disabling_controlpanel.yml +++ b/detections/endpoint/disabling_controlpanel.yml @@ -1,24 +1,26 @@ +name: Disabling ControlPanel +id: 6ae0148e-9215-11eb-a94a-acde48001122 +version: 1 +date: '2021-03-31' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-03-31' description: this search is to identify registry modification to disable control panel window. This technique is commonly seen in malware to prevent their artifacts , persistence removed on the infected machine. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -id: 6ae0148e-9215-11eb-a94a-acde48001122 -known_false_positives: admin may disable this application for non technical user. -name: Disabling ControlPanel -references: -- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_controlpanel_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin may disable this application for non technical user. +references: +- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry tags: analytic_story: - Windows Defense Evasion Tactics @@ -59,5 +61,3 @@ tags: - _time risk_score: 25 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/disabling_defender_services.yml b/detections/endpoint/disabling_defender_services.yml index 38d0245208..c934182c67 100644 --- a/detections/endpoint/disabling_defender_services.yml +++ b/detections/endpoint/disabling_defender_services.yml @@ -1,21 +1,16 @@ +name: Disabling Defender Services +id: 911eacdc-317f-11ec-ad30-acde48001122 +version: 1 +date: '2021-10-20' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-10-20' description: This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: 911eacdc-317f-11ec-ad30-acde48001122 -known_false_positives: admin or user may choose to disable windows defender product -name: Disabling Defender Services -references: -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\System\\CurrentControlSet\\Services\\*" AND (Registry.registry_path IN("*WdBoot*", "*WdFilter*", "*WdNisDrv*", "*WdNisSvc*", @@ -23,6 +18,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Registry.registry_value_data = 0x00000004 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `disabling_defender_services_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: admin or user may choose to disable windows defender product +references: +- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ tags: analytic_story: - IceID @@ -62,5 +64,3 @@ tags: - _time risk_score: 49 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/disabling_firewall_with_netsh.yml b/detections/endpoint/disabling_firewall_with_netsh.yml index 52a8484a73..aeedd44571 100644 --- a/detections/endpoint/disabling_firewall_with_netsh.yml +++ b/detections/endpoint/disabling_firewall_with_netsh.yml @@ -1,27 +1,29 @@ +name: Disabling Firewall with Netsh +id: 6860a62c-9203-11eb-9e05-acde48001122 +version: 2 +date: '2021-03-31' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-03-31' description: This search is to identifies suspicious firewall disabling using netsh application. this technique is commonly seen in malware that tries to communicate or download its component or other payload to its C2 server. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 6860a62c-9203-11eb-9e05-acde48001122 -known_false_positives: admin may disable firewall during testing or fixing network - problem. -name: Disabling Firewall with Netsh -references: -- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.htm search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_netsh` Processes.process= "*firewall*" (Processes.process= "*off*" OR Processes.process= "*disable*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_firewall_with_netsh_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: admin may disable firewall during testing or fixing network + problem. +references: +- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.htm tags: analytic_story: - Windows Defense Evasion Tactics @@ -66,5 +68,3 @@ tags: - _time risk_score: 25 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/disabling_folderoptions_windows_feature.yml b/detections/endpoint/disabling_folderoptions_windows_feature.yml index e3d8d02522..102bcb9987 100644 --- a/detections/endpoint/disabling_folderoptions_windows_feature.yml +++ b/detections/endpoint/disabling_folderoptions_windows_feature.yml @@ -1,26 +1,28 @@ +name: Disabling FolderOptions Windows Feature +id: 83776de4-921a-11eb-868a-acde48001122 +version: 1 +date: '2021-03-31' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-03-31' description: This search is to identify registry modification to disable folder options feature of windows to show hidden files, file extension and etc. This technique used by malware in combination if disabling show hidden files feature to hide their files and also to hide the file extension to lure the user base on file icons or fake file extensions. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -id: 83776de4-921a-11eb-868a-acde48001122 -known_false_positives: admin may disable this application for non technical user. -name: Disabling FolderOptions Windows Feature -references: -- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_folderoptions_windows_feature_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin may disable this application for non technical user. +references: +- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry tags: analytic_story: - Windows Defense Evasion Tactics @@ -61,5 +63,3 @@ tags: - _time risk_score: 25 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/disabling_net_user_account.yml b/detections/endpoint/disabling_net_user_account.yml index 4a654d220e..3a41108021 100644 --- a/detections/endpoint/disabling_net_user_account.yml +++ b/detections/endpoint/disabling_net_user_account.yml @@ -1,21 +1,15 @@ +name: Disabling Net User Account +id: c0325326-acd6-11eb-98c2-acde48001122 +version: 2 +date: '2021-05-04' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-05-04' description: This analytic will identify a suspicious command-line that disables a user account using the `net.exe` utility native to Windows. This technique may used by the adversaries to interrupt availability of such users to do their malicious act. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: c0325326-acd6-11eb-98c2-acde48001122 -known_false_positives: unknown -name: Disabling Net User Account -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes @@ -23,6 +17,14 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as by Processes.process_name Processes.original_file_name Processes.dest Processes.user Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_net_user_account_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: unknown +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - XMRig @@ -73,5 +75,3 @@ tags: - _time risk_score: 42 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml index b3579274b4..c8a9564ca5 100644 --- a/detections/endpoint/disabling_norun_windows_app.yml +++ b/detections/endpoint/disabling_norun_windows_app.yml @@ -1,27 +1,29 @@ +name: Disabling NoRun Windows App +id: de81bc46-9213-11eb-adc9-acde48001122 +version: 1 +date: '2021-03-31' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-03-31' description: This search is to identify modification of registry to disable run application in window start menu. this application is known to be a helpful shortcut to windows OS user to run known application and also to execute some reg or batch script. This technique is used malware to make cleaning of its infection more harder by preventing known application run easily through run shortcut. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -id: de81bc46-9213-11eb-adc9-acde48001122 -known_false_positives: admin may disable this application for non technical user. -name: Disabling NoRun Windows App -references: -- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry -- https://blog.malwarebytes.com/detections/pum-optional-norun/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_norun_windows_app_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin may disable this application for non technical user. +references: +- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry +- https://blog.malwarebytes.com/detections/pum-optional-norun/ tags: analytic_story: - Windows Defense Evasion Tactics @@ -63,5 +65,3 @@ tags: - _time risk_score: 25 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml index a75ac40fbc..e029a9234c 100644 --- a/detections/endpoint/disabling_remote_user_account_control.yml +++ b/detections/endpoint/disabling_remote_user_account_control.yml @@ -1,25 +1,27 @@ +name: Disabling Remote User Account Control +id: bbc644bc-37df-4e1a-9c88-ec9a53e2038c +version: 4 +date: '2020-11-18' author: David Dorsey, Patrick Bareiss, Splunk +type: TTP datamodel: - Endpoint -date: '2020-11-18' description: The search looks for modifications to registry keys that control the enforcement of Windows User Account Control (UAC). +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path=*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA* + Registry.registry_value_data="0x00000000" by Registry.dest, Registry.registry_key_name + Registry.user Registry.registry_path Registry.registry_value_data Registry.action + | `drop_dm_object_name(Registry)` | `disabling_remote_user_account_control_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report registry modifications. -id: bbc644bc-37df-4e1a-9c88-ec9a53e2038c known_false_positives: This registry key may be modified via administrators to implement a change in system policy. This type of change should be a very rare occurrence. -name: Disabling Remote User Account Control references: [] -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path=*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA* - Registry.registry_value_data="0x00000000" by Registry.dest, Registry.registry_key_name - Registry.user Registry.registry_path Registry.registry_value_data Registry.action - | `drop_dm_object_name(Registry)` | `disabling_remote_user_account_control_filter`' tags: analytic_story: - Windows Defense Evasion Tactics @@ -69,5 +71,3 @@ tags: - _time risk_score: 42 security_domain: endpoint -type: TTP -version: 4 diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index 94861c6cc2..57214a0381 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -1,20 +1,15 @@ +name: Disabling SystemRestore In Registry +id: f4f837e2-91fb-11eb-8bf6-acde48001122 +version: 1 +date: '2021-03-31' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-03-31' description: The following search identifies the modification of registry related in disabling the system restore of a machine. This event or behavior are seen in some RAT malware to make the restore of the infected machine difficult and keep their infection on the box. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -id: f4f837e2-91fb-11eb-8bf6-acde48001122 -known_false_positives: in some cases admin can disable systemrestore on a machine. -name: Disabling SystemRestore In Registry -references: -- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows @@ -22,6 +17,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime "0x00000001" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disabling_systemrestore_in_registry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: in some cases admin can disable systemrestore on a machine. +references: +- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html tags: analytic_story: - Windows Defense Evasion Tactics @@ -63,5 +65,3 @@ tags: - _time risk_score: 49 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml index 8582dbe8c5..57353c9143 100644 --- a/detections/endpoint/disabling_task_manager.yml +++ b/detections/endpoint/disabling_task_manager.yml @@ -1,26 +1,28 @@ +name: Disabling Task Manager +id: dac279bc-9202-11eb-b7fb-acde48001122 +version: 1 +date: '2021-03-31' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-03-31' description: This search is to identifies modification of registry to disable the task manager of windows operating system. this event or technique are commonly seen in malware such as RAT, Trojan, TrojanSpy or worm to prevent the user to terminate their process. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -id: dac279bc-9202-11eb-b7fb-acde48001122 -known_false_positives: admin may disable this application for non technical user. -name: Disabling Task Manager -references: -- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry -- https://blog.talosintelligence.com/2020/05/threat-roundup-0424-0501.html search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_task_manager_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin may disable this application for non technical user. +references: +- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry +- https://blog.talosintelligence.com/2020/05/threat-roundup-0424-0501.html tags: analytic_story: - Windows Defense Evasion Tactics @@ -61,5 +63,3 @@ tags: - _time risk_score: 42 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml index fcf9f0f980..b63c809a65 100644 --- a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml @@ -1,23 +1,17 @@ +name: DLLHost with no Command Line Arguments with Network +id: f1c07594-a141-11eb-8407-acde48001122 +version: 2 +date: '2021-10-13' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-10-13' description: The following analytic identifies DLLHost.exe with no command line arguments with a network connection. It is unusual for DLLHost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, triage any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. DLLHost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. -id: f1c07594-a141-11eb-8407-acde48001122 -known_false_positives: Although unlikely, some legitimate third party applications - may use a moved copy of dllhost, triggering a false positive. -name: DLLHost with no Command Line Arguments with Network -references: -- https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile -- https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name="dllhost.exe" by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name @@ -27,6 +21,14 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name process_path process process_guid connection_to_CNC dest_port | `dllhost_with_no_command_line_arguments_with_network_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. +known_false_positives: Although unlikely, some legitimate third party applications + may use a moved copy of dllhost, triggering a false positive. +references: +- https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile +- https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/ tags: analytic_story: - Cobalt Strike @@ -82,5 +84,3 @@ tags: - process_path risk_score: 49 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml index c2a41a9db6..a834f4e69d 100644 --- a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml +++ b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml @@ -1,24 +1,17 @@ +name: DNS Exfiltration Using Nslookup App +id: 2452e632-9e0d-11eb-bacd-acde48001122 +version: 1 +date: '2021-04-15' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-04-15' description: this search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique use of nslookup where it tries to use specific record type, TXT, A, AAAA, that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of nslookup.exe may be used. -id: 2452e632-9e0d-11eb-bacd-acde48001122 -known_false_positives: admin nslookup usage -name: DNS Exfiltration Using Nslookup App -references: -- https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html -- https://www.varonis.com/blog/dns-tunneling/ -- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id values(Processes.parent_process) as parent_process count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes @@ -27,6 +20,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as OR Processes.process="*-retry=*" by Processes.dest Processes.user Processes.process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dns_exfiltration_using_nslookup_app_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances of nslookup.exe may be used. +known_false_positives: admin nslookup usage +references: +- https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html +- https://www.varonis.com/blog/dns-tunneling/ +- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ tags: analytic_story: - Suspicious DNS Traffic @@ -78,5 +80,3 @@ tags: - _time risk_score: 72 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/domain_account_discovery_with_dsquery.yml b/detections/endpoint/domain_account_discovery_with_dsquery.yml index 50b2c4d617..bacee2c53d 100644 --- a/detections/endpoint/domain_account_discovery_with_dsquery.yml +++ b/detections/endpoint/domain_account_discovery_with_dsquery.yml @@ -1,27 +1,29 @@ +name: Domain Account Discovery with Dsquery +id: b1a8ce04-04c2-11ec-bea7-acde48001122 +version: 1 +date: '2021-08-24' author: Teoderick Contreras, Mauricio Velazco, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-08-24' description: This analytic looks for the execution of `dsquery.exe` with command-line arguments utilized to discover domain users. The `user` argument returns a list of all users registered in the domain. Red Teams and adversaries alike engage in remote system discovery for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: b1a8ce04-04c2-11ec-bea7-acde48001122 -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: Domain Account Discovery with Dsquery -references: -- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm -- https://attack.mitre.org/techniques/T1087/002/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="dsquery.exe" AND Processes.process = "*user*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_account_discovery_with_dsquery_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm +- https://attack.mitre.org/techniques/T1087/002/ tags: analytic_story: - Active Directory Discovery @@ -68,5 +70,3 @@ tags: - _time risk_score: 25 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/domain_account_discovery_with_net_app.yml b/detections/endpoint/domain_account_discovery_with_net_app.yml index 15b6990faa..c9a81b4510 100644 --- a/detections/endpoint/domain_account_discovery_with_net_app.yml +++ b/detections/endpoint/domain_account_discovery_with_net_app.yml @@ -1,27 +1,29 @@ +name: Domain Account Discovery With Net App +id: 98f6a534-04c2-11ec-96b2-acde48001122 +version: 1 +date: '2021-08-24' author: Teoderick Contreras, Mauricio Velazco, Splunk +type: TTP datamodel: - Endpoint -date: '2021-08-24' description: This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for domain users. Red Teams and adversaries alike may use net.exe to enumerate domain users for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: 98f6a534-04c2-11ec-96b2-acde48001122 -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: Domain Account Discovery With Net App -references: -- https://docs.microsoft.com/en-us/defender-for-identity/playbook-domain-dominance -- https://attack.mitre.org/techniques/T1087/002/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process = "* user*" AND Processes.process = "*/do*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_account_discovery_with_net_app_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://docs.microsoft.com/en-us/defender-for-identity/playbook-domain-dominance +- https://attack.mitre.org/techniques/T1087/002/ tags: analytic_story: - Active Directory Discovery @@ -68,5 +70,3 @@ tags: - _time risk_score: 25 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/domain_account_discovery_with_wmic.yml b/detections/endpoint/domain_account_discovery_with_wmic.yml index 66f468c6c9..5220da36bb 100644 --- a/detections/endpoint/domain_account_discovery_with_wmic.yml +++ b/detections/endpoint/domain_account_discovery_with_wmic.yml @@ -1,20 +1,15 @@ +name: Domain Account Discovery with Wmic +id: 383572e0-04c5-11ec-bdcc-acde48001122 +version: 1 +date: '2021-08-24' author: Teoderick Contreras, Mauricio Velazco, Splunk +type: TTP datamodel: - Endpoint -date: '2021-08-24' description: This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for domain users. Red Teams and adversaries alike use wmic.exe to enumerate domain users for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: 383572e0-04c5-11ec-bdcc-acde48001122 -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: Domain Account Discovery with Wmic -references: -- https://attack.mitre.org/techniques/T1087/002/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="wmic.exe" AND Processes.process = "*/NAMESPACE:\\\\root\\directory\\ldap*" AND Processes.process @@ -23,6 +18,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_account_discovery_with_wmic_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1087/002/ tags: analytic_story: - Active Directory Discovery @@ -69,5 +71,3 @@ tags: - _time risk_score: 25 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/domain_controller_discovery_with_nltest.yml b/detections/endpoint/domain_controller_discovery_with_nltest.yml index 78bcb88d46..0178a94f1c 100644 --- a/detections/endpoint/domain_controller_discovery_with_nltest.yml +++ b/detections/endpoint/domain_controller_discovery_with_nltest.yml @@ -1,26 +1,28 @@ +name: Domain Controller Discovery with Nltest +id: 41243735-89a7-4c83-bcdd-570aa78f00a1 +version: 1 +date: '2021-08-30' author: Mauricio Velazco, Splunk +type: TTP datamodel: - Endpoint -date: '2021-08-30' description: This analytic looks for the execution of `nltest.exe` with command-line arguments utilized to discover remote systems. The arguments `/dclist:` and '/dsgetdc:', can be used to return a list of all domain controllers. Red Teams and adversaries alike may use nltest.exe to identify domain controllers in a Windows Domain for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: 41243735-89a7-4c83-bcdd-570aa78f00a1 -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: Domain Controller Discovery with Nltest -references: -- https://attack.mitre.org/techniques/T1018/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="nltest.exe") (Processes.process="*/dclist:*" OR Processes.process="*/dsgetdc:*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_controller_discovery_with_nltest_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1018/ tags: analytic_story: - Active Directory Discovery @@ -57,5 +59,3 @@ tags: - Endpoint.Processes.user risk_score: 21 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/domain_controller_discovery_with_wmic.yml b/detections/endpoint/domain_controller_discovery_with_wmic.yml index 54a658fd1a..7aa1b8e7bc 100644 --- a/detections/endpoint/domain_controller_discovery_with_wmic.yml +++ b/detections/endpoint/domain_controller_discovery_with_wmic.yml @@ -1,26 +1,28 @@ +name: Domain Controller Discovery with Wmic +id: 64c7adaa-48ee-483c-b0d6-7175bc65e6cc +version: 1 +date: '2021-09-01' author: Mauricio Velazco, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-09-01' description: This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to discover remote systems. The arguments utilized in this command line return a list of all domain controllers in a Windows domain. Red Teams and adversaries alike use *.exe to identify remote systems for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: 64c7adaa-48ee-483c-b0d6-7175bc65e6cc -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: Domain Controller Discovery with Wmic -references: -- https://attack.mitre.org/techniques/T1018/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe") (Processes.process="" OR Processes.process="*DomainControllerAddress*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_controller_discovery_with_wmic_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1018/ tags: analytic_story: - Active Directory Discovery @@ -57,5 +59,3 @@ tags: - Endpoint.Processes.user risk_score: 21 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml index 31fada1c97..4412039166 100644 --- a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml +++ b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml @@ -1,23 +1,25 @@ -author: Mauricio Velazco, Splunk -datamodel: [] +name: Domain Group Discovery with Adsisearcher +id: 089c862f-5f83-49b5-b1c8-7e4ff66560c7 +version: 1 date: '2021-08-25' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain groups for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -id: 089c862f-5f83-49b5-b1c8-7e4ff66560c7 -known_false_positives: Administrators or power users may use Adsisearcher for troubleshooting. -name: Domain Group Discovery with Adsisearcher -references: -- https://attack.mitre.org/techniques/T1069/002/ -- https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/ search: '`powershell` EventCode=4104 (Message = "*[adsisearcher]*" AND Message = "*(objectcategory=group)*" AND Message = "*findAll()*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `domain_group_discovery_with_adsisearcher_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators or power users may use Adsisearcher for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +- https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/ tags: analytic_story: - Active Directory Discovery @@ -53,5 +55,3 @@ tags: - User risk_score: 18 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/domain_group_discovery_with_dsquery.yml b/detections/endpoint/domain_group_discovery_with_dsquery.yml index 4c63bf245c..dad57d28df 100644 --- a/detections/endpoint/domain_group_discovery_with_dsquery.yml +++ b/detections/endpoint/domain_group_discovery_with_dsquery.yml @@ -1,25 +1,27 @@ +name: Domain Group Discovery With Dsquery +id: f0c9d62f-a232-4edd-b17e-bc409fb133d4 +version: 1 +date: '2021-09-01' author: Mauricio Velazco, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-09-01' description: This analytic looks for the execution of `dsquery.exe` with command-line arguments utilized to query for domain groups. The argument `group`, returns a list of all domain groups. Red Teams and adversaries alike use may leverage dsquery.exe to enumerate domain groups for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: f0c9d62f-a232-4edd-b17e-bc409fb133d4 -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: Domain Group Discovery With Dsquery -references: -- https://attack.mitre.org/techniques/T1069/002/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="dsquery.exe") (Processes.process="*group*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_group_discovery_with_dsquery_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ tags: analytic_story: - Active Directory Discovery @@ -57,5 +59,3 @@ tags: - Endpoint.Processes.user risk_score: 15 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/domain_group_discovery_with_net.yml b/detections/endpoint/domain_group_discovery_with_net.yml index c8bceabf39..168b3ba52c 100644 --- a/detections/endpoint/domain_group_discovery_with_net.yml +++ b/detections/endpoint/domain_group_discovery_with_net.yml @@ -1,25 +1,27 @@ +name: Domain Group Discovery With Net +id: f2f14ac7-fa81-471a-80d5-7eb65c3c7349 +version: 1 +date: '2021-08-25' author: Mauricio Velazco, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-08-25' description: This analytic looks for the execution of `net.exe` with command-line arguments utilized to query for domain groups. The argument `group /domain`, returns a list of all domain groups. Red Teams and adversaries alike use net.exe to enumerate domain groups for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: f2f14ac7-fa81-471a-80d5-7eb65c3c7349 -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: Domain Group Discovery With Net -references: -- https://attack.mitre.org/techniques/T1069/002/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" OR Processes.process_name="net1.exe") (Processes.process=*group* AND Processes.process=*/do*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_group_discovery_with_net_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ tags: analytic_story: - Active Directory Discovery @@ -57,5 +59,3 @@ tags: - Endpoint.Processes.user risk_score: 15 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/domain_group_discovery_with_wmic.yml b/detections/endpoint/domain_group_discovery_with_wmic.yml index 5b14b90c63..69fb35b601 100644 --- a/detections/endpoint/domain_group_discovery_with_wmic.yml +++ b/detections/endpoint/domain_group_discovery_with_wmic.yml @@ -1,19 +1,15 @@ +name: Domain Group Discovery With Wmic +id: a87736a6-95cd-4728-8689-3c64d5026b3e +version: 1 +date: '2021-08-25' author: Mauricio Velazco, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-08-25' description: This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for domain groups. The arguments utilized in this command return a list of all domain groups. Red Teams and adversaries alike use wmic.exe to enumerate domain groups for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: a87736a6-95cd-4728-8689-3c64d5026b3e -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: Domain Group Discovery With Wmic -references: -- https://attack.mitre.org/techniques/T1069/002/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe") (Processes.process=*/NAMESPACE:\\\\root\\directory\\ldap* AND Processes.process=*ds_group* @@ -21,6 +17,12 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_group_discovery_with_wmic_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ tags: analytic_story: - Active Directory Discovery @@ -58,5 +60,3 @@ tags: - Endpoint.Processes.user risk_score: 15 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml index e450861bfb..65512631c8 100644 --- a/detections/endpoint/download_files_using_telegram.yml +++ b/detections/endpoint/download_files_using_telegram.yml @@ -1,26 +1,28 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Download Files Using Telegram +id: 58194e28-ae5e-11eb-8912-acde48001122 +version: 1 date: '2021-05-06' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: [] description: The following analytic will identify a suspicious download by the Telegram application on a Windows system. This behavior was identified on a honeypot where the adversary gained access, installed Telegram and followed through with downloading different network scanners (port, bruteforcer, masscan) to the system and later used to mapped the whole network and further move laterally. +search: '`sysmon` EventCode= 15 process_name = "telegram.exe" TargetFilename = "*:Zone.Identifier" + |stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode + Image process_id TargetFilename Hash | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `download_files_using_telegram_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and TargetFilename from your endpoints or Events that monitor filestream events which is happened when process download something. (EventCode 15) If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -id: 58194e28-ae5e-11eb-8912-acde48001122 known_false_positives: normal download of file in telegram app. (if it was a common app in network) -name: Download Files Using Telegram references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -search: '`sysmon` EventCode= 15 process_name = "telegram.exe" TargetFilename = "*:Zone.Identifier" - |stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode - Image process_id TargetFilename Hash | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `download_files_using_telegram_filter`' tags: analytic_story: - XMRig @@ -61,5 +63,3 @@ tags: - Hash risk_score: 49 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/drop_icedid_license_dat.yml b/detections/endpoint/drop_icedid_license_dat.yml index 845225e4e9..56a0af30fd 100644 --- a/detections/endpoint/drop_icedid_license_dat.yml +++ b/detections/endpoint/drop_icedid_license_dat.yml @@ -1,22 +1,24 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Drop IcedID License dat +id: b7a045fc-f14a-11eb-8e79-acde48001122 +version: 1 date: '2021-07-30' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: [] description: This search is to detect dropping a suspicious file named as "license.dat" in %appdata%. This behavior seen in latest IcedID malware that contain the actual core bot that will be injected in other process to do banking stealing. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: b7a045fc-f14a-11eb-8e79-acde48001122 -known_false_positives: unknown -name: Drop IcedID License dat -references: -- https://www.cisecurity.org/white-papers/security-primer-icedid/ search: '`sysmon` EventCode= 11 TargetFilename = "*\\license.dat" AND (TargetFilename="*\\appdata\\*" OR TargetFilename="*\\programdata\\*") |stats count min(_time) as firstTime max(_time) as lastTime by TargetFilename EventCode process_id process_name Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_icedid_license_dat_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://www.cisecurity.org/white-papers/security-primer-icedid/ tags: analytic_story: - IcedID @@ -51,5 +53,3 @@ tags: - _time risk_score: 63 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/dsquery_domain_discovery.yml b/detections/endpoint/dsquery_domain_discovery.yml index f532975721..fef3565423 100644 --- a/detections/endpoint/dsquery_domain_discovery.yml +++ b/detections/endpoint/dsquery_domain_discovery.yml @@ -1,7 +1,11 @@ +name: DSQuery Domain Discovery +id: cc316032-924a-11eb-91a2-acde48001122 +version: 1 +date: '2021-03-31' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-03-31' description: 'The following analytic identifies "dsquery.exe" execution with arguments looking for `TrustedDomain` query directly on the command-line. This is typically indicative of an Administrator or adversary perform domain trust discovery. Note @@ -23,24 +27,22 @@ description: 'The following analytic identifies "dsquery.exe" execution with arg In addition to trust discovery, review parallel processes for additional behaviors performed. Identify the parent process and capture any files (batch files, for example) being used.' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: cc316032-924a-11eb-91a2-acde48001122 -known_false_positives: Limited false positives. If there is a true false positive, - filter based on command-line or parent process. -name: DSQuery Domain Discovery -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md -- http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/ -- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732952(v=ws.11) -- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc754232(v=ws.11) search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="dsquery.exe" Processes.process="*trustedDomain*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dsquery_domain_discovery_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Limited false positives. If there is a true false positive, + filter based on command-line or parent process. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md +- http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/ +- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732952(v=ws.11) +- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc754232(v=ws.11) tags: analytic_story: - Domain Trust Discovery @@ -91,5 +93,3 @@ tags: - _time risk_score: 72 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml index 8bee0c88e4..b28bdddb75 100644 --- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml +++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml @@ -1,24 +1,26 @@ +name: Dump LSASS via comsvcs DLL +id: 8943b567-f14d-4ee8-a0bb-2121d4ce3184 +version: 2 +date: '2020-02-21' author: Patrick Bareiss, Splunk +type: TTP datamodel: - Endpoint -date: '2020-02-21' description: Detect the usage of comsvcs.dll for dumping the lsass process. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 8943b567-f14d-4ee8-a0bb-2121d4ce3184 -known_false_positives: None identified. -name: Dump LSASS via comsvcs DLL -references: -- https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/ -- https://twitter.com/SBousseaden/status/1167417096374050817 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process="*comsvcs.dll*" Processes.process="*MiniDump*" by Processes.user Processes.process_name Processes.original_file_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dump_lsass_via_comsvcs_dll_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: None identified. +references: +- https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/ +- https://twitter.com/SBousseaden/status/1167417096374050817 tags: analytic_story: - Credential Dumping @@ -76,5 +78,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml index b16c3bdb2f..ee975b2cd1 100644 --- a/detections/endpoint/dump_lsass_via_procdump.yml +++ b/detections/endpoint/dump_lsass_via_procdump.yml @@ -1,7 +1,11 @@ +name: Dump LSASS via procdump +id: 3742ebfe-64c2-11eb-ae93-0242ac130002 +version: 2 +date: '2021-09-16' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-16' description: 'Detect procdump.exe dumping the lsass process. This query looks for both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump file with all process memory. Both are highly suspect and should be reviewed. This @@ -12,23 +16,21 @@ description: 'Detect procdump.exe dumping the lsass process. This query looks fo Sysinternals utility has been ran, it is possible there will be a -accepteula on the command line. Review other endpoint data sources for cross process (injection) into lsass.exe.' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 3742ebfe-64c2-11eb-ae93-0242ac130002 -known_false_positives: None identified. -name: Dump LSASS via procdump -references: -- https://attack.mitre.org/techniques/T1003/001/ -- https://docs.microsoft.com/en-us/sysinternals/downloads/procdump -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_procdump` (Processes.process=*-ma* OR Processes.process=*-mm*) Processes.process=*lsass* by Processes.user Processes.process_name Processes.process Processes.original_file_name Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: None identified. +references: +- https://attack.mitre.org/techniques/T1003/001/ +- https://docs.microsoft.com/en-us/sysinternals/downloads/procdump +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump tags: analytic_story: - Credential Dumping @@ -85,5 +87,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/elevated_group_discovery_with_net.yml b/detections/endpoint/elevated_group_discovery_with_net.yml index 1fb6e0c8f6..b6c5c973d5 100644 --- a/detections/endpoint/elevated_group_discovery_with_net.yml +++ b/detections/endpoint/elevated_group_discovery_with_net.yml @@ -1,22 +1,16 @@ +name: Elevated Group Discovery With Net +id: a23a0e20-0b1b-4a07-82e5-ec5f70811e7a +version: 1 +date: '2021-08-25' author: Mauricio Velazco, Splunk +type: TTP datamodel: - Endpoint -date: '2021-08-25' description: This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for specific elevated domain groups. Red Teams and adversaries alike use net.exe to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: a23a0e20-0b1b-4a07-82e5-ec5f70811e7a -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: Elevated Group Discovery With Net -references: -- https://attack.mitre.org/techniques/T1069/002/ -- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory -- https://adsecurity.org/?p=3658 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" OR Processes.process_name="net1.exe") (Processes.process="*group*" AND Processes.process="*/do*") @@ -27,6 +21,14 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `elevated_group_discovery_with_net_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory +- https://adsecurity.org/?p=3658 tags: analytic_story: - Active Directory Discovery @@ -64,5 +66,3 @@ tags: - Endpoint.Processes.user risk_score: 21 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/elevated_group_discovery_with_powerview.yml b/detections/endpoint/elevated_group_discovery_with_powerview.yml index 97e360eebc..a97e3ce462 100644 --- a/detections/endpoint/elevated_group_discovery_with_powerview.yml +++ b/detections/endpoint/elevated_group_discovery_with_powerview.yml @@ -1,6 +1,10 @@ -author: Mauricio Velazco, Splunk -datamodel: [] +name: Elevated Group Discovery with PowerView +id: 10d62950-0de5-4199-a710-cff9ea79b413 +version: 1 date: '2021-08-25' +author: Mauricio Velazco, Splunk +type: Hunting +datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainGroupMember` commandlet. `Get-DomainGroupMember` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. @@ -8,22 +12,20 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev specific domain group. Red Teams and adversaries alike use PowerView to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -id: 10d62950-0de5-4199-a710-cff9ea79b413 -known_false_positives: Administrators or power users may use this PowerView for troubleshooting. -name: Elevated Group Discovery with PowerView -references: -- https://attack.mitre.org/techniques/T1069/002/ -- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroupMember/ -- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory -- https://attack.mitre.org/techniques/T1069/002/ search: '`powershell` EventCode=4104 (Message = "*Get-DomainGroupMember*") AND Message IN ("*Domain Admins*","*Enterprise Admins*", "*Schema Admins*", "*Account Operators*" , "*Server Operators*", "*Protected Users*", "*Dns Admins*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `elevated_group_discovery_with_powerview_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators or power users may use this PowerView for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroupMember/ +- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory +- https://attack.mitre.org/techniques/T1069/002/ tags: analytic_story: - Active Directory Discovery @@ -59,5 +61,3 @@ tags: - User risk_score: 21 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/elevated_group_discovery_with_wmic.yml b/detections/endpoint/elevated_group_discovery_with_wmic.yml index 910eeccf52..e37dfae4d7 100644 --- a/detections/endpoint/elevated_group_discovery_with_wmic.yml +++ b/detections/endpoint/elevated_group_discovery_with_wmic.yml @@ -1,21 +1,15 @@ +name: Elevated Group Discovery With Wmic +id: 3f6bbf22-093e-4cb4-9641-83f47b8444b6 +version: 1 +date: '2021-08-25' author: Mauricio Velazco, Splunk +type: TTP datamodel: - Endpoint -date: '2021-08-25' description: This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for specific domain groups. Red Teams and adversaries alike use net.exe to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: 3f6bbf22-093e-4cb4-9641-83f47b8444b6 -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: Elevated Group Discovery With Wmic -references: -- https://attack.mitre.org/techniques/T1069/002/ -- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory -- https://adsecurity.org/?p=3658 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe") (Processes.process=*/NAMESPACE:\\\\root\\directory\\ldap*) (Processes.process="*Domain @@ -25,6 +19,14 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Admins*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `elevated_group_discovery_with_wmic_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory +- https://adsecurity.org/?p=3658 tags: analytic_story: - Active Directory Discovery @@ -62,5 +64,3 @@ tags: - Endpoint.Processes.user risk_score: 21 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml index 3be2819d02..af5be00a3d 100644 --- a/detections/endpoint/enable_rdp_in_other_port_number.yml +++ b/detections/endpoint/enable_rdp_in_other_port_number.yml @@ -1,26 +1,28 @@ +name: Enable RDP In Other Port Number +id: 99495452-b899-11eb-96dc-acde48001122 +version: 1 +date: '2021-05-19' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-05-19' description: This search is to detect a modification to registry to enable rdp to a machine with different port number. This technique was seen in some atttacker tries to do lateral movement and remote access to a compromised machine to gain control of it. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: 99495452-b899-11eb-96dc-acde48001122 -known_false_positives: unknown -name: Enable RDP In Other Port Number -references: -- https://www.mvps.net/docs/how-to-secure-remote-desktop-rdp/ search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp*" Registry.registry_value_name = "PortNumber" by Registry.dest Registry.user Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `enable_rdp_in_other_port_number_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://www.mvps.net/docs/how-to-secure-remote-desktop-rdp/ tags: analytic_story: - Prohibited Traffic Allowed or Protocol Mismatch @@ -59,5 +61,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml index 6bf4a0daed..24b9d08348 100644 --- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -1,29 +1,31 @@ +name: Enable WDigest UseLogonCredential Registry +id: 0c7d8ffe-25b1-11ec-9f39-acde48001122 +version: 1 +date: '2021-10-05' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-10-05' description: This analytic is to detect a suspicious registry modification to enable plain text credential feature of windows. This technique was used by several malware and also by mimikatz to be able to dumpe the a plain text credential to the compromised or target host. This TTP is really a good indicator that someone wants to dump the crendential of the host so it must be a good pivot for credential dumping techniques. -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -id: 0c7d8ffe-25b1-11ec-9f39-acde48001122 -known_false_positives: unknown -name: Enable WDigest UseLogonCredential Registry -references: -- https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*" Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data = 0x00000001 by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name Registry.registry_path Registry.registry_value_data | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `enable_wdigest_uselogoncredential_registry_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: unknown +references: +- https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html tags: analytic_story: - Credential Dumping @@ -64,5 +66,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/enumerate_users_local_group_using_telegram.yml b/detections/endpoint/enumerate_users_local_group_using_telegram.yml index 94202a11c9..b98bc305ac 100644 --- a/detections/endpoint/enumerate_users_local_group_using_telegram.yml +++ b/detections/endpoint/enumerate_users_local_group_using_telegram.yml @@ -1,23 +1,25 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Enumerate Users Local Group Using Telegram +id: fcd74532-ae54-11eb-a5ab-acde48001122 +version: 1 date: '2021-05-06' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: [] description: This analytic will detect a suspicious Telegram process enumerating all network users in a local group. This technique was seen in a Monero infected honeypot to mapped all the users on the compromised system. EventCode 4798 is generated when a process enumerates a user's security-enabled local groups on a computer or device. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the Task Schedule (Exa. Security Log EventCode 4798) endpoints. Tune and - filter known instances of process like logonUI used in your environment. -id: fcd74532-ae54-11eb-a5ab-acde48001122 -known_false_positives: unknown -name: Enumerate Users Local Group Using Telegram -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4798 search: '`wineventlog_security` EventCode=4798 Process_Name = "*\\telegram.exe" | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode Process_Name Process_ID Account_Name Account_Domain Logon_ID Security_ID Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `enumerate_users_local_group_using_telegram_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the Task Schedule (Exa. Security Log EventCode 4798) endpoints. Tune and + filter known instances of process like logonUI used in your environment. +known_false_positives: unknown +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4798 tags: analytic_story: - XMRig @@ -61,5 +63,3 @@ tags: - Message risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/esentutl_sam_copy.yml b/detections/endpoint/esentutl_sam_copy.yml index 6dd9b6c2a6..bff1d98bb3 100644 --- a/detections/endpoint/esentutl_sam_copy.yml +++ b/detections/endpoint/esentutl_sam_copy.yml @@ -1,28 +1,30 @@ +name: Esentutl SAM Copy +id: d372f928-ce4f-11eb-a762-acde48001122 +version: 1 +date: '2021-08-18' author: Michael Haag, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-08-18' description: The following analytic identifies the process - `esentutl.exe` - being used to capture credentials stored in ntds.dit or the SAM file on disk. During triage, review parallel processes and determine if legitimate activity. Upon determination of illegitimate activity, take further action to isolate and contain the threat. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: d372f928-ce4f-11eb-a762-acde48001122 -known_false_positives: False positives should be limited. Filter as needed. -name: Esentutl SAM Copy -references: -- https://github.com/redcanaryco/atomic-red-team/blob/6a570c2a4630cf0c2bd41a2e8375b5d5ab92f700/atomics/T1003.002/T1003.002.md -- https://attack.mitre.org/software/S0404/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_esentutl` Processes.process IN ("*ntds*", "*SAM*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esentutl_sam_copy_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives should be limited. Filter as needed. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/6a570c2a4630cf0c2bd41a2e8375b5d5ab92f700/atomics/T1003.002/T1003.002.md +- https://attack.mitre.org/software/S0404/ tags: analytic_story: - Credential Dumping @@ -74,5 +76,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml index f9e5c4dc85..e06e4eaba9 100644 --- a/detections/endpoint/etw_registry_disabled.yml +++ b/detections/endpoint/etw_registry_disabled.yml @@ -1,27 +1,29 @@ +name: ETW Registry Disabled +id: 8ed523ac-276b-11ec-ac39-acde48001122 +version: 1 +date: '2021-10-07' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-10-07' description: This analytic is to detect a registry modification to disable ETW feature of windows. This technique is to evade EDR appliance to evade detections and hide its execution from audit logs. -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -id: 8ed523ac-276b-11ec-ac39-acde48001122 -known_false_positives: unknown -name: ETW Registry Disabled -references: -- https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\Microsoft\\.NETFramework*") Registry.registry_value_name = ETWEnabled Registry.registry_value_data=0x00000000 by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `etw_registry_disabled_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: unknown +references: +- https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3 tags: analytic_story: - Windows Persistence Techniques @@ -64,5 +66,3 @@ tags: - _time risk_score: 90 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml index 35fe7e1407..0ef6495a8a 100644 --- a/detections/endpoint/eventvwr_uac_bypass.yml +++ b/detections/endpoint/eventvwr_uac_bypass.yml @@ -1,29 +1,31 @@ +name: Eventvwr UAC Bypass +id: 9cf8fe08-7ad8-11eb-9819-acde48001122 +version: 1 +date: '2021-03-01' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-03-01' description: The following search identifies Eventvwr bypass by identifying the registry modification into a specific path that eventvwr.msc looks to (but is not valid) upon execution. A successful attack will include a suspicious command to be executed upon eventvwr.msc loading. Upon triage, review the parallel processes that have executed. Identify any additional registry modifications on the endpoint that may look suspicious. Remediate as necessary. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. -id: 9cf8fe08-7ad8-11eb-9819-acde48001122 -known_false_positives: Some false positives may be present and will need to be filtered. -name: Eventvwr UAC Bypass -references: -- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md -- https://attack.mitre.org/techniques/T1548/002 -- https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/ search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*mscfile\\shell\\open\\command\\*" by Registry.user, Registry.dest , Registry.registry_value_name| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `eventvwr_uac_bypass_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. +known_false_positives: Some false positives may be present and will need to be filtered. +references: +- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md +- https://attack.mitre.org/techniques/T1548/002 +- https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/ tags: analytic_story: - Windows Defense Evasion Tactics @@ -66,5 +68,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/excel_spawning_powershell.yml b/detections/endpoint/excel_spawning_powershell.yml index f5cc81db04..078ba7d37f 100644 --- a/detections/endpoint/excel_spawning_powershell.yml +++ b/detections/endpoint/excel_spawning_powershell.yml @@ -1,7 +1,11 @@ +name: Excel Spawning PowerShell +id: 42d40a22-9be3-11eb-8f08-acde48001122 +version: 1 +date: '2021-04-12' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-04-12' description: The following detection identifies Microsoft Excel spawning PowerShell. Typically, this is not common behavior and not default with Excel.exe. Excel.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` @@ -9,24 +13,22 @@ description: The following detection identifies Microsoft Excel spawning PowerSh attachment and is actively used. Albeit, the command executed will most likely be encoded and captured via another detection. During triage, review parallel processes and identify any files that may have been written. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 42d40a22-9be3-11eb-8f08-acde48001122 -known_false_positives: False positives should be limited, but if any are present, - filter as needed. -name: Excel Spawning PowerShell -references: -- https://redcanary.com/threat-detection-report/techniques/powershell/ -- https://attack.mitre.org/techniques/T1566/001/ search: '| tstats `security_content_summariesonly` count values(Processes.process) min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="excel.exe" `process_powershell` by Processes.parent_process Processes.process_name Processes.user Processes.dest Processes.original_file_name | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | `excel_spawning_powershell_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives should be limited, but if any are present, + filter as needed. +references: +- https://redcanary.com/threat-detection-report/techniques/powershell/ +- https://attack.mitre.org/techniques/T1566/001/ tags: analytic_story: - Spearphishing Attachments @@ -76,5 +78,3 @@ tags: - Endpoint.Processes.user risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/excel_spawning_windows_script_host.yml b/detections/endpoint/excel_spawning_windows_script_host.yml index 912850845e..e8a6e9dff4 100644 --- a/detections/endpoint/excel_spawning_windows_script_host.yml +++ b/detections/endpoint/excel_spawning_windows_script_host.yml @@ -1,7 +1,11 @@ +name: Excel Spawning Windows Script Host +id: 57fe880a-9be3-11eb-9bf3-acde48001122 +version: 1 +date: '2021-04-12' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-04-12' description: The following detection identifies Microsoft Excel spawning Windows Script Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior and not default with Excel.exe. Excel.exe will generally be found in the following path @@ -12,23 +16,21 @@ description: The following detection identifies Microsoft Excel spawning Windows be obfuscated and captured via another detection. During triage, review parallel processes and identify any files that may have been written. Review the reputation of the remote destination and block accordingly. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: 57fe880a-9be3-11eb-9bf3-acde48001122 -known_false_positives: False positives should be limited, but if any are present, - filter as needed. In some instances, `cscript.exe` is used for legitimate business - practices. -name: Excel Spawning Windows Script Host -references: -- https://app.any.run/tasks/8ecfbc29-03d0-421c-a5bf-3905d29192a2/ -- https://attack.mitre.org/techniques/T1566/001/ search: '| tstats `security_content_summariesonly` count values(Processes.process) min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="excel.exe" Processes.process_name IN ("cscript.exe", "wscript.exe") by Processes.parent_process Processes.process_name Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | `excel_spawning_windows_script_host_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: False positives should be limited, but if any are present, + filter as needed. In some instances, `cscript.exe` is used for legitimate business + practices. +references: +- https://app.any.run/tasks/8ecfbc29-03d0-421c-a5bf-3905d29192a2/ +- https://attack.mitre.org/techniques/T1566/001/ tags: analytic_story: - Spearphishing Attachments @@ -82,5 +84,3 @@ tags: - user risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/excessive_attempt_to_disable_services.yml b/detections/endpoint/excessive_attempt_to_disable_services.yml index 5d331f240c..0e24818697 100644 --- a/detections/endpoint/excessive_attempt_to_disable_services.yml +++ b/detections/endpoint/excessive_attempt_to_disable_services.yml @@ -1,20 +1,15 @@ +name: Excessive Attempt To Disable Services +id: 8fa2a0f0-acd9-11eb-8994-acde48001122 +version: 1 +date: '2021-05-04' author: Teoderick Contreras, Splunk +type: Anomaly datamodel: - Endpoint -date: '2021-05-04' description: This analytic will identify suspicious series of command-line to disable several services. This technique is seen where the adversary attempts to disable security app services or other malware services to complete the objective on the compromised system. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed sc.exe may be used. -id: 8fa2a0f0-acd9-11eb-8994-acde48001122 -known_false_positives: unknown -name: Excessive Attempt To Disable Services -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = @@ -22,6 +17,13 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as Processes.parent_process_name Processes.dest Processes.user _time span=1m | where count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_attempt_to_disable_services_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed sc.exe may be used. +known_false_positives: unknown +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - XMRig @@ -62,5 +64,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: Anomaly -version: 1 diff --git a/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml b/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml index c1a369054d..522d04e8db 100644 --- a/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml +++ b/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml @@ -1,28 +1,30 @@ +name: Excessive number of distinct processes created in Windows Temp folder +id: 23587b6a-c479-11eb-b671-acde48001122 +version: 1 +date: '2021-06-03' author: Michael Hart, Splunk +type: Anomaly datamodel: - Endpoint -date: '2021-06-03' description: This analytic will identify suspicious series of process executions. We have observed that post exploit framework tools like Koadic and Meterpreter will launch an excessive number of processes with distinct file paths from Windows\Temp to execute actions on objective. This behavior is extremely anomalous compared to typical application behaviors that use Windows\Temp. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the full process path in the process field of CIM's Process data model. - If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. - Tune and filter known instances where renamed sc.exe may be used. -id: 23587b6a-c479-11eb-b671-acde48001122 -known_false_positives: Many benign applications will create processes from executables - in Windows\Temp, although unlikely to exceed the given threshold. Filter as needed. -name: Excessive number of distinct processes created in Windows Temp folder -references: -- https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/ search: '| tstats `security_content_summariesonly` values(Processes.process) as process distinct_count(Processes.process) as distinct_process_count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*\\Windows\\Temp\\*" by Processes.dest Processes.user _time span=20m | where distinct_process_count > 37 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_number_of_distinct_processes_created_in_windows_temp_folder_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the full process path in the process field of CIM's Process data model. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + Tune and filter known instances where renamed sc.exe may be used. +known_false_positives: Many benign applications will create processes from executables + in Windows\Temp, although unlikely to exceed the given threshold. Filter as needed. +references: +- https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/ tags: analytic_story: - Meterpreter @@ -56,5 +58,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: Anomaly -version: 1 diff --git a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml index e17a267b54..b28880bbcc 100644 --- a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml +++ b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml @@ -1,27 +1,17 @@ +name: Excessive number of service control start as disabled +id: 77592bec-d5cc-11eb-9e60-acde48001122 +version: 1 +date: '2021-06-25' author: Michael Hart, Splunk +type: Anomaly datamodel: - Endpoint -date: '2021-06-25' description: This detection targets behaviors observed when threat actors have used sc.exe to modify services. We observed malware in a honey pot spawning numerous sc.exe processes in a short period of time, presumably to impair defenses, possibly to block others from compromising the same machine. This detection will alert when we see both an excessive number of sc.exe processes launched with specific commandline arguments to disable the start of certain services. -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must be ingesting - logs with both the process name and command line from your endpoints. The complete - process name with command-line arguments are mapped to the "process" field in the - Endpoint data model. -id: 77592bec-d5cc-11eb-9e60-acde48001122 -known_false_positives: Legitimate programs and administrators will execute sc.exe - with the start disabled flag. It is possible, but unlikely from the telemetry of - normal Windows operation we observed, that sc.exe will be called more than seven - times in a short period of time. -name: Excessive number of service control start as disabled -references: -- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/sc-create -- https://attack.mitre.org/techniques/T1562/001/ search: '| tstats `security_content_summariesonly` distinct_count(Processes.process) as distinct_cmdlines values(Processes.process_id) as process_ids min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.process_name @@ -29,6 +19,18 @@ search: '| tstats `security_content_summariesonly` distinct_count(Processes.proc Processes.parent_process Processes.process_name Processes.parent_process_id, _time span=30m | where distinct_cmdlines >= 8 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_number_of_service_control_start_as_disabled_filter`' +how_to_implement: You must be ingesting data that records process activity from your + hosts to populate the Endpoint data model in the Processes node. You must be ingesting + logs with both the process name and command line from your endpoints. The complete + process name with command-line arguments are mapped to the "process" field in the + Endpoint data model. +known_false_positives: Legitimate programs and administrators will execute sc.exe + with the start disabled flag. It is possible, but unlikely from the telemetry of + normal Windows operation we observed, that sc.exe will be called more than seven + times in a short period of time. +references: +- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/sc-create +- https://attack.mitre.org/techniques/T1562/001/ tags: analytic_story: - Windows Defense Evasion Tactics @@ -71,5 +73,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: Anomaly -version: 1 diff --git a/detections/endpoint/excessive_number_of_taskhost_processes.yml b/detections/endpoint/excessive_number_of_taskhost_processes.yml index eaa455c2d7..fa6b48e8d9 100644 --- a/detections/endpoint/excessive_number_of_taskhost_processes.yml +++ b/detections/endpoint/excessive_number_of_taskhost_processes.yml @@ -1,22 +1,17 @@ +name: Excessive number of taskhost processes +id: f443dac2-c7cf-11eb-ab51-acde48001122 +version: 1 +date: '2021-06-07' author: Michael Hart +type: Anomaly datamodel: - Endpoint -date: '2021-06-07' description: This detection targets behaviors observed in post exploit kits like Meterpreter and Koadic that are run in memory. We have observed that these tools must invoke an excessive number of taskhost.exe and taskhostex.exe processes to complete various actions (discovery, lateral movement, etc.). It is extremely uncommon in the course of normal operations to see so many distinct taskhost and taskhostex processes running concurrently in a short time frame. -how_to_implement: To successfully implement this search you need to be ingesting events - related to processes on the endpoints that include the name of the process and process - id into the `Endpoint` datamodel in the `Processes` node. -id: f443dac2-c7cf-11eb-ab51-acde48001122 -known_false_positives: Administrators, administrative actions or certain applications - may run many instances of taskhost and taskhostex concurrently. Filter as needed. -name: Excessive number of taskhost processes -references: -- https://attack.mitre.org/software/S0250/ search: '| tstats `security_content_summariesonly` values(Processes.process_id) as process_ids min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.process_name = "taskhost.exe" OR Processes.process_name = "taskhostex.exe" @@ -27,6 +22,13 @@ search: '| tstats `security_content_summariesonly` values(Processes.process_id) as taskhostex_count by _time, dest, firstTime, lastTime | where taskhost_count > 10 and taskhostex_count > 10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_number_of_taskhost_processes_filter`' +how_to_implement: To successfully implement this search you need to be ingesting events + related to processes on the endpoints that include the name of the process and process + id into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators, administrative actions or certain applications + may run many instances of taskhost and taskhostex concurrently. Filter as needed. +references: +- https://attack.mitre.org/software/S0250/ tags: analytic_story: - Meterpreter @@ -64,5 +66,3 @@ tags: - _time risk_score: 56 security_domain: endpoint -type: Anomaly -version: 1 diff --git a/detections/endpoint/excessive_service_stop_attempt.yml b/detections/endpoint/excessive_service_stop_attempt.yml index 4feaa89049..5e2ead6434 100644 --- a/detections/endpoint/excessive_service_stop_attempt.yml +++ b/detections/endpoint/excessive_service_stop_attempt.yml @@ -1,21 +1,15 @@ +name: Excessive Service Stop Attempt +id: ae8d3f4a-acd7-11eb-8846-acde48001122 +version: 2 +date: '2021-05-04' author: Teoderick Contreras, Splunk +type: Anomaly datamodel: - Endpoint -date: '2021-05-04' description: This analytic identifies suspicious series of attempt to kill multiple services on a system using either `net.exe` or `sc.exe`. This technique is use by adversaries to terminate security services or other related services to continue there objective and evade detections. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: ae8d3f4a-acd7-11eb-8846-acde48001122 -known_false_positives: unknown -name: Excessive Service Stop Attempt -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` OR Processes.process_name @@ -24,6 +18,14 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as Processes.parent_process_name Processes.dest Processes.user _time span=1m | where count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_service_stop_attempt_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: unknown +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - XMRig @@ -66,5 +68,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: Anomaly -version: 2 diff --git a/detections/endpoint/excessive_usage_of_cacls_app.yml b/detections/endpoint/excessive_usage_of_cacls_app.yml index 1fb998e21f..5744c10efd 100644 --- a/detections/endpoint/excessive_usage_of_cacls_app.yml +++ b/detections/endpoint/excessive_usage_of_cacls_app.yml @@ -1,20 +1,15 @@ +name: Excessive Usage Of Cacls App +id: 0bdf6092-af17-11eb-939a-acde48001122 +version: 1 +date: '2021-05-07' author: Teoderick Contreras, Splunk +type: Anomaly datamodel: - Endpoint -date: '2021-05-07' description: The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe` or `icacls.exe` application to change file or folder permission. This behavior is commonly seen where the adversary attempts to impair some users from deleting or accessing its malware components or artifact from the compromised system. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: 0bdf6092-af17-11eb-939a-acde48001122 -known_false_positives: Administrators or administrative scripts may use this application. - Filter as needed. -name: Excessive Usage Of Cacls App -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id values(Processes.process_name) as process_name count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes @@ -22,6 +17,13 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as OR Processes.process_name = "XCACLS.exe" by Processes.parent_process_name Processes.parent_process Processes.dest Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_cacls_app_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or administrative scripts may use this application. + Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - XMRig @@ -63,5 +65,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: Anomaly -version: 1 diff --git a/detections/endpoint/excessive_usage_of_net_app.yml b/detections/endpoint/excessive_usage_of_net_app.yml index 5a02b60674..f604ffed9b 100644 --- a/detections/endpoint/excessive_usage_of_net_app.yml +++ b/detections/endpoint/excessive_usage_of_net_app.yml @@ -1,27 +1,29 @@ +name: Excessive Usage Of Net App +id: 45e52536-ae42-11eb-b5c6-acde48001122 +version: 2 +date: '2021-05-06' author: Teoderick Contreras, Splunk +type: Anomaly datamodel: - Endpoint -date: '2021-05-06' description: This analytic identifies excessive usage of `net.exe` or `net1.exe` within a bucket of time (1 minute). This behavior was seen in a Monero incident where the adversary attempts to create many users, delete and disable users as part of its malicious behavior. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 45e52536-ae42-11eb-b5c6-acde48001122 -known_false_positives: unknown. Filter as needed. Modify the time span as needed. -name: Excessive Usage Of Net App -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` by Processes.process_name Processes.parent_process_name Processes.original_file_name Processes.dest Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_net_app_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: unknown. Filter as needed. Modify the time span as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - XMRig @@ -70,5 +72,3 @@ tags: - _time risk_score: 28 security_domain: endpoint -type: Anomaly -version: 2 diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml index 5d5910cc82..c8f931b7a8 100644 --- a/detections/endpoint/excessive_usage_of_nslookup_app.yml +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -1,29 +1,31 @@ -author: Teoderick Contreras, Stanislav Miskovic, Splunk -datamodel: [] +name: Excessive Usage of NSLOOKUP App +id: 0a69fdaa-a2b8-11eb-b16d-acde48001122 +version: 1 date: '2021-04-21' +author: Teoderick Contreras, Stanislav Miskovic, Splunk +type: Anomaly +datamodel: [] description: This search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of nslookup.exe may be used. -id: 0a69fdaa-a2b8-11eb-b16d-acde48001122 -known_false_positives: unknown -name: Excessive Usage of NSLOOKUP App -references: -- https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html -- https://www.varonis.com/blog/dns-tunneling/ -- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ search: '`sysmon` EventCode = 1 process_name = "nslookup.exe" | bucket _time span=15m | stats count as numNsLookup by Computer, _time | eventstats avg(numNsLookup) as avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by Computer | eval upperThreshold=(avgNsLookup + stdNsLookup *3) | eval isOutlier=if(avgNsLookup > 20 and avgNsLookup >= upperThreshold, 1, 0) | search isOutlier=1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_nslookup_app_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances of nslookup.exe may be used. +known_false_positives: unknown +references: +- https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html +- https://www.varonis.com/blog/dns-tunneling/ +- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ tags: analytic_story: - Suspicious DNS Traffic @@ -61,5 +63,3 @@ tags: - EventCode risk_score: 28 security_domain: endpoint -type: Anomaly -version: 1 diff --git a/detections/endpoint/excessive_usage_of_sc_service_utility.yml b/detections/endpoint/excessive_usage_of_sc_service_utility.yml index 253a2851db..41d68e22ce 100644 --- a/detections/endpoint/excessive_usage_of_sc_service_utility.yml +++ b/detections/endpoint/excessive_usage_of_sc_service_utility.yml @@ -1,26 +1,28 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Excessive Usage Of SC Service Utility +id: cb6b339e-d4c6-11eb-a026-acde48001122 +version: 1 date: '2021-06-24' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: [] description: This search is to detect a suspicious excessive usage of sc.exe in a host machine. This technique was seen in several ransomware , xmrig and other malware to create, modify, delete or disable a service may related to security application or to gain privilege escalation. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used. -id: cb6b339e-d4c6-11eb-a026-acde48001122 -known_false_positives: excessive execution of sc.exe is quite suspicious since it - can modify or execute app in high privilege permission. -name: Excessive Usage Of SC Service Utility -references: -- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ search: '`sysmon` EventCode = 1 process_name = "sc.exe" | bucket _time span=15m | stats values(process) as process count as numScExe by Computer, _time | eventstats avg(numScExe) as avgScExe, stdev(numScExe) as stdScExe, count as numSlots by Computer | eval upperThreshold=(avgScExe + stdScExe *3) | eval isOutlier=if(avgScExe > 5 and avgScExe >= upperThreshold, 1, 0) | search isOutlier=1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_sc_service_utility_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used. +known_false_positives: excessive execution of sc.exe is quite suspicious since it + can modify or execute app in high privilege permission. +references: +- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ tags: analytic_story: - Ransomware @@ -42,5 +44,3 @@ tags: - process_name - process security_domain: endpoint -type: Anomaly -version: 1 diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml index 99cc690984..ab6623ebd5 100644 --- a/detections/endpoint/excessive_usage_of_taskkill.yml +++ b/detections/endpoint/excessive_usage_of_taskkill.yml @@ -1,25 +1,27 @@ +name: Excessive Usage Of Taskkill +id: fe5bca48-accb-11eb-a67c-acde48001122 +version: 1 +date: '2021-05-04' author: Teoderick Contreras, Splunk +type: Anomaly datamodel: - Endpoint -date: '2021-05-04' description: This analytic identifies excessive usage of `taskkill.exe` application. This application is commonly used by adversaries to evade detections by killing security product processes or even other processes to evade detection. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used. -id: fe5bca48-accb-11eb-a67c-acde48001122 -known_false_positives: Unknown. Filter as needed. -name: Excessive Usage Of Taskkill -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "taskkill.exe" by Processes.parent_process_name Processes.process_name Processes.dest Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_taskkill_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used. +known_false_positives: Unknown. Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - XMRig @@ -66,5 +68,3 @@ tags: - _time risk_score: 28 security_domain: endpoint -type: Anomaly -version: 1 diff --git a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml index bf1bb12e91..a1b415a63c 100644 --- a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml +++ b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml @@ -1,6 +1,10 @@ -author: Teoderick Contreras, Mauricio Velazco, Splunk -datamodel: [] +name: Executable File Written in Administrative SMB Share +id: f63c34fe-a435-11eb-935a-acde48001122 +version: 2 date: '2021-11-18' +author: Teoderick Contreras, Mauricio Velazco, Splunk +type: TTP +datamodel: [] description: The following analytic identifies executable files (.exe or .dll) being written to Windows administrative SMB shares (Admin$, IPC$, C$). This represents suspicious behavior as its commonly used by tools like like PsExec/PaExec and others @@ -8,24 +12,22 @@ description: The following analytic identifies executable files (.exe or .dll) b endpoints. Red Teams and adversaries alike may abuse administrative shares for lateral movement and remote code execution. The Trickbot malware family also implements this behavior to try to infect other machines in the infected network. -how_to_implement: To successfully implement this search, you need to be ingesting - Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also - required. Also enable the object Audit access success/failure in your group policy. -id: f63c34fe-a435-11eb-935a-acde48001122 -known_false_positives: System Administrators may use looks like PsExec for troubleshooting - or administrations tasks. However, this will typically come only from certain users - and certain systems that can be added to an allow list. -name: Executable File Written in Administrative SMB Share -references: -- https://attack.mitre.org/techniques/T1021/002/ -- https://www.rapid7.com/blog/post/2013/03/09/psexec-demystified/ -- https://labs.vipre.com/trickbot-and-its-modules/ -- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html search: '`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.exe","*.dll") Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask= "0x2" | stats min(_time) as firstTime max(_time) as lastTime count by EventCode Share_Name Relative_Target_Name Object_Type Access_Mask user src_port Source_Address | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `executable_file_written_in_administrative_smb_share_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also + required. Also enable the object Audit access success/failure in your group policy. +known_false_positives: System Administrators may use looks like PsExec for troubleshooting + or administrations tasks. However, this will typically come only from certain users + and certain systems that can be added to an allow list. +references: +- https://attack.mitre.org/techniques/T1021/002/ +- https://www.rapid7.com/blog/post/2013/03/09/psexec-demystified/ +- https://labs.vipre.com/trickbot-and-its-modules/ +- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html tags: analytic_story: - Active Directory Lateral Movement @@ -66,5 +68,3 @@ tags: - Source_Address risk_score: 70 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 292812320e..6946cc748c 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -1,34 +1,37 @@ +name: Executables Or Script Creation In Suspicious Path +id: a7e3f0f0-ae42-11eb-b245-acde48001122 +version: 1 +date: '2021-05-06' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-05-06' description: This analytic will identify suspicious executable or scripts (known file extensions) in list of suspicious file path in Windows. This technique is used by adversaries to evade detection. The suspicious file path are known paths used in the wild and are not common to have executable or scripts. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Filesystem` node. -id: a7e3f0f0-ae42-11eb-b245-acde48001122 -known_false_positives: Administrators may allow creation of script or exe in the paths - specified. Filter as needed. -name: Executables Or Script Creation In Suspicious Path -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where (Filesystem.file_name = "*.exe" OR Filesystem.file_name = "*.dll" OR Filesystem.file_name - = "*.sys" OR Filesystem.file_name = "*.com" OR Filesystem.file_name = "*.vbs" OR Filesystem.file_name - = "*.vbe" OR Filesystem.file_name = "*.js" OR Filesystem.file_name = "*.ps1" OR Filesystem.file_name - = "*.bat" OR Filesystem.file_name = "*.cmd" OR Filesystem.file_name = "*.pif") AND ( Filesystem.file_path - = "*\\windows\\fonts\\*" OR Filesystem.file_path = "*\\windows\\temp\\*" OR Filesystem.file_path - = "*\\users\\public\\*" OR Filesystem.file_path = "*\\windows\\debug\\*" OR Filesystem.file_path - = "*\\Users\\Administrator\\Music\\*" OR Filesystem.file_path = "*\\Windows\\servicing\\*" - OR Filesystem.file_path = "*\\Users\\Default\\*" OR Filesystem.file_path = "*Recycle.bin*" - OR Filesystem.file_path = "*\\Windows\\Media\\*" OR Filesystem.file_path = "*\\Windows\\repair\\*" - OR Filesystem.file_path = "*\\AppData\\Local\\Temp*") by Filesystem.file_create_time - Filesystem.process_id Filesystem.file_name Filesystem.user | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `executables_or_script_creation_in_suspicious_path_filter`' + = "*.sys" OR Filesystem.file_name = "*.com" OR Filesystem.file_name = "*.vbs" OR + Filesystem.file_name = "*.vbe" OR Filesystem.file_name = "*.js" OR Filesystem.file_name + = "*.ps1" OR Filesystem.file_name = "*.bat" OR Filesystem.file_name = "*.cmd" OR + Filesystem.file_name = "*.pif") AND ( Filesystem.file_path = "*\\windows\\fonts\\*" + OR Filesystem.file_path = "*\\windows\\temp\\*" OR Filesystem.file_path = "*\\users\\public\\*" + OR Filesystem.file_path = "*\\windows\\debug\\*" OR Filesystem.file_path = "*\\Users\\Administrator\\Music\\*" + OR Filesystem.file_path = "*\\Windows\\servicing\\*" OR Filesystem.file_path = "*\\Users\\Default\\*" + OR Filesystem.file_path = "*Recycle.bin*" OR Filesystem.file_path = "*\\Windows\\Media\\*" + OR Filesystem.file_path = "*\\Windows\\repair\\*" OR Filesystem.file_path = "*\\AppData\\Local\\Temp*") + by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `executables_or_script_creation_in_suspicious_path_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the Filesystem responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +known_false_positives: Administrators may allow creation of script or exe in the paths + specified. Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - XMRig @@ -74,5 +77,3 @@ tags: - _time risk_score: 56 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml index 25d9cff10a..af6ee5c042 100644 --- a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml +++ b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml @@ -1,25 +1,27 @@ +name: Execute Javascript With Jscript COM CLSID +id: dc64d064-d346-11eb-8588-acde48001122 +version: 1 +date: '2021-06-22' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-06-22' description: This analytic will identify suspicious process of cscript.exe where it tries to execute javascript using jscript.encode CLSID (COM OBJ). This technique was seen in ransomware (reddot ransomware) where it execute javascript with this com object with combination of amsi disabling technique. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Filesystem` node. -id: dc64d064-d346-11eb-8588-acde48001122 -known_false_positives: unknown -name: Execute Javascript With Jscript COM CLSID -references: -- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "cscript.exe" Processes.process="*-e:{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}*" by Processes.parent_process_name Processes.process_name Processes.process Processes.parent_process Processes.process_id Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `execute_javascript_with_jscript_com_clsid_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the Filesystem responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +known_false_positives: unknown +references: +- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ tags: analytic_story: - Ransomware @@ -72,5 +74,3 @@ tags: - _time risk_score: 56 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/execution_of_file_with_multiple_extensions.yml b/detections/endpoint/execution_of_file_with_multiple_extensions.yml index 4543fb47b9..21b9419fa4 100644 --- a/detections/endpoint/execution_of_file_with_multiple_extensions.yml +++ b/detections/endpoint/execution_of_file_with_multiple_extensions.yml @@ -1,24 +1,26 @@ +name: Execution of File with Multiple Extensions +id: b06a555e-dce0-417d-a2eb-28a5d8d66ef7 +version: 3 +date: '2020-11-18' author: Rico Valdez, Splunk +type: TTP datamodel: - Endpoint -date: '2020-11-18' description: This search looks for processes launched from files that have double extensions in the file name. This is typically done to obscure the "real" file extension and make it appear as though the file being accessed is a data file, as opposed to executable content. -how_to_implement: To successfully implement this search, you must be ingesting data - that records process activity from your hosts to populate the endpoint data model - in the processes node. -id: b06a555e-dce0-417d-a2eb-28a5d8d66ef7 -known_false_positives: None identified. -name: Execution of File with Multiple Extensions -references: [] search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*.doc.exe" OR Processes.process = "*.htm.exe" OR Processes.process = "*.html.exe" OR Processes.process - = "*.txt.exe" OR Processes.process = "*.pdf.exe" OR Processes.process = "*.doc.exe" by - Processes.dest Processes.user Processes.process Processes.parent_process | `security_content_ctime(firstTime)` + = "*.txt.exe" OR Processes.process = "*.pdf.exe" OR Processes.process = "*.doc.exe" + by Processes.dest Processes.user Processes.process Processes.parent_process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | `execution_of_file_with_multiple_extensions_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records process activity from your hosts to populate the endpoint data model + in the processes node. +known_false_positives: None identified. +references: [] tags: analytic_story: - Windows File Extension and Association Abuse @@ -72,5 +74,3 @@ tags: - _time risk_score: 56 security_domain: endpoint -type: TTP -version: 3 diff --git a/detections/endpoint/extraction_of_registry_hives.yml b/detections/endpoint/extraction_of_registry_hives.yml index ebd22c8081..e160103801 100644 --- a/detections/endpoint/extraction_of_registry_hives.yml +++ b/detections/endpoint/extraction_of_registry_hives.yml @@ -1,21 +1,15 @@ +name: Extraction of Registry Hives +id: 8bbb7d58-b360-11eb-ba21-acde48001122 +version: 2 +date: '2021-09-09' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-09' description: The following analytic identifies the use of `reg.exe` exporting Windows Registry hives containing credentials. Adversaries may use this technique to export registry hives for offline credential access attacks. Typically found executed from a untrusted process or script. Upon execution, a file will be written to disk. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: 8bbb7d58-b360-11eb-ba21-acde48001122 -known_false_positives: It is possible some agent based products will generate false - positives. Filter as needed. -name: Extraction of Registry Hives -references: -- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` (Processes.process=*save* OR Processes.process=*export*) AND (Processes.process="*\sam *" OR Processes.process="*\system @@ -23,6 +17,14 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `extraction_of_registry_hives_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: It is possible some agent based products will generate false + positives. Filter as needed. +references: +- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md tags: analytic_story: - DarkSide Ransomware @@ -72,5 +74,3 @@ tags: - _time risk_score: 56 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/file_with_samsam_extension.yml b/detections/endpoint/file_with_samsam_extension.yml index 0388de202f..5d52112dd5 100644 --- a/detections/endpoint/file_with_samsam_extension.yml +++ b/detections/endpoint/file_with_samsam_extension.yml @@ -1,18 +1,13 @@ +name: File with Samsam Extension +id: 02c6cfc2-ae66-4735-bfc7-6291da834cbf +version: 1 +date: '2018-12-14' author: Rico Valdez, Splunk +type: TTP datamodel: - Endpoint -date: '2018-12-14' description: The search looks for file writes with extensions consistent with a SamSam ransomware attack. -how_to_implement: You must be ingesting data that records file-system activity from - your hosts to populate the Endpoint file-system data-model node. If you are using - Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you - want to collect data. -id: 02c6cfc2-ae66-4735-bfc7-6291da834cbf -known_false_positives: Because these extensions are not typically used in normal operations, - you should investigate all results. -name: File with Samsam Extension -references: [] search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name | `drop_dm_object_name(Filesystem)` @@ -20,6 +15,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime field=file_name "(?\.[^\.]+)$" | search file_extension=.stubbin OR file_extension=.berkshire OR file_extension=.satoshi OR file_extension=.sophos OR file_extension=.keyxml | `file_with_samsam_extension_filter`' +how_to_implement: You must be ingesting data that records file-system activity from + your hosts to populate the Endpoint file-system data-model node. If you are using + Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you + want to collect data. +known_false_positives: Because these extensions are not typically used in normal operations, + you should investigate all results. +references: [] tags: analytic_story: - SamSam Ransomware @@ -67,5 +69,3 @@ tags: - _time risk_score: 90 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/firewall_allowed_program_enable.yml b/detections/endpoint/firewall_allowed_program_enable.yml index 54a1139c80..9d0557bc57 100644 --- a/detections/endpoint/firewall_allowed_program_enable.yml +++ b/detections/endpoint/firewall_allowed_program_enable.yml @@ -1,24 +1,16 @@ +name: Firewall Allowed Program Enable +id: 9a8f63a8-43ac-11ec-904c-acde48001122 +version: 1 +date: '2021-11-12' author: Teoderick Contreras, Splunk +type: Anomaly datamodel: - Endpoint -date: '2021-11-12' description: This analytic detects a potential suspicious modification of firewall rule allowing to execute specific application. This technique was identified when an adversary and red teams to bypassed firewall file execution restriction in a targetted host. Take note that this event or command can run by administrator during testing or allowing legitimate tool or application. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 9a8f63a8-43ac-11ec-904c-acde48001122 -known_false_positives: A network operator or systems administrator may utilize an - automated or manual execution of this firewall rule that may generate false positives. - Filter as needed. -name: Firewall Allowed Program Enable -references: -- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/# search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*firewall*" Processes.process = "*allowedprogram*" Processes.process = "*add*" Processes.process @@ -26,6 +18,16 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `firewall_allowed_program_enable_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: A network operator or systems administrator may utilize an + automated or manual execution of this firewall rule that may generate false positives. + Filter as needed. +references: +- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/# tags: analytic_story: - Windows Defense Evasion Tactics @@ -65,5 +67,3 @@ tags: - _time risk_score: 25 security_domain: endpoint -type: Anomaly -version: 1 diff --git a/detections/endpoint/fodhelper_uac_bypass.yml b/detections/endpoint/fodhelper_uac_bypass.yml index 0595f98934..17f85b901f 100644 --- a/detections/endpoint/fodhelper_uac_bypass.yml +++ b/detections/endpoint/fodhelper_uac_bypass.yml @@ -1,7 +1,11 @@ +name: FodHelper UAC Bypass +id: 909f8fd8-7ac8-11eb-a1f3-acde48001122 +version: 1 +date: '2021-03-01' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-03-01' description: 'Fodhelper.exe has a known UAC bypass as it attempts to look for specific registry keys upon execution, that do not exist. Therefore, an attacker can write its malicious commands in these registry keys to be executed by fodhelper.exe with @@ -16,22 +20,20 @@ description: 'Fodhelper.exe has a known UAC bypass as it attempts to look for sp Upon triage, fodhelper.exe will have a child process and read access will occur on the registry keys. Isolate the endpoint and review parallel processes for additional behavior.' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: 909f8fd8-7ac8-11eb-a1f3-acde48001122 -known_false_positives: Limited to no false positives are expected. -name: FodHelper UAC Bypass -references: -- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md -- https://github.com/gushmazuko/WinBypass/blob/master/FodhelperBypass.ps1 -- https://attack.mitre.org/techniques/T1548/002 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="fodhelper.exe" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `fodhelper_uac_bypass_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Limited to no false positives are expected. +references: +- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md +- https://github.com/gushmazuko/WinBypass/blob/master/FodhelperBypass.ps1 +- https://attack.mitre.org/techniques/T1548/002 tags: analytic_story: - Windows Defense Evasion Tactics @@ -84,5 +86,3 @@ tags: - _time risk_score: 81 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/fsutil_zeroing_file.yml b/detections/endpoint/fsutil_zeroing_file.yml index 3cb8543b2e..709f3e3f6b 100644 --- a/detections/endpoint/fsutil_zeroing_file.yml +++ b/detections/endpoint/fsutil_zeroing_file.yml @@ -1,25 +1,27 @@ +name: Fsutil Zeroing File +id: 4e5e024e-fabb-11eb-8b8f-acde48001122 +version: 1 +date: '2021-08-11' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-08-11' description: This search is to detect a suspicious fsutil process to zeroing a target file. This technique was seen in lockbit ransomware where it tries to zero out its malware path as part of its defense evasion after encrypting the compromised host. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: 4e5e024e-fabb-11eb-8b8f-acde48001122 -known_false_positives: unknown -name: Fsutil Zeroing File -references: -- https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/ search: '| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="fsutil.exe" Processes.process="*setzerodata*" by Processes.user Processes.process_name Processes.parent_process_name Processes.dest Processes.process Processes.parent_process | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `fsutil_zeroing_file_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/ tags: analytic_story: - Ransomware @@ -55,5 +57,3 @@ tags: - _time risk_score: 54 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml index c8c5d1c399..6be7030df3 100644 --- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml +++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml @@ -1,22 +1,15 @@ +name: Get ADDefaultDomainPasswordPolicy with Powershell +id: 36e46ebe-065a-11ec-b4c7-acde48001122 +version: 1 +date: '2021-08-26' author: Teoderick Contreras, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-08-26' description: This analytic looks for the execution of `powershell.exe` executing the Get-ADDefaultDomainPasswordPolicy commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -id: 36e46ebe-065a-11ec-b4c7-acde48001122 -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: Get ADDefaultDomainPasswordPolicy with Powershell -references: -- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet -- https://attack.mitre.org/techniques/T1201/ -- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2019-ps search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADDefaultDomainPasswordPolicy*" @@ -24,6 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_addefaultdomainpasswordpolicy_with_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +- https://attack.mitre.org/techniques/T1201/ +- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2019-ps tags: analytic_story: - Active Directory Discovery @@ -69,5 +71,3 @@ tags: - _time risk_score: 9 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml index 88566b239c..c30f841441 100644 --- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml +++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml @@ -1,25 +1,27 @@ -author: Teoderick Contreras, Mauricio Velazco, Splunk -datamodel: [] +name: Get ADDefaultDomainPasswordPolicy with Powershell Script Block +id: 1ff7ccc8-065a-11ec-91e4-acde48001122 +version: 1 date: '2021-08-26' +author: Teoderick Contreras, Mauricio Velazco, Splunk +type: Hunting +datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-ADDefaultDomainPasswordPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. -how_to_implement: The following Hunting analytic requires PowerShell operational logs - to be imported. Modify the powershell macro as needed to match the sourcetype or - add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -id: 1ff7ccc8-065a-11ec-91e4-acde48001122 -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: Get ADDefaultDomainPasswordPolicy with Powershell Script Block -references: -- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet -- https://attack.mitre.org/techniques/T1201/ -- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2019-ps search: '`powershell` EventCode=4104 Message ="*Get-ADDefaultDomainPasswordPolicy*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +- https://attack.mitre.org/techniques/T1201/ +- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2019-ps tags: analytic_story: - Active Directory Discovery @@ -58,5 +60,3 @@ tags: - User risk_score: 9 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/get_aduser_with_powershell.yml b/detections/endpoint/get_aduser_with_powershell.yml index b4a08567e2..8e2521e716 100644 --- a/detections/endpoint/get_aduser_with_powershell.yml +++ b/detections/endpoint/get_aduser_with_powershell.yml @@ -1,22 +1,15 @@ +name: Get ADUser with PowerShell +id: 0b6ee3f4-04e3-11ec-a87d-acde48001122 +version: 1 +date: '2021-08-24' author: Teoderick Contreras, Mauricio Velazco, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-08-24' description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to enumerate domain users. The `Get-AdUser' commandlet returns a list of all domain users. Red Teams and adversaries alike may use this commandlet to identify remote systems for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: 0b6ee3f4-04e3-11ec-a87d-acde48001122 -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: Get ADUser with PowerShell -references: -- https://www.blackhillsinfosec.com/red-blue-purple/ -- https://attack.mitre.org/techniques/T1087/002/ -- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2019-ps search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADUser*" @@ -24,6 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_aduser_with_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://www.blackhillsinfosec.com/red-blue-purple/ +- https://attack.mitre.org/techniques/T1087/002/ +- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2019-ps tags: analytic_story: - Active Directory Discovery @@ -70,5 +72,3 @@ tags: - _time risk_score: 25 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/get_aduser_with_powershell_script_block.yml b/detections/endpoint/get_aduser_with_powershell_script_block.yml index 69cb15e71b..d397ed710b 100644 --- a/detections/endpoint/get_aduser_with_powershell_script_block.yml +++ b/detections/endpoint/get_aduser_with_powershell_script_block.yml @@ -1,25 +1,27 @@ -author: Teoderick Contreras, Mauricio Velazco, Splunk -datamodel: [] +name: Get ADUser with PowerShell Script Block +id: 21432e40-04f4-11ec-b7e6-acde48001122 +version: 1 date: '2021-08-24' +author: Teoderick Contreras, Mauricio Velazco, Splunk +type: Hunting +datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-AdGUser` commandlet. The `Get-AdUser` commandlet is used to return a list of all domain users. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. -how_to_implement: The following Hunting analytic requires PowerShell operational logs - to be imported. Modify the powershell macro as needed to match the sourcetype or - add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -id: 21432e40-04f4-11ec-b7e6-acde48001122 -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: Get ADUser with PowerShell Script Block -references: -- https://www.blackhillsinfosec.com/red-blue-purple/ -- https://attack.mitre.org/techniques/T1087/002/ -- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2019-ps search: '`powershell` EventCode=4104 Message = "*get-aduser*" Message = "*-filter*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_aduser_with_powershell_script_block_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://www.blackhillsinfosec.com/red-blue-purple/ +- https://attack.mitre.org/techniques/T1087/002/ +- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2019-ps tags: analytic_story: - Active Directory Discovery @@ -58,5 +60,3 @@ tags: - User risk_score: 25 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml index 9bdfed2898..38c3992e05 100644 --- a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml +++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml @@ -1,22 +1,15 @@ +name: Get ADUserResultantPasswordPolicy with Powershell +id: 8b5ef342-065a-11ec-b0fc-acde48001122 +version: 1 +date: '2021-08-26' author: Teoderick Contreras, Mauricio Velazco, Splunk +type: TTP datamodel: - Endpoint -date: '2021-08-26' description: This analytic looks for the execution of `powershell.exe` executing the Get ADUserResultantPasswordPolicy commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -id: 8b5ef342-065a-11ec-b0fc-acde48001122 -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: Get ADUserResultantPasswordPolicy with Powershell -references: -- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet -- https://attack.mitre.org/techniques/T1201/ -- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduserresultantpasswordpolicy?view=windowsserver2019-ps search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADUserResultantPasswordPolicy*" @@ -24,6 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_aduserresultantpasswordpolicy_with_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +- https://attack.mitre.org/techniques/T1201/ +- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduserresultantpasswordpolicy?view=windowsserver2019-ps tags: analytic_story: - Active Directory Discovery @@ -69,5 +71,3 @@ tags: - _time risk_score: 25 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml index 392d075224..ec29fde4bf 100644 --- a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml +++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml @@ -1,25 +1,27 @@ -author: Teoderick Contreras, MAuricio Velazco, Splunk -datamodel: [] +name: Get ADUserResultantPasswordPolicy with Powershell Script Block +id: 737e1eb0-065a-11ec-921a-acde48001122 +version: 1 date: '2021-08-26' +author: Teoderick Contreras, MAuricio Velazco, Splunk +type: TTP +datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-ADUserResultantPasswordPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. -how_to_implement: The following Hunting analytic requires PowerShell operational logs - to be imported. Modify the powershell macro as needed to match the sourcetype or - add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -id: 737e1eb0-065a-11ec-921a-acde48001122 -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: Get ADUserResultantPasswordPolicy with Powershell Script Block -references: -- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet -- https://attack.mitre.org/techniques/T1201/ -- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduserresultantpasswordpolicy?view=windowsserver2019-ps search: '`powershell` EventCode=4104 Message ="*Get-ADUserResultantPasswordPolicy*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_aduserresultantpasswordpolicy_with_powershell_script_block_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +- https://attack.mitre.org/techniques/T1201/ +- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduserresultantpasswordpolicy?view=windowsserver2019-ps tags: analytic_story: - Active Directory Discovery @@ -58,5 +60,3 @@ tags: - User risk_score: 9 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/get_domainpolicy_with_powershell.yml b/detections/endpoint/get_domainpolicy_with_powershell.yml index 04797cb374..adda27c419 100644 --- a/detections/endpoint/get_domainpolicy_with_powershell.yml +++ b/detections/endpoint/get_domainpolicy_with_powershell.yml @@ -1,22 +1,15 @@ +name: Get DomainPolicy with Powershell +id: b8f9947e-065a-11ec-aafb-acde48001122 +version: 1 +date: '2021-08-26' author: Teoderick Contreras, Mauricio Velazco, Splunk +type: TTP datamodel: - Endpoint -date: '2021-08-26' description: This analytic looks for the execution of `powershell.exe` executing the `Get-DomainPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -id: b8f9947e-065a-11ec-aafb-acde48001122 -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: Get DomainPolicy with Powershell -references: -- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet -- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainPolicy/ -- https://attack.mitre.org/techniques/T1201/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*Get-DomainPolicy*" @@ -24,6 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domainpolicy_with_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainPolicy/ +- https://attack.mitre.org/techniques/T1201/ tags: analytic_story: - Active Directory Discovery @@ -69,5 +71,3 @@ tags: - _time risk_score: 30 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml index 72be6d20d4..bad551fecd 100644 --- a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml +++ b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml @@ -1,23 +1,25 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Get DomainPolicy with Powershell Script Block +id: a360d2b2-065a-11ec-b0bf-acde48001122 +version: 1 date: '2021-08-26' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get DomainPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. +search: '`powershell` EventCode=4104 Message ="*Get-DomainPolicy*" | stats count min(_time) + as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `get_domainpolicy_with_powershell_script_block_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -id: a360d2b2-065a-11ec-b0bf-acde48001122 known_false_positives: Administrators or power users may use this command for troubleshooting. -name: Get DomainPolicy with Powershell Script Block references: - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainPolicy/ - https://attack.mitre.org/techniques/T1201/ -search: '`powershell` EventCode=4104 Message ="*Get-DomainPolicy*" | stats count min(_time) - as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `get_domainpolicy_with_powershell_script_block_filter`' tags: analytic_story: - Active Directory Discovery @@ -55,5 +57,3 @@ tags: - User risk_score: 30 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/get_domaintrust_with_powershell.yml b/detections/endpoint/get_domaintrust_with_powershell.yml index 07b3f60639..79ab487869 100644 --- a/detections/endpoint/get_domaintrust_with_powershell.yml +++ b/detections/endpoint/get_domaintrust_with_powershell.yml @@ -1,29 +1,31 @@ +name: Get-DomainTrust with PowerShell +id: 4fa7f846-054a-11ec-a836-acde48001122 +version: 1 +date: '2021-08-24' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-08-24' description: This analytic identifies Get-DomainTrust from PowerView in order to gather domain trust information. Typically, this is utilized within a script being executed and used to enumerate the domain trust information. This grants the adversary an understanding of how large or small the domain is. During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 4fa7f846-054a-11ec-a836-acde48001122 -known_false_positives: Limited false positives as this requires an active Administrator - or adversary to bring in, import, and execute. -name: Get-DomainTrust with PowerShell -references: -- http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process=*get-domaintrust* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domaintrust_with_powershell_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Limited false positives as this requires an active Administrator + or adversary to bring in, import, and execute. +references: +- http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/ tags: analytic_story: - Active Directory Discovery @@ -65,5 +67,3 @@ tags: - _time risk_score: 12 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml index f790e1fc22..79507ce04c 100644 --- a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml +++ b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml @@ -1,6 +1,10 @@ -author: Michael Haag, Splunk -datamodel: [] +name: Get-DomainTrust with PowerShell Script Block +id: 89275e7e-0548-11ec-bf75-acde48001122 +version: 1 date: '2021-08-24' +author: Michael Haag, Splunk +type: TTP +datamodel: [] description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output @@ -13,22 +17,20 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.' +search: '`powershell` EventCode=4104 Message = "*get-foresttrust*" | stats count min(_time) + as firstTime max(_time) as lastTime by Message ComputerName User EventCode | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `get_domaintrust_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -id: 89275e7e-0548-11ec-bf75-acde48001122 known_false_positives: It is possible certain system management frameworks utilize this command to gather trust information. -name: Get-DomainTrust with PowerShell Script Block references: - http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/ - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ -search: '`powershell` EventCode=4104 Message = "*get-foresttrust*" | stats count min(_time) - as firstTime max(_time) as lastTime by Message ComputerName User EventCode | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `get_domaintrust_with_powershell_script_block_filter`' tags: analytic_story: - Active Directory Discovery @@ -71,5 +73,3 @@ tags: - _time risk_score: 12 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/get_domainuser_with_powershell.yml b/detections/endpoint/get_domainuser_with_powershell.yml index bc500f1374..f89536c90c 100644 --- a/detections/endpoint/get_domainuser_with_powershell.yml +++ b/detections/endpoint/get_domainuser_with_powershell.yml @@ -1,21 +1,16 @@ +name: Get DomainUser with PowerShell +id: 9a5a41d6-04e7-11ec-923c-acde48001122 +version: 1 +date: '2021-08-24' author: Teoderick Contreras, Mauricio Velazco, Splunk +type: TTP datamodel: - Endpoint -date: '2021-08-24' description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to enumerate domain users. `Get-DomainUser` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain users for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: 9a5a41d6-04e7-11ec-923c-acde48001122 -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: Get DomainUser with PowerShell -references: -- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*Get-DomainUser*" @@ -23,6 +18,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domainuser_with_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/ tags: analytic_story: - Active Directory Discovery @@ -69,5 +71,3 @@ tags: - _time risk_score: 25 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/get_domainuser_with_powershell_script_block.yml b/detections/endpoint/get_domainuser_with_powershell_script_block.yml index 0dfb83af8b..13d4985e27 100644 --- a/detections/endpoint/get_domainuser_with_powershell_script_block.yml +++ b/detections/endpoint/get_domainuser_with_powershell_script_block.yml @@ -1,22 +1,24 @@ -author: Teoderick Contreras, Mauricio Velazco, Splunk -datamodel: [] +name: Get DomainUser with PowerShell Script Block +id: 61994268-04f4-11ec-865c-acde48001122 +version: 1 date: '2021-08-24' +author: Teoderick Contreras, Mauricio Velazco, Splunk +type: TTP +datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainUser` commandlet. `GetDomainUser` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain users for situational awareness and Active Directory Discovery. -how_to_implement: The following Hunting analytic requires PowerShell operational logs - to be imported. Modify the powershell macro as needed to match the sourcetype or - add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -id: 61994268-04f4-11ec-865c-acde48001122 -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: Get DomainUser with PowerShell Script Block -references: -- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/ search: '`powershell` EventCode=4104 Message = "*Get-DomainUser*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domainuser_with_powershell_script_block_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/ tags: analytic_story: - Active Directory Discovery @@ -55,5 +57,3 @@ tags: - User risk_score: 25 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/get_foresttrust_with_powershell.yml b/detections/endpoint/get_foresttrust_with_powershell.yml index 53ab1d2790..4d75ef8667 100644 --- a/detections/endpoint/get_foresttrust_with_powershell.yml +++ b/detections/endpoint/get_foresttrust_with_powershell.yml @@ -1,30 +1,32 @@ +name: Get-ForestTrust with PowerShell +id: 584f4884-0bf1-11ec-a5ec-acde48001122 +version: 1 +date: '2021-09-02' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-02' description: This analytic identifies Get-ForestTrust from PowerSploit in order to gather domain trust information. Typically, this is utilized within a script being executed and used to enumerate the domain trust information. This grants the adversary an understanding of how large or small the domain is. During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 584f4884-0bf1-11ec-a5ec-acde48001122 -known_false_positives: Limited false positives as this requires an active Administrator - or adversary to bring in, import, and execute. -name: Get-ForestTrust with PowerShell -references: -- https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="powershell.exe" OR Processes.process_name="cmd.exe" Processes.process="*get-foresttrust*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_foresttrust_with_powershell_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Limited false positives as this requires an active Administrator + or adversary to bring in, import, and execute. +references: +- https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/ tags: analytic_story: - Active Directory Discovery @@ -66,5 +68,3 @@ tags: - _time risk_score: 12 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/get_foresttrust_with_powershell_script_block.yml b/detections/endpoint/get_foresttrust_with_powershell_script_block.yml index c38d2e153c..d29cb79513 100644 --- a/detections/endpoint/get_foresttrust_with_powershell_script_block.yml +++ b/detections/endpoint/get_foresttrust_with_powershell_script_block.yml @@ -1,6 +1,10 @@ -author: Michael Haag, Splunk -datamodel: [] +name: Get-ForestTrust with PowerShell Script Block +id: 70fac80e-0bf1-11ec-9ba0-acde48001122 +version: 1 date: '2021-09-02' +author: Michael Haag, Splunk +type: TTP +datamodel: [] description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output @@ -13,17 +17,15 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.' -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -id: 70fac80e-0bf1-11ec-9ba0-acde48001122 -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES -name: Get-ForestTrust with PowerShell Script Block -references: -- https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/ search: '`powershell` EventCode=4104 Message = "*get-foresttrust*" | stats count min(_time) as firstTime max(_time) as lastTime by Message OpCode ComputerName User EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_foresttrust_with_powershell_script_block_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/ tags: analytic_story: - Active Directory Discovery @@ -63,5 +65,3 @@ tags: - _time risk_score: 12 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/get_parent_process_info.yml b/detections/endpoint/get_parent_process_info.yml index 425e83f199..1003bff5e7 100644 --- a/detections/endpoint/get_parent_process_info.yml +++ b/detections/endpoint/get_parent_process_info.yml @@ -1,23 +1,25 @@ +name: Get Parent Process Info +id: fecf2918-670d-4f1c-872b-3d7317a41bf9 +version: 2 +date: '2019-02-28' author: Bhavin Patel, Splunk +type: Investigation datamodel: - Endpoint -date: '2019-02-28' description: This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest -how_to_implement: You must be ingesting endpoint data that tracks process activity, - including parent-child relationships from your endpoints to populate the Endpoint - data model in the Processes node. The command-line arguments are mapped to the "process" - field in the Endpoint data model. -id: fecf2918-670d-4f1c-872b-3d7317a41bf9 -known_false_positives: '' -name: Get Parent Process Info -references: [] search: '| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name("Processes")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' +how_to_implement: You must be ingesting endpoint data that tracks process activity, + including parent-child relationships from your endpoints to populate the Endpoint + data model in the Processes node. The command-line arguments are mapped to the "process" + field in the Endpoint data model. +known_false_positives: '' +references: [] tags: analytic_story: - Collection and Staging @@ -58,5 +60,3 @@ tags: - Endpoint.Processes.user - _time security_domain: endpoint -type: Investigation -version: 2 diff --git a/detections/endpoint/get_process_file_activity.yml b/detections/endpoint/get_process_file_activity.yml index d43f96eb0d..9a8e6e21de 100644 --- a/detections/endpoint/get_process_file_activity.yml +++ b/detections/endpoint/get_process_file_activity.yml @@ -1,21 +1,23 @@ +name: Get Process File Activity +id: 6a9ad4d9-6ef2-4b85-953f-a37ab256acd5 +version: 2 +date: '2019-11-06' author: David Dorsey, Splunk +type: Investigation datamodel: - Endpoint -date: '2019-11-06' description: This search returns the file activity for a specific process on a specific endpoint -how_to_implement: To successfully implement this search you must be ingesting endpoint - data and populating the Endpoint data model. -id: 6a9ad4d9-6ef2-4b85-953f-a37ab256acd5 -known_false_positives: '' -name: Get Process File Activity -references: [] search: '| tstats `security_content_summariesonly` values(Filesystem.file_name) as file_name values(Filesystem.dest) as dest, values(Filesystem.process_name) as process_name from datamodel=Endpoint.Filesystem by Filesystem.dest Filesystem.process_name Filesystem.file_path, Filesystem.action, _time | `drop_dm_object_name(Filesystem)` | search dest=$dest$ | search process_name=$process_name$ | table _time, process_name, dest, action, file_name, file_path' +how_to_implement: To successfully implement this search you must be ingesting endpoint + data and populating the Endpoint data model. +known_false_positives: '' +references: [] tags: analytic_story: - DHS Report TA18-074A @@ -29,5 +31,3 @@ tags: - Endpoint.Filesystem.file_path - _time security_domain: endpoint -type: Investigation -version: 2 diff --git a/detections/endpoint/get_process_info.yml b/detections/endpoint/get_process_info.yml index 233af6a9d6..43c1cb92d1 100644 --- a/detections/endpoint/get_process_info.yml +++ b/detections/endpoint/get_process_info.yml @@ -1,21 +1,23 @@ +name: Get Process Info +id: bc91a8cf-35e7-4bb2-8140-e756cc06fd71 +version: 2 +date: '2019-04-01' author: Bhavin Patel, Splunk +type: Investigation datamodel: - Endpoint -date: '2019-04-01' description: This search queries the Endpoint data model to give you details about the process running on a host which is under investigation. To gather the process info, enter the values for the process name in question and the destination IP address. -how_to_implement: To successfully implement this search you must be ingesting endpoint - data and populating the Endpoint data model. -id: bc91a8cf-35e7-4bb2-8140-e756cc06fd71 -known_false_positives: '' -name: Get Process Info -references: [] search: '| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name("Processes")` | search process_name= $process_name$ | search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' +how_to_implement: To successfully implement this search you must be ingesting endpoint + data and populating the Endpoint data model. +known_false_positives: '' +references: [] tags: analytic_story: - AWS Network ACL Activity @@ -58,5 +60,3 @@ tags: - Endpoint.Processes.user - _time security_domain: endpoint -type: Investigation -version: 2 diff --git a/detections/endpoint/get_process_information_for_port_activity.yml b/detections/endpoint/get_process_information_for_port_activity.yml index 5fe5a076b3..8044734d7a 100644 --- a/detections/endpoint/get_process_information_for_port_activity.yml +++ b/detections/endpoint/get_process_information_for_port_activity.yml @@ -1,15 +1,13 @@ +name: Get Process Information For Port Activity +id: 9925d08f-561e-4faa-8912-e3888a842341 +version: 2 +date: '2019-04-01' author: Bhavin Patel, Splunk +type: Investigation datamodel: - Endpoint -date: '2019-04-01' description: This search will return information about the process associated with observed network traffic to a specific destination port from a specific host. -how_to_implement: To successfully implement this search you must be ingesting endpoint - data that associates processes with network events and populate the Endpoint Datamodel -id: 9925d08f-561e-4faa-8912-e3888a842341 -known_false_positives: '' -name: Get Process Information For Port Activity -references: [] search: '| tstats `security_content_summariesonly` count min(_time) max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.process_name Processes.user Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` @@ -17,6 +15,10 @@ search: '| tstats `security_content_summariesonly` count min(_time) max(_time) a [| tstats `security_content_summariesonly` count from datamodel=Endpoint.Ports by Ports.process_id Ports.src Ports.dest_port | `drop_dm_object_name(Ports)` | search dest_port=$dest_port$ | rename src as dest]' +how_to_implement: To successfully implement this search you must be ingesting endpoint + data that associates processes with network events and populate the Endpoint Datamodel +known_false_positives: '' +references: [] tags: analytic_story: - AWS Network ACL Activity @@ -42,5 +44,3 @@ tags: - Endpoint.Processes.user - _time security_domain: endpoint -type: Investigation -version: 2 diff --git a/detections/endpoint/get_process_responsible_for_the_dns_traffic.yml b/detections/endpoint/get_process_responsible_for_the_dns_traffic.yml index 09719b6e97..4aec736fea 100644 --- a/detections/endpoint/get_process_responsible_for_the_dns_traffic.yml +++ b/detections/endpoint/get_process_responsible_for_the_dns_traffic.yml @@ -1,18 +1,15 @@ +name: Get Process Responsible For The DNS Traffic +id: 910e6512-edc9-4f93-ba24-5b786f47a672 +version: 2 +date: '2019-04-01' author: Bhavin Patel, Splunk +type: Investigation datamodel: - Endpoint -date: '2019-04-01' description: While investigating, an analyst will want to know what process and parent_process is responsible for generating suspicious DNS traffic. Use the following search and enter the value of `dest` in the search to get specific details on the process responsible for creating the DNS traffic. -how_to_implement: You must be ingesting endpoint data that associates processes with - network events into the Endpoint datamodel. This can come from endpoint protection - products such as carbon black, or endpoint data sources such as Sysmon. -id: 910e6512-edc9-4f93-ba24-5b786f47a672 -known_false_positives: '' -name: Get Process Responsible For The DNS Traffic -references: [] search: '| tstats `security_content_summariesonly` count min(_time) max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.parent_process Processes.process_name Processes.user Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` @@ -20,6 +17,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) max(_time) a dest = $dest$ | join dest type=inner [| tstats `security_content_summariesonly` count from datamodel=Endpoint.Ports where Ports.dest_port=53 by Ports.process_id Ports.src | `drop_dm_object_name(Ports)` | rename src as dest]' +how_to_implement: You must be ingesting endpoint data that associates processes with + network events into the Endpoint datamodel. This can come from endpoint protection + products such as carbon black, or endpoint data sources such as Sysmon. +known_false_positives: '' +references: [] tags: analytic_story: - AWS Network ACL Activity @@ -43,5 +45,3 @@ tags: - Endpoint.Processes.user - _time security_domain: endpoint -type: Investigation -version: 2 diff --git a/detections/endpoint/get_wmiobject_group_discovery.yml b/detections/endpoint/get_wmiobject_group_discovery.yml index 747ccd95db..6254ef1a75 100644 --- a/detections/endpoint/get_wmiobject_group_discovery.yml +++ b/detections/endpoint/get_wmiobject_group_discovery.yml @@ -1,23 +1,16 @@ +name: Get WMIObject Group Discovery +id: 5434f670-155d-11ec-8cca-acde48001122 +version: 1 +date: '2021-09-14' author: Michael Haag, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-09-14' description: The following hunting analytic identifies the use of `Get-WMIObject Win32_Group` being used with PowerShell to identify local groups on the endpoint. \ Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ During triage, review parallel processes and identify any further suspicious behavior. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 5434f670-155d-11ec-8cca-acde48001122 -known_false_positives: False positives may be present. Tune as needed. -name: Get WMIObject Group Discovery -references: -- https://attack.mitre.org/techniques/T1069/001/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe" OR Processes.process_name="cmd.exe") (Processes.process="*Get-WMIObject*" AND Processes.process="*Win32_Group*") @@ -25,6 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `get_wmiobject_group_discovery_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives may be present. Tune as needed. +references: +- https://attack.mitre.org/techniques/T1069/001/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md tags: analytic_story: - Active Directory Discovery @@ -68,5 +70,3 @@ tags: - _time risk_score: 15 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml b/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml index c234f36c5e..efe84d58fb 100644 --- a/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml +++ b/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml @@ -53,13 +53,13 @@ tags: - T1069.001 observable: - name: dest + role: + - Victim type: Endpoint - role: - - Victim - name: user - type: User role: - Victim + type: User product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/getadcomputer_with_powershell.yml b/detections/endpoint/getadcomputer_with_powershell.yml index bce094ce71..586e1b7af5 100644 --- a/detections/endpoint/getadcomputer_with_powershell.yml +++ b/detections/endpoint/getadcomputer_with_powershell.yml @@ -1,25 +1,27 @@ +name: GetAdComputer with PowerShell +id: c5a31f80-5888-4d81-9f78-1cc65026316e +version: 1 +date: '2021-09-07' author: Mauricio Velazco, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-09-07' description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. The `Get-AdComputer' commandlet returns a list of all domain computers. Red Teams and adversaries alike may use this commandlet to identify remote systems for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: c5a31f80-5888-4d81-9f78-1cc65026316e -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: GetAdComputer with PowerShell -references: -- https://attack.mitre.org/techniques/T1018/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-AdComputer*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getadcomputer_with_powershell_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1018/ tags: analytic_story: - Active Directory Discovery @@ -56,5 +58,3 @@ tags: - Endpoint.Processes.user risk_score: 15 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/getadcomputer_with_powershell_script_block.yml b/detections/endpoint/getadcomputer_with_powershell_script_block.yml index e769826d92..b7073645bb 100644 --- a/detections/endpoint/getadcomputer_with_powershell_script_block.yml +++ b/detections/endpoint/getadcomputer_with_powershell_script_block.yml @@ -1,24 +1,26 @@ -author: Mauricio Velazco, Splunk -datamodel: [] +name: GetAdComputer with PowerShell Script Block +id: a9a1da02-8e27-4bf7-a348-f4389c9da487 +version: 1 date: '2021-09-01' +author: Mauricio Velazco, Splunk +type: Hunting +datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-AdGroup` commandlet. The `Get-AdGroup` commandlet is used to return a list of all domain computers. Red Teams and adversaries may leverage this commandlet to enumerate domain computers for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -id: a9a1da02-8e27-4bf7-a348-f4389c9da487 -known_false_positives: Administrators or power users may use this PowerShell commandlet - for troubleshooting. -name: GetAdComputer with PowerShell Script Block -references: -- https://attack.mitre.org/techniques/T1018/ -- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps search: '`powershell` EventCode=4104 (Message = "*Get-AdComputer*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getadcomputer_with_powershell_script_block_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators or power users may use this PowerShell commandlet + for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1018/ +- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps tags: analytic_story: - Active Directory Discovery @@ -53,5 +55,3 @@ tags: - User risk_score: 15 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/getadgroup_with_powershell.yml b/detections/endpoint/getadgroup_with_powershell.yml index 40d14df78a..5553a6586c 100644 --- a/detections/endpoint/getadgroup_with_powershell.yml +++ b/detections/endpoint/getadgroup_with_powershell.yml @@ -1,27 +1,29 @@ +name: GetAdGroup with PowerShell +id: 872e3063-0fc4-4e68-b2f3-f2b99184a708 +version: 1 +date: '2021-08-25' author: Mauricio Velazco, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-08-25' description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. The `Get-AdGroup` commandlnet is used to return a list of all groups available in a Windows Domain. Red Teams and adversaries alike may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: 872e3063-0fc4-4e68-b2f3-f2b99184a708 -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: GetAdGroup with PowerShell -references: -- https://attack.mitre.org/techniques/T1069/002/ -- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-AdGroup*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getadgroup_with_powershell_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps tags: analytic_story: - Active Directory Discovery @@ -59,5 +61,3 @@ tags: - Endpoint.Processes.user risk_score: 15 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/getadgroup_with_powershell_script_block.yml b/detections/endpoint/getadgroup_with_powershell_script_block.yml index 6c714d7768..43868d487a 100644 --- a/detections/endpoint/getadgroup_with_powershell_script_block.yml +++ b/detections/endpoint/getadgroup_with_powershell_script_block.yml @@ -1,24 +1,26 @@ -author: Mauricio Velazco, Splunk -datamodel: [] +name: GetAdGroup with PowerShell Script Block +id: e4c73d68-794b-468d-b4d0-dac1772bbae7 +version: 1 date: '2021-08-25' +author: Mauricio Velazco, Splunk +type: Hunting +datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-AdGroup` commandlet. The `Get-AdGroup` commandlet is used to return a list of all domain groups. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -id: e4c73d68-794b-468d-b4d0-dac1772bbae7 -known_false_positives: Administrators or power users may use this PowerShell commandlet - for troubleshooting. -name: GetAdGroup with PowerShell Script Block -references: -- https://attack.mitre.org/techniques/T1069/002/ -- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps search: '`powershell` EventCode=4104 (Message = "*Get-ADGroup*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getadgroup_with_powershell_script_block_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators or power users may use this PowerShell commandlet + for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps tags: analytic_story: - Active Directory Discovery @@ -54,5 +56,3 @@ tags: - User risk_score: 15 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/getcurrent_user_with_powershell.yml b/detections/endpoint/getcurrent_user_with_powershell.yml index b11084cd64..6614738843 100644 --- a/detections/endpoint/getcurrent_user_with_powershell.yml +++ b/detections/endpoint/getcurrent_user_with_powershell.yml @@ -1,26 +1,28 @@ +name: GetCurrent User with PowerShell +id: 7eb9c3d5-c98c-4088-acc5-8240bad15379 +version: 1 +date: '2021-09-13' author: Mauricio Velazco, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-09-13' description: This analytic looks for the execution of `powerhsell.exe` with command-line arguments that execute the `GetCurrent` method of the WindowsIdentity .NET class. This method returns an object that represents the current Windows user. Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: 7eb9c3d5-c98c-4088-acc5-8240bad15379 -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: GetCurrent User with PowerShell -references: -- https://attack.mitre.org/techniques/T1033/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process="*System.Security.Principal.WindowsIdentity*" OR Processes.process="*GetCurrent()*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getcurrent_user_with_powershell_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1033/ tags: analytic_story: - Active Directory Discovery @@ -58,5 +60,3 @@ tags: - _time risk_score: 15 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml index 44a50c4b45..f914a43a9a 100644 --- a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml +++ b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml @@ -1,25 +1,27 @@ -author: Mauricio Velazco, Splunk -datamodel: [] +name: GetCurrent User with PowerShell Script Block +id: 80879283-c30f-44f7-8471-d1381f6d437a +version: 1 date: '2021-09-13' +author: Mauricio Velazco, Splunk +type: Hunting +datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `GetCurrent` method of the WindowsIdentity .NET class. This method returns an object that represents the current Windows user. Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -id: 80879283-c30f-44f7-8471-d1381f6d437a -known_false_positives: Administrators or power users may use this PowerShell commandlet - for troubleshooting. -name: GetCurrent User with PowerShell Script Block -references: -- https://attack.mitre.org/techniques/T1033/ -- https://docs.microsoft.com/en-us/dotnet/api/system.security.principal.windowsidentity.getcurrent?view=net-5.0 search: '`powershell` EventCode=4104 (Message = "*[System.Security.Principal.WindowsIdentity]*" AND Message = "*GetCurrent()*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getcurrent_user_with_powershell_script_block_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators or power users may use this PowerShell commandlet + for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1033/ +- https://docs.microsoft.com/en-us/dotnet/api/system.security.principal.windowsidentity.getcurrent?view=net-5.0 tags: analytic_story: - Active Directory Discovery @@ -54,5 +56,3 @@ tags: - _time risk_score: 15 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/getdomaincomputer_with_powershell.yml b/detections/endpoint/getdomaincomputer_with_powershell.yml index f470c3a074..7e0965356b 100644 --- a/detections/endpoint/getdomaincomputer_with_powershell.yml +++ b/detections/endpoint/getdomaincomputer_with_powershell.yml @@ -1,26 +1,28 @@ +name: GetDomainComputer with PowerShell +id: ed550c19-712e-43f6-bd19-6f58f61b3a5e +version: 1 +date: '2021-09-07' author: Mauricio Velazco, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-07' description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. `Get-DomainComputer` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain groups for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: ed550c19-712e-43f6-bd19-6f58f61b3a5e -known_false_positives: Administrators or power users may use PowerView for troubleshooting. -name: GetDomainComputer with PowerShell -references: -- https://attack.mitre.org/techniques/T1018/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-DomainComputer*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getdomaincomputer_with_powershell_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use PowerView for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1018/ tags: analytic_story: - Active Directory Discovery @@ -57,5 +59,3 @@ tags: - Endpoint.Processes.user risk_score: 24 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml b/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml index 717136402c..e6fc06f3e8 100644 --- a/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml +++ b/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml @@ -1,23 +1,25 @@ -author: Mauricio Velazco, Splunk -datamodel: [] +name: GetDomainComputer with PowerShell Script Block +id: f64da023-b988-4775-8d57-38e512beb56e +version: 1 date: '2021-09-02' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainComputer` commandlet. `GetDomainComputer` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain computers for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -id: f64da023-b988-4775-8d57-38e512beb56e -known_false_positives: Administrators or power users may use PowerView for troubleshooting. -name: GetDomainComputer with PowerShell Script Block -references: -- https://attack.mitre.org/techniques/T1018/ -- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainComputer/ search: '`powershell` EventCode=4104 (Message = "*Get-DomainComputer*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getdomaincomputer_with_powershell_script_block_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators or power users may use PowerView for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1018/ +- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainComputer/ tags: analytic_story: - Active Directory Discovery @@ -52,5 +54,3 @@ tags: - User risk_score: 24 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/getdomaincontroller_with_powershell.yml b/detections/endpoint/getdomaincontroller_with_powershell.yml index 1057ed0cc4..85188fa504 100644 --- a/detections/endpoint/getdomaincontroller_with_powershell.yml +++ b/detections/endpoint/getdomaincontroller_with_powershell.yml @@ -1,27 +1,29 @@ +name: GetDomainController with PowerShell +id: 868ee0e4-52ab-484a-833a-6d85b7c028d0 +version: 1 +date: '2021-09-07' author: Mauricio Velazco, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-09-07' description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. `Get-DomainController` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain groups for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: 868ee0e4-52ab-484a-833a-6d85b7c028d0 -known_false_positives: Administrators or power users may use PowerView for troubleshooting. -name: GetDomainController with PowerShell -references: -- https://attack.mitre.org/techniques/T1018/ -- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainController/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-DomainController*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getdomaincontroller_with_powershell_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use PowerView for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1018/ +- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainController/ tags: analytic_story: - Active Directory Discovery @@ -58,5 +60,3 @@ tags: - Endpoint.Processes.user risk_score: 24 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml b/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml index 430ff23487..b3ef74b9a8 100644 --- a/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml +++ b/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml @@ -1,24 +1,26 @@ -author: Mauricio Velazco, Splunk -datamodel: [] +name: GetDomainController with PowerShell Script Block +id: 676b600a-a94d-4951-b346-11329431e6c1 +version: 1 date: '2021-09-02' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainController` commandlet. `Get-DomainController` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain computers for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -id: 676b600a-a94d-4951-b346-11329431e6c1 -known_false_positives: Administrators or power users may use this PowerShell commandlet - for troubleshooting. -name: GetDomainController with PowerShell Script Block -references: -- https://attack.mitre.org/techniques/T1018/ -- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainController/ search: '`powershell` EventCode=4104 (Message = "*Get-DomainController*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getdomaincontroller_with_powershell_script_block_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators or power users may use this PowerShell commandlet + for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1018/ +- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainController/ tags: analytic_story: - Active Directory Discovery @@ -53,5 +55,3 @@ tags: - User risk_score: 24 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/getdomaingroup_with_powershell.yml b/detections/endpoint/getdomaingroup_with_powershell.yml index ca737e75ed..85b39b1bbd 100644 --- a/detections/endpoint/getdomaingroup_with_powershell.yml +++ b/detections/endpoint/getdomaingroup_with_powershell.yml @@ -1,27 +1,29 @@ +name: GetDomainGroup with PowerShell +id: 93c94be3-bead-4a60-860f-77ca3fe59903 +version: 1 +date: '2021-08-25' author: Mauricio Velazco, Splunk +type: TTP datamodel: - Endpoint -date: '2021-08-25' description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. `Get-DomainGroup` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain groups for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: 93c94be3-bead-4a60-860f-77ca3fe59903 -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: GetDomainGroup with PowerShell -references: -- https://attack.mitre.org/techniques/T1069/002/ -- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroup/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-DomainGroup*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getdomaingroup_with_powershell_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroup/ tags: analytic_story: - Active Directory Discovery @@ -59,5 +61,3 @@ tags: - Endpoint.Processes.user risk_score: 15 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml index be5ccdc1f6..5b87ec7033 100644 --- a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml +++ b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml @@ -1,25 +1,27 @@ -author: Mauricio Velazco, Splunk -datamodel: [] +name: GetDomainGroup with PowerShell Script Block +id: 09725404-a44f-4ed3-9efa-8ed5d69e4c53 +version: 1 date: '2021-08-26' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainGroup` commandlet. `Get-DomainGroup` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. As the name suggests, `Get-DomainGroup` is used to query domain groups. Red Teams and adversaries may leverage this function to enumerate domain groups for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -id: 09725404-a44f-4ed3-9efa-8ed5d69e4c53 -known_false_positives: Administrators or power users may use this PowerView functions - for troubleshooting. -name: GetDomainGroup with PowerShell Script Block -references: -- https://attack.mitre.org/techniques/T1069/002/ -- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroup/ search: '`powershell` EventCode=4104 (Message = "*Get-DomainGroup*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getdomaingroup_with_powershell_script_block_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators or power users may use this PowerView functions + for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroup/ tags: analytic_story: - Active Directory Discovery @@ -55,5 +57,3 @@ tags: - User risk_score: 15 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/getlocaluser_with_powershell.yml b/detections/endpoint/getlocaluser_with_powershell.yml index cfb7f15c64..cae66df314 100644 --- a/detections/endpoint/getlocaluser_with_powershell.yml +++ b/detections/endpoint/getlocaluser_with_powershell.yml @@ -1,26 +1,28 @@ +name: GetLocalUser with PowerShell +id: 85fae8fa-0427-11ec-8b78-acde48001122 +version: 1 +date: '2021-08-23' author: Mauricio Velazco, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-08-23' description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for local users. The `Get-LocalUser` commandlet is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: 85fae8fa-0427-11ec-8b78-acde48001122 -known_false_positives: Administrators or power users may use this PowerShell commandlet - for troubleshooting. -name: GetLocalUser with PowerShell -references: -- https://attack.mitre.org/techniques/T1087/001/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-LocalUser*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getlocaluser_with_powershell_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this PowerShell commandlet + for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1087/001/ tags: analytic_story: - Active Directory Discovery @@ -58,5 +60,3 @@ tags: - _time risk_score: 15 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/getlocaluser_with_powershell_script_block.yml b/detections/endpoint/getlocaluser_with_powershell_script_block.yml index 5b67f77589..198186cf8a 100644 --- a/detections/endpoint/getlocaluser_with_powershell_script_block.yml +++ b/detections/endpoint/getlocaluser_with_powershell_script_block.yml @@ -1,23 +1,25 @@ -author: Mauricio Velazco, Splunk -datamodel: [] +name: GetLocalUser with PowerShell Script Block +id: 2e891cbe-0426-11ec-9c9c-acde48001122 +version: 1 date: '2021-08-23' +author: Mauricio Velazco, Splunk +type: Hunting +datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-LocalUser` commandlet. The `Get-LocalUser` commandlet is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -id: 2e891cbe-0426-11ec-9c9c-acde48001122 -known_false_positives: Administrators or power users may use this PowerShell commandlet - for troubleshooting. -name: GetLocalUser with PowerShell Script Block -references: -- https://attack.mitre.org/techniques/T1087/001/ search: '`powershell` EventCode=4104 (Message = "*Get-LocalUser*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getlocaluser_with_powershell_script_block_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators or power users may use this PowerShell commandlet + for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1087/001/ tags: analytic_story: - Active Directory Discovery @@ -48,5 +50,3 @@ tags: - _time risk_score: 15 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/getnettcpconnection_with_powershell.yml b/detections/endpoint/getnettcpconnection_with_powershell.yml index af883db6ba..84731fb570 100644 --- a/detections/endpoint/getnettcpconnection_with_powershell.yml +++ b/detections/endpoint/getnettcpconnection_with_powershell.yml @@ -1,26 +1,28 @@ +name: GetNetTcpconnection with PowerShell +id: e02af35c-1de5-4afe-b4be-f45aba57272b +version: 1 +date: '2021-08-25' author: Mauricio Velazco, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-08-25' description: This analytic looks for the execution of `powershell.exe` with command-line utilized to get a listing of network connections on a compromised system. The `Get-NetTcpConnection` commandlet lists the current TCP connections. Red Teams and adversaries alike may use this commandlet for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: e02af35c-1de5-4afe-b4be-f45aba57272b -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: GetNetTcpconnection with PowerShell -references: -- https://attack.mitre.org/techniques/T1049/ -- https://docs.microsoft.com/en-us/powershell/module/nettcpip/get-nettcpconnection?view=windowsserver2019-ps search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-NetTcpConnection*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getnettcpconnection_with_powershell_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1049/ +- https://docs.microsoft.com/en-us/powershell/module/nettcpip/get-nettcpconnection?view=windowsserver2019-ps tags: analytic_story: - Active Directory Discovery @@ -57,5 +59,3 @@ tags: - Endpoint.Processes.user risk_score: 15 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml b/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml index 69f5579dc9..aea2e9c6c4 100644 --- a/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml +++ b/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml @@ -1,24 +1,26 @@ -author: Mauricio Velazco, Splunk -datamodel: [] +name: GetNetTcpconnection with PowerShell Script Block +id: 091712ff-b02a-4d43-82ed-34765515d95d +version: 1 date: '2021-09-10' +author: Mauricio Velazco, Splunk +type: Hunting +datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-NetTcpconnection ` commandlet. This commandlet is used to return a listing of network connections on a compromised system. Red Teams and adversaries alike may use this commandlet for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -id: 091712ff-b02a-4d43-82ed-34765515d95d -known_false_positives: Administrators or power users may use this PowerShell commandlet - for troubleshooting. -name: GetNetTcpconnection with PowerShell Script Block -references: -- https://attack.mitre.org/techniques/T1049/ -- https://docs.microsoft.com/en-us/powershell/module/nettcpip/get-nettcpconnection?view=windowsserver2019-ps search: '`powershell` EventCode=4104 (Message = "*Get-NetTcpconnection*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getnettcpconnection_with_powershell_script_block_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators or power users may use this PowerShell commandlet + for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1049/ +- https://docs.microsoft.com/en-us/powershell/module/nettcpip/get-nettcpconnection?view=windowsserver2019-ps tags: analytic_story: - Active Directory Discovery @@ -53,5 +55,3 @@ tags: - User risk_score: 15 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml b/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml index ef3f7e55e6..faabeaeed9 100644 --- a/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml @@ -1,20 +1,16 @@ +name: GetWmiObject Ds Computer with PowerShell +id: 7141122c-3bc2-4aaa-ab3b-7a85a0bbefc3 +version: 1 +date: '2021-09-07' author: Mauricio Velazco, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-07' description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. The `Get-WmiObject` commandlet combined with the `DS_Computer` parameter can be used to return a list of all domain computers. Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, to enumerate domain groups for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: 7141122c-3bc2-4aaa-ab3b-7a85a0bbefc3 -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: GetWmiObject Ds Computer with PowerShell -references: -- https://attack.mitre.org/techniques/T1018/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-WmiObject* AND Processes.process="*namespace root\\directory\\ldap*" @@ -22,6 +18,12 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_ds_computer_with_powershell_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1018/ tags: analytic_story: - Active Directory Discovery @@ -58,5 +60,3 @@ tags: - Endpoint.Processes.user risk_score: 21 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml index 1f266f6562..a624af20d3 100644 --- a/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml @@ -1,25 +1,27 @@ -author: Mauricio Velazco, Splunk -datamodel: [] +name: GetWmiObject Ds Computer with PowerShell Script Block +id: 29b99201-723c-4118-847a-db2b3d3fb8ea +version: 1 date: '2021-09-01' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet. The `DS_Computer` class parameter leverages WMI to query for all domain computers. Red Teams and adversaries may leverage this commandlet to enumerate domain computers for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -id: 29b99201-723c-4118-847a-db2b3d3fb8ea -known_false_positives: Administrators or power users may use this PowerShell commandlet - for troubleshooting. -name: GetWmiObject Ds Computer with PowerShell Script Block -references: -- https://attack.mitre.org/techniques/T1018/ -- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1 search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"namespace root\\directory\\ldap"* AND Message=*"class ds_computer"*) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getwmiobject_ds_computer_with_powershell_script_block_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators or power users may use this PowerShell commandlet + for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1018/ +- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1 tags: analytic_story: - Active Directory Discovery @@ -54,5 +56,3 @@ tags: - User risk_score: 15 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell.yml index a0d4e58321..b5f7fb1447 100644 --- a/detections/endpoint/getwmiobject_ds_group_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_group_with_powershell.yml @@ -1,22 +1,17 @@ +name: GetWmiObject Ds Group with PowerShell +id: df275a44-4527-443b-b884-7600e066e3eb +version: 1 +date: '2021-08-25' author: Mauricio Velazco, Splunk +type: TTP datamodel: - Endpoint -date: '2021-08-25' description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. The `Get-WmiObject` commandlet combined with the `-class ds_group` parameter can be used to return the full list of groups in a Windows domain. Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, to enumerate domain groups for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: df275a44-4527-443b-b884-7600e066e3eb -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: GetWmiObject Ds Group with PowerShell -references: -- https://attack.mitre.org/techniques/T1069/002/ -- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-WmiObject* AND Processes.process="*namespace root\\directory\\ldap*" @@ -24,6 +19,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_ds_group_with_powershell_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1 tags: analytic_story: - Active Directory Discovery @@ -61,5 +63,3 @@ tags: - Endpoint.Processes.user risk_score: 15 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml index 650d6c9aed..b3f26ec5c4 100644 --- a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml @@ -1,25 +1,27 @@ -author: Mauricio Velazco, Splunk -datamodel: [] +name: GetWmiObject Ds Group with PowerShell Script Block +id: 67740bd3-1506-469c-b91d-effc322cc6e5 +version: 1 date: '2021-08-25' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet used with specific parameters . The `DS_Group` parameter leverages WMI to query for all domain groups. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -id: 67740bd3-1506-469c-b91d-effc322cc6e5 -known_false_positives: Administrators or power users may use this PowerShell commandlet - for troubleshooting. -name: GetWmiObject Ds Group with PowerShell Script Block -references: -- https://attack.mitre.org/techniques/T1069/002/ -- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1 search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"namespace root\\directory\\ldap"* AND Message=*"class ds_group"*) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getwmiobject_ds_group_with_powershell_script_block_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators or power users may use this PowerShell commandlet + for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1 tags: analytic_story: - Active Directory Discovery @@ -55,5 +57,3 @@ tags: - User risk_score: 15 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml index 2ab807d6d9..cee3fe4767 100644 --- a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml @@ -1,22 +1,17 @@ +name: GetWmiObject DS User with PowerShell +id: 22d3b118-04df-11ec-8fa3-acde48001122 +version: 1 +date: '2021-08-24' author: Teoderick Contreras, Mauricio Velazco, Splunk +type: TTP datamodel: - Endpoint -date: '2021-08-24' description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain users. The `Get-WmiObject` commandlet combined with the `-class ds_user` parameter can be used to return the full list of users in a Windows domain. Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, to enumerate domain users for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: 22d3b118-04df-11ec-8fa3-acde48001122 -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: GetWmiObject DS User with PowerShell -references: -- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*get-wmiobject*" @@ -25,6 +20,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_ds_user_with_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm tags: analytic_story: - Active Directory Discovery @@ -71,5 +73,3 @@ tags: - _time risk_score: 25 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml index 47e6f390b2..b131acae44 100644 --- a/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml @@ -1,24 +1,26 @@ -author: Teoderick Contreras, Mauricio Velazco, Splunk -datamodel: [] +name: GetWmiObject DS User with PowerShell Script Block +id: fabd364e-04f3-11ec-b34b-acde48001122 +version: 1 date: '2021-08-24' +author: Teoderick Contreras, Mauricio Velazco, Splunk +type: TTP +datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet. The `DS_User` class parameter leverages WMI to query for all domain users. Red Teams and adversaries may leverage this commandlet to enumerate domain users for situational awareness and Active Directory Discovery. -how_to_implement: he following Hunting analytic requires PowerShell operational logs - to be imported. Modify the powershell macro as needed to match the sourcetype or - add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -id: fabd364e-04f3-11ec-b34b-acde48001122 -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: GetWmiObject DS User with PowerShell Script Block -references: -- https://www.blackhillsinfosec.com/red-blue-purple/ -- https://docs.microsoft.com/en-us/windows/win32/wmisdk/describing-the-ldap-namespace search: '`powershell` EventCode=4104 Message = "*get-wmiobject*" Message = "*ds_user*" Message = "*-namespace*" Message = "*root\\directory\\ldap*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_ds_user_with_powershell_script_block_filter`' +how_to_implement: he following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://www.blackhillsinfosec.com/red-blue-purple/ +- https://docs.microsoft.com/en-us/windows/win32/wmisdk/describing-the-ldap-namespace tags: analytic_story: - Active Directory Discovery @@ -57,5 +59,3 @@ tags: - User risk_score: 25 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell.yml b/detections/endpoint/getwmiobject_user_account_with_powershell.yml index 4de43fedcb..ae23c9a806 100644 --- a/detections/endpoint/getwmiobject_user_account_with_powershell.yml +++ b/detections/endpoint/getwmiobject_user_account_with_powershell.yml @@ -1,27 +1,29 @@ +name: GetWmiObject User Account with PowerShell +id: b44f6ac6-0429-11ec-87e9-acde48001122 +version: 1 +date: '2021-08-23' author: Mauricio Velazco, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-08-23' description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query local users. The `Get-WmiObject` commandlet combined with the `Win32_UserAccount` parameter is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: b44f6ac6-0429-11ec-87e9-acde48001122 -known_false_positives: Administrators or power users may use this PowerShell commandlet - for troubleshooting. -name: GetWmiObject User Account with PowerShell -references: -- https://attack.mitre.org/techniques/T1087/001/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-WmiObject* AND Processes.process=*Win32_UserAccount*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_user_account_with_powershell_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this PowerShell commandlet + for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1087/001/ tags: analytic_story: - Active Directory Discovery @@ -59,5 +61,3 @@ tags: - _time risk_score: 15 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml index 60642486f6..ed363737d6 100644 --- a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml @@ -1,23 +1,25 @@ -author: Mauricio Velazco, Splunk -datamodel: [] +name: GetWmiObject User Account with PowerShell Script Block +id: 640b0eda-0429-11ec-accd-acde48001122 +version: 1 date: '2021-08-23' +author: Mauricio Velazco, Splunk +type: Hunting +datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet used with specific parameters. The `Win32_UserAccount` parameter is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -id: 640b0eda-0429-11ec-accd-acde48001122 -known_false_positives: Administrators or power users may use this PowerShell commandlet - for troubleshooting. -name: GetWmiObject User Account with PowerShell Script Block -references: -- https://attack.mitre.org/techniques/T1087/001/ search: '`powershell` EventCode=4104 (Message="*Get-WmiObject*" AND Message="*Win32_UserAccount*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getwmiobject_user_account_with_powershell_script_block_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators or power users may use this PowerShell commandlet + for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1087/001/ tags: analytic_story: - Active Directory Discovery @@ -48,5 +50,3 @@ tags: - _time risk_score: 15 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml index 9d84b7b625..d447ef7d6f 100644 --- a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml @@ -1,7 +1,11 @@ +name: GPUpdate with no Command Line Arguments with Network +id: 2c853856-a140-11eb-a5b5-acde48001122 +version: 1 +date: '2021-04-19' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-04-19' description: The following analytic identifies gpupdate.exe with no command line arguments and with a network connection. It is unusual for gpupdate.exe to execute with no command line arguments present. This particular behavior is common with malicious @@ -9,16 +13,6 @@ description: The following analytic identifies gpupdate.exe with no command line and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. gpupdate.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: 2c853856-a140-11eb-a5b5-acde48001122 -known_false_positives: Limited false positives may be present in small environments. - Tuning may be required based on parent process. -name: GPUpdate with no Command Line Arguments with Network -references: -- https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile -- https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name="gpupdate.exe" by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name @@ -28,6 +22,14 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name process_path process process_guid connection_to_CNC dest_port | `gpupdate_with_no_command_line_arguments_with_network_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Limited false positives may be present in small environments. + Tuning may be required based on parent process. +references: +- https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile +- https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/ tags: analytic_story: - Cobalt Strike @@ -86,5 +88,3 @@ tags: - process_path risk_score: 81 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml index cbdffafe9c..e3be102ed8 100644 --- a/detections/endpoint/hide_user_account_from_sign_in_screen.yml +++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml @@ -1,29 +1,31 @@ +name: Hide User Account From Sign-In Screen +id: 834ba832-ad89-11eb-937d-acde48001122 +version: 1 +date: '2021-05-05' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-05-05' description: This analytic identifies a suspicious registry modification to hide a user account on the Windows Login screen. This technique was seen in some tradecraft where the adversary will create a hidden user account with Admin privileges in login screen to avoid noticing by the user that they already compromise and to persist on that said machine. -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -id: 834ba832-ad89-11eb-937d-acde48001122 -known_false_positives: Unknown. Filter as needed. -name: Hide User Account From Sign-In Screen -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist*" AND Registry.registry_value_data = "0x00000000" by Registry.dest Registry.user Registry.registry_value_data | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `hide_user_account_from_sign_in_screen_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: Unknown. Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - XMRig @@ -69,5 +71,3 @@ tags: - _time risk_score: 72 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml index 25f1445b35..e66d09aa11 100644 --- a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml +++ b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml @@ -1,26 +1,28 @@ +name: Hiding Files And Directories With Attrib exe +id: c77162d3-f93c-45cc-80c8-22f6b5264g9f +version: 4 +date: '2020-07-21' author: Bhavin Patel, Splunk +type: TTP datamodel: - Endpoint -date: '2020-07-21' description: Attackers leverage an existing Windows binary, attrib.exe, to mark specific as hidden by using specific flags so that the victim does not see the file. The search looks for specific command-line arguments to detect the use of attrib.exe to hide files. -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. -id: c77162d3-f93c-45cc-80c8-22f6b5264g9f -known_false_positives: 'Some applications and users may legitimately use attrib.exe - to interact with the files. ' -name: Hiding Files And Directories With Attrib exe -references: [] search: '| tstats `security_content_summariesonly` count min(_time) values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="attrib.exe" (Processes.process="*+h*") by Processes.parent_process Processes.process_name Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`| `hiding_files_and_directories_with_attrib_exe_filter` ' +how_to_implement: You must be ingesting data that records process activity from your + hosts to populate the Endpoint data model in the Processes node. You must also be + ingesting logs with both the process name and command line from your endpoints. + The command-line arguments are mapped to the "process" field in the Endpoint data + model. +known_false_positives: 'Some applications and users may legitimately use attrib.exe + to interact with the files. ' +references: [] tags: analytic_story: - Windows Defense Evasion Tactics @@ -72,5 +74,3 @@ tags: - _time risk_score: 72 security_domain: endpoint -type: TTP -version: 4 diff --git a/detections/endpoint/high_file_deletion_frequency.yml b/detections/endpoint/high_file_deletion_frequency.yml index 3b4e0f8627..8a97d5ecd4 100644 --- a/detections/endpoint/high_file_deletion_frequency.yml +++ b/detections/endpoint/high_file_deletion_frequency.yml @@ -1,25 +1,27 @@ -author: Teoderick Contreras -datamodel: [] +name: High File Deletion Frequency +id: 45b125c4-866f-11eb-a95a-acde48001122 +version: 1 date: '2021-03-16' +author: Teoderick Contreras +type: Anomaly +datamodel: [] description: This search looks for high frequency of file deletion relative to process name and process id. These events usually happen when the ransomware tries to encrypt the files with the ransomware file extensions and sysmon treat the original files to be deleted as soon it was replace as encrypted data. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the deleted target file name, process name and process id from your endpoints. - If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -id: 45b125c4-866f-11eb-a95a-acde48001122 -known_false_positives: user may delete bunch of pictures or files in a folder. -name: High File Deletion Frequency -references: -- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html -- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html search: '`sysmon` EventCode=23 TargetFilename IN ("*\.cmd", "*\.ini","*\.gif", "*\.jpg", "*\.jpeg", "*\.db", "*\.ps1", "*\.doc*", "*\.xls*", "*\.ppt*", "*\.bmp","*\.zip", "*\.rar", "*\.7z", "*\.chm", "*\.png", "*\.log", "*\.vbs", "*\.js") | stats values(TargetFilename) as deleted_files min(_time) as firstTime max(_time) as lastTime count by Computer user EventCode Image ProcessID |where count >=100 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `high_file_deletion_frequency_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the deleted target file name, process name and process id from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: user may delete bunch of pictures or files in a folder. +references: +- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html +- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html tags: analytic_story: - Clop Ransomware @@ -63,5 +65,3 @@ tags: - _time risk_score: 72 security_domain: endpoint -type: Anomaly -version: 1 diff --git a/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml b/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml index 78fb22a0db..3f34555037 100644 --- a/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml +++ b/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml @@ -1,21 +1,16 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: High Frequency Copy Of Files In Network Share +id: 40925f12-4709-11ec-bb43-acde48001122 +version: 1 date: '2021-11-16' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: [] description: This analytic is to detect a suspicious high frequency copying/moving of files in network share as part of information sabotage. This anomaly event can be a good indicator of insider trying to sabotage data by transfering classified or internal files within network share to exfitrate it after or to lure evidence of insider attack to other user. This behavior may catch several noise if network share is a common place for classified or internal document processing. -how_to_implement: o successfully implement this search, you need to be ingesting Windows - Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. - Also enable the object Audit access success/failure in your group policy. -id: 40925f12-4709-11ec-bb43-acde48001122 -known_false_positives: this behavior may seen in normal transfer of file within network - if network share is common place for sharing documents. -name: High Frequency Copy Of Files In Network Share -references: -- https://attack.mitre.org/techniques/T1537/ search: '`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.doc","*.docx","*.xls","*.xlsx","*.ppt","*.pptx","*.log","*.txt","*.db","*.7z","*.zip","*.rar","*.tar","*.gz","*.jpg","*.gif","*.png","*.bmp","*.pdf","*.rtf","*.key") Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask= "0x2" | bucket _time span=5m | stats values(Relative_Target_Name) as valRelativeTargetName, @@ -26,6 +21,13 @@ search: '`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.doc", _time, EventCode, user | eval upperThreshold=(avgShareName + stdShareName *3) | eval isOutlier=if(avgShareName > 20 and avgShareName >= upperThreshold, 1, 0) | search isOutlier=1 | `high_frequency_copy_of_files_in_network_share_filter`' +how_to_implement: o successfully implement this search, you need to be ingesting Windows + Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. + Also enable the object Audit access success/failure in your group policy. +known_false_positives: this behavior may seen in normal transfer of file within network + if network share is common place for sharing documents. +references: +- https://attack.mitre.org/techniques/T1537/ tags: analytic_story: - Information Sabotage @@ -64,5 +66,3 @@ tags: - Source_Address risk_score: 9 security_domain: endpoint -type: Anomaly -version: 1 diff --git a/detections/endpoint/high_process_termination_frequency.yml b/detections/endpoint/high_process_termination_frequency.yml index 63b625dd35..712fc16b06 100644 --- a/detections/endpoint/high_process_termination_frequency.yml +++ b/detections/endpoint/high_process_termination_frequency.yml @@ -1,23 +1,25 @@ -author: Teoderick Contreras -datamodel: [] +name: High Process Termination Frequency +id: 17cd75b2-8666-11eb-9ab4-acde48001122 +version: 1 date: '2021-03-16' +author: Teoderick Contreras +type: Anomaly +datamodel: [] description: This analytics are designed to indentify a high frequency of process termination on a machine which is a common behavior of ransomware malware before encrypting files. This technique is designed to avoid an exception error while accessing (docs, images, database and etc..) in the infected machine for encryption. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the Image (process full path of terminated process) from your endpoints. - If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -id: 17cd75b2-8666-11eb-9ab4-acde48001122 -known_false_positives: admin or user tool that can terminate multiple process. -name: High Process Termination Frequency -references: -- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html -- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html search: '`sysmon` EventCode=5 |bin _time span=3s |stats values(Image) as proc_terminated min(_time) as firstTime max(_time) as lastTime count by Computer EventCode ProcessID | where count >= 15 | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `high_process_termination_frequency_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the Image (process full path of terminated process) from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: admin or user tool that can terminate multiple process. +references: +- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html +- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html tags: analytic_story: - Clop Ransomware @@ -56,5 +58,3 @@ tags: - ProcessID risk_score: 72 security_domain: endpoint -type: Anomaly -version: 1 diff --git a/detections/endpoint/hunting_for_log4shell.yml b/detections/endpoint/hunting_for_log4shell.yml index 104c304ee3..75fface15e 100644 --- a/detections/endpoint/hunting_for_log4shell.yml +++ b/detections/endpoint/hunting_for_log4shell.yml @@ -1,7 +1,11 @@ +name: Hunting for Log4Shell +id: 158b68fa-5d1a-11ec-aac8-acde48001122 +version: 1 +date: '2021-12-14' author: Michael Haag, Splunk +type: Hunting datamodel: - Web -date: '2021-12-14' description: 'The following hunting query assists with quickly assessing CVE-2021-44228, or Log4Shell, activity mapped to the Web Datamodel. This is a combination query attempting to identify, score and dashboard. Because the Log4Shell vulnerability @@ -39,22 +43,6 @@ description: 'The following hunting query assists with quickly assessing CVE-202 Finally, a simple table is created to show the scoring and the _raw field. Sort based on score or columns of interest.' -how_to_implement: Out of the box, the Web datamodel is required to be pre-filled. - However, tested was performed against raw httpd access logs. Change the first line - to any dataset to pass the regex's against. -id: 158b68fa-5d1a-11ec-aac8-acde48001122 -known_false_positives: It is highly possible you will find false positives, however, - the base score is set to 2 for _any_ jndi found in raw logs. tune and change as - needed, include any filtering. -name: Hunting for Log4Shell -references: -- https://gist.github.com/olafhartong/916ebc673ba066537740164f7e7e1d72 -- https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b#gistcomment-3994449 -- https://regex101.com/r/OSrm0q/1/ -- https://github.com/Neo23x0/signature-base/blob/master/yara/expl_log4j_cve_2021_44228.yar -- https://news.sophos.com/en-us/2021/12/12/log4shell-hell-anatomy-of-an-exploit-outbreak/ -- https://gist.github.com/MHaggis/1899b8554f38c8692a9fb0ceba60b44c -- https://twitter.com/sasi2103/status/1469764719850442760?s=20 search: '| from datamodel Web.Web | eval jndi=if(match(_raw, "(\{|%7B)[jJnNdDiI]{4}:"),4,0) | eval jndi_fastmatch=if(match(_raw, "[jJnNdDiI]{4}"),2,0) | eval jndi_proto=if(match(_raw,"(?i)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http|https):"),5,0) | eval all_match = if(match(_raw, "(?i)(%(25){0,}20|\s)*(%(25){0,}24|\$)(%(25){0,}20|\s)*(%(25){0,}7B|{)(%(25){0,}20|\s)*(%(25){0,}(6A|4A)|J)(%(25){0,}(6E|4E)|N)(%(25){0,}(64|44)|D)(%(25){0,}(69|49)|I)(%(25){0,}20|\s)*(%(25){0,}3A|:)[\w\%]+(%(25){1,}3A|:)(%(25){1,}2F|\/)[^\n]+"),5,0) @@ -68,6 +56,20 @@ search: '| from datamodel Web.Web | eval jndi=if(match(_raw, "(\{|%7B)[jJnNdDiI] jndi, jndi_proto, env_var, uridetect, all_match, jndi_fastmatch, keywords, obf, lookups | where Score > 2 | stats values(Score) by jndi, jndi_proto, env_var, uridetect, all_match, jndi_fastmatch, keywords, lookups, obf, _raw | `hunting_for_log4shell_filter`' +how_to_implement: Out of the box, the Web datamodel is required to be pre-filled. + However, tested was performed against raw httpd access logs. Change the first line + to any dataset to pass the regex's against. +known_false_positives: It is highly possible you will find false positives, however, + the base score is set to 2 for _any_ jndi found in raw logs. tune and change as + needed, include any filtering. +references: +- https://gist.github.com/olafhartong/916ebc673ba066537740164f7e7e1d72 +- https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b#gistcomment-3994449 +- https://regex101.com/r/OSrm0q/1/ +- https://github.com/Neo23x0/signature-base/blob/master/yara/expl_log4j_cve_2021_44228.yar +- https://news.sophos.com/en-us/2021/12/12/log4shell-hell-anatomy-of-an-exploit-outbreak/ +- https://gist.github.com/MHaggis/1899b8554f38c8692a9fb0ceba60b44c +- https://twitter.com/sasi2103/status/1469764719850442760?s=20 tags: analytic_story: - Log4Shell CVE-2021-44228 @@ -107,5 +109,3 @@ tags: - _raw risk_score: 40 security_domain: network -type: Hunting -version: 1 diff --git a/detections/endpoint/icacls_deny_command.yml b/detections/endpoint/icacls_deny_command.yml index d3c0dea9cb..7ca76a69e0 100644 --- a/detections/endpoint/icacls_deny_command.yml +++ b/detections/endpoint/icacls_deny_command.yml @@ -1,21 +1,15 @@ +name: Icacls Deny Command +id: cf8d753e-a8fe-11eb-8f58-acde48001122 +version: 1 +date: '2021-04-29' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-04-29' description: This analytic identifies a potential adversary that changes the security permission of a specific file or directory. This technique is commonly seen in APT tradecraft or coinminer scripts. This behavior is meant to evade detection and prevent access to their component files. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. -id: cf8d753e-a8fe-11eb-8f58-acde48001122 -known_false_positives: Unknown. It is possible some administrative scripts use ICacls. - Filter as needed. -name: Icacls Deny Command -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "icacls.exe" @@ -23,6 +17,14 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as AND Processes.process = "*/deny*" by Processes.parent_process_name Processes.process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `icacls_deny_command_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. +known_false_positives: Unknown. It is possible some administrative scripts use ICacls. + Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - XMRig @@ -63,5 +65,3 @@ tags: - _time risk_score: 72 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/icacls_grant_command.yml b/detections/endpoint/icacls_grant_command.yml index 6b2048edca..774f091207 100644 --- a/detections/endpoint/icacls_grant_command.yml +++ b/detections/endpoint/icacls_grant_command.yml @@ -1,20 +1,15 @@ +name: ICACLS Grant Command +id: b1b1e316-accc-11eb-a9b4-acde48001122 +version: 1 +date: '2021-05-04' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-05-04' description: This analytic identifies potential adversaries that modify the security permission of a specific file or directory. This technique is commonly seen in APT tradecraft and coinminer scripts to evade detections and restrict access to their component files. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. -id: b1b1e316-accc-11eb-a9b4-acde48001122 -known_false_positives: Unknown. Filter as needed. -name: ICACLS Grant Command -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "icacls.exe" @@ -22,6 +17,13 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as AND Processes.process = "*/grant*" by Processes.parent_process_name Processes.process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `icacls_grant_command_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. +known_false_positives: Unknown. Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - XMRig @@ -63,5 +65,3 @@ tags: - _time risk_score: 49 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml index 302f7f5c92..2ce503e230 100644 --- a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml +++ b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml @@ -1,22 +1,24 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: IcedID Exfiltrated Archived File Creation +id: 0db4da70-f14b-11eb-8043-acde48001122 +version: 1 date: '2021-07-30' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: [] description: This search is to detect a suspicious file creation namely passff.tar and cookie.tar. This files are possible archived of stolen browser information like history and cookies in a compromised machine with IcedID. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: 0db4da70-f14b-11eb-8043-acde48001122 -known_false_positives: unknown -name: IcedID Exfiltrated Archived File Creation -references: -- https://www.cisecurity.org/white-papers/security-primer-icedid/ search: '`sysmon` EventCode= 11 (TargetFilename = "*\\passff.tar" OR TargetFilename = "*\\cookie.tar") |stats count min(_time) as firstTime max(_time) as lastTime by TargetFilename EventCode process_id process_name Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `icedid_exfiltrated_archived_file_creation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://www.cisecurity.org/white-papers/security-primer-icedid/ tags: analytic_story: - IcedID @@ -56,5 +58,3 @@ tags: - Computer risk_score: 72 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/identify_systems_using_remote_desktop.yml b/detections/endpoint/identify_systems_using_remote_desktop.yml index afab27db6e..b539370979 100644 --- a/detections/endpoint/identify_systems_using_remote_desktop.yml +++ b/detections/endpoint/identify_systems_using_remote_desktop.yml @@ -1,18 +1,20 @@ +name: Identify Systems Using Remote Desktop +id: 063dfe9f-b1d7-4254-a16d-1e2e7eadd6a8 +version: 1 +date: '2019-04-01' author: David Dorsey, Splunk +type: Baseline datamodel: - Endpoint -date: '2019-04-01' description: This search counts the numbers of times the remote desktop process, mstsc.exe, has run on each system. -how_to_implement: To successfully implement this search you must be ingesting endpoint - data that records process activity. -id: 063dfe9f-b1d7-4254-a16d-1e2e7eadd6a8 -known_false_positives: none -name: Identify Systems Using Remote Desktop -references: [] search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes where Processes.process_name="*mstsc.exe*" by Processes.dest Processes.process_name | `drop_dm_object_name(Processes)` | sort - count' +how_to_implement: To successfully implement this search you must be ingesting endpoint + data that records process activity. +known_false_positives: none +references: [] tags: deployments: - Daily Cache Updates @@ -24,5 +26,3 @@ tags: - Endpoint.Processes.dest - Endpoint.Processes.process_name security_domain: endpoint -type: Baseline -version: 1 diff --git a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml index 95677f708e..5d1dd9e9b2 100644 --- a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml +++ b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml @@ -1,7 +1,11 @@ +name: Impacket Lateral Movement Commandline Parameters +id: 8ce07472-496f-11ec-ab3b-3e22fbd008af +version: 1 +date: '2021-11-19' author: Mauricio Velazco, Splunk +type: TTP datamodel: - Endpoint -date: '2021-11-19' description: This analytic looks for the presence of suspicious commandline parameters typically present when using Impacket tools. Impacket is a collection of python classes meant to be used with Microsoft network protocols. There are multiple scripts @@ -10,14 +14,18 @@ description: This analytic looks for the presence of suspicious commandline para scripts leverage administrative shares and hardcoded parameters that can be used as a signature to detect its use. Red Teams and adversaries alike may leverage Impackets tools for lateral movement and remote code execution. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*/c* \\\\127.0.0.1\\*" + OR Processes.process= "*/c* 2>&1") by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `impacket_lateral_movement_commandline_parameters_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. -id: 8ce07472-496f-11ec-ab3b-3e22fbd008af known_false_positives: Although uncommon, Administrators may leverage Impackets tools to start a process on remote systems for system administration or automation use cases. -name: Impacket Lateral Movement Commandline Parameters references: - https://attack.mitre.org/techniques/T1021/002/ - https://attack.mitre.org/techniques/T1021/003/ @@ -26,12 +34,6 @@ references: - https://attack.mitre.org/techniques/T1053/005 - https://github.com/SecureAuthCorp/impacket - https://vk9-sec.com/impacket-remote-code-execution-rce-on-windows-from-linux/ -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*/c* \\\\127.0.0.1\\*" - OR Processes.process= "*/c* 2>&1") by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` - | `impacket_lateral_movement_commandline_parameters_filter`' tags: analytic_story: - Active Directory Lateral Movement @@ -73,5 +75,3 @@ tags: - _time risk_score: 63 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml index 936b3daaf1..b60977d8d7 100644 --- a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml +++ b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml @@ -1,25 +1,27 @@ -author: Mauricio Velazco, Splunk -datamodel: [] +name: Interactive Session on Remote Endpoint with PowerShell +id: a4e8f3a4-48b2-11ec-bcfc-3e22fbd008af +version: 1 date: '2021-11-18' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the usage of the `Enter-PSSession`. This commandlet can be used to open an interactive session on a remote endpoint leveraging the WinRM protocol. Red Teams and adversaries alike may abuse WinRM and `Enter-PSSession` for lateral movement and remote code execution. -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup instructions - can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -id: a4e8f3a4-48b2-11ec-bcfc-3e22fbd008af -known_false_positives: Administrators may leverage WinRM and `Enter-PSSession` for - administrative and troubleshooting tasks. This activity is usually limited to a - small set of hosts or users. In certain environments, tuning may not be possible. -name: Interactive Session on Remote Endpoint with PowerShell -references: -- https://attack.mitre.org/techniques/T1021/006/ -- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enter-pssession?view=powershell-7.2 search: powershell` EventCode=4104 (Message="*Enter-PSSession*" AND Message="*-ComputerName*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `interactive_session_on_remote_endpoint_with_powershell_filter` +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup instructions + can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators may leverage WinRM and `Enter-PSSession` for + administrative and troubleshooting tasks. This activity is usually limited to a + small set of hosts or users. In certain environments, tuning may not be possible. +references: +- https://attack.mitre.org/techniques/T1021/006/ +- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enter-pssession?view=powershell-7.2 tags: analytic_story: - Active Directory Lateral Movement @@ -53,5 +55,3 @@ tags: - User risk_score: 45 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/investigate_failed_logins_for_multiple_destinations.yml b/detections/endpoint/investigate_failed_logins_for_multiple_destinations.yml index 7fb80423a6..3632e701b1 100644 --- a/detections/endpoint/investigate_failed_logins_for_multiple_destinations.yml +++ b/detections/endpoint/investigate_failed_logins_for_multiple_destinations.yml @@ -1,20 +1,22 @@ +name: Investigate Failed Logins for Multiple Destinations +id: 097e8030-8662-4254-a735-bf0bdda696e3 +version: 1 +date: '2019-12-10' author: Patrick Bareiss, Splunk +type: Investigation datamodel: - Authentication -date: '2019-12-10' description: This search returns failed logins to multiple destinations by user. -how_to_implement: To successfully implement this search you need to be ingesting authentication - logs from your various systems and populating the Authentication data model. -id: 097e8030-8662-4254-a735-bf0bdda696e3 -known_false_positives: '' -name: Investigate Failed Logins for Multiple Destinations -references: [] search: '| tstats count `security_content_summariesonly` earliest(_time) as first_login latest(_time) as last_login dc(Authentication.dest) AS distinct_count_dest values(Authentication.dest) AS Authentication.dest values(Authentication.app) AS Authentication.app from datamodel=Authentication.Authentication where Authentication.action=failure by Authentication.user | where distinct_count_dest > 1 | `security_content_ctime(first_login)` | `security_content_ctime(last_login)` | `drop_dm_object_name("Authentication")` | search user=$user$' +how_to_implement: To successfully implement this search you need to be ingesting authentication + logs from your various systems and populating the Authentication data model. +known_false_positives: '' +references: [] tags: analytic_story: - Credential Dumping @@ -27,5 +29,3 @@ tags: - Authentication.Authentication.user - _time security_domain: endpoint -type: Investigation -version: 1 diff --git a/detections/endpoint/investigate_pass_the_ticket_attempts.yml b/detections/endpoint/investigate_pass_the_ticket_attempts.yml index 82575bb989..9bdcce5131 100644 --- a/detections/endpoint/investigate_pass_the_ticket_attempts.yml +++ b/detections/endpoint/investigate_pass_the_ticket_attempts.yml @@ -1,21 +1,23 @@ -author: Patrick Bareiss, Splunk -datamodel: [] +name: Investigate Pass the Ticket Attempts +id: 990007ad-d798-4b29-ab2f-f0034144c937 +version: 1 date: '2019-12-10' +author: Patrick Bareiss, Splunk +type: Investigation +datamodel: [] description: This search hunts for dumped kerberos ticket from LSASS memory. +search: '`wineventlog_security` EventCode=4768 OR EventCode=4769 | rex field=user + "(?[^\@]+)" | stats count BY new_user, dest, EventCode | stats max(count) + AS max_count sum(count) AS sum_count BY new_user, dest| search dest=$dest$ | where + sum_count/max_count!=2 | rename new_user AS user ' how_to_implement: To successfully implement this search you need to be ingesting windows security logs. This search uses an input macro named `wineventlog_security`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Security logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. -id: 990007ad-d798-4b29-ab2f-f0034144c937 known_false_positives: '' -name: Investigate Pass the Ticket Attempts references: [] -search: '`wineventlog_security` EventCode=4768 OR EventCode=4769 | rex field=user - "(?[^\@]+)" | stats count BY new_user, dest, EventCode | stats max(count) - AS max_count sum(count) AS sum_count BY new_user, dest| search dest=$dest$ | where - sum_count/max_count!=2 | rename new_user AS user ' tags: analytic_story: - Credential Dumping @@ -26,5 +28,3 @@ tags: - dest - user security_domain: endpoint -type: Investigation -version: 1 diff --git a/detections/endpoint/investigate_previous_unseen_user.yml b/detections/endpoint/investigate_previous_unseen_user.yml index 252b3e6323..c0efca8278 100644 --- a/detections/endpoint/investigate_previous_unseen_user.yml +++ b/detections/endpoint/investigate_previous_unseen_user.yml @@ -1,15 +1,13 @@ +name: Investigate Previous Unseen User +id: 5de385bf-4f1e-404e-9b67-92d162ff8938ad +version: 1 +date: '2019-12-10' author: Patrick Bareiss, Splunk +type: Investigation datamodel: - Authentication -date: '2019-12-10' description: This search returns previous unseen user, which didn't log in for 30 days. -how_to_implement: To successfully implement this search you need to be ingesting authentication - logs from your various systems and populating the Authentication data model. -id: 5de385bf-4f1e-404e-9b67-92d162ff8938ad -known_false_positives: '' -name: Investigate Previous Unseen User -references: [] search: '| tstats count `security_content_summariesonly` earliest(_time) as first_login latest(_time) as last_login values(Authentication.dest) AS Authentication.dest values(Authentication.app) AS Authentication.app values(Authentication.action) AS Authentication.action from @@ -19,6 +17,10 @@ search: '| tstats count `security_content_summariesonly` earliest(_time) as firs by Authentication.user | where count=1 | where first_login >= relative_time(now(), "-30d") | `security_content_ctime(first_login)` | `security_content_ctime(last_login)` | `drop_dm_object_name("Authentication")` | search dest=$dest$' +how_to_implement: To successfully implement this search you need to be ingesting authentication + logs from your various systems and populating the Authentication data model. +known_false_positives: '' +references: [] tags: analytic_story: - Credential Dumping @@ -31,5 +33,3 @@ tags: - Authentication.Authentication.user - _time security_domain: endpoint -type: Investigation -version: 1 diff --git a/detections/endpoint/investigate_successful_remote_desktop_authentications.yml b/detections/endpoint/investigate_successful_remote_desktop_authentications.yml index ef23a1b53e..1a60f76527 100644 --- a/detections/endpoint/investigate_successful_remote_desktop_authentications.yml +++ b/detections/endpoint/investigate_successful_remote_desktop_authentications.yml @@ -1,16 +1,14 @@ +name: Investigate Successful Remote Desktop Authentications +id: b6618e8e-be04-40a0-a0b9-f0bd4b6c81bc +version: 1 +date: '2018-12-14' author: Jose Hernandez, Splunk +type: Investigation datamodel: - Authentication -date: '2018-12-14' description: 'This search returns the source, destination, and user for all successful remote-desktop authentications. A successful authentication after a brute-force attack on a destination machine is suspicious behavior. ' -how_to_implement: You must be populating the Authentication data model with security - events from your Windows event logs. -id: b6618e8e-be04-40a0-a0b9-f0bd4b6c81bc -known_false_positives: '' -name: Investigate Successful Remote Desktop Authentications -references: [] search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Authentication.Authentication where Authentication.signature_id=4624 Authentication.app=win:remote by Authentication.src Authentication.dest Authentication.app @@ -18,6 +16,10 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(firstTime)` | `drop_dm_object_name("Authentication")` | search dest=$dest$ | table firstTime lastTime src src_nt_domain dest user app count | sort count' +how_to_implement: You must be populating the Authentication data model with security + events from your Windows event logs. +known_false_positives: '' +references: [] tags: analytic_story: - Hidden Cobra Malware @@ -35,5 +37,3 @@ tags: - Authentication.Authentication.user - _time security_domain: endpoint -type: Investigation -version: 1 diff --git a/detections/endpoint/java_class_file_download_by_java_user_agent.yml b/detections/endpoint/java_class_file_download_by_java_user_agent.yml index 71f215569c..13ff378c3e 100644 --- a/detections/endpoint/java_class_file_download_by_java_user_agent.yml +++ b/detections/endpoint/java_class_file_download_by_java_user_agent.yml @@ -1,24 +1,26 @@ +name: Java Class File download by Java User Agent +id: 8281ce42-5c50-11ec-82d2-acde48001122 +version: 1 +date: '2021-12-13' author: Michael Haag, Splunk +type: TTP datamodel: - Web -date: '2021-12-13' description: The following analytic identifies a Java user agent performing a GET request for a .class file from the remote site. This is potentially indicative of exploitation of the Java application and may be related to current event CVE-2021-44228 (Log4Shell). -how_to_implement: To successfully implement this search, you need to be ingesting - web or proxy logs, or ensure it is being filled by a proxy like device, into the - Web Datamodel. For additional filtering, allow list private IP space or restrict - by known good. -id: 8281ce42-5c50-11ec-82d2-acde48001122 -known_false_positives: Filtering may be required in some instances, filter as needed. -name: Java Class File download by Java User Agent -references: -- https://arstechnica.com/information-technology/2021/12/as-log4shell-wreaks-havoc-payroll-service-reports-ransomware-attack/ search: '| tstats count from datamodel=Web.Web where Web.http_user_agent="*Java*" Web.http_method="GET" Web.url="*.class*" by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `java_class_file_download_by_java_user_agent_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + web or proxy logs, or ensure it is being filled by a proxy like device, into the + Web Datamodel. For additional filtering, allow list private IP space or restrict + by known good. +known_false_positives: Filtering may be required in some instances, filter as needed. +references: +- https://arstechnica.com/information-technology/2021/12/as-log4shell-wreaks-havoc-payroll-service-reports-ransomware-attack/ tags: analytic_story: - Log4Shell CVE-2021-44228 @@ -64,5 +66,3 @@ tags: - Web.Web.url_length risk_score: 40 security_domain: network -type: TTP -version: 1 diff --git a/detections/endpoint/jscript_execution_using_cscript_app.yml b/detections/endpoint/jscript_execution_using_cscript_app.yml index 5747fc1897..878761f469 100644 --- a/detections/endpoint/jscript_execution_using_cscript_app.yml +++ b/detections/endpoint/jscript_execution_using_cscript_app.yml @@ -1,22 +1,16 @@ +name: Jscript Execution Using Cscript App +id: 002f1e24-146e-11ec-a470-acde48001122 +version: 1 +date: '2021-09-13' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-13' description: This search is to detect a execution of jscript using cscript process. Commonly when a user run jscript file it was executed by wscript.exe application. This technique was seen in FIN7 js implant to execute its malicious script using cscript process. This behavior is uncommon and a good artifacts to check further anomalies within the network -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: 002f1e24-146e-11ec-a470-acde48001122 -known_false_positives: unknown -name: Jscript Execution Using Cscript App -references: -- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html -- https://attack.mitre.org/groups/G0046/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "cscript.exe" AND Processes.parent_process = "*//e:jscript*") OR (Processes.process_name @@ -24,6 +18,14 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.parent_process Processes.process_name Processes.process_id Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `jscript_execution_using_cscript_app_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html +- https://attack.mitre.org/groups/G0046/ tags: analytic_story: - FIN7 @@ -67,5 +69,3 @@ tags: - _time risk_score: 49 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml index 70038db580..c3d5e0e2f9 100644 --- a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml +++ b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml @@ -44,9 +44,9 @@ tags: - DE.CM observable: - name: dest - type: Endpoint role: - Victim + type: Endpoint product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/known_services_killed_by_ransomware.yml b/detections/endpoint/known_services_killed_by_ransomware.yml index 3b9e16ffc4..512d7252eb 100644 --- a/detections/endpoint/known_services_killed_by_ransomware.yml +++ b/detections/endpoint/known_services_killed_by_ransomware.yml @@ -1,25 +1,27 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Known Services Killed by Ransomware +id: 3070f8e0-c528-11eb-b2a0-acde48001122 +version: 1 date: '2021-06-04' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: [] description: This search detects a suspicioous termination of known services killed by ransomware before encrypting files in a compromised machine. This technique is commonly seen in most of ransomware now a days to avoid exception error while accessing the targetted files it wants to encrypts because of the open handle of those services to the targetted file. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the 7036 EventCode ScManager in System audit Logs from your endpoints. -id: 3070f8e0-c528-11eb-b2a0-acde48001122 -known_false_positives: Admin activities or installing related updates may do a sudden - stop to list of services we monitor. -name: Known Services Killed by Ransomware -references: -- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ -- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ search: '`wineventlog_system` EventCode=7036 Message IN ("*Volume Shadow Copy*","*VSS*", "*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*") Message="*service entered the stopped state*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message dest Type | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `known_services_killed_by_ransomware_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the 7036 EventCode ScManager in System audit Logs from your endpoints. +known_false_positives: Admin activities or installing related updates may do a sudden + stop to list of services we monitor. +references: +- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ +- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ tags: analytic_story: - Ransomware @@ -58,5 +60,3 @@ tags: - Type risk_score: 72 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/loading_of_dynwrapx_module.yml b/detections/endpoint/loading_of_dynwrapx_module.yml index 9a471222f2..5e1d4dc0c0 100644 --- a/detections/endpoint/loading_of_dynwrapx_module.yml +++ b/detections/endpoint/loading_of_dynwrapx_module.yml @@ -1,6 +1,10 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Loading Of Dynwrapx Module +id: eac5e8ba-4857-11ec-9371-acde48001122 +version: 1 date: '2021-11-18' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: [] description: DynamicWrapperX is an ActiveX component that can be used in a script to call Windows API functions, but it requires the dynwrapx.dll to be installed and registered. With that, registering or loading dynwrapx.dll to a host is highly @@ -9,28 +13,26 @@ description: DynamicWrapperX is an ActiveX component that can be used in a scrip for any suspicious modifications meant to load dynwrapx.dll. Identify any suspicious module loads of dynwrapx.dll. This detection will return and identify the processes that invoke vbs/wscript/cscript. +search: '`sysmon` EventCode=7 (ImageLoaded = "*\\dynwrapx.dll" OR OriginalFileName + = "dynwrapx.dll" OR Product = "DynamicWrapperX") | stats count min(_time) as firstTime + max(_time) as lastTime by Image ImageLoaded OriginalFileName Product process_name + Computer EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `loading_of_dynwrapx_module_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on processes that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -id: eac5e8ba-4857-11ec-9371-acde48001122 known_false_positives: False positives should be limited, however it is possible to filter by Processes.process_name and specific processes (ex. wscript.exe). Filter as needed. This may need modification based on EDR telemetry and how it brings in registry data. For example, removal of (Default). -name: Loading Of Dynwrapx Module references: - https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/ - https://www.script-coding.com/dynwrapx_eng.html - https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/ - https://tria.ge/210929-ap75vsddan - https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89 -search: '`sysmon` EventCode=7 (ImageLoaded = "*\\dynwrapx.dll" OR OriginalFileName - = "dynwrapx.dll" OR Product = "DynamicWrapperX") | stats count min(_time) as firstTime - max(_time) as lastTime by Image ImageLoaded OriginalFileName Product process_name - Computer EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `loading_of_dynwrapx_module_filter`' tags: analytic_story: - Remcos @@ -70,5 +72,3 @@ tags: - ProcessId risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/local_account_discovery_with_net.yml b/detections/endpoint/local_account_discovery_with_net.yml index 52f2249169..030857d60d 100644 --- a/detections/endpoint/local_account_discovery_with_net.yml +++ b/detections/endpoint/local_account_discovery_with_net.yml @@ -1,25 +1,27 @@ +name: Local Account Discovery with Net +id: 5d0d4830-0133-11ec-bae3-acde48001122 +version: 2 +date: '2021-09-16' author: Mauricio Velazco, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-09-16' description: This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for local users. The two arguments `user` and 'users', return a list of all local users. Red Teams and adversaries alike use net.exe to enumerate users for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: 5d0d4830-0133-11ec-bae3-acde48001122 -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: Local Account Discovery with Net -references: -- https://attack.mitre.org/techniques/T1087/001/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` (Processes.process=*user OR Processes.process=*users) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `local_account_discovery_with_net_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1087/001/ tags: analytic_story: - Active Directory Discovery @@ -57,5 +59,3 @@ tags: - _time risk_score: 15 security_domain: endpoint -type: Hunting -version: 2 diff --git a/detections/endpoint/local_account_discovery_with_wmic.yml b/detections/endpoint/local_account_discovery_with_wmic.yml index f9a83a4b27..1fd41a2820 100644 --- a/detections/endpoint/local_account_discovery_with_wmic.yml +++ b/detections/endpoint/local_account_discovery_with_wmic.yml @@ -1,24 +1,26 @@ +name: Local Account Discovery With Wmic +id: 4902d7aa-0134-11ec-9d65-acde48001122 +version: 2 +date: '2021-09-16' author: Mauricio Velazco, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-09-16' description: This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for local users. The argument `useraccount` is used to leverage WMI to return a list of all local users. Red Teams and adversaries alike use net.exe to enumerate users for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: 4902d7aa-0134-11ec-9d65-acde48001122 -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: Local Account Discovery With Wmic -references: -- https://attack.mitre.org/techniques/T1087/001/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_wmic` (Processes.process=*useraccount*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `local_account_discovery_with_wmic_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1087/001/ tags: analytic_story: - Active Directory Discovery @@ -56,5 +58,3 @@ tags: - _time risk_score: 15 security_domain: endpoint -type: Hunting -version: 2 diff --git a/detections/endpoint/logon_script_event_trigger_execution.yml b/detections/endpoint/logon_script_event_trigger_execution.yml index 8dc8ef7ff2..c936a93515 100644 --- a/detections/endpoint/logon_script_event_trigger_execution.yml +++ b/detections/endpoint/logon_script_event_trigger_execution.yml @@ -1,27 +1,29 @@ +name: Logon Script Event Trigger Execution +id: 4c38c264-1f74-11ec-b5fa-acde48001122 +version: 1 +date: '2021-09-27' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-27' description: This search is to detect a suspicious modification of registry entry to persist and gain privilege escalation upon booting up of compromised host. This technique was seen in several APT and malware where it modify UserInitMprLogonScript registry entry to its malicious payload to be executed upon boot up of the machine. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime + max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path + IN ("*\\Environment\\UserInitMprLogonScript") by Registry.dest Registry.user Registry.registry_path + Registry.registry_key_name Registry.registry_value_name | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `logon_script_event_trigger_execution_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. -id: 4c38c264-1f74-11ec-b5fa-acde48001122 known_false_positives: unknown -name: Logon Script Event Trigger Execution references: - https://attack.mitre.org/techniques/T1037/001 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime - max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path - IN ("*\\Environment\\UserInitMprLogonScript") by Registry.dest Registry.user Registry.registry_path - Registry.registry_key_name Registry.registry_value_name | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `logon_script_event_trigger_execution_filter`' tags: analytic_story: - Windows Persistence Techniques @@ -62,5 +64,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/mailsniper_invoke_functions.yml b/detections/endpoint/mailsniper_invoke_functions.yml index a19a43b45b..8400cbfd23 100644 --- a/detections/endpoint/mailsniper_invoke_functions.yml +++ b/detections/endpoint/mailsniper_invoke_functions.yml @@ -1,17 +1,13 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Mailsniper Invoke functions +id: a36972c8-b894-11eb-9f78-acde48001122 +version: 1 date: '2021-05-19' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: [] description: This search is to detect known mailsniper.ps1 functions executed in a machine. This technique was seen in some attacker to harvest some sensitive e-mail in a compromised exchange server. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the powershell logs from your endpoints. make sure you enable needed - registry to monitor this event. -id: a36972c8-b894-11eb-9f78-acde48001122 -known_false_positives: unknown -name: Mailsniper Invoke functions -references: -- https://www.blackhillsinfosec.com/introducing-mailsniper-a-tool-for-searching-every-users-email-for-sensitive-data/ search: '`powershell` EventCode=4104 Message IN ("*Invoke-GlobalO365MailSearch*", "*Invoke-GlobalMailSearch*", "*Invoke-SelfSearch*", "*Invoke-PasswordSprayOWA*", "*Invoke-PasswordSprayEWS*","*Invoke-DomainHarvestOWA*", "*Invoke-UsernameHarvestOWA*","*Invoke-OpenInboxFinder*","*Invoke-InjectGEventAPI*","*Invoke-InjectGEvent*","*Invoke-SearchGmail*", @@ -19,6 +15,12 @@ search: '`powershell` EventCode=4104 Message IN ("*Invoke-GlobalO365MailSearch*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mailsniper_invoke_functions_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the powershell logs from your endpoints. make sure you enable needed + registry to monitor this event. +known_false_positives: unknown +references: +- https://www.blackhillsinfosec.com/introducing-mailsniper-a-tool-for-searching-every-users-email-for-sensitive-data/ tags: analytic_story: - Data Exfiltration @@ -58,5 +60,3 @@ tags: - User risk_score: 72 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/malicious_inprocserver32_modification.yml b/detections/endpoint/malicious_inprocserver32_modification.yml index eece3294c6..d1a93c1fdd 100644 --- a/detections/endpoint/malicious_inprocserver32_modification.yml +++ b/detections/endpoint/malicious_inprocserver32_modification.yml @@ -1,7 +1,11 @@ +name: Malicious InProcServer32 Modification +id: 127c8d08-25ff-11ec-9223-acde48001122 +version: 1 +date: '2021-10-05' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-10-05' description: The following analytic identifies a process modifying the registry with a known malicious CLSID under InProcServer32. Most COM classes are registered with the operating system and are identified by a GUID that represents the Class Identifier @@ -14,21 +18,6 @@ description: The following analytic identifies a process modifying the registry of events. Analyze the value and look for file modifications. Being this is looking for inprocserver32, a DLL found in the value will most likely be loaded by a parallel process. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 127c8d08-25ff-11ec-9223-acde48001122 -known_false_positives: False positives should be limited, filter as needed. In our - test case, Remcos used regsvr32.exe to modify the registry. It may be required, - dependent upon the EDR tool producing registry events, to remove (Default) from - the command-line. -name: Malicious InProcServer32 Modification -references: -- https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/ -- https://tria.ge/210929-ap75vsddan -- https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid Processes.user | `drop_dm_object_name(Processes)` | join process_guid [| tstats @@ -40,6 +29,19 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint process process_guid user] | stats count min(_time) as firstTime max(_time) as lastTime by dest, process_name registry_path registry_key_name registry_value_name user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_inprocserver32_modification_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives should be limited, filter as needed. In our + test case, Remcos used regsvr32.exe to modify the registry. It may be required, + dependent upon the EDR tool producing registry events, to remove (Default) from + the command-line. +references: +- https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/ +- https://tria.ge/210929-ap75vsddan +- https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89 tags: analytic_story: - Suspicious Regsvr32 Activity @@ -93,5 +95,3 @@ tags: - user risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/malicious_powershell_executed_as_a_service.yml b/detections/endpoint/malicious_powershell_executed_as_a_service.yml index e452371e10..ca7ce0db84 100644 --- a/detections/endpoint/malicious_powershell_executed_as_a_service.yml +++ b/detections/endpoint/malicious_powershell_executed_as_a_service.yml @@ -1,25 +1,27 @@ -author: Ryan Becwar -datamodel: [] +name: Malicious Powershell Executed As A Service +id: 8e204dfd-cae0-4ea8-a61d-e972a1ff2ff8 +version: 1 date: '2021-04-07' +author: Ryan Becwar +type: TTP +datamodel: [] description: This detection is to identify the abuse the Windows SC.exe to execute malicious commands or payloads via PowerShell. -how_to_implement: To successfully implement this search, you need to be ingesting - Windows System logs with the Service name, Service File Name Service Start type, - and Service Type from your endpoints. -id: 8e204dfd-cae0-4ea8-a61d-e972a1ff2ff8 -known_false_positives: Creating a hidden powershell service is rare and could key - off of those instances. -name: Malicious Powershell Executed As A Service -references: -- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/dosfuscation-report.pdf -- http://az4n6.blogspot.com/2017/ -- https://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier search: ' `wineventlog_system` EventCode=7045 | eval l_Service_File_Name=lower(Service_File_Name) | regex l_Service_File_Name="powershell[.\s]|powershell_ise[.\s]|pwsh[.\s]|psexec[.\s]" | regex l_Service_File_Name="-nop[rofile\s]+|-w[indowstyle]*\s+hid[den]*|-noe[xit\s]+|-enc[odedcommand\s]+" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type Service_Account user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_powershell_executed_as_a_service_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows System logs with the Service name, Service File Name Service Start type, + and Service Type from your endpoints. +known_false_positives: Creating a hidden powershell service is rare and could key + off of those instances. +references: +- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/dosfuscation-report.pdf +- http://az4n6.blogspot.com/2017/ +- https://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier tags: analytic_story: - Malicious Powershell @@ -62,5 +64,3 @@ tags: - user risk_score: 72 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml index 194aadf95f..2ad07f8486 100644 --- a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml +++ b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml @@ -1,7 +1,11 @@ +name: Malicious PowerShell Process - Connect To Internet With Hidden Window +id: ee18ed37-0802-4268-9435-b3b91aaa18db +version: 7 +date: '2021-10-05' author: David Dorsey, Michael Haag Splunk +type: Hunting datamodel: - Endpoint -date: '2021-10-05' description: The following hunting analytic identifies PowerShell commands utilizing the WindowStyle parameter to hide the window on the compromised endpoint. This combination of command-line options is suspicious because it is overriding the default PowerShell @@ -11,27 +15,25 @@ description: The following hunting analytic identifies PowerShell commands utili For example w, win, windowsty and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash. -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. -id: ee18ed37-0802-4268-9435-b3b91aaa18db -known_false_positives: Legitimate process can have this combination of command-line - options, but it's not common. -name: Malicious PowerShell Process - Connect To Internet With Hidden Window -references: -- https://regexr.com/663rr -- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1 -- https://ss64.com/ps/powershell.html -- https://twitter.com/M_haggis/status/1440758396534214658?s=20 -- https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/ search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)\ \ as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user\ \ Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name\ \ Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`\ \ | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013\ |\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]\") | `malicious_powershell_process___connect_to_internet_with_hidden_window_filter`" +how_to_implement: You must be ingesting data that records process activity from your + hosts to populate the Endpoint data model in the Processes node. You must also be + ingesting logs with both the process name and command line from your endpoints. + The command-line arguments are mapped to the "process" field in the Endpoint data + model. +known_false_positives: Legitimate process can have this combination of command-line + options, but it's not common. +references: +- https://regexr.com/663rr +- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1 +- https://ss64.com/ps/powershell.html +- https://twitter.com/M_haggis/status/1440758396534214658?s=20 +- https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/ tags: analytic_story: - Malicious PowerShell @@ -95,5 +97,3 @@ tags: - _time risk_score: 81 security_domain: endpoint -type: Hunting -version: 7 diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml index 57bc591050..5d1a1f81ea 100644 --- a/detections/endpoint/malicious_powershell_process___encoded_command.yml +++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml @@ -1,7 +1,11 @@ +name: Malicious PowerShell Process - Encoded Command +id: c4db14d9-7909-48b4-a054-aa14d89dbb19 +version: 6 +date: '2021-10-05' author: David Dorsey, Michael Haag, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-10-05' description: 'The following analytic identifies the use of the EncodedCommand PowerShell parameter. This is typically used by Administrators to run complex scripts, but commonly used by adversaries to hide their code. \ @@ -16,25 +20,23 @@ description: 'The following analytic identifies the use of the EncodedCommand Po on admin scripts in use. \ Alternatively, may use regex per matching here https://regexr.com/662ov.' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: c4db14d9-7909-48b4-a054-aa14d89dbb19 -known_false_positives: System administrators may use this option, but it's not common. -name: Malicious PowerShell Process - Encoded Command -references: -- https://regexr.com/662ov -- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1 -- https://ss64.com/ps/powershell.html -- https://twitter.com/M_haggis/status/1440758396534214658?s=20 search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)\ \ as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user\ \ Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name\ \ Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`\ \ | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013\ |\u2014|\u2015]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\\s+[^-]\") | `malicious_powershell_process___encoded_command_filter`" +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: System administrators may use this option, but it's not common. +references: +- https://regexr.com/662ov +- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1 +- https://ss64.com/ps/powershell.html +- https://twitter.com/M_haggis/status/1440758396534214658?s=20 tags: analytic_story: - Malicious PowerShell @@ -84,5 +86,3 @@ tags: - _time risk_score: 35 security_domain: endpoint -type: Hunting -version: 6 diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index b5246901af..f28cbea856 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -1,28 +1,30 @@ +name: Malicious PowerShell Process - Execution Policy Bypass +id: 9be56c82-b1cc-4318-87eb-d138afaaca39 +version: 5 +date: '2020-07-21' author: Rico Valdez, Mauricio Velazco, Splunk +type: TTP datamodel: - Endpoint -date: '2020-07-21' description: This search looks for PowerShell processes started with parameters used to bypass the local execution policy for scripts. These parameters are often observed in attacks leveraging PowerShell scripts as they override the default PowerShell execution policy. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 9be56c82-b1cc-4318-87eb-d138afaaca39 -known_false_positives: There may be legitimate reasons to bypass the PowerShell execution - policy. The PowerShell script being run with this parameter should be validated - to ensure that it is legitimate. -name: Malicious PowerShell Process - Execution Policy Bypass -references: [] search: '| tstats `security_content_summariesonly` values(Processes.process_id) as process_id, values(Processes.parent_process_id) as parent_process_id values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="* -ex*" OR Processes.process="* bypass *") by Processes.process_id, Processes.user, Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_powershell_process___execution_policy_bypass_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: There may be legitimate reasons to bypass the PowerShell execution + policy. The PowerShell script being run with this parameter should be validated + to ensure that it is legitimate. +references: [] tags: analytic_story: - DHS Report TA18-074A @@ -71,5 +73,3 @@ tags: - _time risk_score: 42 security_domain: endpoint -type: TTP -version: 5 diff --git a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml index 9a3777cac0..a44eaa26b2 100644 --- a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml +++ b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml @@ -1,19 +1,13 @@ +name: Malicious PowerShell Process With Obfuscation Techniques +id: cde75cf6-3c7a-4dd6-af01-27cdb4511fd4 +version: 5 +date: '2021-01-19' author: David Dorsey, Splunk +type: TTP datamodel: - Endpoint -date: '2021-01-19' description: This search looks for PowerShell processes launched with arguments that have characters indicative of obfuscation on the command-line. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: cde75cf6-3c7a-4dd6-af01-27cdb4511fd4 -known_false_positives: These characters might be legitimately on the command-line, - but it is not common. -name: Malicious PowerShell Process With Obfuscation Techniques -references: [] search: '| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` @@ -22,6 +16,14 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces `security_content_ctime(lastTime)`| eval num_obfuscation = (mvcount(split(process,"`"))-1) + (mvcount(split(process, "^"))-1) + (mvcount(split(process, "''"))-1) | `malicious_powershell_process_with_obfuscation_techniques_filter` | search num_obfuscation > 10 ' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: These characters might be legitimately on the command-line, + but it is not common. +references: [] tags: analytic_story: - Malicious PowerShell @@ -71,5 +73,3 @@ tags: - _time risk_score: 42 security_domain: endpoint -type: TTP -version: 5 diff --git a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml index 93adcba353..269aba11a5 100644 --- a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml @@ -1,7 +1,11 @@ +name: Mmc LOLBAS Execution Process Spawn +id: f6601940-4c74-11ec-b9b7-3e22fbd008af +version: 1 +date: '2021-11-23' author: Mauricio Velazco, Splunk +type: TTP datamodel: - Endpoint -date: '2021-11-23' description: The following analytic identifies `mmc.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the DCOM protocol and the MMC20 COM object, the executed command is spawned as a child processs of @@ -9,17 +13,6 @@ description: The following analytic identifies `mmc.exe` spawning a LOLBAS execu by threat actors to perform tasks like executing malicious code. Looking for child processes of mmc.exe that are part of the LOLBAS project can help defenders identify lateral movement activity. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -id: f6601940-4c74-11ec-b9b7-3e22fbd008af -known_false_positives: Legitimate applications may trigger this behavior, filter as - needed. -name: Mmc LOLBAS Execution Process Spawn -references: -- https://attack.mitre.org/techniques/T1021/003/ -- https://www.cybereason.com/blog/dcom-lateral-movement-techniques -- https://lolbas-project.github.io/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name="mmc.exe") (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", @@ -36,6 +29,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mmc_lolbas_execution_process_spawn_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. +known_false_positives: Legitimate applications may trigger this behavior, filter as + needed. +references: +- https://attack.mitre.org/techniques/T1021/003/ +- https://www.cybereason.com/blog/dcom-lateral-movement-techniques +- https://lolbas-project.github.io/ tags: analytic_story: - Active Directory Lateral Movement @@ -74,5 +76,3 @@ tags: - _time risk_score: 54 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/modification_of_wallpaper.yml b/detections/endpoint/modification_of_wallpaper.yml index ebb503c09e..8c1b2afe57 100644 --- a/detections/endpoint/modification_of_wallpaper.yml +++ b/detections/endpoint/modification_of_wallpaper.yml @@ -1,25 +1,27 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Modification Of Wallpaper +id: accb0712-c381-11eb-8e5b-acde48001122 +version: 1 date: '2021-06-02' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: [] description: This analytic identifies suspicious modification of registry to deface or change the wallpaper of a compromised machines as part of its payload. This technique was commonly seen in ransomware like REVIL where it create a bitmap file contain a note that the machine was compromised and make it as a wallpaper. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the Image, TargetObject registry key, registry Details from your endpoints. - If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -id: accb0712-c381-11eb-8e5b-acde48001122 -known_false_positives: 3rd party tool may used to changed the wallpaper of the machine -name: Modification Of Wallpaper -references: -- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ -- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ search: '`sysmon` EventCode =13 (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper" AND Image != "*\\explorer.exe") OR (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper" AND Details = "*\\temp\\*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Image TargetObject Details Computer process_guid process_id user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `modification_of_wallpaper_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the Image, TargetObject registry key, registry Details from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: 3rd party tool may used to changed the wallpaper of the machine +references: +- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ +- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ tags: analytic_story: - Ransomware @@ -59,5 +61,3 @@ tags: - user_id risk_score: 54 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml index 1c4d6ae4d6..55c4496f3a 100644 --- a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml +++ b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml @@ -1,22 +1,17 @@ +name: Modify ACL permission To Files Or Folder +id: 7e8458cc-acca-11eb-9e3f-acde48001122 +version: 1 +date: '2021-05-04' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-05-04' description: This analytic identifies suspicious modification of ACL permission to a files or folder to make it available to everyone. This technique may be used by the adversary to evade ACLs or protected files access. This changes is commonly configured by the file or directory owner with appropriate permission. This behavior is a good indicator if this command seen on a machine utilized by an account with no permission to do so. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used. -id: 7e8458cc-acca-11eb-9e3f-acde48001122 -known_false_positives: administrators may use this command. Filter as needed. -name: Modify ACL permission To Files Or Folder -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "cacls.exe" @@ -25,6 +20,13 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as by Processes.parent_process_name Processes.process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `modify_acl_permission_to_files_or_folder_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used. +known_false_positives: administrators may use this command. Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - XMRig @@ -60,5 +62,3 @@ tags: - _time risk_score: 32 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml index fb9805227e..245368aea0 100644 --- a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml +++ b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml @@ -1,28 +1,30 @@ +name: Monitor Registry Keys for Print Monitors +id: f5f6af30-7ba7-4295-bfe9-07de87c01bbc +version: 2 +date: '2020-11-23' author: Bhavin Patel, Splunk +type: TTP datamodel: - Endpoint -date: '2020-11-23' description: This search looks for registry activity associated with modifications to the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors`. In this scenario, an attacker can load an arbitrary .dll into the print-monitor registry by giving the full path name to the after.dll. The system will execute the .dll with elevated (SYSTEM) permissions and will persist after reboot. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Registry where Registry.action=modified AND + Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*" by Registry.dest, + Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_name + Registry.action | `drop_dm_object_name(Registry)` | `monitor_registry_keys_for_print_monitors_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report registry modifications. -id: f5f6af30-7ba7-4295-bfe9-07de87c01bbc known_false_positives: You will encounter noise from legitimate print-monitor registry entries. -name: Monitor Registry Keys for Print Monitors references: [] -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Registry where Registry.action=modified AND - Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*" by Registry.dest, - Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_name - Registry.action | `drop_dm_object_name(Registry)` | `monitor_registry_keys_for_print_monitors_filter`' tags: analytic_story: - Suspicious Windows Registry Activities @@ -70,5 +72,3 @@ tags: - _time risk_score: 64 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml index d6532cbb42..6016cff9c4 100644 --- a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml +++ b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml @@ -1,6 +1,10 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: MS Scripting Process Loading Ldap Module +id: 0b0c40dc-14a6-11ec-b267-acde48001122 +version: 1 date: '2021-09-13' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: [] description: This search is to detect a suspicious MS scripting process such as wscript.exe or cscript.exe that loading ldap module to process ldap query. This behavior was seen in FIN7 implant where it uses javascript to execute ldap query to parse host @@ -8,22 +12,20 @@ description: This search is to detect a suspicious MS scripting process such as step to hunt further a suspicious ldap query or ldap related events to the host that may give you good information regarding ldap or AD information processing or might be a attacker. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -id: 0b0c40dc-14a6-11ec-b267-acde48001122 -known_false_positives: automation scripting language may used by network operator - to do ldap query. -name: MS Scripting Process Loading Ldap Module -references: -- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html -- https://attack.mitre.org/groups/G0046/ search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded IN ("*\\Wldap32.dll", "*\\adsldp.dll", "*\\adsldpc.dll") | stats min(_time) as firstTime max(_time) as lastTime count by Image EventCode process_name ProcessId ProcessGuid Computer ImageLoaded | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ms_scripting_process_loading_ldap_module_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: automation scripting language may used by network operator + to do ldap query. +references: +- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html +- https://attack.mitre.org/groups/G0046/ tags: analytic_story: - FIN7 @@ -61,5 +63,3 @@ tags: - ImageLoaded risk_score: 9 security_domain: endpoint -type: Anomaly -version: 1 diff --git a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml index a1b49e0fb8..2b367bdd65 100644 --- a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml +++ b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml @@ -1,6 +1,10 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: MS Scripting Process Loading WMI Module +id: 2eba3d36-14a6-11ec-a682-acde48001122 +version: 1 date: '2021-09-13' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: [] description: This search is to detect a suspicious MS scripting process such as wscript.exe or cscript.exe that loading wmi module to process wmi query. This behavior was seen in FIN7 implant where it uses javascript to execute wmi query to parse host information @@ -8,23 +12,21 @@ description: This search is to detect a suspicious MS scripting process such as to hunt further a suspicious wmi query or wmi related events to the host that may give you good information regarding process that are commonly using wmi query or modules or might be an attacker using this technique. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -id: 2eba3d36-14a6-11ec-a682-acde48001122 -known_false_positives: automation scripting language may used by network operator - to do ldap query. -name: MS Scripting Process Loading WMI Module -references: -- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html -- https://attack.mitre.org/groups/G0046/ search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded IN ("*\\fastprox.dll", "*\\wbemdisp.dll", "*\\wbemprox.dll", "*\\wbemsvc.dll" , "*\\wmiutils.dll", "*\\wbemcomn.dll") | stats min(_time) as firstTime max(_time) as lastTime count by Image EventCode process_name ProcessId ProcessGuid Computer ImageLoaded | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ms_scripting_process_loading_wmi_module_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: automation scripting language may used by network operator + to do ldap query. +references: +- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html +- https://attack.mitre.org/groups/G0046/ tags: analytic_story: - FIN7 @@ -62,5 +64,3 @@ tags: - ImageLoaded risk_score: 9 security_domain: endpoint -type: Anomaly -version: 1 diff --git a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml index b2a6dac022..56f12ab063 100644 --- a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml +++ b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml @@ -1,24 +1,17 @@ +name: MSBuild Suspicious Spawned By Script Process +id: 213b3148-24ea-11ec-93a2-acde48001122 +version: 1 +date: '2021-10-04' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-10-04' description: This analytic is to detect a suspicious child process of MSBuild spawned by Windows Script Host - cscript or wscript. This behavior or event are commonly seen and used by malware or adversaries to execute malicious msbuild process using malicious script in the compromised host. During triage, review parallel processes and identify any file modifications. MSBuild may load a script from the same path without having command-line arguments. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 213b3148-24ea-11ec-93a2-acde48001122 -known_false_positives: False positives should be limited as developers do not spawn - MSBuild via a WSH. -name: MSBuild Suspicious Spawned By Script Process -references: -- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name @@ -26,6 +19,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `msbuild_suspicious_spawned_by_script_process_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives should be limited as developers do not spawn + MSBuild via a WSH. +references: +- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# tags: analytic_story: - Trusted Developer Utilities Proxy Execution MSBuild @@ -68,5 +70,3 @@ tags: - _time risk_score: 49 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml index 3ad2dad958..6a6a52ae12 100644 --- a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml +++ b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml @@ -1,28 +1,30 @@ +name: Mshta spawning Rundll32 OR Regsvr32 Process +id: 4aa5d062-e893-11eb-9eb2-acde48001122 +version: 2 +date: '2021-07-19' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-07-19' description: This search is to detect a suspicious mshta.exe process that spawn rundll32 or regsvr32 child process. This technique was seen in several malware nowadays like trickbot to load its initial .dll stage loader to execute and download the the actual trickbot payload. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 4aa5d062-e893-11eb-9eb2-acde48001122 -known_false_positives: limitted. this anomaly behavior is not commonly seen in clean - host. -name: Mshta spawning Rundll32 OR Regsvr32 Process -references: -- https://twitter.com/cyb3rops/status/1416050325870587910?s=21 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name = "mshta.exe" `process_rundll32` OR `process_regsvr32` by Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `mshta_spawning_rundll32_or_regsvr32_process_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: limitted. this anomaly behavior is not commonly seen in clean + host. +references: +- https://twitter.com/cyb3rops/status/1416050325870587910?s=21 tags: analytic_story: - Trickbot @@ -67,5 +69,3 @@ tags: - _time risk_score: 56 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/mshtml_module_load_in_office_product.yml b/detections/endpoint/mshtml_module_load_in_office_product.yml index f7e9ac3ee3..18f31034e0 100644 --- a/detections/endpoint/mshtml_module_load_in_office_product.yml +++ b/detections/endpoint/mshtml_module_load_in_office_product.yml @@ -1,26 +1,28 @@ -author: Michael Haag, Splunk -datamodel: [] +name: MSHTML Module Load in Office Product +id: 5f1c168e-118b-11ec-84ff-acde48001122 +version: 1 date: '2021-09-09' +author: Michael Haag, Splunk +type: TTP +datamodel: [] description: The following detection identifies the module load of mshtml.dll into an Office product. This behavior has been related to CVE-2021-40444, whereas the malicious document will load ActiveX, which activates the MSHTML component. The vulnerability resides in the MSHTML component. During triage, identify parallel processes and capture any file modifications for analysis. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process names and image loads from your endpoints. If you are using - Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -id: 5f1c168e-118b-11ec-84ff-acde48001122 -known_false_positives: Limited false positives will be present, however, tune as necessary. -name: MSHTML Module Load in Office Product -references: -- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ -- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 -- https://strontic.github.io/xcyclopedia/index-dll search: '`sysmon` EventID=7 process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll") | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, ImageLoaded, OriginalFileName, process_id | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mshtml_module_load_in_office_product_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process names and image loads from your endpoints. If you are using + Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: Limited false positives will be present, however, tune as necessary. +references: +- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ +- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 +- https://strontic.github.io/xcyclopedia/index-dll tags: analytic_story: - Spearphishing Attachments @@ -68,5 +70,3 @@ tags: - dest risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/msmpeng_application_dll_side_loading.yml b/detections/endpoint/msmpeng_application_dll_side_loading.yml index f4a2921ee0..cb19c7d010 100644 --- a/detections/endpoint/msmpeng_application_dll_side_loading.yml +++ b/detections/endpoint/msmpeng_application_dll_side_loading.yml @@ -1,26 +1,28 @@ +name: Msmpeng Application DLL Side Loading +id: 8bb3f280-dd9b-11eb-84d5-acde48001122 +version: 1 +date: '2021-07-05' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-07-05' description: This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in non default windows defender folder. This technique was seen couple days ago with revil ransomware in Kaseya Supply chain. The approach is to drop an old version of msmpeng.exe to load the actual payload name as mspvc.dll which will load the revil ransomware to the compromise machine -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Filesystem` node. -id: 8bb3f280-dd9b-11eb-84d5-acde48001122 -known_false_positives: quite minimal false positive expected. -name: Msmpeng Application DLL Side Loading -references: -- https://community.sophos.com/b/security-blog/posts/active-ransomware-attack-on-kaseya-customers search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where (Filesystem.file_name = "msmpeng.exe" OR Filesystem.file_name = "mpsvc.dll") AND Filesystem.file_path != "*\\Program Files\\windows defender\\*" by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `msmpeng_application_dll_side_loading_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the Filesystem responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +known_false_positives: quite minimal false positive expected. +references: +- https://community.sophos.com/b/security-blog/posts/active-ransomware-attack-on-kaseya-customers tags: analytic_story: - Ransomware @@ -45,5 +47,3 @@ tags: - Endpoint.Filesystem.user - _time security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml index 239ab26083..2288b51fce 100644 --- a/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -1,6 +1,10 @@ -author: Mauricio Velazco, Splunk -datamodel: [] +name: Multiple Disabled Users Failing To Authenticate From Host Using Kerberos +id: 98f22d82-9d62-11eb-9fcf-acde48001122 +version: 1 date: '2021-04-14' +author: Mauricio Velazco, Splunk +type: Anomaly +datamodel: [] description: 'The following analytic identifies one source endpoint failing to authenticate with multiple disabled domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory @@ -22,23 +26,21 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.' -how_to_implement: To successfully implement this search, you need to be ingesting - Domain Controller and Kerberos events. The Advanced Security Audit policy setting - `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. -id: 98f22d82-9d62-11eb-9fcf-acde48001122 -known_false_positives: A host failing to authenticate with multiple disabled domain - users is not a common behavior for legitimate systems. Possible false positive scenarios - include but are not limited to vulnerability scanners, multi-user systems missconfigured - systems. -name: Multiple Disabled Users Failing To Authenticate From Host Using Kerberos -references: -- https://attack.mitre.org/techniques/T1110/003/ search: '`wineventlog_security` EventCode=4768 Account_Name!="*$" Result_Code=0x12 | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos_filter` ' +how_to_implement: To successfully implement this search, you need to be ingesting + Domain Controller and Kerberos events. The Advanced Security Audit policy setting + `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +known_false_positives: A host failing to authenticate with multiple disabled domain + users is not a common behavior for legitimate systems. Possible false positive scenarios + include but are not limited to vulnerability scanners, multi-user systems missconfigured + systems. +references: +- https://attack.mitre.org/techniques/T1110/003/ tags: analytic_story: - Active Directory Password Spraying @@ -74,5 +76,3 @@ tags: - Client_Address risk_score: 49 security_domain: endpoint -type: Anomaly -version: 1 diff --git a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml index 1f9fb534ee..f67fb581e3 100644 --- a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -1,6 +1,10 @@ -author: Mauricio Velazco, Splunk -datamodel: [] +name: Multiple Invalid Users Failing To Authenticate From Host Using Kerberos +id: 001266a6-9d5b-11eb-829b-acde48001122 +version: 1 date: '2021-04-14' +author: Mauricio Velazco, Splunk +type: Anomaly +datamodel: [] description: 'The following analytic identifies one source endpoint failing to authenticate with multiple invalid domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory @@ -22,23 +26,21 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.' -how_to_implement: To successfully implement this search, you need to be ingesting - Domain Controller and Kerberos events. The Advanced Security Audit policy setting - `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. -id: 001266a6-9d5b-11eb-829b-acde48001122 -known_false_positives: A host failing to authenticate with multiple invalid domain - users is not a common behavior for legitimate systems. Possible false positive scenarios - include but are not limited to vulnerability scanners, multi-user systems and missconfigured - systems. -name: Multiple Invalid Users Failing To Authenticate From Host Using Kerberos -references: -- https://attack.mitre.org/techniques/T1110/003/ search: '`wineventlog_security` EventCode=4768 Result_Code=0x6 Account_Name!="*$" | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos_filter` ' +how_to_implement: To successfully implement this search, you need to be ingesting + Domain Controller and Kerberos events. The Advanced Security Audit policy setting + `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +known_false_positives: A host failing to authenticate with multiple invalid domain + users is not a common behavior for legitimate systems. Possible false positive scenarios + include but are not limited to vulnerability scanners, multi-user systems and missconfigured + systems. +references: +- https://attack.mitre.org/techniques/T1110/003/ tags: analytic_story: - Active Directory Password Spraying @@ -74,5 +76,3 @@ tags: - Client_Address risk_score: 49 security_domain: endpoint -type: Anomaly -version: 1 diff --git a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml index 706d594c0f..f6d3946811 100644 --- a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml @@ -1,6 +1,10 @@ -author: Mauricio Velazco, Splunk -datamodel: [] +name: Multiple Invalid Users Failing To Authenticate From Host Using NTLM +id: 57ad5a64-9df7-11eb-a290-acde48001122 +version: 1 date: '2021-04-15' +author: Mauricio Velazco, Splunk +type: Anomaly +datamodel: [] description: 'The following analytic identifies one source endpoint failing to authenticate with multiple invalid users using the NTLM protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment @@ -23,26 +27,24 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts.' -how_to_implement: To successfully implement this search, you need to be ingesting - Domain Controller events. The Advanced Security Audit policy setting `Audit Credential - Validation' within `Account Logon` needs to be enabled. -id: 57ad5a64-9df7-11eb-a290-acde48001122 -known_false_positives: A host failing to authenticate with multiple invalid domain - users is not a common behavior for legitimate systems. Possible false positive scenarios - include but are not limited to vulnerability scanners and missconfigured systems. - If this detection triggers on a host other than a Domain Controller, the behavior - could represent a password spraying attack against the host's local accounts. -name: Multiple Invalid Users Failing To Authenticate From Host Using NTLM -references: -- https://attack.mitre.org/techniques/T1110/003/ -- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation -- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776 search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC0000064 action=failure | bucket span=2m _time | stats dc(Logon_Account) AS unique_accounts values(Logon_Account) as tried_accounts by _time, Source_Workstation | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Domain Controller events. The Advanced Security Audit policy setting `Audit Credential + Validation' within `Account Logon` needs to be enabled. +known_false_positives: A host failing to authenticate with multiple invalid domain + users is not a common behavior for legitimate systems. Possible false positive scenarios + include but are not limited to vulnerability scanners and missconfigured systems. + If this detection triggers on a host other than a Domain Controller, the behavior + could represent a password spraying attack against the host's local accounts. +references: +- https://attack.mitre.org/techniques/T1110/003/ +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776 tags: analytic_story: - Active Directory Password Spraying @@ -78,5 +80,3 @@ tags: - Source_Workstation risk_score: 49 security_domain: endpoint -type: Anomaly -version: 1 diff --git a/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml b/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml index f9a61c1683..e09b12edba 100644 --- a/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml +++ b/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml @@ -1,6 +1,10 @@ -author: Mauricio Velazco, Splunk -datamodel: [] +name: Multiple Users Attempting To Authenticate Using Explicit Credentials +id: e61918fa-9ca4-11eb-836c-acde48001122 +version: 1 date: '2021-04-13' +author: Mauricio Velazco, Splunk +type: Anomaly +datamodel: [] description: 'The following analytic identifies a source user failing to authenticate with multiple users using explicit credentials on a host. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment @@ -21,21 +25,6 @@ description: 'The following analytic identifies a source user failing to authent The analytics returned fields allow analysts to investigate the event further by providing fields like source account, attempted user accounts and the endpoint were the behavior was identified.' -how_to_implement: To successfully implement this search, you need to be ingesting - Windows Event Logs from domain controllers as well as member servers and workstations. - The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs - to be enabled. -id: e61918fa-9ca4-11eb-836c-acde48001122 -known_false_positives: A source user failing attempting to authenticate multiple users - on a host is not a common behavior for regular systems. Some applications, however, - may exhibit this behavior in which case sets of users hosts can be added to an allow - list. Possible false positive scenarios include systems where several users connect - to like Mail servers, identity providers, remote desktop services, Citrix, etc. -name: Multiple Users Attempting To Authenticate Using Explicit Credentials -references: -- https://attack.mitre.org/techniques/T1110/003/ -- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648 -- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events search: ' `wineventlog_security` EventCode=4648 | bucket span=2m _time | eval Source_Account = mvindex(Account_Name, 0) | eval Destination_Account = mvindex(Account_Name, 1) | search Source_Account != "*$" Source_Account !="-" Destination_Account !="*$" @@ -44,6 +33,19 @@ search: ' `wineventlog_security` EventCode=4648 | bucket span=2m _time | eval So as comp_avg , stdev(unique_accounts) as comp_std by ComputerName | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_users_attempting_to_authenticate_using_explicit_credentials_filter` ' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows Event Logs from domain controllers as well as member servers and workstations. + The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs + to be enabled. +known_false_positives: A source user failing attempting to authenticate multiple users + on a host is not a common behavior for regular systems. Some applications, however, + may exhibit this behavior in which case sets of users hosts can be added to an allow + list. Possible false positive scenarios include systems where several users connect + to like Mail servers, identity providers, remote desktop services, Citrix, etc. +references: +- https://attack.mitre.org/techniques/T1110/003/ +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648 +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events tags: analytic_story: - Active Directory Password Spraying @@ -78,5 +80,3 @@ tags: - _time risk_score: 49 security_domain: endpoint -type: Anomaly -version: 1 diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml index 4f1c0773c2..88271a5856 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -1,6 +1,10 @@ -author: Mauricio Velazco, Splunk -datamodel: [] +name: Multiple Users Failing To Authenticate From Host Using Kerberos +id: 3a91a212-98a9-11eb-b86a-acde48001122 +version: 1 date: '2021-04-08' +author: Mauricio Velazco, Splunk +type: Anomaly +datamodel: [] description: 'The following analytic identifies one source endpoint failing to authenticate with multiple valid users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment @@ -20,25 +24,23 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.' -how_to_implement: To successfully implement this search, you need to be ingesting - Domain Controller and Kerberos events. The Advanced Security Audit policy setting - `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. -id: 3a91a212-98a9-11eb-b86a-acde48001122 -known_false_positives: A host failing to authenticate with multiple valid domain users - is not a common behavior for legitimate systems. Possible false positive scenarios - include but are not limited to vulnerability scanners, missconfigured systems and - multi-user systems like Citrix farms. -name: Multiple Users Failing To Authenticate From Host Using Kerberos -references: -- https://attack.mitre.org/techniques/T1110/003/ -- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn319109(v=ws.11) -- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4771 search: '`wineventlog_security` EventCode=4771 Failure_Code=0x18 Account_Name!="*$" | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_users_failing_to_authenticate_from_host_using_kerberos_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Domain Controller and Kerberos events. The Advanced Security Audit policy setting + `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +known_false_positives: A host failing to authenticate with multiple valid domain users + is not a common behavior for legitimate systems. Possible false positive scenarios + include but are not limited to vulnerability scanners, missconfigured systems and + multi-user systems like Citrix farms. +references: +- https://attack.mitre.org/techniques/T1110/003/ +- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn319109(v=ws.11) +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4771 tags: analytic_story: - Active Directory Password Spraying @@ -73,5 +75,3 @@ tags: - _time risk_score: 49 security_domain: endpoint -type: Anomaly -version: 1 diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml index dd553927df..67075e44c5 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml @@ -1,6 +1,10 @@ -author: Mauricio Velazco, Splunk -datamodel: [] +name: Multiple Users Failing To Authenticate From Host Using NTLM +id: 7ed272a4-9c77-11eb-af22-acde48001122 +version: 1 date: '2021-04-13' +author: Mauricio Velazco, Splunk +type: Anomaly +datamodel: [] description: 'The following analytic identifies one source endpoint failing to authenticate with multiple valid users using the NTLM protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment @@ -21,26 +25,24 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts.' -how_to_implement: To successfully implement this search, you need to be ingesting - Domain Controller events. The Advanced Security Audit policy setting `Audit Credential - Validation` within `Account Logon` needs to be enabled. -id: 7ed272a4-9c77-11eb-af22-acde48001122 -known_false_positives: A host failing to authenticate with multiple valid domain users - is not a common behavior for legitimate systems. Possible false positive scenarios - include but are not limited to vulnerability scanners and missconfigured systems. - If this detection triggers on a host other than a Domain Controller, the behavior - could represent a password spraying attack against the host's local accounts. -name: Multiple Users Failing To Authenticate From Host Using NTLM -references: -- https://attack.mitre.org/techniques/T1110/003/ -- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation -- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776 search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC000006A action=failure | bucket span=2m _time | stats dc(Logon_Account) AS unique_accounts values(Logon_Account) as tried_accounts by _time, Source_Workstation | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_users_failing_to_authenticate_from_host_using_ntlm_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Domain Controller events. The Advanced Security Audit policy setting `Audit Credential + Validation` within `Account Logon` needs to be enabled. +known_false_positives: A host failing to authenticate with multiple valid domain users + is not a common behavior for legitimate systems. Possible false positive scenarios + include but are not limited to vulnerability scanners and missconfigured systems. + If this detection triggers on a host other than a Domain Controller, the behavior + could represent a password spraying attack against the host's local accounts. +references: +- https://attack.mitre.org/techniques/T1110/003/ +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776 tags: analytic_story: - Active Directory Password Spraying @@ -76,5 +78,3 @@ tags: - Source_Workstation risk_score: 49 security_domain: endpoint -type: Anomaly -version: 1 diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml index 2a2c074a41..916c6770ce 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml @@ -1,6 +1,10 @@ -author: Mauricio Velazco, Splunk -datamodel: [] +name: Multiple Users Failing To Authenticate From Process +id: 9015385a-9c84-11eb-bef2-acde48001122 +version: 1 date: '2021-04-13' +author: Mauricio Velazco, Splunk +type: Anomaly +datamodel: [] description: 'The following analytic identifies a source process name failing to authenticate with multiple users. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access @@ -21,20 +25,6 @@ description: 'The following analytic identifies a source process name failing to The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts.' -how_to_implement: To successfully implement this search, you need to be ingesting - Windows Event Logs from domain controllers aas well as member servers and workstations. - The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs - to be enabled. -id: 9015385a-9c84-11eb-bef2-acde48001122 -known_false_positives: A process failing to authenticate with multiple users is not - a common behavior for legitimate user sessions. Possible false positive scenarios - include but are not limited to vulnerability scanners and missconfigured systems. -name: Multiple Users Failing To Authenticate From Process -references: -- https://attack.mitre.org/techniques/T1110/003/ -- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625 -- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625 -- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events search: ' `wineventlog_security` EventCode=4625 Logon_Type=2 Caller_Process_Name!="-" | bucket span=2m _time | eval Source_Account = mvindex(Account_Name, 0) | eval Destination_Account = mvindex(Account_Name, 1) | stats dc(Destination_Account) AS unique_accounts values(Account_Name) @@ -43,6 +33,18 @@ search: ' `wineventlog_security` EventCode=4625 Logon_Type=2 Caller_Process_Name by Caller_Process_Name, Source_Account, ComputerName | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_users_failing_to_authenticate_from_process_filter` ' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows Event Logs from domain controllers aas well as member servers and workstations. + The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs + to be enabled. +known_false_positives: A process failing to authenticate with multiple users is not + a common behavior for legitimate user sessions. Possible false positive scenarios + include but are not limited to vulnerability scanners and missconfigured systems. +references: +- https://attack.mitre.org/techniques/T1110/003/ +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625 +- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625 +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events tags: analytic_story: - Active Directory Password Spraying @@ -79,5 +81,3 @@ tags: - _time risk_score: 49 security_domain: endpoint -type: Anomaly -version: 1 diff --git a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml index ae0c21f92b..1e23261f9c 100644 --- a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml +++ b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml @@ -1,6 +1,10 @@ -author: Mauricio Velazco, Splunk -datamodel: [] +name: Multiple Users Remotely Failing To Authenticate From Host +id: 80f9d53e-9ca1-11eb-b0d6-acde48001122 +version: 1 date: '2021-04-13' +author: Mauricio Velazco, Splunk +type: Anomaly +datamodel: [] description: 'The following analytic identifies a source host failing to authenticate against a remote host with multiple users. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to @@ -20,21 +24,6 @@ description: 'The following analytic identifies a source host failing to authent The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts.' -how_to_implement: To successfully implement this search, you need to be ingesting - Windows Event Logs from domain controllers as as well as member servers and workstations. - The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs - to be enabled. -id: 80f9d53e-9ca1-11eb-b0d6-acde48001122 -known_false_positives: A host failing to authenticate with multiple valid users against - a remote host is not a common behavior for legitimate systems. Possible false positive - scenarios include but are not limited to vulnerability scanners, remote administration - tools, missconfigyred systems, etc. -name: Multiple Users Remotely Failing To Authenticate From Host -references: -- https://attack.mitre.org/techniques/T1110/003/ -- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625 -- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625 -- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 Source_Network_Address!="-" | bucket span=2m _time | eval Destination_Account = mvindex(Account_Name, 1) | stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_accounts @@ -42,6 +31,19 @@ search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 Source_Network_Addr as comp_avg , stdev(unique_accounts) as comp_std by Source_Network_Address, ComputerName | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_users_remotely_failing_to_authenticate_from_host_filter` ' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows Event Logs from domain controllers as as well as member servers and workstations. + The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs + to be enabled. +known_false_positives: A host failing to authenticate with multiple valid users against + a remote host is not a common behavior for legitimate systems. Possible false positive + scenarios include but are not limited to vulnerability scanners, remote administration + tools, missconfigyred systems, etc. +references: +- https://attack.mitre.org/techniques/T1110/003/ +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625 +- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625 +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events tags: analytic_story: - Active Directory Password Spraying @@ -78,5 +80,3 @@ tags: - _time risk_score: 49 security_domain: endpoint -type: Anomaly -version: 1 diff --git a/detections/endpoint/net_localgroup_discovery.yml b/detections/endpoint/net_localgroup_discovery.yml index e9921acb62..6e6e53783d 100644 --- a/detections/endpoint/net_localgroup_discovery.yml +++ b/detections/endpoint/net_localgroup_discovery.yml @@ -1,21 +1,14 @@ +name: Net Localgroup Discovery +id: 54f5201e-155b-11ec-a6e2-acde48001122 +version: 1 +date: '2021-09-14' author: Michael Haag, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-09-14' description: The following hunting analytic will identify the use of localgroup discovery using `net localgroup`. During triage, review parallel processes and identify any further suspicious behavior. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 54f5201e-155b-11ec-a6e2-acde48001122 -known_false_positives: False positives may be present. Tune as needed. -name: Net Localgroup Discovery -references: -- https://attack.mitre.org/techniques/T1069/001/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="net.exe" OR Processes.process_name="net1.exe" (Processes.process="*localgroup*") by Processes.dest @@ -23,6 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.original_file_name Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `net_localgroup_discovery_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives may be present. Tune as needed. +references: +- https://attack.mitre.org/techniques/T1069/001/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md tags: analytic_story: - Active Directory Discovery @@ -67,5 +69,3 @@ tags: - _time risk_score: 15 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/net_profiler_uac_bypass.yml b/detections/endpoint/net_profiler_uac_bypass.yml index 2dc5ef3980..106e1b4315 100644 --- a/detections/endpoint/net_profiler_uac_bypass.yml +++ b/detections/endpoint/net_profiler_uac_bypass.yml @@ -1,28 +1,30 @@ +name: NET Profiler UAC bypass +id: 0252ca80-e30d-11eb-8aa3-acde48001122 +version: 1 +date: '2021-07-12' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-07-12' description: This search is to detect modification of registry to bypass UAC windows feature. This technique is to add a payload dll path on .NET COR file path that will be loaded by mmc.exe as soon it was executed. This detection rely on monitoring the registry key and values in the detection area. It may happened that windows update some dll related to mmc.exe and add dll path in this registry. In this case filtering is needed. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -id: 0252ca80-e30d-11eb-8aa3-acde48001122 -known_false_positives: limited false positive. It may trigger by some windows update - that will modify this registry. -name: NET Profiler UAC bypass -references: -- https://offsec.almond.consulting/UAC-bypass-dotnet.html search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\Environment\\COR_PROFILER_PATH" Registry.registry_value_name = "*.dll" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `net_profiler_uac_bypass_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: limited false positive. It may trigger by some windows update + that will modify this registry. +references: +- https://offsec.almond.consulting/UAC-bypass-dotnet.html tags: analytic_story: - Windows Defense Evasion Tactics @@ -60,5 +62,3 @@ tags: - _time risk_score: 63 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/network_connection_discovery_arp.yml b/detections/endpoint/network_connection_discovery_arp.yml index 3b870c69ca..e8b0841366 100644 --- a/detections/endpoint/network_connection_discovery_arp.yml +++ b/detections/endpoint/network_connection_discovery_arp.yml @@ -1,24 +1,26 @@ +name: Network Connection Discovery With Arp +id: ae008c0f-83bd-4ed4-9350-98d4328e15d2 +version: 1 +date: '2021-09-10' author: Mauricio Velazco, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-09-10' description: This analytic looks for the execution of `arp.exe` utilized to get a listing of network connections on a compromised system. Red Teams and adversaries alike may use arp.exe for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: ae008c0f-83bd-4ed4-9350-98d4328e15d2 -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: Network Connection Discovery With Arp -references: -- https://attack.mitre.org/techniques/T1049/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="arp.exe") (Processes.process=*-a*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `network_connection_discovery_with_arp_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1049/ tags: analytic_story: - Active Directory Discovery @@ -55,5 +57,3 @@ tags: - Endpoint.Processes.user risk_score: 15 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/network_connection_discovery_net.yml b/detections/endpoint/network_connection_discovery_net.yml index ece8e7f5ac..bf36bd152f 100644 --- a/detections/endpoint/network_connection_discovery_net.yml +++ b/detections/endpoint/network_connection_discovery_net.yml @@ -1,25 +1,27 @@ +name: Network Connection Discovery With Net +id: 640337e5-6e41-4b7f-af06-9d9eab5e1e2d +version: 1 +date: '2021-09-10' author: Mauricio Velazco, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-09-10' description: This analytic looks for the execution of `net.exe` with command-line arguments utilized to get a listing of network connections on a compromised system. Red Teams and adversaries alike may use net.exe for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: 640337e5-6e41-4b7f-af06-9d9eab5e1e2d -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: Network Connection Discovery With Net -references: -- https://attack.mitre.org/techniques/T1049/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" OR Processes.process_name="net1.exe") (Processes.process=*use*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `network_connection_discovery_with_net_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1049/ tags: analytic_story: - Active Directory Discovery @@ -56,5 +58,3 @@ tags: - Endpoint.Processes.user risk_score: 15 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/network_connection_discovery_netstat.yml b/detections/endpoint/network_connection_discovery_netstat.yml index 5f4b93d55d..b6dd72f71a 100644 --- a/detections/endpoint/network_connection_discovery_netstat.yml +++ b/detections/endpoint/network_connection_discovery_netstat.yml @@ -1,25 +1,27 @@ +name: Network Connection Discovery With Netstat +id: 2cf5cc25-f39a-436d-a790-4857e5995ede +version: 1 +date: '2021-09-10' author: Mauricio Velazco, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-09-10' description: This analytic looks for the execution of `netstat.exe` with command-line arguments utilized to get a listing of network connections on a compromised system. Red Teams and adversaries alike may use netstat.exe for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: 2cf5cc25-f39a-436d-a790-4857e5995ede -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: Network Connection Discovery With Netstat -references: -- https://attack.mitre.org/techniques/T1049/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="netstat.exe") (Processes.process=*-a*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `network_connection_discovery_with_netstat_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1049/ tags: analytic_story: - Active Directory Discovery @@ -56,5 +58,3 @@ tags: - Endpoint.Processes.user risk_score: 15 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/network_discovery_using_route_windows_app.yml b/detections/endpoint/network_discovery_using_route_windows_app.yml index 59fc35facf..191f5f8dcf 100644 --- a/detections/endpoint/network_discovery_using_route_windows_app.yml +++ b/detections/endpoint/network_discovery_using_route_windows_app.yml @@ -1,28 +1,30 @@ +name: Network Discovery Using Route Windows App +id: dd83407e-439f-11ec-ab8e-acde48001122 +version: 1 +date: '2021-11-12' author: Teoderick Contreras, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-11-12' description: This analytic look for a spawned process of route.exe windows application. Adversaries and red teams alike abuse this application the recon or do a network discovery on a target host. but one possible false positive might be an automated tool used by a system administator or a powershell script in amazon ec2 config services. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: dd83407e-439f-11ec-ab8e-acde48001122 -known_false_positives: A network operator or systems administrator may utilize an - automated host discovery application that may generate false positives or an amazon - ec2 script that uses this application. Filter as needed. -name: Network Discovery Using Route Windows App -references: -- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/# search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_route` by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `network_discovery_using_route_windows_app_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: A network operator or systems administrator may utilize an + automated host discovery application that may generate false positives or an amazon + ec2 script that uses this application. Filter as needed. +references: +- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/# tags: analytic_story: - Active Directory Discovery @@ -62,5 +64,3 @@ tags: - _time risk_score: 9 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/nishang_powershelltcponeline.yml b/detections/endpoint/nishang_powershelltcponeline.yml index 101ba4860b..b9d8924d1d 100644 --- a/detections/endpoint/nishang_powershelltcponeline.yml +++ b/detections/endpoint/nishang_powershelltcponeline.yml @@ -1,33 +1,35 @@ +name: Nishang PowershellTCPOneLine +id: 1a382c6c-7c2e-11eb-ac69-acde48001122 +version: 2 +date: '2021-03-03' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-03-03' description: This query detects the Nishang Invoke-PowerShellTCPOneLine utility that spawns a call back to a remote command and control server. This is a powershell oneliner. In addition, this will capture on the command-line additional utilities used by Nishang. Triage the endpoint and identify any parallel processes that look suspicious. Review the reputation of the remote IP or domain contacted by the powershell process. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 1a382c6c-7c2e-11eb-ac69-acde48001122 -known_false_positives: Limited false positives may be present. Filter as needed based - on initial analysis. -name: Nishang PowershellTCPOneLine -references: -- https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcpOneLine.ps1 -- https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/ -- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/ -- https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="*Net.Sockets.TCPClient*" AND Processes.process="*System.Text.ASCIIEncoding*") by Processes.dest Processes.user Processes.parent_process Processes.original_file_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `nishang_powershelltcponeline_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Limited false positives may be present. Filter as needed based + on initial analysis. +references: +- https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcpOneLine.ps1 +- https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/ +- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/ +- https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day/ tags: analytic_story: - HAFNIUM Group @@ -67,5 +69,3 @@ tags: - _time risk_score: 42 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml index cd95fa66f0..e93e63100b 100644 --- a/detections/endpoint/nltest_domain_trust_discovery.yml +++ b/detections/endpoint/nltest_domain_trust_discovery.yml @@ -1,19 +1,28 @@ +name: NLTest Domain Trust Discovery +id: c3e05466-5f22-11eb-ae93-0242ac130002 +version: 1 +date: '2021-01-25' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-01-25' description: This search looks for the execution of `nltest.exe` with command-line arguments utilized to query for Domain Trust information. Two arguments `/domain trusts`, returns a list of trusted domains, and `/all_trusts`, returns all trusted domains. Red Teams and adversaries alike use NLTest.exe to enumerate the current domain to assist with further understanding where to pivot next. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="nltest.exe" + OR Processes.process_name!="nltest.exe") (Processes.process="*/domain_trusts*" OR + Processes.process="*/all_trusts*") by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `nltest_domain_trust_discovery_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: c3e05466-5f22-11eb-ae93-0242ac130002 known_false_positives: Administrators may use nltest for troubleshooting purposes, otherwise, rarely used. -name: NLTest Domain Trust Discovery references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md - https://malware.news/t/lets-learn-trickbot-implements-network-collector-module-leveraging-cmd-wmi-ldap/19104 @@ -22,12 +31,6 @@ references: - https://ss64.com/nt/nltest.html - https://redcanary.com/threat-detection-report/techniques/domain-trust-discovery/ - https://thedfirreport.com/2020/10/08/ryuks-return/ -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="nltest.exe" - OR Processes.process_name!="nltest.exe") (Processes.process="*/domain_trusts*" OR Processes.process="*/all_trusts*") - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `nltest_domain_trust_discovery_filter`' tags: analytic_story: - Ryuk Ransomware @@ -73,5 +76,3 @@ tags: - _time risk_score: 15 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml index d0c3885c92..68e3d8d78a 100644 --- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -1,6 +1,10 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Non Chrome Process Accessing Chrome Default Dir +id: 81263de4-160a-11ec-944f-acde48001122 +version: 1 date: '2021-09-15' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: [] description: This search is to detect an anomaly event of non-chrome process accessing the files in chrome user default folder. This folder contains all the sqlite database of the chrome browser related to users login, history, cookies and etc. Most of @@ -9,19 +13,17 @@ description: This search is to detect an anomaly event of non-chrome process acc enabled to tthe firefox profile directory to be eable to use this. Since you monitoring this access to the folder a noise coming from firefox need to be filter and also sqlite db browser and explorer .exe to make this detection more stable. -how_to_implement: To successfully implement this search, you must ingest Windows Security - Event logs and track event code 4663. For 4663, enable "Audit Object Access" in - Group Policy. Then check the two boxes listed for both "Success" and "Failure." -id: 81263de4-160a-11ec-944f-acde48001122 -known_false_positives: other browser not listed related to firefox may catch by this - rule. -name: Non Chrome Process Accessing Chrome Default Dir -references: [] search: '`wineventlog_security` EventCode=4663 NOT (process_name IN ("*\\chrome.exe", "*\\explorer.exe", "*sql*")) Object_Name="*\\Google\\Chrome\\User Data\\Default*" | stats count min(_time) as firstTime max(_time) as lastTime by Object_Name Object_Type process_name Access_Mask Accesses process_id EventCode dest user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `non_chrome_process_accessing_chrome_default_dir_filter`' +how_to_implement: To successfully implement this search, you must ingest Windows Security + Event logs and track event code 4663. For 4663, enable "Audit Object Access" in + Group Policy. Then check the two boxes listed for both "Success" and "Failure." +known_false_positives: other browser not listed related to firefox may catch by this + rule. +references: [] tags: analytic_story: - FIN7 @@ -66,5 +68,3 @@ tags: - user risk_score: 35 security_domain: endpoint -type: Anomaly -version: 1 diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index d8e41e0c9b..fa0372d4e0 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -1,6 +1,10 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Non Firefox Process Access Firefox Profile Dir +id: e6fc13b0-1609-11ec-b533-acde48001122 +version: 1 date: '2021-09-15' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: [] description: This search is to detect an anomaly event of non-firefox process accessing the files in profile folder. This folder contains all the sqlite database of the firefox browser related to users login, history, cookies and etc. Most of the RAT, @@ -9,19 +13,17 @@ description: This search is to detect an anomaly event of non-firefox process ac tthe firefox profile directory to be eable to use this. Since you monitoring this access to the folder a noise coming from firefox need to be filter and also sqlite db browser and explorer .exe to make this detection more stable. -how_to_implement: To successfully implement this search, you must ingest Windows Security - Event logs and track event code 4663. For 4663, enable "Audit Object Access" in - Group Policy. Then check the two boxes listed for both "Success" and "Failure." -id: e6fc13b0-1609-11ec-b533-acde48001122 -known_false_positives: other browser not listed related to firefox may catch by this - rule. -name: Non Firefox Process Access Firefox Profile Dir -references: [] search: '`wineventlog_security` EventCode=4663 NOT (process_name IN ("*\\firefox.exe", "*\\explorer.exe", "*sql*")) Object_Name="*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles*" | stats count min(_time) as firstTime max(_time) as lastTime by Object_Name Object_Type process_name Access_Mask Accesses process_id EventCode dest user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `non_firefox_process_access_firefox_profile_dir_filter`' +how_to_implement: To successfully implement this search, you must ingest Windows Security + Event logs and track event code 4663. For 4663, enable "Audit Object Access" in + Group Policy. Then check the two boxes listed for both "Success" and "Failure." +known_false_positives: other browser not listed related to firefox may catch by this + rule. +references: [] tags: analytic_story: - FIN7 @@ -66,5 +68,3 @@ tags: - user risk_score: 35 security_domain: endpoint -type: Anomaly -version: 1 diff --git a/detections/endpoint/ntdsutil_export_ntds.yml b/detections/endpoint/ntdsutil_export_ntds.yml index d3c2e04733..bf8c81a832 100644 --- a/detections/endpoint/ntdsutil_export_ntds.yml +++ b/detections/endpoint/ntdsutil_export_ntds.yml @@ -1,7 +1,11 @@ +name: Ntdsutil Export NTDS +id: da63bc76-61ae-11eb-ae93-0242ac130002 +version: 1 +date: '2021-01-28' author: Michael Haag, Patrick Bareiss, Splunk +type: TTP datamodel: - Endpoint -date: '2021-01-28' description: 'Monitor for signs that Ntdsutil is being used to Extract Active Directory database - NTDS.dit, typically used for offline password cracking. It may be used in normal circumstances with no command line arguments or shorthand variations of @@ -13,25 +17,23 @@ description: 'Monitor for signs that Ntdsutil is being used to Extract Active Di This technique uses "Install from Media" (IFM), which will extract a copy of the Active Directory database. A successful export of the Active Directory database will yield a file modification named ntds.dit to the destination.' -how_to_implement: You must be ingesting endpoint data that tracks process activity, - including parent-child relationships from your endpoints, to populate the Endpoint - data model in the Processes node. The command-line arguments are mapped to the "process" - field in the Endpoint data model. -id: da63bc76-61ae-11eb-ae93-0242ac130002 -known_false_positives: Highly possible Server Administrators will troubleshoot with - ntdsutil.exe, generating false positives. -name: Ntdsutil Export NTDS -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.003/T1003.003.md#atomic-test-3---dump-active-directory-database-with-ntdsutil -- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753343(v=ws.11) -- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf -- https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="ntdsutil.exe" Processes.process="*ntds*" Processes.process="*create*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `ntdsutil_export_ntds_filter`' +how_to_implement: You must be ingesting endpoint data that tracks process activity, + including parent-child relationships from your endpoints, to populate the Endpoint + data model in the Processes node. The command-line arguments are mapped to the "process" + field in the Endpoint data model. +known_false_positives: Highly possible Server Administrators will troubleshoot with + ntdsutil.exe, generating false positives. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.003/T1003.003.md#atomic-test-3---dump-active-directory-database-with-ntdsutil +- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753343(v=ws.11) +- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf +- https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html tags: analytic_story: - Credential Dumping @@ -76,5 +78,3 @@ tags: - _time risk_score: 50 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/office_application_drop_executable.yml b/detections/endpoint/office_application_drop_executable.yml index 7151ee6e51..82fc077fea 100644 --- a/detections/endpoint/office_application_drop_executable.yml +++ b/detections/endpoint/office_application_drop_executable.yml @@ -1,23 +1,17 @@ +name: Office Application Drop Executable +id: 73ce70c4-146d-11ec-9184-acde48001122 +version: 1 +date: '2021-09-13' author: Teoderick Contreras, Michael Haag Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-13' description: This search is to detect a suspicious MS office application that drop or create executables or script in the host. This behavior is commonly seen in spear phishing office attachment where it drop malicious files or script to compromised the host. It might be some normal macro may drop script or tools as part of automation but still this behavior is reallly suspicious and not commonly seen in normal office application -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -id: 73ce70c4-146d-11ec-9184-acde48001122 -known_false_positives: office macro for automation may do this behavior -name: Office Application Drop Executable -references: -- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html -- https://attack.mitre.org/groups/G0046/ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest @@ -31,6 +25,14 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint file_path process_name process_path process proc_guid] | dedup file_create_time | table dest, process_name, process, file_create_time, file_name, file_path, proc_guid | `office_application_drop_executable_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: office macro for automation may do this behavior +references: +- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html +- https://attack.mitre.org/groups/G0046/ tags: analytic_story: - FIN7 @@ -76,5 +78,3 @@ tags: - dest risk_score: 64 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/office_application_spawn_regsvr32_process.yml b/detections/endpoint/office_application_spawn_regsvr32_process.yml index 5bdaf9f75d..0e91a57144 100644 --- a/detections/endpoint/office_application_spawn_regsvr32_process.yml +++ b/detections/endpoint/office_application_spawn_regsvr32_process.yml @@ -1,21 +1,15 @@ +name: Office Application Spawn Regsvr32 process +id: 2d9fc90c-f11f-11eb-9300-acde48001122 +version: 2 +date: '2021-07-30' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-07-30' description: this detection was designed to identifies suspicious spawned process of known MS office application due to macro or malicious code. this technique can be seen in so many malware like IcedID that used MS office as its weapon or attack vector to initially infect the machines. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 2d9fc90c-f11f-11eb-9300-acde48001122 -known_false_positives: unknown -name: Office Application Spawn Regsvr32 process -references: -- https://www.joesandbox.com/analysis/380662/0/html search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name @@ -24,6 +18,14 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.original_file_name Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `office_application_spawn_regsvr32_process_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: unknown +references: +- https://www.joesandbox.com/analysis/380662/0/html tags: analytic_story: - IcedID @@ -63,5 +65,3 @@ tags: - _time risk_score: 63 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml index b097eff933..ffba984049 100644 --- a/detections/endpoint/office_application_spawn_rundll32_process.yml +++ b/detections/endpoint/office_application_spawn_rundll32_process.yml @@ -1,22 +1,15 @@ +name: Office Application Spawn rundll32 process +id: 958751e4-9c5f-11eb-b103-acde48001122 +version: 2 +date: '2021-04-13' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-04-13' description: this detection was designed to identifies suspicious spawned process of known MS office application due to macro or malicious code. this technique can be seen in so many malware like trickbot that used MS office as its weapon or attack vector to initially infect the machines. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 958751e4-9c5f-11eb-b103-acde48001122 -known_false_positives: unknown -name: Office Application Spawn rundll32 process -references: -- https://any.run/malware-trends/trickbot -- https://any.run/report/47561b4e949041eff0a0f4693c59c81726591779fe21183ae9185b5eb6a69847/aba3722a-b373-4dae-8273-8730fb40cdbe search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name @@ -24,6 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `office_application_spawn_rundll32_process_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: unknown +references: +- https://any.run/malware-trends/trickbot +- https://any.run/report/47561b4e949041eff0a0f4693c59c81726591779fe21183ae9185b5eb6a69847/aba3722a-b373-4dae-8273-8730fb40cdbe tags: analytic_story: - Spearphishing Attachments @@ -63,5 +65,3 @@ tags: - Endpoint.Processes.user risk_score: 63 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/office_document_creating_schedule_task.yml b/detections/endpoint/office_document_creating_schedule_task.yml index bd3ebe6315..67295be98e 100644 --- a/detections/endpoint/office_document_creating_schedule_task.yml +++ b/detections/endpoint/office_document_creating_schedule_task.yml @@ -1,6 +1,10 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Office Document Creating Schedule Task +id: cc8b7b74-9d0f-11eb-8342-acde48001122 +version: 1 date: '2021-04-14' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: [] description: this search detects a potential malicious office document that create schedule task entry through macro VBA api or through loading taskschd.dll. This technique was seen in so many malicious macro malware that create persistence , @@ -14,21 +18,19 @@ description: this search detects a potential malicious office document that crea source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. - If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. - Also be sure to include those monitored dll to your own sysmon config. -id: cc8b7b74-9d0f-11eb-8342-acde48001122 -known_false_positives: unknown -name: Office Document Creating Schedule Task -references: -- https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/ -- https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/ search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") ImageLoaded = "*\\taskschd.dll" | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_creating_schedule_task_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + Also be sure to include those monitored dll to your own sysmon config. +known_false_positives: unknown +references: +- https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/ +- https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/ tags: analytic_story: - Spearphishing Attachments @@ -67,5 +69,3 @@ tags: - _time risk_score: 49 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml index 2dee5f3604..8ff99d020c 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -1,6 +1,10 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Office Document Executing Macro Code +id: b12c89bc-9d06-11eb-a592-acde48001122 +version: 1 date: '2021-04-14' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: [] description: this detection was designed to identifies suspicious office documents that using macro code. Macro code is known to be one of the prevalent weaponization or attack vector of threat actor. This malicious macro code is embed to a office @@ -8,20 +12,18 @@ description: this detection was designed to identifies suspicious office documen or other malware component. It is really good practice to disable macro by default to avoid automatically execute macro code while opening or closing a office document files. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. - If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. - Also be sure to include those monitored dll to your own sysmon config. -id: b12c89bc-9d06-11eb-a592-acde48001122 -known_false_positives: Normal Office Document macro use for automation -name: Office Document Executing Macro Code -references: -- https://www.joesandbox.com/analysis/386500/0/html search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_executing_macro_code_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + Also be sure to include those monitored dll to your own sysmon config. +known_false_positives: Normal Office Document macro use for automation +references: +- https://www.joesandbox.com/analysis/386500/0/html tags: analytic_story: - Spearphishing Attachments @@ -62,5 +64,3 @@ tags: - _time risk_score: 35 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/office_document_spawned_child_process_to_download.yml b/detections/endpoint/office_document_spawned_child_process_to_download.yml index 027f8535c6..07512ce816 100644 --- a/detections/endpoint/office_document_spawned_child_process_to_download.yml +++ b/detections/endpoint/office_document_spawned_child_process_to_download.yml @@ -1,21 +1,15 @@ +name: Office Document Spawned Child Process To Download +id: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3 +version: 3 +date: '2021-09-20' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-20' description: This search is to detect potential malicious office document executing lolbin child process to download payload or other malware. Since most of the attacker abused the capability of office document to execute living on land application to blend it to the normal noise in the infected machine to cover its track. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances office application and browser may be - used. -id: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3 -known_false_positives: Default browser not in the filter list. -name: Office Document Spawned Child Process To Download -references: -- https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/# search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process @@ -24,6 +18,14 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_spawned_child_process_to_download_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances office application and browser may be + used. +known_false_positives: Default browser not in the filter list. +references: +- https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/# tags: analytic_story: - Spearphishing Attachments @@ -62,5 +64,3 @@ tags: - _time risk_score: 35 security_domain: endpoint -type: TTP -version: 3 diff --git a/detections/endpoint/office_product_spawn_cmd_process.yml b/detections/endpoint/office_product_spawn_cmd_process.yml index 1bc00df34b..4f792a977a 100644 --- a/detections/endpoint/office_product_spawn_cmd_process.yml +++ b/detections/endpoint/office_product_spawn_cmd_process.yml @@ -1,23 +1,16 @@ +name: Office Product Spawn CMD Process +id: b8b19420-e892-11eb-9244-acde48001122 +version: 2 +date: '2021-07-19' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-07-19' description: this search is to detect a suspicious office product process that spawn cmd child process. This is commonly seen in a ms office product having macro to execute shell command to download or execute malicious lolbin relative to its malicious code. This is seen in trickbot spear phishing doc where it execute shell cmd to run mshta payload. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: b8b19420-e892-11eb-9244-acde48001122 -known_false_positives: IT or network admin may create an document automation that - will run shell script. -name: Office Product Spawn CMD Process -references: -- https://twitter.com/cyb3rops/status/1416050325870587910?s=21 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name= "excel.exe" OR Processes.parent_process_name @@ -25,6 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest Processes.original_file_name | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `office_product_spawn_cmd_process_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: IT or network admin may create an document automation that + will run shell script. +references: +- https://twitter.com/cyb3rops/status/1416050325870587910?s=21 tags: analytic_story: - Trickbot @@ -69,5 +71,3 @@ tags: - _time risk_score: 56 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/office_product_spawning_bitsadmin.yml b/detections/endpoint/office_product_spawning_bitsadmin.yml index 899919082e..a4378fbe0f 100644 --- a/detections/endpoint/office_product_spawning_bitsadmin.yml +++ b/detections/endpoint/office_product_spawning_bitsadmin.yml @@ -1,7 +1,11 @@ +name: Office Product Spawning BITSAdmin +id: e8c591f4-a6d7-11eb-8cf7-acde48001122 +version: 2 +date: '2021-04-26' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-04-26' description: The following detection identifies the latest behavior utilized by different malware families (including TA551, IcedID). This detection identifies any Windows Office Product spawning `bitsadmin.exe`. In malicious instances, the command-line @@ -13,16 +17,6 @@ description: The following detection identifies the latest behavior utilized by on disk. The Office Product, or `bitsadmin.exe` will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: e8c591f4-a6d7-11eb-8cf7-acde48001122 -known_false_positives: No false positives known. Filter as needed. -name: Office Product Spawning BITSAdmin -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") `process_bitsadmin` @@ -30,6 +24,14 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_bitsadmin_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: No false positives known. Filter as needed. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md tags: analytic_story: - Spearphishing Attachments @@ -74,5 +76,3 @@ tags: - _time risk_score: 63 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/office_product_spawning_certutil.yml b/detections/endpoint/office_product_spawning_certutil.yml index 8feec59abc..99a9320530 100644 --- a/detections/endpoint/office_product_spawning_certutil.yml +++ b/detections/endpoint/office_product_spawning_certutil.yml @@ -1,7 +1,11 @@ +name: Office Product Spawning CertUtil +id: 6925fe72-a6d5-11eb-9e17-acde48001122 +version: 2 +date: '2021-04-26' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-04-26' description: The following detection identifies the latest behavior utilized by different malware families (including TA551, IcedID). This detection identifies any Windows Office Product spawning `certutil.exe`. In malicious instances, the command-line @@ -12,17 +16,6 @@ description: The following detection identifies the latest behavior utilized by on disk. The Office Product, or `certutil.exe` will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 6925fe72-a6d5-11eb-9e17-acde48001122 -known_false_positives: No false positives known. Filter as needed. -name: Office Product Spawning CertUtil -references: -- https://redcanary.com/threat-detection-report/threats/TA551/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") `process_certutil` @@ -30,6 +23,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_certutil_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: No false positives known. Filter as needed. +references: +- https://redcanary.com/threat-detection-report/threats/TA551/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md tags: analytic_story: - Spearphishing Attachments @@ -74,5 +76,3 @@ tags: - _time risk_score: 63 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/office_product_spawning_mshta.yml b/detections/endpoint/office_product_spawning_mshta.yml index 873eee5bd6..8c39bf99e6 100644 --- a/detections/endpoint/office_product_spawning_mshta.yml +++ b/detections/endpoint/office_product_spawning_mshta.yml @@ -1,7 +1,11 @@ +name: Office Product Spawning MSHTA +id: 6078fa20-a6d2-11eb-b662-acde48001122 +version: 2 +date: '2021-04-26' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-04-26' description: The following detection identifies the latest behavior utilized by different malware families (including TA551, IcedID). This detection identifies any Windows Office Product spawning `mshta.exe`. In malicious instances, the command-line of @@ -12,16 +16,6 @@ description: The following detection identifies the latest behavior utilized by any artifacts on disk. The Office Product, or `mshta.exe` will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 6078fa20-a6d2-11eb-b662-acde48001122 -known_false_positives: No false positives known. Filter as needed. -name: Office Product Spawning MSHTA -references: -- https://redcanary.com/threat-detection-report/threats/TA551/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") `process_mshta` @@ -29,6 +23,14 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_mshta_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: No false positives known. Filter as needed. +references: +- https://redcanary.com/threat-detection-report/threats/TA551/ tags: analytic_story: - Spearphishing Attachments @@ -74,5 +76,3 @@ tags: - _time risk_score: 63 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml index f502e596b2..f077d2e3ca 100644 --- a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml +++ b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml @@ -1,7 +1,11 @@ +name: Office Product Spawning Rundll32 with no DLL +id: c661f6be-a38c-11eb-be57-acde48001122 +version: 2 +date: '2021-04-22' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-04-22' description: The following detection identifies the latest behavior utilized by IcedID malware family. This detection identifies any Windows Office Product spawning `rundll32.exe` without a `.dll` file extension. In malicious instances, the command-line of `rundll32.exe` @@ -12,19 +16,6 @@ description: The following detection identifies the latest behavior utilized by Capture and analyze the `DLL` that was dropped to disk. The Office Product will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: c661f6be-a38c-11eb-be57-acde48001122 -known_false_positives: False positives should be limited, but if any are present, - filter as needed. -name: Office Product Spawning Rundll32 with no DLL -references: -- https://www.joesandbox.com/analysis/395471/0/html -- https://app.any.run/tasks/cef4b8ba-023c-4b3b-b2ef-6486a44f6ed9/ -- https://any.run/malware-trends/icedid search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") `process_rundll32` @@ -32,6 +23,17 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_rundll32_with_no_dll_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives should be limited, but if any are present, + filter as needed. +references: +- https://www.joesandbox.com/analysis/395471/0/html +- https://app.any.run/tasks/cef4b8ba-023c-4b3b-b2ef-6486a44f6ed9/ +- https://any.run/malware-trends/icedid tags: analytic_story: - Spearphishing Attachments @@ -76,5 +78,3 @@ tags: - _time risk_score: 63 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/office_product_spawning_wmic.yml b/detections/endpoint/office_product_spawning_wmic.yml index 39d539fc23..9c62fe5017 100644 --- a/detections/endpoint/office_product_spawning_wmic.yml +++ b/detections/endpoint/office_product_spawning_wmic.yml @@ -1,7 +1,11 @@ +name: Office Product Spawning Wmic +id: ffc236d6-a6c9-11eb-95f1-acde48001122 +version: 3 +date: '2021-09-16' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-16' description: The following detection identifies the latest behavior utilized by Ursnif malware family. This detection identifies any Windows Office Product spawning `wmic.exe`. In malicious instances, the command-line of `wmic.exe` will contain `wmic process @@ -12,18 +16,6 @@ description: The following detection identifies the latest behavior utilized by on disk. The Office Product, or `wmic.exe` will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: ffc236d6-a6c9-11eb-95f1-acde48001122 -known_false_positives: No false positives known. Filter as needed. -name: Office Product Spawning Wmic -references: -- https://app.any.run/tasks/fb894ab8-a966-4b72-920b-935f41756afd/ -- https://attack.mitre.org/techniques/T1047/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.md search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") `process_wmic` @@ -31,6 +23,16 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_wmic_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: No false positives known. Filter as needed. +references: +- https://app.any.run/tasks/fb894ab8-a966-4b72-920b-935f41756afd/ +- https://attack.mitre.org/techniques/T1047/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.md tags: analytic_story: - Spearphishing Attachments @@ -76,5 +78,3 @@ tags: - _time risk_score: 63 security_domain: endpoint -type: TTP -version: 3 diff --git a/detections/endpoint/office_product_writing_cab_or_inf.yml b/detections/endpoint/office_product_writing_cab_or_inf.yml index d9bf5650dc..2c2bf232e2 100644 --- a/detections/endpoint/office_product_writing_cab_or_inf.yml +++ b/detections/endpoint/office_product_writing_cab_or_inf.yml @@ -1,25 +1,15 @@ +name: Office Product Writing cab or inf +id: f48cd1d4-125a-11ec-a447-acde48001122 +version: 1 +date: '2021-09-10' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-10' description: The following analytic identifies behavior related to CVE-2021-40444. Whereas the malicious document will load ActiveX and download the remote payload (.inf, .cab). During triage, review parallel processes and further activity on endpoint to identify additional patterns. Retrieve the file modifications and analyze further. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` - node. -id: f48cd1d4-125a-11ec-a447-acde48001122 -known_false_positives: The query is structured in a way that `action` (read, create) - is not defined. Review the results of this query, filter, and tune as necessary. - It may be necessary to generate this query specific to your endpoint product. -name: Office Product Writing cab or inf -references: -- https://twitter.com/vxunderground/status/1436326057179860992?s=20 -- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ -- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 -- https://twitter.com/RonnyTNL/status/1436334640617373699?s=20 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest @@ -30,6 +20,18 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint | fields _time dest file_create_time file_name file_path process_name process_path process] | dedup file_create_time | table dest, process_name, process, file_create_time, file_name, file_path | `office_product_writing_cab_or_inf_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` + node. +known_false_positives: The query is structured in a way that `action` (read, create) + is not defined. Review the results of this query, filter, and tune as necessary. + It may be necessary to generate this query specific to your endpoint product. +references: +- https://twitter.com/vxunderground/status/1436326057179860992?s=20 +- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ +- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 +- https://twitter.com/RonnyTNL/status/1436334640617373699?s=20 tags: analytic_story: - Spearphishing Attachments @@ -82,5 +84,3 @@ tags: - process_name risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/office_spawning_control.yml b/detections/endpoint/office_spawning_control.yml index 36eb13e3af..09fc9d9cd7 100644 --- a/detections/endpoint/office_spawning_control.yml +++ b/detections/endpoint/office_spawning_control.yml @@ -1,7 +1,11 @@ +name: Office Spawning Control +id: 053e027c-10c7-11ec-8437-acde48001122 +version: 1 +date: '2021-09-08' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-08' description: The following detection identifies control.exe spawning from an office product. This detection identifies any Windows Office Product spawning `control.exe`. In malicious instances, the command-line of `control.exe` will contain a file path @@ -9,21 +13,6 @@ description: The following detection identifies control.exe spawning from an off down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze any artifacts on disk. review parallel and child processes to identify further suspicious behavior -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 053e027c-10c7-11ec-8437-acde48001122 -known_false_positives: Limited false positives should be present. -name: Office Spawning Control -references: -- https://strontic.github.io/xcyclopedia/library/control.exe-1F13E714A0FEA8887707DFF49287996F.html -- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ -- https://attack.mitre.org/techniques/T1218/011/ -- https://www.echotrail.io/insights/search/control.exe -- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") @@ -31,6 +20,19 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `office_spawning_control_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Limited false positives should be present. +references: +- https://strontic.github.io/xcyclopedia/library/control.exe-1F13E714A0FEA8887707DFF49287996F.html +- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ +- https://attack.mitre.org/techniques/T1218/011/ +- https://www.echotrail.io/insights/search/control.exe +- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml tags: analytic_story: - Spearphishing Attachments @@ -80,5 +82,3 @@ tags: - Endpoint.Processes.user risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml index 9717ae44a7..c7153783cf 100644 --- a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml +++ b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml @@ -1,8 +1,12 @@ +name: Outbound Network Connection from Java Using Default Ports +id: d2c14d28-5c47-11ec-9892-acde48001122 +version: 1 +date: '2021-12-13' author: Mauricio Velazco, Splunk +type: TTP datamodel: - Endpoint - Endpoint -date: '2021-12-13' description: A required step while exploiting the CVE-2021-44228-Log4j vulnerability is that the victim server will perform outbound connections to attacker-controlled infrastructure. This is required as part of the JNDI lookup as well as for retrieving @@ -10,16 +14,6 @@ description: A required step while exploiting the CVE-2021-44228-Log4j vulnerabi reaching out to default ports used by the LDAP and RMI protocols. This behavior could represent successfull exploitation. Note that adversaries can easily decide to use arbitrary ports for these protocols and potentially bypass this detection. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: d2c14d28-5c47-11ec-9892-acde48001122 -known_false_positives: Legitimate Java applications may use perform outbound connections - to these ports. Filter as needed -name: Outbound Network Connection from Java Using Default Ports -references: -- https://www.lunasec.io/docs/blog/log4j-zero-day/ -- https://www.govcert.admin.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where (Processes.process_name="java.exe" OR Processes.process_name="javaw.exe" OR Processes.process_name="javaw.exe") by _time Processes.process_guid Processes.process_name @@ -30,6 +24,14 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint Ports.dest_port = 1099 ) by Ports.process_guid Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name process_path process connection_to_CNC dest_port | `outbound_network_connection_from_java_using_default_ports_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Legitimate Java applications may use perform outbound connections + to these ports. Filter as needed +references: +- https://www.lunasec.io/docs/blog/log4j-zero-day/ +- https://www.govcert.admin.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/ tags: analytic_story: - Log4Shell CVE-2021-44228 @@ -71,5 +73,3 @@ tags: - _time risk_score: 54 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/overwriting_accessibility_binaries.yml b/detections/endpoint/overwriting_accessibility_binaries.yml index 256713f445..c728c986cd 100644 --- a/detections/endpoint/overwriting_accessibility_binaries.yml +++ b/detections/endpoint/overwriting_accessibility_binaries.yml @@ -1,20 +1,15 @@ +name: Overwriting Accessibility Binaries +id: 13c2f6c3-10c5-4deb-9ba1-7c4460ebe4ae +version: 4 +date: '2020-07-21' author: David Dorsey, Splunk +type: TTP datamodel: - Endpoint -date: '2020-07-21' description: Microsoft Windows contains accessibility features that can be launched with a key combination before a user has logged in. An adversary can modify or replace these programs so they can get a command prompt or backdoor without logging in to the system. This search looks for modifications to these binaries. -how_to_implement: You must be ingesting data that records the filesystem activity - from your hosts to populate the Endpoint file-system data model node. If you are - using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which - you want to collect data. -id: 13c2f6c3-10c5-4deb-9ba1-7c4460ebe4ae -known_false_positives: Microsoft may provide updates to these binaries. Verify that - these changes do not correspond with your normal software update cycle. -name: Overwriting Accessibility Binaries -references: [] search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem where (Filesystem.file_path="*\\Windows\\System32\\sethc.exe*" @@ -23,6 +18,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime OR Filesystem.file_path="*\\Windows\\System32\\DisplaySwitch.exe*" OR Filesystem.file_path="*\\Windows\\System32\\AtBroker.exe*") by Filesystem.file_name Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `overwriting_accessibility_binaries_filter`' +how_to_implement: You must be ingesting data that records the filesystem activity + from your hosts to populate the Endpoint file-system data model node. If you are + using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which + you want to collect data. +known_false_positives: Microsoft may provide updates to these binaries. Verify that + these changes do not correspond with your normal software update cycle. +references: [] tags: analytic_story: - Windows Privilege Escalation @@ -67,5 +69,3 @@ tags: - _time risk_score: 72 security_domain: endpoint -type: TTP -version: 4 diff --git a/detections/endpoint/password_policy_discovery_with_net.yml b/detections/endpoint/password_policy_discovery_with_net.yml index d4e4be50fd..0b637e4138 100644 --- a/detections/endpoint/password_policy_discovery_with_net.yml +++ b/detections/endpoint/password_policy_discovery_with_net.yml @@ -1,20 +1,15 @@ +name: Password Policy Discovery with Net +id: 09336538-065a-11ec-8665-acde48001122 +version: 1 +date: '2021-08-26' author: Teoderick Contreras, Mauricio Velazco, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-08-26' description: This analytic looks for the execution of `net.exe` or `net1.exe` with command line arguments used to obtain the domain password policy. Red Teams and adversaries may leverage `net.exe` for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -id: 09336538-065a-11ec-8665-acde48001122 -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: Password Policy Discovery with Net -references: -- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" OR Processes.process_name="net1.exe") AND Processes.process = "*accounts*" AND Processes.process @@ -22,6 +17,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `password_policy_discovery_with_net_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet tags: analytic_story: - Active Directory Discovery @@ -67,5 +69,3 @@ tags: - _time risk_score: 9 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/permission_modification_using_takeown_app.yml b/detections/endpoint/permission_modification_using_takeown_app.yml index da580c9be4..a4ccb9300a 100644 --- a/detections/endpoint/permission_modification_using_takeown_app.yml +++ b/detections/endpoint/permission_modification_using_takeown_app.yml @@ -1,26 +1,28 @@ +name: Permission Modification using Takeown App +id: fa7ca5c6-c9d8-11eb-bce9-acde48001122 +version: 1 +date: '2021-06-10' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-06-10' description: This search is to detect a modification of file or directory permission using takeown.exe windows app. This technique was seen in some ransomware that take the ownership of a folder or files to encrypt or delete it. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: fa7ca5c6-c9d8-11eb-bce9-acde48001122 -known_false_positives: takeown.exe is a normal windows application that may used by - network operator. -name: Permission Modification using Takeown App -references: -- https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "takeown.exe" Processes.process = "*/f*" by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `permission_modification_using_takeown_app_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: takeown.exe is a normal windows application that may used by + network operator. +references: +- https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/ tags: analytic_story: - Ransomware @@ -63,5 +65,3 @@ tags: - _time risk_score: 56 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/petitpotam_network_share_access_request.yml b/detections/endpoint/petitpotam_network_share_access_request.yml index aaccf8ea9b..cba0381611 100644 --- a/detections/endpoint/petitpotam_network_share_access_request.yml +++ b/detections/endpoint/petitpotam_network_share_access_request.yml @@ -53,9 +53,9 @@ tags: - T1187 observable: - name: dest - type: Hostname role: - Victim + type: Hostname product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml b/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml index 4a6b5beaa4..8889df82d4 100644 --- a/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml +++ b/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml @@ -47,9 +47,9 @@ tags: - T1003 observable: - name: dest - type: Hostname role: - Victim + type: Hostname product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/possible_browser_pass_view_parameter.yml b/detections/endpoint/possible_browser_pass_view_parameter.yml index 4a19b91428..7296f6e865 100644 --- a/detections/endpoint/possible_browser_pass_view_parameter.yml +++ b/detections/endpoint/possible_browser_pass_view_parameter.yml @@ -1,7 +1,11 @@ +name: Possible Browser Pass View Parameter +id: 8ba484e8-4b97-11ec-b19a-acde48001122 +version: 1 +date: '2021-11-22' author: Teoderick Contreras, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-11-22' description: This analytic will detect if a suspicious process contains a commandline parameter related to a web browser credential dumper. This technique is used by Remcos RAT malware which uses the Nirsoft webbrowserpassview.exe application to @@ -10,16 +14,6 @@ description: This analytic will detect if a suspicious process contains a comman from possible Remcos RAT infection. Since the hunting query is based on the parameter command and the possible path where it will save the text credential information, it may catch normal tools that are using the same command and behavior. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: 8ba484e8-4b97-11ec-b19a-acde48001122 -known_false_positives: False positive is quite limited. Filter is needed -name: Possible Browser Pass View Parameter -references: -- https://www.nirsoft.net/utils/web_browser_password.html -- https://app.any.run/tasks/df0baf9f-8baf-4c32-a452-16562ecb19be/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*/stext *", "*/shtml *", "*/LoadPasswordsIE*", "*/LoadPasswordsFirefox*", "*/LoadPasswordsChrome*", @@ -30,6 +24,14 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `possible_browser_pass_view_parameter_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: False positive is quite limited. Filter is needed +references: +- https://www.nirsoft.net/utils/web_browser_password.html +- https://app.any.run/tasks/df0baf9f-8baf-4c32-a452-16562ecb19be/ tags: analytic_story: - Remcos @@ -73,5 +75,3 @@ tags: - _time risk_score: 16 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml index 2d172b90ca..59db2114bb 100644 --- a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml +++ b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml @@ -1,7 +1,11 @@ +name: Possible Lateral Movement PowerShell Spawn +id: cb909b3e-512b-11ec-aa31-3e22fbd008af +version: 1 +date: '2021-11-29' author: Mauricio Velazco, Splunk +type: TTP datamodel: - Endpoint -date: '2021-11-29' description: The following analytic assists with identifying a PowerShell process spawned as a child or grand child process of commonly abused processes during lateral movement techniques including `services.exe`, `wmiprsve.exe`, `svchost.exe`, `wsmprovhost.exe` @@ -11,28 +15,27 @@ description: The following analytic assists with identifying a PowerShell proces for PowerShell spawned out of this processes may reveal a lateral movement attack. Red Teams and adversaries alike may abuse these services during a breach for lateral movement and remote code execution. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name="wmiprvse.exe" + OR Processes.parent_process_name="services.exe" OR Processes.parent_process_name="svchost.exe" + OR Processes.parent_process_name="wsmprovhost.exe" OR Processes.parent_process_name="mmc.exe") + (Processes.process_name="powershell.exe" OR (Processes.process_name="cmd.exe" AND + Processes.process="*powershell.exe*") OR Processes.process_name="pwsh.exe" OR (Processes.process_name="cmd.exe" + AND Processes.process="*pwsh.exe*")) by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `possible_lateral_movement_powershell_spawn_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. -id: cb909b3e-512b-11ec-aa31-3e22fbd008af known_false_positives: Legitimate applications may spawn PowerShell as a child process of the the identified processes. Filter as needed. -name: Possible Lateral Movement PowerShell Spawn references: - https://attack.mitre.org/techniques/T1021/003 - https://attack.mitre.org/techniques/T1021/006/ - https://attack.mitre.org/techniques/T1047/ - https://attack.mitre.org/techniques/T1053.005/ - https://attack.mitre.org/techniques/T1543/003/ -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name="wmiprvse.exe" - OR Processes.parent_process_name="services.exe" OR Processes.parent_process_name="svchost.exe" - OR Processes.parent_process_name="wsmprovhost.exe" OR Processes.parent_process_name="mmc.exe") - (Processes.process_name="powershell.exe" OR (Processes.process_name="cmd.exe" AND Processes.process="*powershell.exe*") - OR Processes.process_name="pwsh.exe" OR (Processes.process_name="cmd.exe" AND Processes.process="*pwsh.exe*")) - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `possible_lateral_movement_powershell_spawn_filter`' tags: analytic_story: - Active Directory Lateral Movement @@ -79,5 +82,3 @@ tags: - _time risk_score: 45 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index 09c38b8463..6946eec29b 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -1,25 +1,15 @@ -author: Michael Haag, Splunk -datamodel: [] +name: PowerShell 4104 Hunting +id: d6f2b006-0041-11ec-8885-acde48001122 +version: 1 date: '2021-08-18' +author: Michael Haag, Splunk +type: Hunting +datamodel: [] description: The following Hunting analytic assists with identifying suspicious PowerShell execution using Script Block Logging, or EventCode 4104. This analytic is not meant to be ran hourly, but occasionally to identify malicious or suspicious PowerShell. This analytic is a combination of work completed by Alex Teixeira and Splunk Threat Research Team. -how_to_implement: The following Hunting analytic requires PowerShell operational logs - to be imported. Modify the powershell macro as needed to match the sourcetype or - add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -id: d6f2b006-0041-11ec-8885-acde48001122 -known_false_positives: Limited false positives. May filter as needed. -name: PowerShell 4104 Hunting -references: -- https://github.com/inodee/threathunting-spl/blob/master/hunt-queries/powershell_qualifiers.md -- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell -- https://github.com/marcurdy/dfir-toolset/blob/master/Powershell%20Blueteam.txt -- https://devblogs.microsoft.com/powershell/powershell-the-blue-team/ -- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging?view=powershell-5.1 -- https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html -- https://hurricanelabs.com/splunk-tutorials/how-to-use-powershell-transcription-logs-in-splunk/ search: '`powershell` EventCode=4104 | eval DoIt = if(match(Message,"(?i)(\$doit)"), "4", 0) | eval enccom=if(match(Message,"[A-Za-z0-9+\/]{44,}([A-Za-z0-9+\/]{4}|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{2}==)") OR match(Message, "(?i)[-]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]"),4,0) | eval suspcmdlet=if(match(Message, @@ -45,6 +35,18 @@ search: '`powershell` EventCode=4104 | eval DoIt = if(match(Message,"(?i)(\$doit base64, get | stats values(Score) by DoIt, enccom, compressed, downgrade, iex, mimikatz, rundll32, empire, webclient, syswow64, httplocal, reflection, invokewmi, invokecmd, base64, get, suspcmdlet, suspkeywrd | `powershell_4104_hunting_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: Limited false positives. May filter as needed. +references: +- https://github.com/inodee/threathunting-spl/blob/master/hunt-queries/powershell_qualifiers.md +- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell +- https://github.com/marcurdy/dfir-toolset/blob/master/Powershell%20Blueteam.txt +- https://devblogs.microsoft.com/powershell/powershell-the-blue-team/ +- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging?view=powershell-5.1 +- https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html +- https://hurricanelabs.com/splunk-tutorials/how-to-use-powershell-transcription-logs-in-splunk/ tags: analytic_story: - Malicious PowerShell @@ -86,5 +88,3 @@ tags: - Message risk_score: 80 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/powershell_creating_thread_mutex.yml b/detections/endpoint/powershell_creating_thread_mutex.yml index 0602742c85..d9ce15cace 100644 --- a/detections/endpoint/powershell_creating_thread_mutex.yml +++ b/detections/endpoint/powershell_creating_thread_mutex.yml @@ -45,13 +45,13 @@ tags: - T1027.005 observable: - name: ComputerName + role: + - Victim type: Hostname - role: - - Victim - name: User - type: User role: - Victim + type: User product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml index e513bacd93..9612fdafe4 100644 --- a/detections/endpoint/powershell_disable_security_monitoring.yml +++ b/detections/endpoint/powershell_disable_security_monitoring.yml @@ -1,21 +1,14 @@ +name: Powershell Disable Security Monitoring +id: c148a894-dd93-11eb-bf2a-acde48001122 +version: 2 +date: '2021-07-05' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-07-05' description: This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: c148a894-dd93-11eb-bf2a-acde48001122 -known_false_positives: Limited false positives. However, tune based on scripts that - may perform this action. -name: Powershell Disable Security Monitoring -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process="*set-mppreference*" AND Processes.process IN ("*disablerealtimemonitoring*","*disableioavprotection*","*disableintrusionpreventionsystem*","*disablescriptscanning*","*disableblockatfirstseen*") @@ -23,6 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_disable_security_monitoring_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Limited false positives. However, tune based on scripts that + may perform this action. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell tags: analytic_story: - Ransomware @@ -50,5 +52,3 @@ tags: - Endpoint.Processes.user - _time security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/powershell_domain_enumeration.yml b/detections/endpoint/powershell_domain_enumeration.yml index 4021aed5c3..96234d20b7 100644 --- a/detections/endpoint/powershell_domain_enumeration.yml +++ b/detections/endpoint/powershell_domain_enumeration.yml @@ -50,13 +50,13 @@ tags: - T1059.001 observable: - name: ComputerName + role: + - Victim type: Hostname - role: - - Victim - name: User - type: User role: - Victim + type: User product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/powershell_enable_smb1protocol_feature.yml b/detections/endpoint/powershell_enable_smb1protocol_feature.yml index bd22b818f5..09f7287044 100644 --- a/detections/endpoint/powershell_enable_smb1protocol_feature.yml +++ b/detections/endpoint/powershell_enable_smb1protocol_feature.yml @@ -1,22 +1,24 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Powershell Enable SMB1Protocol Feature +id: afed80b2-d34b-11eb-a952-acde48001122 +version: 1 date: '2021-06-22' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: [] description: This search is to detect a suspicious enabling of smb1protocol through "powershell.exe". This technique was seen in some ransomware (like reddot) where it enable smb share to do the lateral movement and encrypt other files within the compromise network system. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the powershell logs from your endpoints. make sure you enable needed - registry to monitor this event. -id: afed80b2-d34b-11eb-a952-acde48001122 -known_false_positives: network operator may enable or disable this windows feature. -name: Powershell Enable SMB1Protocol Feature -references: -- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ search: '`powershell` EventCode=4104 Message = "*Enable-WindowsOptionalFeature*" Message = "*SMB1Protocol*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_enable_smb1protocol_feature_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the powershell logs from your endpoints. make sure you enable needed + registry to monitor this event. +known_false_positives: network operator may enable or disable this windows feature. +references: +- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ tags: analytic_story: - Malicious PowerShell @@ -40,5 +42,3 @@ tags: - ComputerName - User security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/powershell_execute_com_object.yml b/detections/endpoint/powershell_execute_com_object.yml index 70d0162f15..9c05378bae 100644 --- a/detections/endpoint/powershell_execute_com_object.yml +++ b/detections/endpoint/powershell_execute_com_object.yml @@ -1,24 +1,26 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Powershell Execute COM Object +id: 65711630-f9bf-11eb-8d72-acde48001122 +version: 1 date: '2021-08-10' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: [] description: This search is to detect a COM CLSID execution through powershell. This technique was seen in several adversaries and malware like ransomware conti where it has a feature to execute command using COM Object. This technique may use by network operator at some cases but a good indicator if some application want to gain privilege escalation or bypass uac. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: 65711630-f9bf-11eb-8d72-acde48001122 -known_false_positives: network operrator may use this command. -name: Powershell Execute COM Object -references: -- https://threadreaderapp.com/thread/1423361119926816776.html search: '`powershell` EventCode=4104 Message = "*CreateInstance([type]::GetTypeFromCLSID*" OR Message = "*CreateInstance([Type]::GetTypeFromProgID*"| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_execute_com_object_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: network operrator may use this command. +references: +- https://threadreaderapp.com/thread/1423361119926816776.html tags: analytic_story: - Malicious PowerShell @@ -55,5 +57,3 @@ tags: - _time risk_score: 5 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml index 714cc5862c..f28c3a964b 100644 --- a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml +++ b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml @@ -54,13 +54,13 @@ tags: - T1059.001 observable: - name: ComputerName + role: + - Victim type: Hostname - role: - - Victim - name: User - type: User role: - Victim + type: User product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml index 9ebd2144a7..bc9c41b6fd 100644 --- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml +++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml @@ -54,13 +54,13 @@ tags: - T1059.001 observable: - name: ComputerName + role: + - Victim type: Hostname - role: - - Victim - name: User - type: User role: - Victim + type: User product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/powershell_get_localgroup_discovery.yml b/detections/endpoint/powershell_get_localgroup_discovery.yml index 6bffb4c836..880cd0b9dd 100644 --- a/detections/endpoint/powershell_get_localgroup_discovery.yml +++ b/detections/endpoint/powershell_get_localgroup_discovery.yml @@ -1,27 +1,29 @@ +name: PowerShell Get LocalGroup Discovery +id: b71adfcc-155b-11ec-9413-acde48001122 +version: 1 +date: '2021-09-14' author: Michael Haag, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-09-14' description: The following hunting analytic identifies the use of `get-localgroup` being used with PowerShell to identify local groups on the endpoint. During triage, review parallel processes and identify any further suspicious behavior. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: b71adfcc-155b-11ec-9413-acde48001122 -known_false_positives: False positives may be present. Tune as needed. -name: PowerShell Get LocalGroup Discovery -references: -- https://attack.mitre.org/techniques/T1069/001/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe" OR Processes.process_name="cmd.exe") (Processes.process="*get-localgroup*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `powershell_get_localgroup_discovery_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives may be present. Tune as needed. +references: +- https://attack.mitre.org/techniques/T1069/001/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md tags: analytic_story: - Active Directory Discovery @@ -64,5 +66,3 @@ tags: - _time risk_score: 15 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml index 54903f48fa..c4d8c84948 100644 --- a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml +++ b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml @@ -1,6 +1,10 @@ -author: Michael Haag, Splunk -datamodel: [] +name: Powershell Get LocalGroup Discovery with Script Block Logging +id: d7c6ad22-155c-11ec-bb64-acde48001122 +version: 1 date: '2021-09-14' +author: Michael Haag, Splunk +type: Hunting +datamodel: [] description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output @@ -14,12 +18,13 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.' +search: '`powershell` EventCode=4104 Message = "*get-localgroup*" | stats count min(_time) + as firstTime max(_time) as lastTime by Message OpCode ComputerName User EventCode| + `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_get_localgroup_discovery_with_script_block_logging_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -id: d7c6ad22-155c-11ec-bb64-acde48001122 known_false_positives: False positives may be present. Tune as needed. -name: Powershell Get LocalGroup Discovery with Script Block Logging references: - https://www.splunk.com/en_us/blog/security/powershell-detections-threat-research-release-august-2021.html - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md @@ -27,9 +32,6 @@ references: - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ -search: '`powershell` EventCode=4104 Message = "*get-localgroup*" | stats count min(_time) - as firstTime max(_time) as lastTime by Message OpCode ComputerName User EventCode| - `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_get_localgroup_discovery_with_script_block_logging_filter`' tags: analytic_story: - Active Directory Discovery @@ -69,5 +71,3 @@ tags: - User risk_score: 15 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml index 09c32ff942..efdc9f9913 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml @@ -54,13 +54,13 @@ tags: - T1059.001 observable: - name: ComputerName + role: + - Victim type: Hostname - role: - - Victim - name: User - type: User role: - Victim + type: User product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml index 586f987b32..c21b8de988 100644 --- a/detections/endpoint/powershell_processing_stream_of_data.yml +++ b/detections/endpoint/powershell_processing_stream_of_data.yml @@ -1,28 +1,30 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Powershell Processing Stream Of Data +id: 0d718b52-c9f1-11eb-bc61-acde48001122 +version: 1 date: '2021-06-10' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: [] description: The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is processing compressed stream data. This is typically found in obfuscated PowerShell or PowerShell executing embedded .NET or binary files that are stream flattened and will be deflated durnig execution. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. +search: '`powershell` EventCode=4104 Message = "*IO.Compression.*" OR Message = "*IO.StreamReader*" + OR Message = "*]::Decompress*" | stats count min(_time) as firstTime max(_time) + as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `powershell_processing_stream_of_data_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -id: 0d718b52-c9f1-11eb-bc61-acde48001122 known_false_positives: powershell may used this function to process compressed data. -name: Powershell Processing Stream Of Data references: - https://medium.com/@ahmedjouini99/deobfuscating-emotets-powershell-payload-e39fb116f7b9 - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ -search: '`powershell` EventCode=4104 Message = "*IO.Compression.*" OR Message = "*IO.StreamReader*" - OR Message = "*]::Decompress*" | stats count min(_time) as firstTime max(_time) - as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `powershell_processing_stream_of_data_filter`' tags: analytic_story: - Malicious PowerShell @@ -63,5 +65,3 @@ tags: - _time risk_score: 40 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml index 39196a7be9..2bfc70b942 100644 --- a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml +++ b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml @@ -1,26 +1,28 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Powershell Remote Thread To Known Windows Process +id: ec102cb2-a0f5-11eb-9b38-acde48001122 +version: 1 date: '2021-04-19' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: [] description: this search is designed to detect suspicious powershell process that tries to inject code and to known/critical windows process and execute it using CreateRemoteThread. This technique is seen in several malware like trickbot and offensive tooling like cobaltstrike where it load a shellcode to svchost.exe to execute reverse shell to c2 and download another payload -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, Create Remote thread from your endpoints. If you are - using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter - known instances of create remote thread may be used. -id: ec102cb2-a0f5-11eb-9b38-acde48001122 -known_false_positives: unknown -name: Powershell Remote Thread To Known Windows Process -references: -- https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/ search: '`sysmon` EventCode = 8 process_name IN ("powershell_ise.exe", "powershell.exe") TargetImage IN ("*\\svchost.exe","*\\csrss.exe" "*\\gpupdate.exe", "*\\explorer.exe","*\\services.exe","*\\winlogon.exe","*\\smss.exe","*\\wininit.exe","*\\userinit.exe","*\\spoolsv.exe","*\\taskhost.exe") | stats min(_time) as firstTime max(_time) as lastTime count by SourceImage process_name SourceProcessId SourceProcessGuid TargetImage TargetProcessId NewThreadId StartAddress Computer EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_remote_thread_to_known_windows_process_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, Create Remote thread from your endpoints. If you are + using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter + known instances of create remote thread may be used. +known_false_positives: unknown +references: +- https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/ tags: analytic_story: - Trickbot @@ -66,5 +68,3 @@ tags: - EventCode risk_score: 63 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/powershell_start_bitstransfer.yml b/detections/endpoint/powershell_start_bitstransfer.yml index 01bfa8a838..19ebf6fbc7 100644 --- a/detections/endpoint/powershell_start_bitstransfer.yml +++ b/detections/endpoint/powershell_start_bitstransfer.yml @@ -1,7 +1,11 @@ +name: PowerShell Start-BitsTransfer +id: 39e2605a-90d8-11eb-899e-acde48001122 +version: 2 +date: '2021-03-29' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-03-29' description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar functionality is present. This technique variation is not as commonly used by adversaries, but has been abused in the past. Lesser known uses include the ability to set the @@ -9,25 +13,23 @@ description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Si is used, it is highly possible files will be archived. During triage, review parallel processes and process lineage. Capture any files on disk and review. For the remote domain or IP, what is the reputation? -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 39e2605a-90d8-11eb-899e-acde48001122 -known_false_positives: Limited false positives. It is possible administrators will - utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent - process or command-line arguments. -name: PowerShell Start-BitsTransfer -references: -- https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281 -- https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process=*start-bitstransfer* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.original_file_name Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_start_bitstransfer_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Limited false positives. It is possible administrators will + utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent + process or command-line arguments. +references: +- https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281 +- https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs tags: analytic_story: - BITS Jobs @@ -71,5 +73,3 @@ tags: - _time risk_score: 56 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/powershell_using_memory_as_backing_store.yml b/detections/endpoint/powershell_using_memory_as_backing_store.yml index 34f285569d..3b3d8be870 100644 --- a/detections/endpoint/powershell_using_memory_as_backing_store.yml +++ b/detections/endpoint/powershell_using_memory_as_backing_store.yml @@ -44,13 +44,13 @@ tags: - T1140 observable: - name: ComputerName + role: + - Victim type: Hostname - role: - - Victim - name: User - type: User role: - Victim + type: User product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml index 05e3c45290..8d9cee339f 100644 --- a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml +++ b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml @@ -1,26 +1,28 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Powershell Windows Defender Exclusion Commands +id: 907ac95c-4dd9-11ec-ba2c-acde48001122 +version: 1 date: '2021-11-25' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: [] description: This analytic will detect a suspicious process commandline related to windows defender exclusion feature. This command is abused by adversaries, malware author and red teams to bypassed Windows Defender Anti-Virus product by excluding folder path, file path, process, extensions and etc. from its real time or schedule scan to execute their malicious code. This is a good indicator for defense evasion and to look further for events after this behavior. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -id: 907ac95c-4dd9-11ec-ba2c-acde48001122 -known_false_positives: admin or user may choose to use this windows features. -name: Powershell Windows Defender Exclusion Commands -references: -- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html -- https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/ search: '`powershell` EventCode=4104 (Message = "*Add-MpPreference *" OR Message = "*Set-MpPreference *") AND Message = "*-exclusion*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_windows_defender_exclusion_commands_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin or user may choose to use this windows features. +references: +- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html +- https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/ tags: analytic_story: - Remcos @@ -60,5 +62,3 @@ tags: - User risk_score: 64 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml index e41b4a2577..5c98f4036f 100644 --- a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml +++ b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml @@ -1,20 +1,14 @@ +name: Prevent Automatic Repair Mode using Bcdedit +id: 7742aa92-c9d9-11eb-bbfc-acde48001122 +version: 1 +date: '2021-06-10' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-06-10' description: This search is to detect a suspicious bcdedit.exe execution to ignore all failures. This technique was used by ransomware to prevent the compromise machine automatically boot in repair mode. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed bcdedit.exe may be used. -id: 7742aa92-c9d9-11eb-bbfc-acde48001122 -known_false_positives: Administrators may modify the boot configuration ignore failure - during testing and debugging. -name: Prevent Automatic Repair Mode using Bcdedit -references: -- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "bcdedit.exe" Processes.process = "*bootstatuspolicy*" Processes.process = "*ignoreallfailures*" @@ -22,6 +16,14 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `prevent_automatic_repair_mode_using_bcdedit_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed bcdedit.exe may be used. +known_false_positives: Administrators may modify the boot configuration ignore failure + during testing and debugging. +references: +- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf tags: analytic_story: - Ransomware @@ -64,5 +66,3 @@ tags: - _time risk_score: 56 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/previously_seen_command_line_arguments.yml b/detections/endpoint/previously_seen_command_line_arguments.yml index 711ba3fc92..6cf86d3358 100644 --- a/detections/endpoint/previously_seen_command_line_arguments.yml +++ b/detections/endpoint/previously_seen_command_line_arguments.yml @@ -1,22 +1,24 @@ +name: Previously seen command line arguments +id: 56059acf-50fe-4f60-98d1-b75b51b5c2f3 +version: 2 +date: '2019-03-01' author: Bhavin Patel, Splunk +type: Baseline datamodel: - Endpoint -date: '2019-03-01' description: This search looks for command-line arguments where `cmd.exe /c` is used to execute a program, then creates a baseline of the earliest and latest times we have encountered this command-line argument in our dataset within the last 30 days. +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe + AND Processes.process="* /c *" by Processes.process | `drop_dm_object_name(Processes)`' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the "process" field in the Endpoint data model. -id: 56059acf-50fe-4f60-98d1-b75b51b5c2f3 known_false_positives: none -name: Previously seen command line arguments references: [] -search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe - AND Processes.process="* /c *" by Processes.process | `drop_dm_object_name(Processes)`' tags: analytic_story: - DHS Report TA18-074A @@ -41,5 +43,3 @@ tags: - Endpoint.Processes.process_name - _time security_domain: endpoint -type: Baseline -version: 2 diff --git a/detections/endpoint/previously_seen_zoom_child_processes_initial.yml b/detections/endpoint/previously_seen_zoom_child_processes_initial.yml index 4d7270c322..79fad6ffef 100644 --- a/detections/endpoint/previously_seen_zoom_child_processes_initial.yml +++ b/detections/endpoint/previously_seen_zoom_child_processes_initial.yml @@ -1,22 +1,24 @@ +name: Previously Seen Zoom Child Processes - Initial +id: 60b9c00f-a9d6-4e51-803c-5d63ea21b95b +version: 1 +date: '2020-05-20' author: David Dorsey, Splunk +type: Baseline datamodel: - Endpoint -date: '2020-05-20' description: This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS). This table is then cached. -how_to_implement: You must be ingesting endpoint data that tracks process activity, - including parent-child relationships from your endpoints, to populate the Endpoint - data model in the Processes node. -id: 60b9c00f-a9d6-4e51-803c-5d63ea21b95b -known_false_positives: none -name: Previously Seen Zoom Child Processes - Initial -references: [] search: '| tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time) as lastTimeSeen from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us) by Processes.process_name Processes.dest| `drop_dm_object_name(Processes)` | table dest, process_name, firstTimeSeen, lastTimeSeen | outputlookup zoom_first_time_child_process' +how_to_implement: You must be ingesting endpoint data that tracks process activity, + including parent-child relationships from your endpoints, to populate the Endpoint + data model in the Processes node. +known_false_positives: none +references: [] tags: analytic_story: - Suspicious Zoom Child Processes @@ -34,5 +36,3 @@ tags: - Endpoint.Processes.process_name - _time security_domain: endpoint -type: Baseline -version: 1 diff --git a/detections/endpoint/previously_seen_zoom_child_processes_update.yml b/detections/endpoint/previously_seen_zoom_child_processes_update.yml index 0064cef418..dfd7cca928 100644 --- a/detections/endpoint/previously_seen_zoom_child_processes_update.yml +++ b/detections/endpoint/previously_seen_zoom_child_processes_update.yml @@ -1,19 +1,16 @@ +name: Previously Seen Zoom Child Processes - Update +id: 80aea7fd-5da2-4533-b3c2-560533bfbaee +version: 1 +date: '2020-05-20' author: David Dorsey, Splunk +type: Baseline datamodel: - Endpoint -date: '2020-05-20' description: This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS) within the last hour. It then updates this information with historical data and filters out proces_name and endpoint pairs that have not been seen within the specified time window. This updated table is outputed to disk. -how_to_implement: You must be ingesting endpoint data that tracks process activity, - including parent-child relationships from your endpoints, to populate the Endpoint - data model in the Processes node. -id: 80aea7fd-5da2-4533-b3c2-560533bfbaee -known_false_positives: none -name: Previously Seen Zoom Child Processes - Update -references: [] search: '| tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time) as lastTimeSeen from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us) by Processes.process_name Processes.dest| @@ -22,6 +19,11 @@ search: '| tstats `security_content_summariesonly` min(_time) as firstTimeSeen m as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by process_name, dest | where lastTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_forget_window`") | outputlookup zoom_first_time_child_process' +how_to_implement: You must be ingesting endpoint data that tracks process activity, + including parent-child relationships from your endpoints, to populate the Endpoint + data model in the Processes node. +known_false_positives: none +references: [] tags: analytic_story: - Suspicious Zoom Child Processes @@ -39,5 +41,3 @@ tags: - Endpoint.Processes.process_name - _time security_domain: endpoint -type: Baseline -version: 1 diff --git a/detections/endpoint/print_spooler_adding_a_printer_driver.yml b/detections/endpoint/print_spooler_adding_a_printer_driver.yml index 3d94eef705..d4a600a384 100644 --- a/detections/endpoint/print_spooler_adding_a_printer_driver.yml +++ b/detections/endpoint/print_spooler_adding_a_printer_driver.yml @@ -1,6 +1,10 @@ -author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk -datamodel: [] +name: Print Spooler Adding A Printer Driver +id: 313681a2-da8e-11eb-adad-acde48001122 +version: 1 date: '2021-07-01' +author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk +type: TTP +datamodel: [] description: 'The following analytic identifies new printer drivers being load by utilizing the Windows PrintService operational logs, EventCode 316. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. @@ -13,21 +17,19 @@ description: 'The following analytic identifies new printer drivers being load b During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events and review the source of where the exploitation began.' -how_to_implement: You will need to ensure PrintService Admin and Operational logs - are being logged to Splunk from critical or all systems. -id: 313681a2-da8e-11eb-adad-acde48001122 -known_false_positives: Unknown. This may require filtering. -name: Print Spooler Adding A Printer Driver -references: -- https://twitter.com/MalwareJake/status/1410421445608476679?s=20 -- https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ -- https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ -- https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes search: '`printservice` EventCode=316 category = "Adding a printer driver" Message = "*kernelbase.dll,*" Message = "*UNIDRV.DLL,*" Message = "*.DLL.*" | stats count min(_time) as firstTime max(_time) as lastTime by OpCode EventCode ComputerName Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `print_spooler_adding_a_printer_driver_filter`' +how_to_implement: You will need to ensure PrintService Admin and Operational logs + are being logged to Splunk from critical or all systems. +known_false_positives: Unknown. This may require filtering. +references: +- https://twitter.com/MalwareJake/status/1410421445608476679?s=20 +- https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ +- https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ +- https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes tags: analytic_story: - PrintNightmare CVE-2021-34527 @@ -68,5 +70,3 @@ tags: - Message risk_score: 72 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml index 58cc974aec..1a447b17bd 100644 --- a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml +++ b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml @@ -1,6 +1,10 @@ -author: Mauricio Velazco, Michael Haag, Splunk -datamodel: [] +name: Print Spooler Failed to Load a Plug-in +id: 1adc9548-da7c-11eb-8f13-acde48001122 +version: 1 date: '2021-07-01' +author: Mauricio Velazco, Michael Haag, Splunk +type: TTP +datamodel: [] description: 'The following analytic identifies driver load errors utilizing the Windows PrintService Admin logs. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \ @@ -13,20 +17,18 @@ description: 'The following analytic identifies driver load errors utilizing the During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events.' -how_to_implement: You will need to ensure PrintService Admin and Operational logs - are being logged to Splunk from critical or all systems. -id: 1adc9548-da7c-11eb-8f13-acde48001122 -known_false_positives: False positives are unknown and filtering may be required. -name: Print Spooler Failed to Load a Plug-in -references: -- https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ -- https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ -- https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes search: '`printservice` ((ErrorCode="0x45A" (EventCode="808" OR EventCode="4909")) OR ("The print spooler failed to load a plug-in module" OR "\\drivers\\x64\\")) | stats count min(_time) as firstTime max(_time) as lastTime by OpCode EventCode ComputerName Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `print_spooler_failed_to_load_a_plug_in_filter`' +how_to_implement: You will need to ensure PrintService Admin and Operational logs + are being logged to Splunk from critical or all systems. +known_false_positives: False positives are unknown and filtering may be required. +references: +- https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ +- https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ +- https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes tags: analytic_story: - PrintNightmare CVE-2021-34527 @@ -66,5 +68,3 @@ tags: - Message risk_score: 72 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml index 086b33bd30..acad9751d5 100644 --- a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml +++ b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml @@ -1,20 +1,13 @@ +name: Process Creating LNK file in Suspicious Location +id: 5d814af1-1041-47b5-a9ac-d754e82e9a26 +version: 5 +date: '2021-08-26' author: Jose Hernandez, Splunk +type: TTP datamodel: - Endpoint -date: '2021-08-26' description: This search looks for a process launching an `*.lnk` file under `C:\User*` or `*\Local\Temp\*`. This is common behavior used by various spear phishing tools. -how_to_implement: You must be ingesting data that records filesystem and process activity - from your hosts to populate the Endpoint data model. This is typically populated - via endpoint detection-and-response product, such as Carbon Black, or endpoint data - sources, such as Sysmon. -id: 5d814af1-1041-47b5-a9ac-d754e82e9a26 -known_false_positives: This detection should yield little or no false positive results. - It is uncommon for LNK files to be executed from temporary or user directories. -name: Process Creating LNK file in Suspicious Location -references: -- https://attack.mitre.org/techniques/T1566/001/ -- https://www.trendmicro.com/en_us/research/17/e/rising-trend-attackers-using-lnk-files-download-malware.html search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.lnk" AND (Filesystem.file_path="C:\\User\\*" OR Filesystem.file_path="*\\Temp\\*") by @@ -28,6 +21,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime process_name process_path process] | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table firstTime, lastTime, lnk_guid, process_id, user, dest, file_name, file_path, process_name, process, process_path, file_hash | `process_creating_lnk_file_in_suspicious_location_filter`' +how_to_implement: You must be ingesting data that records filesystem and process activity + from your hosts to populate the Endpoint data model. This is typically populated + via endpoint detection-and-response product, such as Carbon Black, or endpoint data + sources, such as Sysmon. +known_false_positives: This detection should yield little or no false positive results. + It is uncommon for LNK files to be executed from temporary or user directories. +references: +- https://attack.mitre.org/techniques/T1566/001/ +- https://www.trendmicro.com/en_us/research/17/e/rising-trend-attackers-using-lnk-files-download-malware.html tags: analytic_story: - Spearphishing Attachments @@ -82,5 +84,3 @@ tags: - _time risk_score: 63 security_domain: network -type: TTP -version: 5 diff --git a/detections/endpoint/process_deleting_its_process_file_path.yml b/detections/endpoint/process_deleting_its_process_file_path.yml index 4ae57f4631..5748004773 100644 --- a/detections/endpoint/process_deleting_its_process_file_path.yml +++ b/detections/endpoint/process_deleting_its_process_file_path.yml @@ -1,27 +1,29 @@ -author: Teoderick Contreras -datamodel: [] +name: Process Deleting Its Process File Path +id: f7eda4bc-871c-11eb-b110-acde48001122 +version: 1 date: '2021-03-17' +author: Teoderick Contreras +type: TTP +datamodel: [] description: This detection is to identify a suspicious process that tries to delete the process file path related to its process. This technique is known to be defense evasion once a certain condition of malware is satisfied or not. Clop ransomware use this technique where it will try to delete its process file path using a .bat command if the keyboard layout is not the layout it tries to infect. -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. -id: f7eda4bc-871c-11eb-b110-acde48001122 -known_false_positives: unknown -name: Process Deleting Its Process File Path -references: -- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html -- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html search: '`sysmon` EventCode=1 cmdline = "*/c del*" Image = "*\\cmd.exe" |eval result = if(like(process,"%".parent_process."%"), "Found", "Not Found") | stats min(_time) as firstTime max(_time) as lastTime count by Computer user ParentImage ParentCommandLine Image cmdline EventCode ProcessID result | where result = "Found" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_deleting_its_process_file_path_filter`' +how_to_implement: You must be ingesting data that records process activity from your + hosts to populate the Endpoint data model in the Processes node. You must also be + ingesting logs with both the process name and command line from your endpoints. + The command-line arguments are mapped to the "process" field in the Endpoint data + model. +known_false_positives: unknown +references: +- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html +- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html tags: analytic_story: - Clop Ransomware @@ -66,5 +68,3 @@ tags: - _time risk_score: 60 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/process_execution_via_wmi.yml b/detections/endpoint/process_execution_via_wmi.yml index 9a092f690c..d062ea2d13 100644 --- a/detections/endpoint/process_execution_via_wmi.yml +++ b/detections/endpoint/process_execution_via_wmi.yml @@ -1,26 +1,28 @@ +name: Process Execution via WMI +id: 24869767-8579-485d-9a4f-d9ddfd8f0cac +version: 4 +date: '2020-03-16' author: Rico Valdez, Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2020-03-16' description: The following analytic identifies `WmiPrvSE.exe` spawning a process. This typically occurs when a process is instantiated from a local or remote process using `wmic.exe`. During triage, review parallel processes for suspicious behavior or commands executed. Review the process and command-line spawning from `wmiprvse.exe`. Contain and remediate the endpoint as necessary. -how_to_implement: You must be ingesting endpoint data that tracks process activity, - including parent-child relationships from your endpoints to populate the Endpoint - data model in the Processes node. The command-line arguments are mapped to the "process" - field in the Endpoint data model. -id: 24869767-8579-485d-9a4f-d9ddfd8f0cac -known_false_positives: Although unlikely, administrators may use wmi to execute commands - for legitimate purposes. -name: Process Execution via WMI -references: [] search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="WmiPrvSE.exe" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_execution_via_wmi_filter` ' +how_to_implement: You must be ingesting endpoint data that tracks process activity, + including parent-child relationships from your endpoints to populate the Endpoint + data model in the Processes node. The command-line arguments are mapped to the "process" + field in the Endpoint data model. +known_false_positives: Although unlikely, administrators may use wmi to execute commands + for legitimate purposes. +references: [] tags: analytic_story: - Suspicious WMI Use @@ -72,5 +74,3 @@ tags: - _time risk_score: 49 security_domain: endpoint -type: TTP -version: 4 diff --git a/detections/endpoint/process_kill_base_on_file_path.yml b/detections/endpoint/process_kill_base_on_file_path.yml index 64bfa0f88b..3f8c4572f7 100644 --- a/detections/endpoint/process_kill_base_on_file_path.yml +++ b/detections/endpoint/process_kill_base_on_file_path.yml @@ -1,20 +1,14 @@ +name: Process Kill Base On File Path +id: 5ffaa42c-acdb-11eb-9ad3-acde48001122 +version: 2 +date: '2021-05-04' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-05-04' description: The following analytic identifies the use of `wmic.exe` using `delete` to remove a executable path. This is typically ran via a batch file during beginning stages of an adversary setting up for mining on an endpoint. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 5ffaa42c-acdb-11eb-9ad3-acde48001122 -known_false_positives: Unknown. -name: Process Kill Base On File Path -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_wmic` AND Processes.process="*process*" @@ -22,6 +16,14 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as Processes.process_name Processes.original_file_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_kill_base_on_file_path_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Unknown. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - XMRig @@ -64,5 +66,3 @@ tags: - _time risk_score: 56 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/process_writing_dynamicwrapperx.yml b/detections/endpoint/process_writing_dynamicwrapperx.yml index 0ad6358f9d..0a2249efb6 100644 --- a/detections/endpoint/process_writing_dynamicwrapperx.yml +++ b/detections/endpoint/process_writing_dynamicwrapperx.yml @@ -1,7 +1,11 @@ +name: Process Writing DynamicWrapperX +id: b0a078e4-2601-11ec-9aec-acde48001122 +version: 1 +date: '2021-10-05' author: Michael Haag, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-10-05' description: DynamicWrapperX is an ActiveX component that can be used in a script to call Windows API functions, but it requires the dynwrapx.dll to be installed and registered. With that, a binary writing dynwrapx.dll to disk and registering @@ -10,23 +14,6 @@ description: DynamicWrapperX is an ActiveX component that can be used in a scrip processes and pivot on the process_guid. Review the registry for any suspicious modifications meant to load dynwrapx.dll. Identify any suspicious module loads of dynwrapx.dll. This will identify the process that will invoke vbs/wscript/cscript. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` - node. In addition, confirm the latest CIM App 4.20 or higher is installed and the - latest TA for the endpoint product. -id: b0a078e4-2601-11ec-9aec-acde48001122 -known_false_positives: False positives should be limited, however it is possible to - filter by Processes.process_name and specific processes (ex. wscript.exe). Filter - as needed. This may need modification based on EDR telemetry and how it brings in - registry data. For example, removal of (Default). -name: Process Writing DynamicWrapperX -references: -- https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/ -- https://www.script-coding.com/dynwrapx_eng.html -- https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/ -- https://tria.ge/210929-ap75vsddan -- https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid Processes.user | `drop_dm_object_name(Processes)` | join process_guid [| tstats @@ -38,6 +25,21 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint as lastTime by dest process_name process_guid file_name file_path file_create_time user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_writing_dynamicwrapperx_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` + node. In addition, confirm the latest CIM App 4.20 or higher is installed and the + latest TA for the endpoint product. +known_false_positives: False positives should be limited, however it is possible to + filter by Processes.process_name and specific processes (ex. wscript.exe). Filter + as needed. This may need modification based on EDR telemetry and how it brings in + registry data. For example, removal of (Default). +references: +- https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/ +- https://www.script-coding.com/dynwrapx_eng.html +- https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/ +- https://tria.ge/210929-ap75vsddan +- https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89 tags: analytic_story: - Remcos @@ -94,5 +96,3 @@ tags: - process_name risk_score: 80 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/processes_launching_netsh.yml b/detections/endpoint/processes_launching_netsh.yml index 55c0afb124..b23630f154 100644 --- a/detections/endpoint/processes_launching_netsh.yml +++ b/detections/endpoint/processes_launching_netsh.yml @@ -1,30 +1,32 @@ +name: Processes launching netsh +id: b89919ed-fe5f-492c-b139-95dbb162040e +version: 4 +date: '2021-09-16' author: Michael Haag, Josef Kuepker, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-16' description: This search looks for processes launching netsh.exe. Netsh is a command-line scripting utility that allows you to, either locally or remotely, display or modify the network configuration of a computer that is currently running. Netsh can be used as a persistence proxy technique to execute a helper DLL when netsh.exe is executed. In this search, we are looking for processes spawned by netsh.exe and executing commands via the command line. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: b89919ed-fe5f-492c-b139-95dbb162040e -known_false_positives: Some VPN applications are known to launch netsh.exe. Outside - of these instances, it is unusual for an executable to launch netsh.exe and run - commands. -name: Processes launching netsh -references: [] search: '| tstats `security_content_summariesonly` count values(Processes.process) AS Processes.process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_netsh` by Processes.parent_process_name Processes.parent_process Processes.original_file_name Processes.process_name Processes.user Processes.dest |`drop_dm_object_name("Processes")` |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` |`processes_launching_netsh_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Some VPN applications are known to launch netsh.exe. Outside + of these instances, it is unusual for an executable to launch netsh.exe and run + commands. +references: [] tags: analytic_story: - Netsh Abuse @@ -75,5 +77,3 @@ tags: - _time risk_score: 42 security_domain: endpoint -type: TTP -version: 4 diff --git a/detections/endpoint/ransomware_notes_bulk_creation.yml b/detections/endpoint/ransomware_notes_bulk_creation.yml index 5f700ae4eb..e31b83d7dc 100644 --- a/detections/endpoint/ransomware_notes_bulk_creation.yml +++ b/detections/endpoint/ransomware_notes_bulk_creation.yml @@ -1,26 +1,28 @@ -author: Teoderick Contreras -datamodel: [] +name: Ransomware Notes bulk creation +id: eff7919a-8330-11eb-83f8-acde48001122 +version: 1 date: '2021-03-12' +author: Teoderick Contreras +type: Anomaly +datamodel: [] description: The following analytics identifies a big number of instance of ransomware notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This behavior is a good sensor if the ransomware note filename is quite new for security industry or the ransomware note filename is not in your ransomware lookup table list for monitoring. -how_to_implement: You must be ingesting data that records the filesystem activity - from your hosts to populate the Endpoint file-system data model node. If you are - using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which - you want to collect data. -id: eff7919a-8330-11eb-83f8-acde48001122 -known_false_positives: unknown -name: Ransomware Notes bulk creation -references: -- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html -- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html search: '`sysmon` EventCode=11 file_name IN ("*\.txt","*\.html","*\.hta") |bin _time span=10s | stats min(_time) as firstTime max(_time) as lastTime dc(TargetFilename) as unique_readme_path_count values(TargetFilename) as list_of_readme_path by Computer Image file_name | where unique_readme_path_count >= 15 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ransomware_notes_bulk_creation_filter`' +how_to_implement: You must be ingesting data that records the filesystem activity + from your hosts to populate the Endpoint file-system data model node. If you are + using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which + you want to collect data. +known_false_positives: unknown +references: +- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html +- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html tags: analytic_story: - Clop Ransomware @@ -62,5 +64,3 @@ tags: - file_name risk_score: 81 security_domain: endpoint -type: Anomaly -version: 1 diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml index edeb6c723b..6dddc75b65 100644 --- a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml +++ b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml @@ -46,13 +46,13 @@ tags: - T1592 observable: - name: ComputerName + role: + - Victim type: Hostname - role: - - Victim - name: User - type: User role: - Victim + type: User product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/recon_using_wmi_class.yml b/detections/endpoint/recon_using_wmi_class.yml index 203a04acdb..1c83df520e 100644 --- a/detections/endpoint/recon_using_wmi_class.yml +++ b/detections/endpoint/recon_using_wmi_class.yml @@ -46,13 +46,13 @@ tags: - T1592 observable: - name: ComputerName + role: + - Victim type: Hostname - role: - - Victim - name: User - type: User role: - Victim + type: User product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml index 44cffe0908..a91321a586 100644 --- a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml +++ b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml @@ -1,28 +1,30 @@ +name: Recursive Delete of Directory In Batch CMD +id: ba570b3a-d356-11eb-8358-acde48001122 +version: 2 +date: '2021-06-22' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-06-22' description: This search is to detect a suspicious commandline designed to delete files or directory recursive using batch command. This technique was seen in ransomware (reddot) where it it tries to delete the files in recycle bin to impaire user from recovering deleted files. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: ba570b3a-d356-11eb-8358-acde48001122 -known_false_positives: network operator may use this batch command to delete recursively - a directory or files within directory -name: Recursive Delete of Directory In Batch CMD -references: -- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_cmd` Processes.process=*/c* Processes.process=* rd * Processes.process="*/s*" Processes.process="*/q*" by Processes.user Processes.process_name Processes.parent_process_name Processes.parent_process Processes.process Processes.process_id Processes.dest |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `recursive_delete_of_directory_in_batch_cmd_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: network operator may use this batch command to delete recursively + a directory or files within directory +references: +- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ tags: analytic_story: - Ransomware @@ -48,5 +50,3 @@ tags: - Endpoint.Processes.user - _time security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml index 41194be91e..044e4989a3 100644 --- a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml +++ b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml @@ -1,21 +1,13 @@ +name: Reg exe Manipulating Windows Services Registry Keys +id: 8470d755-0c13-45b3-bd63-387a373c10cf +version: 5 +date: '2020-11-26' author: Rico Valdez, Splunk +type: TTP datamodel: - Endpoint -date: '2020-11-26' description: The search looks for reg.exe modifying registry keys that define Windows services and their configurations. -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -id: 8470d755-0c13-45b3-bd63-387a373c10cf -known_false_positives: It is unusual for a service to be created or modified by directly - manipulating the registry. However, there may be legitimate instances of this behavior. - It is important to validate and investigate, as appropriate. -name: Reg exe Manipulating Windows Services Registry Keys -references: [] search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process_name) as process_name values(Processes.parent_process_name) as parent_process_name values(Processes.user) as user FROM datamodel=Endpoint.Processes @@ -23,6 +15,16 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process="*Services*" by Processes.process_id Processes.dest Processes.process | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `reg_exe_manipulating_windows_services_registry_keys_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: It is unusual for a service to be created or modified by directly + manipulating the registry. However, there may be legitimate instances of this behavior. + It is important to validate and investigate, as appropriate. +references: [] tags: analytic_story: - Windows Service Abuse @@ -77,5 +79,3 @@ tags: - _time risk_score: 45 security_domain: endpoint -type: TTP -version: 5 diff --git a/detections/endpoint/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml index c8c9003388..b54e4570c5 100644 --- a/detections/endpoint/registry_keys_for_creating_shim_databases.yml +++ b/detections/endpoint/registry_keys_for_creating_shim_databases.yml @@ -1,24 +1,26 @@ +name: Registry Keys for Creating SHIM Databases +id: f5f6af30-7aa7-4295-bfe9-07fe87c01bbb +version: 3 +date: '2020-11-26' author: Bhavin Patel, Patrick Bareiss, Splunk +type: TTP datamodel: - Endpoint -date: '2020-11-26' description: This search looks for registry activity associated with application compatibility shims, which can be leveraged by attackers for various nefarious purposes. -how_to_implement: To successfully implement this search, you must populate the Change_Analysis - data model. This is typically populated via endpoint detection and response product, - such as Carbon Black or other endpoint data sources such as Sysmon. The data used - for this search is typically generated via logs that report reads and writes to - the registry. -id: f5f6af30-7aa7-4295-bfe9-07fe87c01bbb -known_false_positives: There are many legitimate applications that leverage shim databases - for compatibility purposes for legacy applications -name: Registry Keys for Creating SHIM Databases -references: [] search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path=*CurrentVersion\\AppCompatFlags\\Custom* OR Registry.registry_path=*CurrentVersion\\AppCompatFlags\\InstalledSDB* by Registry.dest Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `registry_keys_for_creating_shim_databases_filter`' +how_to_implement: To successfully implement this search, you must populate the Change_Analysis + data model. This is typically populated via endpoint detection and response product, + such as Carbon Black or other endpoint data sources such as Sysmon. The data used + for this search is typically generated via logs that report reads and writes to + the registry. +known_false_positives: There are many legitimate applications that leverage shim databases + for compatibility purposes for legacy applications +references: [] tags: analytic_story: - Suspicious Windows Registry Activities @@ -66,5 +68,3 @@ tags: - _time risk_score: 56 security_domain: endpoint -type: TTP -version: 3 diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 87bcaf0992..9e6dc3a1bd 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -1,20 +1,13 @@ +name: Registry Keys Used For Persistence +id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b +version: 6 +date: '2021-09-07' author: Jose Hernandez, David Dorsey, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-07' description: The search looks for modifications to registry keys that can be used to launch an application or service at system startup. -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b -known_false_positives: There are many legitimate applications that must execute on - system startup and will use these registry keys to accomplish that task. -name: Registry Keys Used For Persistence -references: [] search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\currentversion\\run* @@ -33,6 +26,15 @@ search: '| tstats `security_content_summariesonly` count values(Registry.registr AND Registry.registry_key_name="auto_update")) by Registry.dest Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `registry_keys_used_for_persistence_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: There are many legitimate applications that must execute on + system startup and will use these registry keys to accomplish that task. +references: [] tags: analytic_story: - Suspicious Windows Registry Activities @@ -87,5 +89,3 @@ tags: - _time risk_score: 76 security_domain: endpoint -type: TTP -version: 6 diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml index 3aa82f861f..2172e8d97a 100644 --- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml +++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml @@ -1,29 +1,31 @@ +name: Registry Keys Used For Privilege Escalation +id: c9f4b923-f8af-4155-b697-1354f5bcbc5e +version: 4 +date: '2020-11-27' author: David Dorsey, Splunk +type: TTP datamodel: - Endpoint -date: '2020-11-27' description: This search looks for modifications to registry keys that can be used to elevate privileges. The registry keys under "Image File Execution Options" are used to intercept calls to an executable and can be used to attach malicious binaries to benign system binaries. -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black, or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -id: c9f4b923-f8af-4155-b697-1354f5bcbc5e -known_false_positives: There are many legitimate applications that must execute upon - system startup and will use these registry keys to accomplish that task. -name: Registry Keys Used For Privilege Escalation -references: -- https://blog.malwarebytes.com/101/2015/12/an-introduction-to-image-file-execution-options/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*") AND (Registry.registry_value_name=GlobalFlag OR Registry.registry_value_name=Debugger) by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `registry_keys_used_for_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black, or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: There are many legitimate applications that must execute upon + system startup and will use these registry keys to accomplish that task. +references: +- https://blog.malwarebytes.com/101/2015/12/an-introduction-to-image-file-execution-options/ tags: analytic_story: - Windows Privilege Escalation @@ -71,5 +73,3 @@ tags: - _time risk_score: 76 security_domain: endpoint -type: TTP -version: 4 diff --git a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml index 8ea731c8b9..49c3051882 100644 --- a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml +++ b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml @@ -1,31 +1,33 @@ +name: Regsvr32 Silent and Install Param Dll Loading +id: f421c250-24e7-11ec-bc43-acde48001122 +version: 1 +date: '2021-10-04' author: Teoderick Contreras, Splunk +type: Anomaly datamodel: - Endpoint -date: '2021-10-04' description: This analytic is to detect a loading of dll using regsvr32 application with silent parameter and dllinstall execution. This technique was seen in several RAT malware similar to remcos, njrat and adversaries to load their malicious DLL on the compromised machine. This TTP may executed by normal 3rd party application so it is better to pivot by the parent process, parent command-line and command-line of the file that execute this regsvr32. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: f421c250-24e7-11ec-bc43-acde48001122 -known_false_positives: Other third part application may used this parameter but not - so common in base windows environment. -name: Regsvr32 Silent and Install Param Dll Loading -references: -- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# -- https://attack.mitre.org/techniques/T1218/010/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` AND Processes.process="*/i*" by Processes.dest Processes.parent_process Processes.process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,"(?i)[\-|\/][Ss]{1}") | `regsvr32_silent_and_install_param_dll_loading_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Other third part application may used this parameter but not + so common in base windows environment. +references: +- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# +- https://attack.mitre.org/techniques/T1218/010/ tags: analytic_story: - Suspicious Regsvr32 Activity @@ -78,5 +80,3 @@ tags: - _time risk_score: 36 security_domain: endpoint -type: Anomaly -version: 1 diff --git a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml index d21920f604..3efb999cb7 100644 --- a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml +++ b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml @@ -1,7 +1,11 @@ +name: Regsvr32 with Known Silent Switch Cmdline +id: c9ef7dc4-eeaf-11eb-b2b6-acde48001122 +version: 2 +date: '2021-07-27' author: Teoderick Contreras, Splunk +type: Anomaly datamodel: - Endpoint -date: '2021-07-27' description: The following analytic identifies Regsvr32.exe utilizing the silent switch to load DLLs. This technique has most recently been seen in IcedID campaigns to load its initial dll that will download the 2nd stage loader that will download @@ -10,24 +14,22 @@ description: The following analytic identifies Regsvr32.exe utilizing the silent are more switch types that may be used. \ During triage, review parallel processes and capture any artifacts that may have landed on disk. Isolate and contain the endpoint as necessary. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: c9ef7dc4-eeaf-11eb-b2b6-acde48001122 -known_false_positives: minimal. but network operator can use this application to load - dll. -name: Regsvr32 with Known Silent Switch Cmdline -references: -- https://app.any.run/tasks/56680cba-2bbc-4b34-8633-5f7878ddf858/ -- https://regexr.com/699e2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,"(?i)[\-|\/][Ss]{1}") | `regsvr32_with_known_silent_switch_cmdline_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: minimal. but network operator can use this application to load + dll. +references: +- https://app.any.run/tasks/56680cba-2bbc-4b34-8633-5f7878ddf858/ +- https://regexr.com/699e2 tags: analytic_story: - IcedID @@ -80,5 +82,3 @@ tags: - _time risk_score: 56 security_domain: endpoint -type: Anomaly -version: 2 diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index e2d31555da..daad4cf263 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -1,23 +1,25 @@ +name: Remcos client registry install entry +id: f2a1615a-1d63-11ec-97d2-acde48001122 +version: 1 +date: '2021-09-24' author: Bhavin Patel, Rod Soto, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-24' description: This search detects registry key license at host where Remcos RAT agent is installed. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -id: f2a1615a-1d63-11ec-97d2-acde48001122 -known_false_positives: unknown -name: Remcos client registry install entry -references: -- https://attack.mitre.org/software/S0332/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Registry.registry_path) as registry_path FROM datamodel=Endpoint.Registry where (Registry.registry_key_name=*\\Software\\Remcos*) by Registry.dest Registry.user Registry.registry_key_name Registry.process_id| `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`|`remcos_client_registry_install_entry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: unknown +references: +- https://attack.mitre.org/software/S0332/ tags: analytic_story: - Remcos @@ -52,5 +54,3 @@ tags: - _time risk_score: 90 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml b/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml index 4d55cb34de..864b308375 100644 --- a/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml +++ b/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml @@ -1,26 +1,28 @@ +name: Remcos RAT File Creation in Remcos Folder +id: 25ae862a-1ac3-11ec-94a1-acde48001122 +version: 1 +date: '2021-09-21' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-21' description: This search is to detect file creation in remcos folder in appdata which is the keylog and clipboard logs that will be send to its c2 server. This is really a good TTP indicator that there is a remcos rat in the system that do keylogging, clipboard grabbing and audio recording. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: 25ae862a-1ac3-11ec-94a1-acde48001122 -known_false_positives: unknown -name: Remcos RAT File Creation in Remcos Folder -references: -- https://success.trendmicro.com/solution/1123281-remcos-malware-information -- https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/ search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.dat") Filesystem.file_path = "*\\remcos\\*" by _time Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.file_create_time | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remcos_rat_file_creation_in_remcos_folder_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://success.trendmicro.com/solution/1123281-remcos-malware-information +- https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/ tags: analytic_story: - Remcos @@ -58,5 +60,3 @@ tags: - file_path risk_score: 100 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml index 3411b32af0..f578ba96bf 100644 --- a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml +++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml @@ -1,28 +1,30 @@ +name: Remote Process Instantiation via DCOM and PowerShell +id: d4f42098-4680-11ec-ad07-3e22fbd008af +version: 1 +date: '2021-11-15' author: Mauricio Velazco, Splunk +type: TTP datamodel: - Endpoint -date: '2021-11-15' description: This analytic looks for the execution of `powershell.exe` with arguments utilized to start a process on a remote endpoint by abusing the DCOM protocol. Specifically, this search looks for the abuse of ShellExecute and ExecuteShellCommand. Red Teams and adversaries alike may abuse DCOM and `powershell.exe` for lateral movement and remote code execution. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -id: d4f42098-4680-11ec-ad07-3e22fbd008af -known_false_positives: Administrators may leverage DCOM to start a process on remote - systems, but this activity is usually limited to a small set of hosts or users. -name: Remote Process Instantiation via DCOM and PowerShell -references: -- https://attack.mitre.org/techniques/T1021/003/ -- https://www.cybereason.com/blog/dcom-lateral-movement-techniques search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="*Document.ActiveView.ExecuteShellCommand*" OR Processes.process="*Document.Application.ShellExecute*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_process_instantiation_via_dcom_and_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. +known_false_positives: Administrators may leverage DCOM to start a process on remote + systems, but this activity is usually limited to a small set of hosts or users. +references: +- https://attack.mitre.org/techniques/T1021/003/ +- https://www.cybereason.com/blog/dcom-lateral-movement-techniques tags: analytic_story: - Active Directory Lateral Movement @@ -61,5 +63,3 @@ tags: - _time risk_score: 63 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml index 659cfd42d5..b4f59154fa 100644 --- a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml +++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml @@ -1,25 +1,27 @@ -author: Mauricio Velazco, Splunk -datamodel: [] +name: Remote Process Instantiation via DCOM and PowerShell Script Block +id: fa1c3040-4680-11ec-a618-3e22fbd008af +version: 1 date: '2021-11-15' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of PowerShell with arguments utilized to start a process on a remote endpoint by abusing the DCOM protocol. Specifically, this search looks for the abuse of ShellExecute and ExecuteShellCommand. Red Teams and adversaries alike may abuse DCOM for lateral movement and remote code execution. -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup instructions - can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -id: fa1c3040-4680-11ec-a618-3e22fbd008af -known_false_positives: Administrators may leverage DCOM to start a process on remote - systems, but this activity is usually limited to a small set of hosts or users. -name: Remote Process Instantiation via DCOM and PowerShell Script Block -references: -- https://attack.mitre.org/techniques/T1021/003/ -- https://www.cybereason.com/blog/dcom-lateral-movement-techniques search: '`powershell` EventCode=4104 (Message="*Document.Application.ShellExecute*" OR Message="*Document.ActiveView.ExecuteShellCommand*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_dcom_and_powershell_script_block_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup instructions + can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators may leverage DCOM to start a process on remote + systems, but this activity is usually limited to a small set of hosts or users. +references: +- https://attack.mitre.org/techniques/T1021/003/ +- https://www.cybereason.com/blog/dcom-lateral-movement-techniques tags: analytic_story: - Active Directory Lateral Movement @@ -55,5 +57,3 @@ tags: - User risk_score: 63 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml index b5aaf77c19..734c5ed1f9 100644 --- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml @@ -1,29 +1,31 @@ +name: Remote Process Instantiation via WinRM and PowerShell +id: ba24cda8-4716-11ec-8009-3e22fbd008af +version: 1 +date: '2021-11-16' author: Mauricio Velazco, Splunk +type: TTP datamodel: - Endpoint -date: '2021-11-16' description: This analytic looks for the execution of `powershell.exe` with arguments utilized to start a process on a remote endpoint by abusing the WinRM protocol. Specifically, this search looks for the abuse of the `Invoke-Command` commandlet. Red Teams and adversaries alike may abuse WinRM and `powershell.exe` for lateral movement and remote code execution. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -id: ba24cda8-4716-11ec-8009-3e22fbd008af -known_false_positives: Administrators may leverage WinRM and `Invoke-Command` to start - a process on remote systems for system administration or automation use cases. However, - this activity is usually limited to a small set of hosts or users. -name: Remote Process Instantiation via WinRM and PowerShell -references: -- https://attack.mitre.org/techniques/T1021/006/ -- https://pentestlab.blog/2018/05/15/lateral-movement-winrm/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="*Invoke-Command*" AND Processes.process="*-ComputerName*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_process_instantiation_via_winrm_and_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. +known_false_positives: Administrators may leverage WinRM and `Invoke-Command` to start + a process on remote systems for system administration or automation use cases. However, + this activity is usually limited to a small set of hosts or users. +references: +- https://attack.mitre.org/techniques/T1021/006/ +- https://pentestlab.blog/2018/05/15/lateral-movement-winrm/ tags: analytic_story: - Active Directory Lateral Movement @@ -62,5 +64,3 @@ tags: - _time risk_score: 45 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml index c5498df39b..0a82d4b2b3 100644 --- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml @@ -1,26 +1,28 @@ -author: Mauricio Velazco, Splunk -datamodel: [] +name: Remote Process Instantiation via WinRM and PowerShell Script Block +id: 7d4c618e-4716-11ec-951c-3e22fbd008af +version: 1 date: '2021-11-16' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of PowerShell with arguments utilized to start a process on a remote endpoint by abusing the WinRM protocol. Specifically, this search looks for the abuse of the `Invoke-Command` commandlet. Red Teams and adversaries alike may abuse WinRM for lateral movement and remote code execution. +search: '`powershell` EventCode=4104 (Message="*Invoke-Command*" AND Message="*-ComputerName*") + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message + ComputerName User | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_winrm_and_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup instructions can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -id: 7d4c618e-4716-11ec-951c-3e22fbd008af known_false_positives: Administrators may leverage WinRM and `Invoke-Command` to start a process on remote systems for system administration or automation use cases. This activity is usually limited to a small set of hosts or users. In certain environments, tuning may not be possible. -name: Remote Process Instantiation via WinRM and PowerShell Script Block references: - https://attack.mitre.org/techniques/T1021/006/ - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/ -search: '`powershell` EventCode=4104 (Message="*Invoke-Command*" AND Message="*-ComputerName*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message - ComputerName User | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_winrm_and_powershell_script_block_filter`' tags: analytic_story: - Active Directory Lateral Movement @@ -56,5 +58,3 @@ tags: - User risk_score: 45 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml index 7467742cca..f1d37ab0bc 100644 --- a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml @@ -1,28 +1,30 @@ +name: Remote Process Instantiation via WinRM and Winrs +id: 0dd296a2-4338-11ec-ba02-3e22fbd008af +version: 1 +date: '2021-11-11' author: Mauricio Velazco, Splunk +type: TTP datamodel: - Endpoint -date: '2021-11-11' description: This analytic looks for the execution of `winrs.exe` with command-line arguments utilized to start a process on a remote endpoint. Red Teams and adversaries alike may abuse the WinRM protocol and this binary for lateral movement and remote code execution. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -id: 0dd296a2-4338-11ec-ba02-3e22fbd008af -known_false_positives: Administrators may leverage WinRM and WinRs to start a process - on remote systems, but this activity is usually limited to a small set of hosts - or users. -name: Remote Process Instantiation via WinRM and Winrs -references: -- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/winrs -- https://attack.mitre.org/techniques/T1021/006/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="winrs.exe" OR Processes.original_file_name="winrs.exe") (Processes.process="*-r:*" OR Processes.process="*-remote:*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_process_instantiation_via_winrm_and_winrs_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. +known_false_positives: Administrators may leverage WinRM and WinRs to start a process + on remote systems, but this activity is usually limited to a small set of hosts + or users. +references: +- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/winrs +- https://attack.mitre.org/techniques/T1021/006/ tags: analytic_story: - Active Directory Lateral Movement @@ -61,5 +63,3 @@ tags: - _time risk_score: 54 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml index e734bd3f7f..2bf31b51ff 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml @@ -1,29 +1,31 @@ +name: Remote Process Instantiation via WMI +id: d25d2c3d-d9d8-40ec-8fdf-e86fe155a3da +version: 7 +date: '2021-11-12' author: Rico Valdez, Mauricio Velazco, Splunk +type: TTP datamodel: - Endpoint -date: '2021-11-12' description: This analytic identifies wmic.exe being launched with parameters to spawn a process on a remote system. Red Teams and adversaries alike may abuse WMI and this binary for lateral movement and remote code execution. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: d25d2c3d-d9d8-40ec-8fdf-e86fe155a3da -known_false_positives: The wmic.exe utility is a benign Windows application. It may - be used legitimately by Administrators with these parameters for remote system administration, - but it's relatively uncommon. -name: Remote Process Instantiation via WMI -references: -- https://attack.mitre.org/techniques/T1047/ -- https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/create-method-in-class-win32-process search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_wmic` (Processes.process="*/node:*" AND Processes.process="*process*" AND Processes.process="*call*" AND Processes.process="*create*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_process_instantiation_via_wmi_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: The wmic.exe utility is a benign Windows application. It may + be used legitimately by Administrators with these parameters for remote system administration, + but it's relatively uncommon. +references: +- https://attack.mitre.org/techniques/T1047/ +- https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/create-method-in-class-win32-process tags: analytic_story: - Ransomware @@ -76,5 +78,3 @@ tags: - _time risk_score: 49 security_domain: endpoint -type: TTP -version: 7 diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml index 57e96f2b96..7eb18e20c8 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml @@ -1,28 +1,30 @@ +name: Remote Process Instantiation via WMI and PowerShell +id: 112638b4-4634-11ec-b9ab-3e22fbd008af +version: 1 +date: '2021-11-15' author: Mauricio Velazco, Splunk +type: TTP datamodel: - Endpoint -date: '2021-11-15' description: This analytic looks for the execution of `powershell.exe` leveraging the `Invoke-WmiMethod` commandlet complemented with arguments utilized to start a process on a remote endpoint by abusing WMI. Red Teams and adversaries alike may abuse WMI and `powershell.exe` for lateral movement and remote code execution. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -id: 112638b4-4634-11ec-b9ab-3e22fbd008af -known_false_positives: Administrators may leverage WWMI and powershell.exe to start - a process on remote systems, but this activity is usually limited to a small set - of hosts or users. -name: Remote Process Instantiation via WMI and PowerShell -references: -- https://attack.mitre.org/techniques/T1047/ -- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="*Invoke-WmiMethod*" AND Processes.process="*-CN*" AND Processes.process="*-Class Win32_Process*" AND Processes.process="*-Name create*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_process_instantiation_via_wmi_and_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. +known_false_positives: Administrators may leverage WWMI and powershell.exe to start + a process on remote systems, but this activity is usually limited to a small set + of hosts or users. +references: +- https://attack.mitre.org/techniques/T1047/ +- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1 tags: analytic_story: - Active Directory Lateral Movement @@ -60,5 +62,3 @@ tags: - _time risk_score: 63 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml index 88cd9a9d79..ce4a2642b2 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml @@ -1,25 +1,27 @@ -author: Mauricio Velazco, Splunk -datamodel: [] +name: Remote Process Instantiation via WMI and PowerShell Script Block +id: 2a048c14-4634-11ec-a618-3e22fbd008af +version: 1 date: '2021-11-15' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Invoke-WmiMethod` commandlet with arguments utilized to start a process on a remote endpoint by abusing WMI. Red Teams and adversaries alike may abuse WMI and this commandlet for lateral movement and remote code execution. -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup instructions - can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -id: 2a048c14-4634-11ec-a618-3e22fbd008af -known_false_positives: Administrators may leverage WWMI and powershell.exe to start - a process on remote systems, but this activity is usually limited to a small set - of hosts or users. -name: Remote Process Instantiation via WMI and PowerShell Script Block -references: -- https://attack.mitre.org/techniques/T1047/ -- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1 search: '`powershell` EventCode=4104 (Message="*Invoke-WmiMethod*" AND Message="*-CN*" AND Message="*-Class Win32_Process*" AND Message="*-Name create*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_wmi_and_powershell_script_block_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup instructions + can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators may leverage WWMI and powershell.exe to start + a process on remote systems, but this activity is usually limited to a small set + of hosts or users. +references: +- https://attack.mitre.org/techniques/T1047/ +- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1 tags: analytic_story: - Active Directory Lateral Movement @@ -54,5 +56,3 @@ tags: - User risk_score: 63 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml index a6eee27016..e44828c855 100644 --- a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml +++ b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml @@ -1,23 +1,25 @@ -author: Mauricio Velazco, Splunk -datamodel: [] +name: Remote System Discovery with Adsisearcher +id: 70803451-0047-4e12-9d63-77fa7eb8649c +version: 1 date: '2021-09-01' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain computers. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain computers for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -id: 70803451-0047-4e12-9d63-77fa7eb8649c -known_false_positives: Administrators or power users may use Adsisearcher for troubleshooting. -name: Remote System Discovery with Adsisearcher -references: -- https://attack.mitre.org/techniques/T1018/ -- https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/ search: '`powershell` EventCode=4104 (Message = "*[adsisearcher]*" AND Message = "*objectclass=computer*" AND Message = "*findAll()*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `remote_system_discovery_with_adsisearcher_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators or power users may use Adsisearcher for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1018/ +- https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/ tags: analytic_story: - Active Directory Discovery @@ -52,5 +54,3 @@ tags: - User risk_score: 15 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/remote_system_discovery_with_dsquery.yml b/detections/endpoint/remote_system_discovery_with_dsquery.yml index dcec5b7eba..d95a89a53b 100644 --- a/detections/endpoint/remote_system_discovery_with_dsquery.yml +++ b/detections/endpoint/remote_system_discovery_with_dsquery.yml @@ -1,27 +1,29 @@ +name: Remote System Discovery with Dsquery +id: 9fb562f4-42f8-4139-8e11-a82edf7ed718 +version: 1 +date: '2021-08-31' author: Mauricio Velazco, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-08-31' description: This analytic looks for the execution of `dsquery.exe` with command-line arguments utilized to discover remote systems. The `computer` argument returns a list of all computers registered in the domain. Red Teams and adversaries alike engage in remote system discovery for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: 9fb562f4-42f8-4139-8e11-a82edf7ed718 -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: Remote System Discovery with Dsquery -references: -- https://attack.mitre.org/techniques/T1018/ -- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc732952(v=ws.11) search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="dsquery.exe") (Processes.process="*computer*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_system_discovery_with_dsquery_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1018/ +- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc732952(v=ws.11) tags: analytic_story: - Active Directory Discovery @@ -58,5 +60,3 @@ tags: - Endpoint.Processes.user risk_score: 15 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/remote_system_discovery_with_net.yml b/detections/endpoint/remote_system_discovery_with_net.yml index 081c3a7e9d..67ad0627bf 100644 --- a/detections/endpoint/remote_system_discovery_with_net.yml +++ b/detections/endpoint/remote_system_discovery_with_net.yml @@ -1,20 +1,16 @@ +name: Remote System Discovery with Net +id: 9df16706-04a2-41e2-bbfe-9b38b34409d3 +version: 1 +date: '2021-08-30' author: Mauricio Velazco, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-08-30' description: This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to discover remote systems. The argument `domain computers /domain` returns a list of all domain computers. Red Teams and adversaries alike use net.exe to identify remote systems for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: 9df16706-04a2-41e2-bbfe-9b38b34409d3 -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: Remote System Discovery with Net -references: -- https://attack.mitre.org/techniques/T1018/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" OR Processes.process_name="net1.exe") (Processes.process="*domain computers*" AND @@ -22,6 +18,12 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_system_discovery_with_net_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1018/ tags: analytic_story: - Active Directory Discovery @@ -58,5 +60,3 @@ tags: - Endpoint.Processes.user risk_score: 15 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/remote_system_discovery_with_wmic.yml b/detections/endpoint/remote_system_discovery_with_wmic.yml index 49884b9589..3887042502 100644 --- a/detections/endpoint/remote_system_discovery_with_wmic.yml +++ b/detections/endpoint/remote_system_discovery_with_wmic.yml @@ -1,21 +1,16 @@ +name: Remote System Discovery with Wmic +id: d82eced3-b1dc-42ab-859e-a2fc98827359 +version: 1 +date: '2021-09-01' author: Mauricio Velazco, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-01' description: This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to discover remote systems. The arguments utilized in this command return a list of all the systems registered in the domain. Red Teams and adversaries alike may leverage WMI and wmic.exe to identify remote systems for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: d82eced3-b1dc-42ab-859e-a2fc98827359 -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: Remote System Discovery with Wmic -references: -- https://attack.mitre.org/techniques/T1018/ -- https://docs.microsoft.com/en-us/windows/win32/wmisdk/wmic search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe") (Processes.process=*/NAMESPACE:\\\\root\\directory\\ldap* AND Processes.process=*ds_computer* @@ -23,6 +18,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_system_discovery_with_wmic_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1018/ +- https://docs.microsoft.com/en-us/windows/win32/wmisdk/wmic tags: analytic_story: - Active Directory Discovery @@ -59,5 +61,3 @@ tags: - Endpoint.Processes.user risk_score: 15 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/remote_wmi_command_attempt.yml b/detections/endpoint/remote_wmi_command_attempt.yml index f8971eb6fc..9fc695a5b1 100644 --- a/detections/endpoint/remote_wmi_command_attempt.yml +++ b/detections/endpoint/remote_wmi_command_attempt.yml @@ -1,29 +1,31 @@ +name: Remote WMI Command Attempt +id: 272df6de-61f1-4784-877c-1fbc3e2d0838 +version: 4 +date: '2018-12-03' author: Rico Valdez, Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2018-12-03' description: The following analytic identifies usage of `wmic.exe` spawning a local or remote process, identified by the `node` switch. During triage, review parallel processes for additional commands executed. Look for any file modifications before and after `wmic.exe` execution. In addition, identify the remote endpoint and confirm execution or file modifications. Contain and isolate the endpoint as needed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_wmic` Processes.process=*node* + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_wmi_command_attempt_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. Deprecated because duplicate of Remote Process Instantiation via WMI. -id: 272df6de-61f1-4784-877c-1fbc3e2d0838 known_false_positives: Administrators may use this legitimately to gather info from remote systems. Filter as needed. -name: Remote WMI Command Attempt references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.yaml -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_wmic` Processes.process=*node* - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_wmi_command_attempt_filter`' tags: analytic_story: - Suspicious WMI Use @@ -74,5 +76,3 @@ tags: - _time risk_score: 36 security_domain: endpoint -type: TTP -version: 4 diff --git a/detections/endpoint/resize_shadowstorage_volume.yml b/detections/endpoint/resize_shadowstorage_volume.yml index fdfd10f479..2db1334b14 100644 --- a/detections/endpoint/resize_shadowstorage_volume.yml +++ b/detections/endpoint/resize_shadowstorage_volume.yml @@ -1,23 +1,17 @@ +name: Resize ShadowStorage volume +id: bc760ca6-8336-11eb-bcbb-acde48001122 +version: 1 +date: '2021-03-12' author: Teoderick Contreras +type: TTP datamodel: - Endpoint -date: '2021-03-12' description: The following analytics identifies the resizing of shadowstorage by ransomware malware to avoid the shadow volumes being made again. this technique is an alternative by ransomware attacker than deleting the shadowstorage which is known alert in defensive team. one example of ransomware that use this technique is CLOP ransomware where it drops a .bat file that will resize the shadowstorage to minimum size as much as possible -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: bc760ca6-8336-11eb-bcbb-acde48001122 -known_false_positives: network admin can resize the shadowstorage for valid purposes. -name: Resize ShadowStorage volume -references: -- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html -- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline values(Processes.parent_process_name) as parent_process values(Processes.process_name) as process_name min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes @@ -28,6 +22,14 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as Processes.parent_process Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `resize_shadowstorage_volume_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: network admin can resize the shadowstorage for valid purposes. +references: +- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html +- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html tags: analytic_story: - Clop Ransomware @@ -70,5 +72,3 @@ tags: - _time risk_score: 72 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/revil_common_exec_parameter.yml b/detections/endpoint/revil_common_exec_parameter.yml index b921710fef..d8ba65dcd9 100644 --- a/detections/endpoint/revil_common_exec_parameter.yml +++ b/detections/endpoint/revil_common_exec_parameter.yml @@ -1,20 +1,13 @@ +name: Revil Common Exec Parameter +id: 85facebe-c382-11eb-9c3e-acde48001122 +version: 2 +date: '2021-06-02' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-06-02' description: This analytic identifies suspicious commandline parameter that are commonly used by REVIL ransomware to encrypts the compromise machine. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: 85facebe-c382-11eb-9c3e-acde48001122 -known_false_positives: third party tool may have same command line parameters as revil - ransomware. -name: Revil Common Exec Parameter -references: -- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ -- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "* -nolan *" OR Processes.process = "* -nolocal *" OR Processes.process = "* -fast *" OR Processes.process @@ -22,6 +15,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `revil_common_exec_parameter_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: third party tool may have same command line parameters as revil + ransomware. +references: +- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ +- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ tags: analytic_story: - Ransomware @@ -65,5 +67,3 @@ tags: - _time risk_score: 54 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml index 5a2e362e79..3764eae6c0 100644 --- a/detections/endpoint/revil_registry_entry.yml +++ b/detections/endpoint/revil_registry_entry.yml @@ -1,21 +1,16 @@ +name: Revil Registry Entry +id: e3d3f57a-c381-11eb-9e35-acde48001122 +version: 1 +date: '2021-06-02' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-06-02' description: This analytic identifies suspicious modification in registry entry to keep some malware data during its infection. This technique seen in several apt implant, malware and ransomware like REVIL where it keep some information like the random generated file extension it uses for all the encrypted files and ransomware notes file name in the compromised host. -how_to_implement: to successfully implement this search, you need to be ingesting - logs with the Image, TargetObject registry key, registry Details from your endpoints. - If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -id: e3d3f57a-c381-11eb-9e35-acde48001122 -known_false_positives: unknown -name: Revil Registry Entry -references: -- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ -- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" @@ -23,6 +18,13 @@ search: '| tstats `security_content_summariesonly` count values(Registry.registr = "\.*" OR Registry.registry_value_name = "Binary Data") by Registry.registry_value_name Registry.dest Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `revil_registry_entry_filter`' +how_to_implement: to successfully implement this search, you need to be ingesting + logs with the Image, TargetObject registry key, registry Details from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: unknown +references: +- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ +- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ tags: analytic_story: - Ransomware @@ -63,5 +65,3 @@ tags: - _time risk_score: 60 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/runas_execution_in_commandline.yml b/detections/endpoint/runas_execution_in_commandline.yml index 2027a4b083..95728646ca 100644 --- a/detections/endpoint/runas_execution_in_commandline.yml +++ b/detections/endpoint/runas_execution_in_commandline.yml @@ -1,31 +1,33 @@ +name: Runas Execution in CommandLine +id: 4807e716-43a4-11ec-a0e7-acde48001122 +version: 1 +date: '2021-11-12' author: Teoderick Contreras, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-11-12' description: This analytic look for a spawned runas.exe process with a administrator user option parameter. This parameter was abused by adversaries, malware author or even red teams to gain elevated privileges in target host. This is a good hunting query to figure out privilege escalation tactics that may used for different stages like lateral movement but take note that administrator may use this command in purpose so its better to see other event context before and after this analytic. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 4807e716-43a4-11ec-a0e7-acde48001122 -known_false_positives: A network operator or systems administrator may utilize an - automated or manual execute this command that may generate false positives. filter - is needed. -name: Runas Execution in CommandLine -references: -- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/# search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_runas` AND Processes.process = "*/user:*" AND Processes.process = "*admin*" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `runas_execution_in_commandline_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: A network operator or systems administrator may utilize an + automated or manual execute this command that may generate false positives. filter + is needed. +references: +- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/# tags: analytic_story: - Windows Privilege Escalation @@ -64,5 +66,3 @@ tags: - _time risk_score: 25 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/rundll32_control_rundll_hunt.yml b/detections/endpoint/rundll32_control_rundll_hunt.yml index b48fef0b89..36fc4903cd 100644 --- a/detections/endpoint/rundll32_control_rundll_hunt.yml +++ b/detections/endpoint/rundll32_control_rundll_hunt.yml @@ -1,7 +1,11 @@ +name: Rundll32 Control RunDLL Hunt +id: c8e7ced0-10c5-11ec-8b03-acde48001122 +version: 1 +date: '2021-09-08' author: Michael Haag, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-09-08' description: The following hunting detection identifies rundll32.exe with `control_rundll` within the command-line, loading a .cpl or another file type. Developed in relation to CVE-2021-40444. Rundll32.exe can also be used to execute Control Panel Item files @@ -9,28 +13,26 @@ description: The following hunting detection identifies rundll32.exe with `contr Double-clicking a .cpl file also causes rundll32.exe to execute. \ This is written to be a bit more broad by not including .cpl. \ During triage, review parallel processes to identify any further suspicious behavior. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="rundll32.exe" + OR Processes.original_file_name="RUNDLL32.EXE") Processes.process="*Control_RunDLL*" + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `rundll32_control_rundll_hunt_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -id: c8e7ced0-10c5-11ec-8b03-acde48001122 known_false_positives: This is a hunting detection, meant to provide a understanding of how voluminous control_rundll is within the environment. -name: Rundll32 Control RunDLL Hunt references: - https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html - https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ - https://attack.mitre.org/techniques/T1218/011/ - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="rundll32.exe" - OR Processes.original_file_name="RUNDLL32.EXE") Processes.process="*Control_RunDLL*" by - Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `rundll32_control_rundll_hunt_filter`' tags: analytic_story: - Suspicious Rundll32 Activity @@ -84,5 +86,3 @@ tags: - Endpoint.Processes.user risk_score: 15 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml index 81d35e3e32..f038a82f61 100644 --- a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml +++ b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml @@ -1,7 +1,11 @@ +name: Rundll32 Control RunDLL World Writable Directory +id: 1adffe86-10c3-11ec-8ce6-acde48001122 +version: 1 +date: '2021-09-08' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-08' description: The following detection identifies rundll32.exe with `control_rundll` within the command-line, loading a .cpl or another file type from windows\temp, programdata, or appdata. Developed in relation to CVE-2021-40444. Rundll32.exe can @@ -10,21 +14,6 @@ description: The following detection identifies rundll32.exe with `control_rundl .cpl file also causes rundll32.exe to execute. This is written to be a bit more broad by not including .cpl. The paths are specified, add more as needed. During triage, review parallel processes to identify any further suspicious behavior. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 1adffe86-10c3-11ec-8ce6-acde48001122 -known_false_positives: This may be tuned, or a new one related, by adding .cpl to - command-line. However, it's important to look for both. Tune/filter as needed. -name: Rundll32 Control RunDLL World Writable Directory -references: -- https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html -- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ -- https://attack.mitre.org/techniques/T1218/011/ -- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="rundll32.exe" OR Processes.original_file_name="RUNDLL32.EXE") Processes.process="*Control_RunDLL*" @@ -33,6 +22,19 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_control_rundll_world_writable_directory_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: This may be tuned, or a new one related, by adding .cpl to + command-line. However, it's important to look for both. Tune/filter as needed. +references: +- https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html +- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ +- https://attack.mitre.org/techniques/T1218/011/ +- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml tags: analytic_story: - Suspicious Rundll32 Activity @@ -86,5 +88,3 @@ tags: - Endpoint.Processes.user risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml index c0ee5fe8fc..919c9ae9c3 100644 --- a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml +++ b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml @@ -1,23 +1,25 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Rundll32 Create Remote Thread To A Process +id: 2dbeee3a-f067-11eb-96c0-acde48001122 +version: 1 date: '2021-07-29' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: [] description: This analytic identifies the suspicious Remote Thread execution of rundll32.exe process to cmd.exe process. This technique was seen in IcedID malware to execute its malicious code in normal process for defense evasion and to steal sensitive information the the compromised host. browser process. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the SourceImage, TargetImage, and EventCode executions from your endpoints - related to create remote thread or injecting codes. If you are using Sysmon, you - must have at least version 6.0.4 of the Sysmon TA. -id: 2dbeee3a-f067-11eb-96c0-acde48001122 -known_false_positives: unknown -name: Rundll32 Create Remote Thread To A Process -references: -- https://www.joesandbox.com/analysis/380662/0/html search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage = "*.exe" | stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage TargetProcessId SourceProcessId StartAddress EventCode Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_create_remote_thread_to_a_process_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the SourceImage, TargetImage, and EventCode executions from your endpoints + related to create remote thread or injecting codes. If you are using Sysmon, you + must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: unknown +references: +- https://www.joesandbox.com/analysis/380662/0/html tags: analytic_story: - IcedID @@ -59,5 +61,3 @@ tags: - Computer risk_score: 56 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/rundll32_createremotethread_in_browser.yml b/detections/endpoint/rundll32_createremotethread_in_browser.yml index 90cdc473d3..f57ba3f415 100644 --- a/detections/endpoint/rundll32_createremotethread_in_browser.yml +++ b/detections/endpoint/rundll32_createremotethread_in_browser.yml @@ -1,24 +1,26 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Rundll32 CreateRemoteThread In Browser +id: f8a22586-ee2d-11eb-a193-acde48001122 +version: 1 date: '2021-07-26' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: [] description: This analytic identifies the suspicious Remote Thread execution of rundll32.exe process to "firefox.exe" and "chrome.exe" browser. This technique was seen in IcedID malware where it hooks the browser to parse banking information as user used the targetted browser process. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the SourceImage, TargetImage, and EventCode executions from your endpoints - related to create remote thread or injecting codes. If you are using Sysmon, you - must have at least version 6.0.4 of the Sysmon TA. -id: f8a22586-ee2d-11eb-a193-acde48001122 -known_false_positives: unknown -name: Rundll32 CreateRemoteThread In Browser -references: -- https://www.joesandbox.com/analysis/380662/0/html search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage IN ("*\\firefox.exe", "*\\chrome.exe", "*\\iexplore.exe","*\\microsoftedgecp.exe") | stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage TargetProcessId SourceProcessId StartAddress EventCode Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_createremotethread_in_browser_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the SourceImage, TargetImage, and EventCode executions from your endpoints + related to create remote thread or injecting codes. If you are using Sysmon, you + must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: unknown +references: +- https://www.joesandbox.com/analysis/380662/0/html tags: analytic_story: - IcedID @@ -60,5 +62,3 @@ tags: - Computer risk_score: 70 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/rundll32_dnsquery.yml b/detections/endpoint/rundll32_dnsquery.yml index 4cde4043a5..9097669e72 100644 --- a/detections/endpoint/rundll32_dnsquery.yml +++ b/detections/endpoint/rundll32_dnsquery.yml @@ -1,24 +1,26 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Rundll32 DNSQuery +id: f1483f5e-ee29-11eb-9d23-acde48001122 +version: 1 date: '2021-07-26' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: [] description: This search is to detect a suspicious rundll32.exe process having a http connection and do a dns query in some web domain. This technique was seen in IcedID malware where the rundll32 that execute its payload will contact amazon.com to check internet connect and to communicate to its C&C server to download config and other file component. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name and eventcode = 22 dnsquery executions from your endpoints. - If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. - Tune and filter known instances where renamed rundll32.exe may be used. -id: f1483f5e-ee29-11eb-9d23-acde48001122 -known_false_positives: unknown -name: Rundll32 DNSQuery -references: -- https://any.run/malware-trends/icedid search: '`sysmon` EventCode=22 process_name="rundll32.exe" | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus ProcessId direction Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_dnsquery_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name and eventcode = 22 dnsquery executions from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: unknown +references: +- https://any.run/malware-trends/icedid tags: analytic_story: - IcedID @@ -60,5 +62,3 @@ tags: - Computer risk_score: 56 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/rundll32_lockworkstation.yml b/detections/endpoint/rundll32_lockworkstation.yml index 3183109f0e..149c3a7f7f 100644 --- a/detections/endpoint/rundll32_lockworkstation.yml +++ b/detections/endpoint/rundll32_lockworkstation.yml @@ -1,26 +1,28 @@ +name: Rundll32 LockWorkStation +id: fa90f372-f91d-11eb-816c-acde48001122 +version: 1 +date: '2021-08-09' author: Teoderick Contreras, Splunk +type: Investigation datamodel: - Endpoint -date: '2021-08-09' description: This search is to detect a suspicious rundll32 commandline to lock the workstation through command line. This technique was seen in CONTI leak tooling and script as part of its defense evasion. This technique is not a common practice to lock a screen and maybe a good indicator of compromise. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -id: fa90f372-f91d-11eb-816c-acde48001122 -known_false_positives: unknown -name: Rundll32 LockWorkStation -references: -- https://threadreaderapp.com/thread/1423361119926816776.html search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process= "*user32.dll,LockWorkStation*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_lockworkstation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: unknown +references: +- https://threadreaderapp.com/thread/1423361119926816776.html tags: analytic_story: - Ransomware @@ -63,5 +65,3 @@ tags: - _time risk_score: 25 security_domain: endpoint -type: Investigation -version: 1 diff --git a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml index 19a9b6e9f6..9a1d2fb6e9 100644 --- a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml +++ b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml @@ -1,23 +1,25 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Rundll32 Process Creating Exe Dll Files +id: 6338266a-ee2a-11eb-bf68-acde48001122 +version: 1 date: '2021-07-26' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: [] description: This search is to detect a suspicious rundll32 process that drops executable (.exe or .dll) files. this behavior seen in rundll32 process of IcedID that tries to drop copy of itself in temp folder or download executable drop it either appdata or programdata as part of its execution. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, TargetFilename, and eventcode 11 executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -id: 6338266a-ee2a-11eb-bf68-acde48001122 -known_false_positives: unknown -name: Rundll32 Process Creating Exe Dll Files -references: -- https://any.run/malware-trends/icedid search: '`sysmon` EventCode=11 process_name="rundll32.exe" TargetFilename IN ("*.exe", "*.dll",) | stats count min(_time) as firstTime max(_time) as lastTime by Image TargetFilename ProcessGuid dest user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_process_creating_exe_dll_files_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, TargetFilename, and eventcode 11 executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: unknown +references: +- https://any.run/malware-trends/icedid tags: analytic_story: - IcedID @@ -57,5 +59,3 @@ tags: - user_id risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/rundll32_shimcache_flush.yml b/detections/endpoint/rundll32_shimcache_flush.yml index b02bd8fdc5..2dd53b00e3 100644 --- a/detections/endpoint/rundll32_shimcache_flush.yml +++ b/detections/endpoint/rundll32_shimcache_flush.yml @@ -1,28 +1,30 @@ +name: Rundll32 Shimcache Flush +id: a913718a-25b6-11ec-96d3-acde48001122 +version: 1 +date: '2021-10-05' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-10-05' description: This analytic is to detect a suspicious rundll32 commandline to clear shim cache. This technique is a anti-forensic technique to clear the cache taht are one important artifacts in terms of digital forensic during attacks or incident. This TTP is a good indicator that someone tries to evade some tools and clear foothold on the machine. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: a913718a-25b6-11ec-96d3-acde48001122 -known_false_positives: unknown -name: Rundll32 Shimcache Flush -references: -- https://blueteamops.medium.com/shimcache-flush-89daff28d15e search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` AND Processes.process = "*apphelp.dll,ShimFlushCache*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_shimcache_flush_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: unknown +references: +- https://blueteamops.medium.com/shimcache-flush-89daff28d15e tags: analytic_story: - Unusual Processes @@ -64,5 +66,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml index dde35a1ba5..341f6746e4 100644 --- a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml @@ -1,7 +1,11 @@ +name: Rundll32 with no Command Line Arguments with Network +id: 35307032-a12d-11eb-835f-acde48001122 +version: 3 +date: '2021-10-13' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-10-13' description: The following analytic identifies rundll32.exe with no command line arguments and performing a network connection. It is unusual for rundll32.exe to execute with no command line arguments present. This particular behavior is common with malicious @@ -9,22 +13,6 @@ description: The following analytic identifies rundll32.exe with no command line and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. - To successfully implement this search you need to be ingesting information on process - that include the name of the process responsible for the changes from your endpoints - into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the - latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -id: 35307032-a12d-11eb-835f-acde48001122 -known_false_positives: Although unlikely, some legitimate applications may use a moved - copy of rundll32, triggering a false positive. -name: Rundll32 with no Command Line Arguments with Network -references: -- https://attack.mitre.org/techniques/T1218/011/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md -- https://lolbas-project.github.io/lolbas/Binaries/Rundll32 -- https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_rundll32` by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name @@ -34,6 +22,20 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name process_path process process_guid connection_to_CNC dest_port | `rundll32_with_no_command_line_arguments_with_network_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. + To successfully implement this search you need to be ingesting information on process + that include the name of the process responsible for the changes from your endpoints + into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the + latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: Although unlikely, some legitimate applications may use a moved + copy of rundll32, triggering a false positive. +references: +- https://attack.mitre.org/techniques/T1218/011/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md +- https://lolbas-project.github.io/lolbas/Binaries/Rundll32 +- https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/ tags: analytic_story: - Suspicious Rundll32 Activity @@ -83,5 +85,3 @@ tags: - _time risk_score: 70 security_domain: endpoint -type: TTP -version: 3 diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml index b4e176107d..301fc9cb5d 100644 --- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml +++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml @@ -1,27 +1,29 @@ +name: RunDLL Loading DLL By Ordinal +id: 6c135f8d-5e60-454e-80b7-c56eed739833 +version: 5 +date: '2020-11-30' author: David Dorsey, Splunk +type: TTP datamodel: - Endpoint -date: '2020-11-30' description: This search looks for executing scripts with rundll32. Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly, may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 6c135f8d-5e60-454e-80b7-c56eed739833 -known_false_positives: While not common, loading a DLL under %AppData% and calling - a function by ordinal is possible by a legitimate process -name: RunDLL Loading DLL By Ordinal -references: [] search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` by Processes.process_name Processes.parent_process_name Processes.original_file_name Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll_loading_dll_by_ordinal_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: While not common, loading a DLL under %AppData% and calling + a function by ordinal is possible by a legitimate process +references: [] tags: analytic_story: - Unusual Processes @@ -69,5 +71,3 @@ tags: - _time risk_score: 70 security_domain: endpoint -type: TTP -version: 5 diff --git a/detections/endpoint/ryuk_test_files_detected.yml b/detections/endpoint/ryuk_test_files_detected.yml index de17d353bf..69b8afe9b8 100644 --- a/detections/endpoint/ryuk_test_files_detected.yml +++ b/detections/endpoint/ryuk_test_files_detected.yml @@ -1,22 +1,24 @@ +name: Ryuk Test Files Detected +id: 57d44d70-28d9-4ed1-acf5-1c80ae2bbce3 +version: 1 +date: '2020-11-06' author: Rod Soto, Jose Hernandez, Splunk +type: TTP datamodel: - Endpoint -date: '2020-11-06' description: The search looks for files that contain the key word *Ryuk* under any folder in the C drive, which is consistent with Ryuk propagation. -how_to_implement: You must be ingesting data that records the filesystem activity - from your hosts to populate the Endpoint Filesystem data-model object. If you are - using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which - you want to collect data. -id: 57d44d70-28d9-4ed1-acf5-1c80ae2bbce3 -known_false_positives: If there are files with this keywoord as file names it might - trigger false possitives, please make use of our filters to tune out potential FPs. -name: Ryuk Test Files Detected -references: [] search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem WHERE "Filesystem.file_path"=C:\\*Ryuk* BY "Filesystem.dest", "Filesystem.user", "Filesystem.file_path" | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `ryuk_test_files_detected_filter`' +how_to_implement: You must be ingesting data that records the filesystem activity + from your hosts to populate the Endpoint Filesystem data-model object. If you are + using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which + you want to collect data. +known_false_positives: If there are files with this keywoord as file names it might + trigger false possitives, please make use of our filters to tune out potential FPs. +references: [] tags: analytic_story: - Ryuk Ransomware @@ -56,5 +58,3 @@ tags: - _time risk_score: 70 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/ryuk_wake_on_lan_command.yml b/detections/endpoint/ryuk_wake_on_lan_command.yml index 7094531d0b..64535f8bb5 100644 --- a/detections/endpoint/ryuk_wake_on_lan_command.yml +++ b/detections/endpoint/ryuk_wake_on_lan_command.yml @@ -1,7 +1,11 @@ +name: Ryuk Wake on LAN Command +id: 538d0152-7aaa-11eb-beaa-acde48001122 +version: 1 +date: '2021-03-01' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-03-01' description: This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk ransomware. The Ryuk Ransomware uses the Wake-on-Lan feature to turn on powered off devices on a compromised network to have greater success encrypting them. This @@ -11,22 +15,20 @@ description: This Splunk query identifies the use of Wake-on-LAN utilized by Ryu Scheduled Tasks on the isolated endpoint and across the fleet. Suspicious Scheduled Tasks will include a path to a unknown binary and those endpoints should be isolated until triaged. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: 538d0152-7aaa-11eb-beaa-acde48001122 -known_false_positives: Limited to no known false positives. -name: Ryuk Wake on LAN Command -references: -- https://www.bleepingcomputer.com/news/security/ryuk-ransomware-uses-wake-on-lan-to-encrypt-offline-devices/ -- https://www.bleepingcomputer.com/news/security/ryuk-ransomware-now-self-spreads-to-other-windows-lan-devices/ -- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-006.pdf search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="*8 LAN*" OR Processes.process="*9 REP*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `ryuk_wake_on_lan_command_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Limited to no known false positives. +references: +- https://www.bleepingcomputer.com/news/security/ryuk-ransomware-uses-wake-on-lan-to-encrypt-offline-devices/ +- https://www.bleepingcomputer.com/news/security/ryuk-ransomware-now-self-spreads-to-other-windows-lan-devices/ +- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-006.pdf tags: analytic_story: - Ryuk Ransomware @@ -70,5 +72,3 @@ tags: - _time risk_score: 63 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml index 1aca83a772..ca575d641c 100644 --- a/detections/endpoint/time_provider_persistence_registry.yml +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -1,30 +1,32 @@ +name: Time Provider Persistence Registry +id: 5ba382c4-2105-11ec-8d8f-acde48001122 +version: 1 +date: '2021-09-29' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-29' description: This analytic is to detect a suspiciouos modification of time provider registry for persistence and autostart. This technique can allow the attacker to persist on the compromised host and autostart as soon as the machine boot up. This TTP can be a good indicator of suspicious behavior since this registry is not commonly modified by normal user or even an admin. -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -id: 5ba382c4-2105-11ec-8d8f-acde48001122 -known_false_positives: unknown -name: Time Provider Persistence Registry -references: -- https://pentestlab.blog/2019/10/22/persistence-time-providers/ -- https://attack.mitre.org/techniques/T1547/003/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path ="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*" by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `time_provider_persistence_registry_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: unknown +references: +- https://pentestlab.blog/2019/10/22/persistence-time-providers/ +- https://attack.mitre.org/techniques/T1547/003/ tags: analytic_story: - Windows Persistence Techniques @@ -65,5 +67,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/trickbot_named_pipe.yml b/detections/endpoint/trickbot_named_pipe.yml index 41e2b3121b..7fb77a3f2f 100644 --- a/detections/endpoint/trickbot_named_pipe.yml +++ b/detections/endpoint/trickbot_named_pipe.yml @@ -1,22 +1,24 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Trickbot Named Pipe +id: 1804b0a4-a682-11eb-8f68-acde48001122 +version: 1 date: '2021-04-26' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: [] description: this search is to detect potential trickbot infection through the create/connected named pipe to the system. This technique is used by trickbot to communicate to its c2 to post or get command during infection. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name and pipename from your endpoints. If you are using Sysmon, - you must have at least version 6.0.4 of the Sysmon TA. . -id: 1804b0a4-a682-11eb-8f68-acde48001122 -known_false_positives: unknown -name: Trickbot Named Pipe -references: -- https://labs.vipre.com/trickbot-and-its-modules/ -- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html search: '`sysmon` EventCode IN (17,18) PipeName="\\pipe\\*lacesomepipe" | stats min(_time) as firstTime max(_time) as lastTime count by Computer user_id EventCode PipeName signature Image process_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `trickbot_named_pipe_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name and pipename from your endpoints. If you are using Sysmon, + you must have at least version 6.0.4 of the Sysmon TA. . +known_false_positives: unknown +references: +- https://labs.vipre.com/trickbot-and-its-modules/ +- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html tags: analytic_story: - Trickbot @@ -58,5 +60,3 @@ tags: - process_id risk_score: 42 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml b/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml index bf27729aad..f828551abc 100644 --- a/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml +++ b/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml @@ -1,24 +1,26 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: UAC Bypass MMC Load Unsigned Dll +id: 7f04349c-e30d-11eb-bc7f-acde48001122 +version: 1 date: '2021-07-12' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: [] description: This search is to detect a suspicious loaded unsigned dll by MMC.exe application. This technique is commonly seen in attacker that tries to bypassed UAC feature or gain privilege escalation. This is done by modifying some CLSID registry that will trigger the mmc.exe to load the dll path -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name and imageloaded executions from your endpoints. If you - are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -id: 7f04349c-e30d-11eb-bc7f-acde48001122 -known_false_positives: unknown. all of the dll loaded by mmc.exe is microsoft signed - dll. -name: UAC Bypass MMC Load Unsigned Dll -references: -- https://offsec.almond.consulting/UAC-bypass-dotnet.html search: '`sysmon` EventCode=7 ImageLoaded = "*.dll" Image = "*\\mmc.exe" Signed=false Company != "Microsoft Corporation" | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded Signed ProcessId OriginalFileName Computer EventCode Company | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `uac_bypass_mmc_load_unsigned_dll_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name and imageloaded executions from your endpoints. If you + are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: unknown. all of the dll loaded by mmc.exe is microsoft signed + dll. +references: +- https://offsec.almond.consulting/UAC-bypass-dotnet.html tags: analytic_story: - Windows Defense Evasion Tactics @@ -61,5 +63,3 @@ tags: - Company risk_score: 63 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/uac_bypass_with_colorui_com_object.yml b/detections/endpoint/uac_bypass_with_colorui_com_object.yml index 41a1d532b0..1d872047e6 100644 --- a/detections/endpoint/uac_bypass_with_colorui_com_object.yml +++ b/detections/endpoint/uac_bypass_with_colorui_com_object.yml @@ -1,23 +1,25 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: UAC Bypass With Colorui COM Object +id: 2bcccd20-fc2b-11eb-8d22-acde48001122 +version: 1 date: '2021-08-13' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: [] description: This search is to detect a possible uac bypass using the colorui.dll COM Object. this technique was seen in so many malware and ransomware like lockbit where it make use of the colorui.dll COM CLSID to bypass UAC. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: 2bcccd20-fc2b-11eb-8d22-acde48001122 -known_false_positives: not so common. but 3rd part app may load this dll. -name: UAC Bypass With Colorui COM Object -references: -- https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/ search: '`sysmon` EventCode=7 ImageLoaded="*\\colorui.dll" process_name != "colorcpl.exe" NOT(Image IN("*\\windows\\*", "*\\program files*")) | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `uac_bypass_with_colorui_com_object_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: not so common. but 3rd part app may load this dll. +references: +- https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/ tags: analytic_story: - Ransomware @@ -64,5 +66,3 @@ tags: - ProcessId risk_score: 48 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/unified_messaging_service_spawning_a_process.yml b/detections/endpoint/unified_messaging_service_spawning_a_process.yml index 5af2415016..943e5c2c68 100644 --- a/detections/endpoint/unified_messaging_service_spawning_a_process.yml +++ b/detections/endpoint/unified_messaging_service_spawning_a_process.yml @@ -1,7 +1,11 @@ +name: Unified Messaging Service Spawning a Process +id: f1126df0-7bd5-11eb-988f-acde48001122 +version: 1 +date: '2021-03-02' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-03-02' description: This detection identifies Microsoft Exchange Server's Unified Messaging services, umworkerprocess.exe and umservice.exe, spawning a child process, indicating possible exploitation of CVE-2021-26857 vulnerability. The query filters out werfault.exe @@ -11,18 +15,6 @@ description: This detection identifies Microsoft Exchange Server's Unified Messa processes. Identify any recent out of place file modifications. Review Exchange logs following Microsofts guide. To contain, perform egress filtering or restrict public access to Exchange. In final, patch the vulnerablity and monitor. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: f1126df0-7bd5-11eb-988f-acde48001122 -known_false_positives: Unknown. Tune out child processes as needed to limit volume - of false positives. -name: Unified Messaging Service Spawning a Process -references: -- https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/ -- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/ -- https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="umworkerprocess.exe" OR Processes.parent_process_name="UMService.exe" (Processes.process_name!="wermgr.exe" @@ -30,6 +22,16 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `unified_messaging_service_spawning_a_process_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Unknown. Tune out child processes as needed to limit volume + of false positives. +references: +- https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/ +- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/ +- https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day/ tags: analytic_story: - HAFNIUM Group @@ -70,5 +72,3 @@ tags: - _time risk_score: 56 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/uninstall_app_using_msiexec.yml b/detections/endpoint/uninstall_app_using_msiexec.yml index a64ec480b8..7fe53e119e 100644 --- a/detections/endpoint/uninstall_app_using_msiexec.yml +++ b/detections/endpoint/uninstall_app_using_msiexec.yml @@ -1,26 +1,28 @@ +name: Uninstall App Using MsiExec +id: 1fca2b28-f922-11eb-b2dd-acde48001122 +version: 1 +date: '2021-08-09' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-08-09' description: This search is to detect a suspicious un-installation of application using msiexec. This technique was seen in conti leak tool and script where it tries to uninstall AV product using this commandline. This commandline to uninstall product is not a common practice in enterprise network. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: 1fca2b28-f922-11eb-b2dd-acde48001122 -known_false_positives: unknown. -name: Uninstall App Using MsiExec -references: -- https://threadreaderapp.com/thread/1423361119926816776.html search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="msiexec.exe" Processes.process= "* /qn *" Processes.process= "*/X*" Processes.process= "*REBOOT=*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `uninstall_app_using_msiexec_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown. +references: +- https://threadreaderapp.com/thread/1423361119926816776.html tags: analytic_story: - Ransomware @@ -62,5 +64,3 @@ tags: - _time risk_score: 30 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/unload_sysmon_filter_driver.yml b/detections/endpoint/unload_sysmon_filter_driver.yml index 56f3d6144e..d09ded1239 100644 --- a/detections/endpoint/unload_sysmon_filter_driver.yml +++ b/detections/endpoint/unload_sysmon_filter_driver.yml @@ -1,20 +1,14 @@ +name: Unload Sysmon Filter Driver +id: c77162d3-f93c-45cc-80c8-22f665664g9f +version: 3 +date: '2020-07-22' author: Bhavin Patel, Splunk +type: TTP datamodel: - Endpoint -date: '2020-07-22' description: Attackers often disable security tools to avoid detection. This search looks for the usage of process `fltMC.exe` to unload a Sysmon Driver that will stop sysmon from collecting the data. -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. This search is also shipped with `unload_sysmon_filter_driver_filter` macro, - update this macro to filter out false positives. -id: c77162d3-f93c-45cc-80c8-22f665664g9f -known_false_positives: '' -name: Unload Sysmon Filter Driver -references: [] search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="fltMC.exe" AND Processes.process="*unload*" AND Processes.process="*SysmonDrv*"" by Processes.process_name @@ -22,6 +16,14 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.user | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` |`unload_sysmon_filter_driver_filter`| table firstTime lastTime dest user count process_name process_id parent_process_name process' +how_to_implement: You must be ingesting data that records process activity from your + hosts to populate the Endpoint data model in the Processes node. You must also be + ingesting logs with both the process name and command line from your endpoints. + The command-line arguments are mapped to the "process" field in the Endpoint data + model. This search is also shipped with `unload_sysmon_filter_driver_filter` macro, + update this macro to filter out false positives. +known_false_positives: '' +references: [] tags: analytic_story: - Disabling Security Tools @@ -63,5 +65,3 @@ tags: - _time risk_score: 45 security_domain: endpoint -type: TTP -version: 3 diff --git a/detections/endpoint/unloading_amsi_via_reflection.yml b/detections/endpoint/unloading_amsi_via_reflection.yml index 3cbd73e2df..2a2700c588 100644 --- a/detections/endpoint/unloading_amsi_via_reflection.yml +++ b/detections/endpoint/unloading_amsi_via_reflection.yml @@ -52,9 +52,9 @@ tags: - T1562 observable: - name: ComputerName - type: Endpoint role: - Victim + type: Endpoint product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/unusually_long_command_line.yml b/detections/endpoint/unusually_long_command_line.yml index 897d9958fd..7ad96f2c83 100644 --- a/detections/endpoint/unusually_long_command_line.yml +++ b/detections/endpoint/unusually_long_command_line.yml @@ -1,17 +1,13 @@ +name: Unusually Long Command Line +id: c77162d3-f93c-45cc-80c8-22f6a4264e7f +version: 5 +date: '2020-12-08' author: David Dorsey, Splunk +type: Anomaly datamodel: - Endpoint -date: '2020-12-08' description: Command lines that are extremely long may be indicative of malicious activity on your hosts. -how_to_implement: You must be ingesting endpoint data that tracks process activity, - including parent-child relationships, from your endpoints to populate the Endpoint - data model in the Processes node. The command-line arguments are mapped to the process - field in the Endpoint data model. -id: c77162d3-f93c-45cc-80c8-22f6a4264e7f -known_false_positives: Some legitimate applications start with long command lines. -name: Unusually Long Command Line -references: [] search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.dest Processes.process_name Processes.process | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`| @@ -20,6 +16,12 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as stdevperhost, values(avg) as avgperhost by dest, user, process_name, process | `unusually_long_command_line_filter` |eval threshold = 3 | where maxlen > ((threshold*stdevperhost) + avgperhost)' +how_to_implement: You must be ingesting endpoint data that tracks process activity, + including parent-child relationships, from your endpoints to populate the Endpoint + data model in the Processes node. The command-line arguments are mapped to the process + field in the Endpoint data model. +known_false_positives: Some legitimate applications start with long command lines. +references: [] tags: analytic_story: - Suspicious Command-Line Executions @@ -64,5 +66,3 @@ tags: - _time risk_score: 42 security_domain: endpoint -type: Anomaly -version: 5 diff --git a/detections/endpoint/user_discocvery_with_env_vars_powershell.yml b/detections/endpoint/user_discocvery_with_env_vars_powershell.yml index 8d7d5d6a78..1f60268d7e 100644 --- a/detections/endpoint/user_discocvery_with_env_vars_powershell.yml +++ b/detections/endpoint/user_discocvery_with_env_vars_powershell.yml @@ -1,26 +1,28 @@ +name: User Discovery With Env Vars PowerShell +id: 0cdf318b-a0dd-47d7-b257-c621c0247de8 +version: 1 +date: '2021-09-13' author: Mauricio Velazco, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-09-13' description: This analytic looks for the execution of `powershell.exe` with command-line arguments that leverage PowerShell environment variables to identify the current logged user. Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: 0cdf318b-a0dd-47d7-b257-c621c0247de8 -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: User Discovery With Env Vars PowerShell -references: -- https://attack.mitre.org/techniques/T1033/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process="*$env:UserName*" OR Processes.process="*[System.Environment]::UserName*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `user_discovery_with_env_vars_powershell_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1033/ tags: analytic_story: - Active Directory Discovery @@ -58,5 +60,3 @@ tags: - _time risk_score: 15 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml index 970b6da264..16cc6d0e83 100644 --- a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml +++ b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml @@ -1,23 +1,25 @@ -author: Mauricio Velazco, Splunk -datamodel: [] +name: User Discovery With Env Vars PowerShell Script Block +id: 77f41d9e-b8be-47e3-ab35-5776f5ec1d20 +version: 1 date: '2021-09-13' +author: Mauricio Velazco, Splunk +type: Hunting +datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the use of PowerShell environment variables to identify the current logged user. Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery. -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -id: 77f41d9e-b8be-47e3-ab35-5776f5ec1d20 -known_false_positives: Administrators or power users may use this PowerShell commandlet - for troubleshooting. -name: User Discovery With Env Vars PowerShell Script Block -references: -- https://attack.mitre.org/techniques/T1033/ search: '`powershell` EventCode=4104 (Message = "*$env:UserName*" OR Message = "*[System.Environment]::UserName*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `user_discovery_with_env_vars_powershell_script_block_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators or power users may use this PowerShell commandlet + for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1033/ tags: analytic_story: - Active Directory Discovery @@ -52,5 +54,3 @@ tags: - _time risk_score: 15 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/usn_journal_deletion.yml b/detections/endpoint/usn_journal_deletion.yml index 08a45a8c85..52909b9902 100644 --- a/detections/endpoint/usn_journal_deletion.yml +++ b/detections/endpoint/usn_journal_deletion.yml @@ -1,26 +1,28 @@ +name: USN Journal Deletion +id: b6e0ff70-b122-4227-9368-4cf322ab43c3 +version: 2 +date: '2018-12-03' author: David Dorsey, Splunk +type: TTP datamodel: - Endpoint -date: '2018-12-03' description: The fsutil.exe application is a legitimate Windows utility used to perform tasks related to the file allocation table (FAT) and NTFS file systems. The update sequence number (USN) change journal provides a log of all changes made to the files on the disk. This search looks for fsutil.exe deleting the USN journal. -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. -id: b6e0ff70-b122-4227-9368-4cf322ab43c3 -known_false_positives: None identified -name: USN Journal Deletion -references: [] search: '| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="fsutil.exe" by Processes.user Processes.process_name Processes.parent_process_name Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | search process="*deletejournal*" AND process="*usn*" | `usn_journal_deletion_filter`' +how_to_implement: You must be ingesting data that records process activity from your + hosts to populate the Endpoint data model in the Processes node. You must also be + ingesting logs with both the process name and command line from your endpoints. + The command-line arguments are mapped to the "process" field in the Endpoint data + model. +known_false_positives: None identified +references: [] tags: analytic_story: - Windows Log Manipulation @@ -68,5 +70,3 @@ tags: - _time risk_score: 45 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/vbscript_execution_using_wscript_app.yml b/detections/endpoint/vbscript_execution_using_wscript_app.yml index 6fe1547c25..2fd261f2f2 100644 --- a/detections/endpoint/vbscript_execution_using_wscript_app.yml +++ b/detections/endpoint/vbscript_execution_using_wscript_app.yml @@ -1,22 +1,16 @@ +name: Vbscript Execution Using Wscript App +id: 35159940-228f-11ec-8a49-acde48001122 +version: 1 +date: '2021-10-01' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-10-01' description: This analytic is to detect a suspicious wscript commandline to execute vbscript. This technique was seen in several malware to execute malicious vbs file using wscript application. commonly vbs script is associated to cscript process and this can be a technique to evade process parent child detections or even some av script emulation system. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 35159940-228f-11ec-8a49-acde48001122 -known_false_positives: unknown -name: Vbscript Execution Using Wscript App -references: -- https://www.joesandbox.com/analysis/369332/0/html search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "wscript.exe" AND Processes.parent_process = "*//e:vbscript*") OR (Processes.process_name @@ -24,6 +18,14 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.parent_process Processes.process_name Processes.process_id Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `vbscript_execution_using_wscript_app_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: unknown +references: +- https://www.joesandbox.com/analysis/369332/0/html tags: analytic_story: - FIN7 @@ -66,5 +68,3 @@ tags: - _time risk_score: 49 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/verclsid_clsid_execution.yml b/detections/endpoint/verclsid_clsid_execution.yml index da2de9227c..1e108c5829 100644 --- a/detections/endpoint/verclsid_clsid_execution.yml +++ b/detections/endpoint/verclsid_clsid_execution.yml @@ -1,24 +1,16 @@ +name: Verclsid CLSID Execution +id: 61e9a56a-20fa-11ec-8ba3-acde48001122 +version: 1 +date: '2021-09-29' author: Teoderick Contreras, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-09-29' description: This analytic is to detect a possible abuse of verclsid to execute malicious file through generate CLSID. This process is a normal application of windows to verify the CLSID COM object before it is instantiated by Windows Explorer. This hunting query can be a good pivot point to analyze what is he CLSID or COM object pointing too to check if it is a valid application or not. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 61e9a56a-20fa-11ec-8ba3-acde48001122 -known_false_positives: windows can used this application for its normal COM object - validation. -name: Verclsid CLSID Execution -references: -- https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5 -- https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/ search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes @@ -27,6 +19,16 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as Processes.dest Processes.user Processes.parent_process_name Processes.parent_process | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `verclsid_clsid_execution_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: windows can used this application for its normal COM object + validation. +references: +- https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5 +- https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/ tags: analytic_story: - Unusual Processes @@ -70,5 +72,3 @@ tags: - _time risk_score: 25 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/w3wp_spawning_shell.yml b/detections/endpoint/w3wp_spawning_shell.yml index 63d73424d7..401e0c4eeb 100644 --- a/detections/endpoint/w3wp_spawning_shell.yml +++ b/detections/endpoint/w3wp_spawning_shell.yml @@ -1,7 +1,11 @@ +name: W3WP Spawning Shell +id: 0f03423c-7c6a-11eb-bc47-acde48001122 +version: 2 +date: '2021-03-03' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-03-03' description: This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe, or IIS. In addition to IIS logs, this behavior with an EDR product will capture potential webshell activity, similar to the HAFNIUM Group abusing CVEs, @@ -10,27 +14,25 @@ description: This query identifies a shell, PowerShell.exe or Cmd.exe, spawning and any file modifications that may occur. Identify additional parallel process, child processes, that may highlight further commands executed. After triaging, work to contain the threat and patch the system that is vulnerable. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 0f03423c-7c6a-11eb-bc47-acde48001122 -known_false_positives: Baseline your environment before production. It is possible - build systems using IIS will spawn cmd.exe to perform a software build. Filter as - needed. -name: W3WP Spawning Shell -references: -- https://www.microsoft.com/security/blog/2020/02/04/ghost-in-the-shell-investigating-web-shell-attacks/ -- https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell -- https://www.youtube.com/watch?v=FC6iHw258RI -- https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="w3wp.exe" AND `process_cmd` OR `process_powershell` by Processes.dest Processes.parent_process Processes.original_file_name Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `w3wp_spawning_shell_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Baseline your environment before production. It is possible + build systems using IIS will spawn cmd.exe to perform a software build. Filter as + needed. +references: +- https://www.microsoft.com/security/blog/2020/02/04/ghost-in-the-shell-investigating-web-shell-attacks/ +- https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell +- https://www.youtube.com/watch?v=FC6iHw258RI +- https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do tags: analytic_story: - HAFNIUM Group @@ -74,5 +76,3 @@ tags: - _time risk_score: 56 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/wbadmin_delete_system_backups.yml b/detections/endpoint/wbadmin_delete_system_backups.yml index 74c6b56ef3..f83d12d140 100644 --- a/detections/endpoint/wbadmin_delete_system_backups.yml +++ b/detections/endpoint/wbadmin_delete_system_backups.yml @@ -1,27 +1,29 @@ +name: WBAdmin Delete System Backups +id: cd5aed7e-5cea-11eb-ae93-0242ac130002 +version: 1 +date: '2021-01-22' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-01-22' description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator Tool) that delete backup files. This is typically used by ransomware to prevent recovery. -how_to_implement: You must be ingesting endpoint data that tracks process activity, - including parent-child relationships from your endpoints to populate the Endpoint - data model in the Processes node. Tune based on parent process names. -id: cd5aed7e-5cea-11eb-ae93-0242ac130002 -known_false_positives: Administrators may modify the boot configuration. -name: WBAdmin Delete System Backups -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md -- https://thedfirreport.com/2020/10/08/ryuks-return/ -- https://attack.mitre.org/techniques/T1490/ -- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="wbadmin.exe" Processes.process="*delete*" AND (Processes.process="*catalog*" OR Processes.process="*systemstatebackup*") by Processes.process_name Processes.process Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `wbadmin_delete_system_backups_filter`' +how_to_implement: You must be ingesting endpoint data that tracks process activity, + including parent-child relationships from your endpoints to populate the Endpoint + data model in the Processes node. Tune based on parent process names. +known_false_positives: Administrators may modify the boot configuration. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md +- https://thedfirreport.com/2020/10/08/ryuks-return/ +- https://attack.mitre.org/techniques/T1490/ +- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin tags: analytic_story: - Ryuk Ransomware @@ -62,5 +64,3 @@ tags: - _time risk_score: 15 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/wbemprox_com_object_execution.yml b/detections/endpoint/wbemprox_com_object_execution.yml index 1d86c6f3a5..f4be4bebfa 100644 --- a/detections/endpoint/wbemprox_com_object_execution.yml +++ b/detections/endpoint/wbemprox_com_object_execution.yml @@ -1,24 +1,26 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Wbemprox COM Object Execution +id: 9d911ce0-c3be-11eb-b177-acde48001122 +version: 1 date: '2021-06-02' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: [] description: this search is designed to detect potential malicious process loading COM object to wbemprox.dll, -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name and imageloaded executions from your endpoints. If you - are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -id: 9d911ce0-c3be-11eb-b177-acde48001122 -known_false_positives: legitimate process that are not in the exception list may trigger - this event. -name: Wbemprox COM Object Execution -references: -- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ -- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ search: '`sysmon` EventCode=7 ImageLoaded IN ("*\\fastprox.dll", "*\\wbemprox.dll", "*\\wbemcomn.dll") NOT (process_name IN ("wmiprvse.exe", "WmiApSrv.exe", "unsecapp.exe")) NOT(Image IN("*\\windows\\*","*\\program files*", "*\\wbem\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId Hashes IMPHASH | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wbemprox_com_object_execution_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name and imageloaded executions from your endpoints. If you + are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: legitimate process that are not in the exception list may trigger + this event. +references: +- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ +- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ tags: analytic_story: - Ransomware @@ -59,5 +61,3 @@ tags: - IMPHASH risk_score: 35 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml index 624687f523..b3fc18f0ec 100644 --- a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml +++ b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml @@ -1,6 +1,10 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Wermgr Process Connecting To IP Check Web Services +id: ed313326-a0f9-11eb-a89c-acde48001122 +version: 1 date: '2021-04-19' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: [] description: this search is designed to detect suspicious wermgr.exe process that tries to connect to known IP web services. This technique is know for trickbot and other trojan spy malware to recon the infected machine and look for its ip address @@ -8,16 +12,6 @@ description: this search is designed to detect suspicious wermgr.exe process tha for error handling process of windows it is really suspicious that this process is trying to connect to this IP web services cause that maybe cause of some malicious code injection. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, dns query name process path , and query ststus from - your endpoints like EventCode 22. If you are using Sysmon, you must have at least - version 12 of the Sysmon TA. -id: ed313326-a0f9-11eb-a89c-acde48001122 -known_false_positives: unknown -name: Wermgr Process Connecting To IP Check Web Services -references: -- https://labs.vipre.com/trickbot-and-its-modules/ -- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html search: '`sysmon` EventCode =22 process_name = wermgr.exe QueryName IN ("*wtfismyip.com", "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", @@ -25,6 +19,14 @@ search: '`sysmon` EventCode =22 process_name = wermgr.exe QueryName IN ("*wtfism | stats min(_time) as firstTime max(_time) as lastTime count by process_path process_name process_id QueryName QueryStatus QueryResults Computer EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wermgr_process_connecting_to_ip_check_web_services_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, dns query name process path , and query ststus from + your endpoints like EventCode 22. If you are using Sysmon, you must have at least + version 12 of the Sysmon TA. +known_false_positives: unknown +references: +- https://labs.vipre.com/trickbot-and-its-modules/ +- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html tags: analytic_story: - Trickbot @@ -64,5 +66,3 @@ tags: - EventCode risk_score: 56 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/wermgr_process_create_executable_file.yml b/detections/endpoint/wermgr_process_create_executable_file.yml index 522f736160..d0b0929a2e 100644 --- a/detections/endpoint/wermgr_process_create_executable_file.yml +++ b/detections/endpoint/wermgr_process_create_executable_file.yml @@ -1,26 +1,28 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Wermgr Process Create Executable File +id: ab3bcce0-a105-11eb-973c-acde48001122 +version: 1 date: '2021-04-19' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: [] description: this search is designed to detect potential malicious wermgr.exe process that drops or create executable file. Since wermgr.exe is an application trigger when error encountered in a process, it is really un ussual to this process to drop executable file. This technique is commonly seen in trickbot malware where it injects it code to this process to execute it malicious behavior like downloading other payload -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. -id: ab3bcce0-a105-11eb-973c-acde48001122 -known_false_positives: unknown -name: Wermgr Process Create Executable File -references: -- https://labs.vipre.com/trickbot-and-its-modules/ -- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html search: '`sysmon` EventCode=11 process_name = "wermgr.exe" TargetFilename = "*.exe" | stats min(_time) as firstTime max(_time) as lastTime count by Image TargetFilename process_name dest EventCode ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wermgr_process_create_executable_file_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances of wermgr.exe may be used. +known_false_positives: unknown +references: +- https://labs.vipre.com/trickbot-and-its-modules/ +- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html tags: analytic_story: - Trickbot @@ -56,5 +58,3 @@ tags: - ProcessId risk_score: 56 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml index ccb4db1967..29d75bfa37 100644 --- a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml +++ b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml @@ -1,22 +1,15 @@ +name: Wermgr Process Spawned CMD Or Powershell Process +id: e8fc95bc-a107-11eb-a978-acde48001122 +version: 2 +date: '2021-04-19' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-04-19' description: This search is designed to detect suspicious cmd and powershell process spawned by wermgr.exe process. This suspicious behavior are commonly seen in code injection technique technique like trickbot to execute a shellcode, dll modules to run malicious behavior. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: e8fc95bc-a107-11eb-a978-acde48001122 -known_false_positives: unknown -name: Wermgr Process Spawned CMD Or Powershell Process -references: -- https://labs.vipre.com/trickbot-and-its-modules/ -- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name = "wermgr.exe" `process_cmd` OR `process_powershell` @@ -24,6 +17,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as Processes.process Processes.process_id Processes.process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wermgr_process_spawned_cmd_or_powershell_process_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: unknown +references: +- https://labs.vipre.com/trickbot-and-its-modules/ +- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html tags: analytic_story: - Trickbot @@ -62,5 +64,3 @@ tags: - _time risk_score: 56 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/wget_download_and_bash_execution.yml b/detections/endpoint/wget_download_and_bash_execution.yml index e0c479eec0..33f4fafd76 100644 --- a/detections/endpoint/wget_download_and_bash_execution.yml +++ b/detections/endpoint/wget_download_and_bash_execution.yml @@ -1,24 +1,14 @@ +name: Wget Download and Bash Execution +id: 35682718-5a85-11ec-b8f7-acde48001122 +version: 1 +date: '2021-12-11' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-12-11' description: The following analytic identifies the use of wget on Linux or MacOS attempting to download a file from a remote source and pipe it to bash. This is typically found with coinminers and most recently with CVE-2021-44228, a vulnerability in Log4j. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon for Linux, you will need to ensure mapping is - occurring correctly. If the EDR is not parsing the pipe bash in the command-line, - modifying the analytic will be required. Add parent process name (Processes.parent_process_name) - as needed to filter. -id: 35682718-5a85-11ec-b8f7-acde48001122 -known_false_positives: False positives should be limited, however filtering may be - required. -name: Wget Download and Bash Execution -references: -- https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java -- https://www.lunasec.io/docs/blog/log4j-zero-day/ -- https://gist.github.com/nathanqthai/01808c569903f41a52e7e7b575caa890 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wget (Processes.process="*-q *" OR Processes.process="*--quiet*" AND Processes.process="*-O- @@ -26,6 +16,18 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wget_download_and_bash_execution_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon for Linux, you will need to ensure mapping is + occurring correctly. If the EDR is not parsing the pipe bash in the command-line, + modifying the analytic will be required. Add parent process name (Processes.parent_process_name) + as needed to filter. +known_false_positives: False positives should be limited, however filtering may be + required. +references: +- https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java +- https://www.lunasec.io/docs/blog/log4j-zero-day/ +- https://gist.github.com/nathanqthai/01808c569903f41a52e7e7b575caa890 tags: analytic_story: - Ingress Tool Transfer @@ -73,5 +75,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/windows_adfind_exe.yml b/detections/endpoint/windows_adfind_exe.yml index 27a2340437..0d54ed0d68 100644 --- a/detections/endpoint/windows_adfind_exe.yml +++ b/detections/endpoint/windows_adfind_exe.yml @@ -1,23 +1,17 @@ +name: Windows AdFind Exe +id: bd3b0187-189b-46c0-be45-f52da2bae67f +version: 2 +date: '2021-11-03' author: Jose Hernandez, Bhavin Patel, Splunk +type: TTP datamodel: - Endpoint -date: '2021-11-03' description: 'This search looks for the execution of `adfind.exe` with command-line arguments that it uses by default. Specifically the filter or search functions. It also considers the arguments necessary like objectcategory, see readme for more details: https://www.joeware.net/freetools/tools/adfind/usage.htm. This has been seen used before by Wizard Spider, FIN6 and actors whom also launched SUNBURST. AdFind.exe is usually used a recon tool to enumare a domain controller.' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, and command-line executions from your endpoints. If - you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -id: bd3b0187-189b-46c0-be45-f52da2bae67f -known_false_positives: administrators rarely use adfind, usually not used for legitimate - reasons -name: Windows AdFind Exe -references: -- https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/ -- https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="* -f *" OR Processes.process="* -b *") AND (Processes.process=*objectcategory* OR Processes.process="* @@ -25,6 +19,14 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process Processes.parent_process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_adfind_exe_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, and command-line executions from your endpoints. If + you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: administrators rarely use adfind, usually not used for legitimate + reasons +references: +- https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/ +- https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html tags: analytic_story: - NOBELIUM Group @@ -56,5 +58,3 @@ tags: - Endpoint.Processes.user - _time security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml index d03c6130cd..e82b878d5c 100644 --- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml +++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml @@ -1,7 +1,11 @@ +name: Windows Curl Download to Suspicious Path +id: c32f091e-30db-11ec-8738-acde48001122 +version: 1 +date: '2021-10-19' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-10-19' description: 'The following analytic identifies the use of Windows Curl.exe downloading a file to a suspicious location. \ @@ -10,19 +14,6 @@ description: 'The following analytic identifies the use of Windows Curl.exe down During triage, review parallel processes for further behavior. In addition, identify if the download was successful. If a file was downloaded, capture and analyze.' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: c32f091e-30db-11ec-8738-acde48001122 -known_false_positives: It is possible Administrators or super users will use Curl - for legitimate purposes. Filter as needed. -name: Windows Curl Download to Suspicious Path -references: -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ -- https://attack.mitre.org/techniques/T1105/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_curl` Processes.process IN ("*-O *","*--output*") Processes.process IN ("*\\appdata\\*","*\\programdata\\*","*\\public\\*") @@ -30,6 +21,17 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_curl_download_to_suspicious_path_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: It is possible Administrators or super users will use Curl + for legitimate purposes. Filter as needed. +references: +- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ +- https://attack.mitre.org/techniques/T1105/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md tags: analytic_story: - IceID @@ -81,5 +83,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/windows_curl_upload_to_remote_destination.yml b/detections/endpoint/windows_curl_upload_to_remote_destination.yml index a8bfdec2e7..d45bf7a819 100644 --- a/detections/endpoint/windows_curl_upload_to_remote_destination.yml +++ b/detections/endpoint/windows_curl_upload_to_remote_destination.yml @@ -1,7 +1,11 @@ +name: Windows Curl Upload to Remote Destination +id: 42f8f1a2-4228-11ec-aade-acde48001122 +version: 1 +date: '2021-11-10' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-11-10' description: 'The following analytic identifies the use of Windows Curl.exe uploading a file to a remote destination. \ @@ -20,25 +24,23 @@ description: 'The following analytic identifies the use of Windows Curl.exe uplo what they are attempting to upload (zip vs txt). During triage, review parallel processes for further behavior. In addition, identify if the upload was successful in network logs. If a file was uploaded, isolate the endpoint and review.' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 42f8f1a2-4228-11ec-aade-acde48001122 -known_false_positives: False positives may be limited to source control applications - and may be required to be filtered out. -name: Windows Curl Upload to Remote Destination -references: -- https://everything.curl.dev/usingcurl/uploads -- https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409 -- https://twitter.com/d1r4c/status/1279042657508081664?s=20 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_curl` Processes.process IN ("*-T *","*--upload-file *", "*-d *", "*--data *", "*-F *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_curl_upload_to_remote_destination_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives may be limited to source control applications + and may be required to be filtered out. +references: +- https://everything.curl.dev/usingcurl/uploads +- https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409 +- https://twitter.com/d1r4c/status/1279042657508081664?s=20 tags: analytic_story: - Ingress Tool Transfer @@ -89,5 +91,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/windows_defender_exclusion_registry_entry.yml b/detections/endpoint/windows_defender_exclusion_registry_entry.yml index 4e037ff84c..7bc60f5c66 100644 --- a/detections/endpoint/windows_defender_exclusion_registry_entry.yml +++ b/detections/endpoint/windows_defender_exclusion_registry_entry.yml @@ -1,28 +1,30 @@ +name: Windows Defender Exclusion Registry Entry +id: 13395a44-4dd9-11ec-9df7-acde48001122 +version: 1 +date: '2021-11-25' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-11-25' description: This analytic will detect a suspicious process that modify a registry related to windows defender exclusion feature. This registry is abused by adversaries, malware author and red teams to bypassed Windows Defender Anti-Virus product by excluding folder path, file path, process, extensions and etc. from its real time or schedule scan to execute their malicious code. This is a good indicator for a defense evasion and to look further for events after this behavior. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -id: 13395a44-4dd9-11ec-9df7-acde48001122 -known_false_positives: admin or user may choose to use this windows features. -name: Windows Defender Exclusion Registry Entry -references: -- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html -- https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Exclusions\\*" by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_defender_exclusion_registry_entry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin or user may choose to use this windows features. +references: +- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html +- https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/ tags: analytic_story: - Remcos @@ -63,5 +65,3 @@ tags: - _time risk_score: 64 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/windows_disableantispyware_reg.yml b/detections/endpoint/windows_disableantispyware_reg.yml index 414fb0fac7..0cddc061f3 100644 --- a/detections/endpoint/windows_disableantispyware_reg.yml +++ b/detections/endpoint/windows_disableantispyware_reg.yml @@ -1,29 +1,31 @@ +name: Windows DisableAntiSpyware Registry +id: 23150a40-9301-4195-b802-5bb4f43067fb +version: 2 +date: '2021-03-02' author: Rod Soto, Jose Hernandez, Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-03-02' description: The search looks for the Registry Key DisableAntiSpyware set to disable. This is consistent with Ryuk infections across a fleet of endpoints. This particular behavior is typically executed when an ransomware actor gains access to an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. -id: 23150a40-9301-4195-b802-5bb4f43067fb -known_false_positives: It is unusual to turn this feature off a Windows system since - it is a default security control, although it is not rare for some policies to disable - it. Although no false positives have been identified, use the provided filter macro - to tune the search. -name: Windows DisableAntiSpyware Registry -references: -- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_value_name="DisableAntiSpyware" AND Registry.registry_value_data="0x00000001" by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_disableantispyware_registry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. +known_false_positives: It is unusual to turn this feature off a Windows system since + it is a default security control, although it is not rare for some policies to disable + it. Although no false positives have been identified, use the provided filter macro + to tune the search. +references: +- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ tags: analytic_story: - Ryuk Ransomware @@ -66,5 +68,3 @@ tags: - _time risk_score: 24 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/windows_diskcryptor_usage.yml b/detections/endpoint/windows_diskcryptor_usage.yml index ba2d4ac830..0f2a880594 100644 --- a/detections/endpoint/windows_diskcryptor_usage.yml +++ b/detections/endpoint/windows_diskcryptor_usage.yml @@ -1,31 +1,33 @@ +name: Windows DiskCryptor Usage +id: d56fe0c8-4650-11ec-a8fa-acde48001122 +version: 1 +date: '2021-11-15' author: Michael Haag, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-11-15' description: The following analytic identifies DiskCryptor process name of dcrypt.exe or internal name dcinst.exe. This utility has been utilized by adversaries to encrypt disks manually during an operation. In addition, during install, a dcrypt.sys driver is installed and requires a reboot in order to take effect. There are no command-line arguments used. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: d56fe0c8-4650-11ec-a8fa-acde48001122 -known_false_positives: It is possible false positives may be present based on the - internal name dcinst.exe, filter as needed. It may be worthy to alert on the service - name. -name: Windows DiskCryptor Usage -references: -- https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/ -- https://github.com/DavidXanatos/DiskCryptor search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="dcrypt.exe" OR Processes.original_file_name="dcinst.exe") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_diskcryptor_usage_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: It is possible false positives may be present based on the + internal name dcinst.exe, filter as needed. It may be worthy to alert on the service + name. +references: +- https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/ +- https://github.com/DavidXanatos/DiskCryptor tags: analytic_story: - Ransomware @@ -76,5 +78,3 @@ tags: - _time risk_score: 35 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/windows_event_log_cleared.yml b/detections/endpoint/windows_event_log_cleared.yml index 7d11c1f611..9da4c6070d 100644 --- a/detections/endpoint/windows_event_log_cleared.yml +++ b/detections/endpoint/windows_event_log_cleared.yml @@ -56,9 +56,9 @@ tags: - DE.AE observable: - name: dest - type: Endpoint role: - Victim + type: Endpoint product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_installutil_credential_theft.yml b/detections/endpoint/windows_installutil_credential_theft.yml index 184ad8eb4f..b45de5b2d0 100644 --- a/detections/endpoint/windows_installutil_credential_theft.yml +++ b/detections/endpoint/windows_installutil_credential_theft.yml @@ -1,6 +1,10 @@ -author: Michael Haag, Splunk -datamodel: [] +name: Windows InstallUtil Credential Theft +id: ccfeddec-43ec-11ec-b494-acde48001122 +version: 1 date: '2021-11-12' +author: Michael Haag, Splunk +type: TTP +datamodel: [] description: 'The following analytic identifies the Windows InstallUtil.exe binary loading `vaultcli.dll` and Samlib.dll`. This technique may be used to execute code to bypassing application control and capture credentials by utilizing a tool like @@ -16,20 +20,18 @@ description: 'The following analytic identifies the Windows InstallUtil.exe bina During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further.' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and module loads from your endpoints. - If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -id: ccfeddec-43ec-11ec-b494-acde48001122 -known_false_positives: Typically this will not trigger as by it's very nature InstallUtil - does not need credentials. Filter as needed. -name: Windows InstallUtil Credential Theft -references: -- https://gist.github.com/xorrior/bbac3919ca2aef8d924bdf3b16cce3d0 search: '`sysmon` EventCode=7 process_name=installutil.exe ImageLoaded IN ("*\\samlib.dll", "*\\vaultcli.dll") | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, ImageLoaded, OriginalFileName, process_id | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_installutil_credential_theft_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and module loads from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: Typically this will not trigger as by it's very nature InstallUtil + does not need credentials. Filter as needed. +references: +- https://gist.github.com/xorrior/bbac3919ca2aef8d924bdf3b16cce3d0 tags: analytic_story: - Signed Binary Proxy Execution InstallUtil @@ -75,5 +77,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/windows_installutil_remote_network_connection.yml b/detections/endpoint/windows_installutil_remote_network_connection.yml index 52fca34eca..6b710e6fc8 100644 --- a/detections/endpoint/windows_installutil_remote_network_connection.yml +++ b/detections/endpoint/windows_installutil_remote_network_connection.yml @@ -1,7 +1,11 @@ +name: Windows InstallUtil Remote Network Connection +id: 4fbf9270-43da-11ec-9486-acde48001122 +version: 1 +date: '2021-11-12' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-11-12' description: 'The following analytic identifies the Windows InstallUtil.exe binary making a remote network connection. This technique may be used to download and execute code while bypassing application control. \ @@ -16,18 +20,6 @@ description: 'The following analytic identifies the Windows InstallUtil.exe bina During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further.' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node. - In addition, confirm the latest CIM App 4.20 or higher is installed and the latest - TA for the endpoint product. -id: 4fbf9270-43da-11ec-9486-acde48001122 -known_false_positives: Limited false positives should be present as InstallUtil is - not typically used to download remote files. Filter as needed based on Developers - requirements. -name: Windows InstallUtil Remote Network Connection -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_installutil` by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name @@ -37,6 +29,16 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name process_path process process_guid connection_to_CNC dest_port | `windows_installutil_remote_network_connection_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node. + In addition, confirm the latest CIM App 4.20 or higher is installed and the latest + TA for the endpoint product. +known_false_positives: Limited false positives should be present as InstallUtil is + not typically used to download remote files. Filter as needed based on Developers + requirements. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md tags: analytic_story: - Signed Binary Proxy Execution InstallUtil @@ -91,5 +93,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/windows_installutil_uninstall_option.yml b/detections/endpoint/windows_installutil_uninstall_option.yml index 936394b7bf..8321ab5e84 100644 --- a/detections/endpoint/windows_installutil_uninstall_option.yml +++ b/detections/endpoint/windows_installutil_uninstall_option.yml @@ -1,7 +1,11 @@ +name: Windows InstallUtil Uninstall Option +id: cfa7b9ac-43f0-11ec-9b48-acde48001122 +version: 1 +date: '2021-11-12' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-11-12' description: 'The following analytic identifies the Windows InstallUtil.exe binary. This will execute code while bypassing application control using the `/u` (uninstall) switch. \ @@ -20,25 +24,23 @@ description: 'The following analytic identifies the Windows InstallUtil.exe bina During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further.' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: cfa7b9ac-43f0-11ec-9b48-acde48001122 -known_false_positives: Limited false positives should be present. Filter as needed - by parent process or application. -name: Windows InstallUtil Uninstall Option -references: -- https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12 -- https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/md/Installutil.exe.md -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_installutil` Processes.process IN ("*/u*", "*uninstall*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_installutil_uninstall_option_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Limited false positives should be present. Filter as needed + by parent process or application. +references: +- https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12 +- https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/md/Installutil.exe.md +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md tags: analytic_story: - Signed Binary Proxy Execution InstallUtil @@ -91,5 +93,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml index b909674212..cb8ca56a2d 100644 --- a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml +++ b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml @@ -1,7 +1,11 @@ +name: Windows InstallUtil Uninstall Option with Network +id: 1a52c836-43ef-11ec-a36c-acde48001122 +version: 1 +date: '2021-11-12' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-11-12' description: 'The following analytic identifies the Windows InstallUtil.exe binary making a remote network connection. This technique may be used to download and execute code while bypassing application control using the `/u` (uninstall) switch. \ @@ -20,20 +24,6 @@ description: 'The following analytic identifies the Windows InstallUtil.exe bina During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further.' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node. - In addition, confirm the latest CIM App 4.20 or higher is installed and the latest - TA for the endpoint product. -id: 1a52c836-43ef-11ec-a36c-acde48001122 -known_false_positives: Limited false positives should be present as InstallUtil is - not typically used to download remote files. Filter as needed based on Developers - requirements. -name: Windows InstallUtil Uninstall Option with Network -references: -- https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12 -- https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/md/Installutil.exe.md -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_installutil` Processes.process IN ("*/u*", "*uninstall*") by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path @@ -44,6 +34,18 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name original_file_name process_path process process_guid connection_to_CNC dest_port | `windows_installutil_uninstall_option_with_network_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node. + In addition, confirm the latest CIM App 4.20 or higher is installed and the latest + TA for the endpoint product. +known_false_positives: Limited false positives should be present as InstallUtil is + not typically used to download remote files. Filter as needed based on Developers + requirements. +references: +- https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12 +- https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/md/Installutil.exe.md +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md tags: analytic_story: - Signed Binary Proxy Execution InstallUtil @@ -97,5 +99,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/windows_installutil_url_in_command_line.yml b/detections/endpoint/windows_installutil_url_in_command_line.yml index 966dcab1cd..a3350bfcd7 100644 --- a/detections/endpoint/windows_installutil_url_in_command_line.yml +++ b/detections/endpoint/windows_installutil_url_in_command_line.yml @@ -1,7 +1,11 @@ +name: Windows InstallUtil URL in Command Line +id: 28e06670-43df-11ec-a569-acde48001122 +version: 1 +date: '2021-11-12' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-11-12' description: 'The following analytic identifies the Windows InstallUtil.exe binary passing a HTTP request on the command-line. This technique may be used to download and execute code while bypassing application control. \ @@ -16,25 +20,23 @@ description: 'The following analytic identifies the Windows InstallUtil.exe bina During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further.' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 28e06670-43df-11ec-a569-acde48001122 -known_false_positives: Limited false positives should be present as InstallUtil is - not typically used to download remote files. Filter as needed based on Developers - requirements. -name: Windows InstallUtil URL in Command Line -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md -- https://gist.github.com/DanielRTeixeira/0fd06ec8f041f34a32bf5623c6dd479d search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_installutil` Processes.process IN ("*http://*","*https://*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_installutil_url_in_command_line_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Limited false positives should be present as InstallUtil is + not typically used to download remote files. Filter as needed based on Developers + requirements. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md +- https://gist.github.com/DanielRTeixeira/0fd06ec8f041f34a32bf5623c6dd479d tags: analytic_story: - Signed Binary Proxy Execution InstallUtil @@ -87,5 +89,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/windows_security_account_manager_stopped.yml b/detections/endpoint/windows_security_account_manager_stopped.yml index e975a19683..4f60232c6e 100644 --- a/detections/endpoint/windows_security_account_manager_stopped.yml +++ b/detections/endpoint/windows_security_account_manager_stopped.yml @@ -1,24 +1,26 @@ +name: Windows Security Account Manager Stopped +id: 69c12d59-d951-431e-ab77-ec426b8d65e6 +version: 1 +date: '2020-11-06' author: Rod Soto, Jose Hernandez, Splunk +type: TTP datamodel: - Endpoint -date: '2020-11-06' description: The search looks for a Windows Security Account Manager (SAM) was stopped via command-line. This is consistent with Ryuk infections across a fleet of endpoints. -how_to_implement: You must be ingesting data that records the process-system activity - from your hosts to populate the Endpoint Processes data-model object. If you are - using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which - you want to collect data. -id: 69c12d59-d951-431e-ab77-ec426b8d65e6 -known_false_positives: SAM is a critical windows service, stopping it would cause - major issues on an endpoint this makes false positive rare. AlthoughNo false positives - have been identified. -name: Windows Security Account Manager Stopped -references: [] search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE ("Processes.process_name"="net*.exe" "Processes.process"="*stop \"samss\"*") BY "Processes.dest", "Processes.user", "Processes.process" | `drop_dm_object_name(Processes)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_security_account_manager_stopped_filter`' +how_to_implement: You must be ingesting data that records the process-system activity + from your hosts to populate the Endpoint Processes data-model object. If you are + using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which + you want to collect data. +known_false_positives: SAM is a critical windows service, stopping it would cause + major issues on an endpoint this makes false positive rare. AlthoughNo false positives + have been identified. +references: [] tags: analytic_story: - Ryuk Ransomware @@ -63,5 +65,3 @@ tags: - _time risk_score: 70 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml index 0edafab0e1..71f83e18b4 100644 --- a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml +++ b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml @@ -1,27 +1,29 @@ -author: Teoderick Contreras, Mauricio Velazco, Splunk -datamodel: [] +name: Windows Service Created With Suspicious Service Path +id: 429141be-8311-11eb-adb6-acde48001122 +version: 2 date: '2021-11-22' +author: Teoderick Contreras, Mauricio Velazco, Splunk +type: TTP +datamodel: [] description: The following analytc uses Windows Event Id 7045, `New Service Was Installed`, to identify the creation of a Windows Service where the service binary path path is located in a non-common Service folder in Windows. Red Teams and adversaries alike may create malicious Services for lateral movement or remote code execution as well as persistence and execution. The Clop ransomware has also been seen in the wild abusing Windows services. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the Service name, Service File Name Service Start type, and Service Type - from your endpoints. -id: 429141be-8311-11eb-adb6-acde48001122 -known_false_positives: Legitimate applications may install services with uncommon - services paths. -name: Windows Service Created With Suspicious Service Path -references: -- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html -- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html search: ' `wineventlog_system` EventCode=7045 Service_File_Name = "*\.exe" NOT (Service_File_Name IN ("C:\\Windows\\*", "C:\\Program File*", "C:\\Programdata\\*", "%systemroot%\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_created_with_suspicious_service_path_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the Service name, Service File Name Service Start type, and Service Type + from your endpoints. +known_false_positives: Legitimate applications may install services with uncommon + services paths. +references: +- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html +- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html tags: analytic_story: - Clop Ransomware @@ -65,5 +67,3 @@ tags: - Service_Start_Type risk_score: 56 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/windows_service_created_within_public_path.yml b/detections/endpoint/windows_service_created_within_public_path.yml index 335d55b0bb..617c47453d 100644 --- a/detections/endpoint/windows_service_created_within_public_path.yml +++ b/detections/endpoint/windows_service_created_within_public_path.yml @@ -1,26 +1,28 @@ -author: Mauricio Velazco, Splunk -datamodel: [] +name: Windows Service Created Within Public Path +id: 3abb2eda-4bb8-11ec-9ae4-3e22fbd008af +version: 1 date: '2021-11-22' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] description: The following analytc uses Windows Event Id 7045, `New Service Was Installed`, to identify the creation of a Windows Service where the service binary path is located in public paths. This behavior could represent the installation of a malicious service. Red Teams and adversaries alike may create malicious Services for lateral movement or remote code execution -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the Service name, Service File Name Service Start type, and Service Type - from your endpoints. -id: 3abb2eda-4bb8-11ec-9ae4-3e22fbd008af -known_false_positives: Legitimate applications may install services with uncommon - services paths. -name: Windows Service Created Within Public Path -references: -- https://docs.microsoft.com/en-us/windows/win32/services/service-control-manager -- https://pentestlab.blog/2020/07/21/lateral-movement-services/ search: '`wineventlog_system` EventCode=7045 Service_File_Name = "*\.exe" NOT (Service_File_Name IN ("C:\\Windows\\*", "C:\\Program File*", "C:\\Programdata\\*", "%systemroot%\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode Service_File_Name Service_Name Service_Start_Type Service_Type | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_created_within_public_path_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the Service name, Service File Name Service Start type, and Service Type + from your endpoints. +known_false_positives: Legitimate applications may install services with uncommon + services paths. +references: +- https://docs.microsoft.com/en-us/windows/win32/services/service-control-manager +- https://pentestlab.blog/2020/07/21/lateral-movement-services/ tags: analytic_story: - Active Directory Lateral Movement @@ -61,5 +63,3 @@ tags: - Service_Start_Type risk_score: 54 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml index aafdd0ca6f..7445df8348 100644 --- a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml +++ b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml @@ -1,22 +1,15 @@ +name: Windows Service Creation on Remote Endpoint +id: e0eea4fa-4274-11ec-882b-3e22fbd008af +version: 1 +date: '2021-11-10' author: Mauricio Velazco, Splunk +type: TTP datamodel: - Endpoint -date: '2021-11-10' description: This analytic looks for the execution of `sc.exe` with command-line arguments utilized to create a Windows Service on a remote endpoint. Red Teams and adversaries alike may abuse the Service Control Manager for lateral movement and remote code execution. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -id: e0eea4fa-4274-11ec-882b-3e22fbd008af -known_false_positives: Administrators may create Windows Services on remote systems, - but this activity is usually limited to a small set of hosts or users. -name: Windows Service Creation on Remote Endpoint -references: -- https://docs.microsoft.com/en-us/windows/win32/services/service-control-manager -- https://docs.microsoft.com/en-us/windows/win32/services/controlling-a-service-using-sc -- https://attack.mitre.org/techniques/T1543/003/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="sc.exe" OR Processes.original_file_name="sc.exe") (Processes.process="*\\\\*" AND Processes.process="*create*" @@ -24,6 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_service_creation_on_remote_endpoint_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. +known_false_positives: Administrators may create Windows Services on remote systems, + but this activity is usually limited to a small set of hosts or users. +references: +- https://docs.microsoft.com/en-us/windows/win32/services/service-control-manager +- https://docs.microsoft.com/en-us/windows/win32/services/controlling-a-service-using-sc +- https://attack.mitre.org/techniques/T1543/003/ tags: analytic_story: - Active Directory Lateral Movement @@ -62,5 +64,3 @@ tags: - _time risk_score: 54 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml index df6aab86c2..db010a182d 100644 --- a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml +++ b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml @@ -1,27 +1,29 @@ +name: Windows Service Initiation on Remote Endpoint +id: 3f519894-4276-11ec-ab02-3e22fbd008af +version: 1 +date: '2021-11-10' author: Mauricio Velazco, Splunk +type: TTP datamodel: - Endpoint -date: '2021-11-10' description: This analytic looks for the execution of `sc.exe` with command-line arguments utilized to start a Windows Service on a remote endpoint. Red Teams and adversaries alike may abuse the Service Control Manager for lateral movement and remote code execution. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -id: 3f519894-4276-11ec-ab02-3e22fbd008af -known_false_positives: Administrators may start Windows Services on remote systems, - but this activity is usually limited to a small set of hosts or users. -name: Windows Service Initiation on Remote Endpoint -references: -- https://docs.microsoft.com/en-us/windows/win32/services/controlling-a-service-using-sc -- https://attack.mitre.org/techniques/T1543/003/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="sc.exe" OR Processes.original_file_name="sc.exe") (Processes.process="*\\\\*" AND Processes.process="*start*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_service_initiation_on_remote_endpoint_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. +known_false_positives: Administrators may start Windows Services on remote systems, + but this activity is usually limited to a small set of hosts or users. +references: +- https://docs.microsoft.com/en-us/windows/win32/services/controlling-a-service-using-sc +- https://attack.mitre.org/techniques/T1543/003/ tags: analytic_story: - Active Directory Lateral Movement @@ -60,5 +62,3 @@ tags: - _time risk_score: 54 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/windows_updates_install_failures.yml b/detections/endpoint/windows_updates_install_failures.yml index 6a0a4c5e85..fc51fee8da 100644 --- a/detections/endpoint/windows_updates_install_failures.yml +++ b/detections/endpoint/windows_updates_install_failures.yml @@ -1,18 +1,20 @@ +name: Windows Updates Install Failures +id: 6a4dbd1b-4502-4a11-943a-82b5ae7a42d7 +version: 1 +date: '2017-09-14' author: David Dorsey, Splunk +type: Baseline datamodel: - Updates -date: '2017-09-14' description: This search is intended to give you a feel for how often Windows updates fail to install in your environment. Fluctuations in these numbers will allow you to determine when you should be concerned. -how_to_implement: You must be ingesting your Windows Update Logs -id: 6a4dbd1b-4502-4a11-943a-82b5ae7a42d7 -known_false_positives: none -name: Windows Updates Install Failures -references: [] search: '| tstats `security_content_summariesonly` dc(Updates.dest) as count FROM datamodel=Updates.Updates where Updates.vendor_product="Microsoft Windows" AND Updates.status=failure by _time span=1d' +how_to_implement: You must be ingesting your Windows Update Logs +known_false_positives: none +references: [] tags: deployments: - Daily Cache Updates @@ -26,5 +28,3 @@ tags: - Updates.Updates.vendor_product - _time security_domain: endpoint -type: Baseline -version: 1 diff --git a/detections/endpoint/windows_updates_install_successes.yml b/detections/endpoint/windows_updates_install_successes.yml index 1c5255e2e7..11eb849eab 100644 --- a/detections/endpoint/windows_updates_install_successes.yml +++ b/detections/endpoint/windows_updates_install_successes.yml @@ -1,18 +1,20 @@ +name: Windows Updates Install Successes +id: 6a80535c-86a6-4b54-894c-4b446d0c701d +version: 1 +date: '2017-09-14' author: David Dorsey, Splunk +type: Baseline datamodel: - Updates -date: '2017-09-14' description: This search is intended to give you a feel for how often successful Windows updates are applied in your environments. Fluctuations in these numbers will allow you to determine when you should be concerned. -how_to_implement: You must be ingesting your Windows Update Logs -id: 6a80535c-86a6-4b54-894c-4b446d0c701d -known_false_positives: none -name: Windows Updates Install Successes -references: [] search: '| tstats `security_content_summariesonly` dc(Updates.dest) as count FROM datamodel=Updates.Updates where Updates.vendor_product="Microsoft Windows" AND Updates.status=installed by _time span=1d' +how_to_implement: You must be ingesting your Windows Update Logs +known_false_positives: none +references: [] tags: deployments: - Daily Cache Updates @@ -26,5 +28,3 @@ tags: - Updates.Updates.vendor_product - _time security_domain: endpoint -type: Baseline -version: 1 diff --git a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml index 282f728c99..188fb44dd4 100644 --- a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml +++ b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml @@ -1,6 +1,10 @@ -author: Michael Haag, Splunk -datamodel: [] +name: WinEvent Scheduled Task Created to Spawn Shell +id: 203ef0ea-9bd8-11eb-8201-acde48001122 +version: 1 date: '2021-04-12' +author: Michael Haag, Splunk +type: TTP +datamodel: [] description: 'The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed with a native Windows @@ -20,25 +24,23 @@ description: 'The following query utilizes Windows Security EventCode 4698, `A s Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' -how_to_implement: To successfully implement this search, you need to be ingesting - Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also - required. -id: 203ef0ea-9bd8-11eb-8201-acde48001122 -known_false_positives: False positives are possible if legitimate applications are - allowed to register tasks that call a shell to be spawned. Filter as needed based - on command-line or processes that are used legitimately. -name: WinEvent Scheduled Task Created to Spawn Shell -references: -- https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/ -- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4698 -- https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/ -- https://docs.microsoft.com/en-us/windows/win32/taskschd/time-trigger-example--scripting-?redirectedfrom=MSDN search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN ("*powershell.exe*", "*wscript.exe*", "*cscript.exe*", "*cmd.exe*", "*sh.exe*", "*ksh.exe*", "*zsh.exe*", "*bash.exe*", "*scrcons.exe*", "*pwsh.exe*") | stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winevent_scheduled_task_created_to_spawn_shell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also + required. +known_false_positives: False positives are possible if legitimate applications are + allowed to register tasks that call a shell to be spawned. Filter as needed based + on command-line or processes that are used legitimately. +references: +- https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/ +- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4698 +- https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/ +- https://docs.microsoft.com/en-us/windows/win32/taskschd/time-trigger-example--scripting-?redirectedfrom=MSDN tags: analytic_story: - Windows Persistence Techniques @@ -81,5 +83,3 @@ tags: - dest risk_score: 70 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml index 4a4b48d20c..3bff485405 100644 --- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -1,6 +1,10 @@ -author: Michael Haag, Splunk -datamodel: [] +name: WinEvent Scheduled Task Created Within Public Path +id: 5d9c6eee-988c-11eb-8253-acde48001122 +version: 1 date: '2021-04-08' +author: Michael Haag, Splunk +type: TTP +datamodel: [] description: 'The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed from a user writeable @@ -20,25 +24,23 @@ description: 'The following query utilizes Windows Security EventCode 4698, `A s TaskService. Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' +search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN + ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", + "*\\appdata\\*") | stats count min(_time) as firstTime max(_time) as lastTime by + dest, Task_Name, Command, Author, Enabled, Hidden | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `winevent_scheduled_task_created_within_public_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required. -id: 5d9c6eee-988c-11eb-8253-acde48001122 known_false_positives: False positives are possible if legitimate applications are allowed to register tasks in public paths. Filter as needed based on paths that are used legitimately. -name: WinEvent Scheduled Task Created Within Public Path references: - https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/ - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4698 - https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/ - https://docs.microsoft.com/en-us/windows/win32/taskschd/time-trigger-example--scripting-?redirectedfrom=MSDN - https://app.any.run/tasks/e26f1b2e-befa-483b-91d2-e18636e2faf3/ -search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN - ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", - "*\\appdata\\*") | stats count min(_time) as firstTime max(_time) as lastTime by - dest, Task_Name, Command, Author, Enabled, Hidden | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `winevent_scheduled_task_created_within_public_path_filter`' tags: analytic_story: - Windows Persistence Techniques @@ -83,5 +85,3 @@ tags: - dest risk_score: 70 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml index f345871857..72db0557de 100644 --- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml +++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml @@ -1,6 +1,10 @@ -author: Michael Haag, Splunk -datamodel: [] +name: WinEvent Windows Task Scheduler Event Action Started +id: b3632472-310b-11ec-9aab-acde48001122 +version: 1 date: '2021-10-19' +author: Michael Haag, Splunk +type: Hunting +datamodel: [] description: The following hunting analytic assists with identifying suspicious tasks that have been registered and ran in Windows using EventID 200 (action run) and 201 (action completed). It is recommended to filter based on ActionName by specifying @@ -9,21 +13,19 @@ description: The following hunting analytic assists with identifying suspicious events related to tasks being scheduled. EventID 106 will generate when a new task is generated, however, that does not mean it ran. Capture any files on disk and analyze. -how_to_implement: Task Scheduler logs are required to be collected. Enable logging - with inputs.conf by adding a stanza for [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] - and renderXml=false. Note, not translating it in XML may require a proper extraction - of specific items in the Message. -id: b3632472-310b-11ec-9aab-acde48001122 -known_false_positives: False positives will be present. Filter based on ActionName - paths or specify keywords of interest. -name: WinEvent Windows Task Scheduler Event Action Started -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.005/T1053.005.md -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ search: '`wineventlog_task_scheduler` EventCode IN ("200","201") | rename ComputerName as dest | stats count min(_time) as firstTime max(_time) as lastTime by Message dest EventCode category | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winevent_windows_task_scheduler_event_action_started_filter`' +how_to_implement: Task Scheduler logs are required to be collected. Enable logging + with inputs.conf by adding a stanza for [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] + and renderXml=false. Note, not translating it in XML may require a proper extraction + of specific items in the Message. +known_false_positives: False positives will be present. Filter based on ActionName + paths or specify keywords of interest. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.005/T1053.005.md +- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ tags: analytic_story: - IcedID @@ -55,5 +57,3 @@ tags: - dest risk_score: 80 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/winhlp32_spawning_a_process.yml b/detections/endpoint/winhlp32_spawning_a_process.yml index c63fba6367..5512d12cc1 100644 --- a/detections/endpoint/winhlp32_spawning_a_process.yml +++ b/detections/endpoint/winhlp32_spawning_a_process.yml @@ -1,7 +1,11 @@ +name: Winhlp32 Spawning a Process +id: d17dae9e-2618-11ec-b9f5-acde48001122 +version: 1 +date: '2021-10-05' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-10-05' description: The following analytic identifies winhlp32.exe, found natively in `c:\windows\`, spawning a child process that loads a file out of appdata, programdata, or temp. Winhlp32.exe has a rocky past in that multiple vulnerabilities were found and added @@ -12,25 +16,23 @@ description: The following analytic identifies winhlp32.exe, found natively in ` triage, review parallel processes to identify further suspicious behavior. Review module loads for unsuspecting unsigned modules. Capture any file modifications and analyze. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: d17dae9e-2618-11ec-b9f5-acde48001122 -known_false_positives: False positives should be limited as winhlp32.exe is typically - not used with the latest flavors of Windows OS. However, filter as needed. -name: Winhlp32 Spawning a Process -references: -- https://www.exploit-db.com/exploits/16541 -- https://tria.ge/210929-ap75vsddan -- https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="winhlp32.exe" Processes.process IN ("*\\appdata\\*","*\\programdata\\*", "*\\temp\\*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winhlp32_spawning_a_process_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives should be limited as winhlp32.exe is typically + not used with the latest flavors of Windows OS. However, filter as needed. +references: +- https://www.exploit-db.com/exploits/16541 +- https://tria.ge/210929-ap75vsddan +- https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89 tags: analytic_story: - Remcos @@ -81,5 +83,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/winword_spawning_cmd.yml b/detections/endpoint/winword_spawning_cmd.yml index ffbed1321c..e91deede1e 100644 --- a/detections/endpoint/winword_spawning_cmd.yml +++ b/detections/endpoint/winword_spawning_cmd.yml @@ -1,7 +1,11 @@ +name: Winword Spawning Cmd +id: 6fcbaedc-a37b-11eb-956b-acde48001122 +version: 2 +date: '2021-04-22' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-04-22' description: The following detection identifies Microsoft Word spawning `cmd.exe`. Typically, this is not common behavior and not default with winword.exe. Winword.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` @@ -10,23 +14,21 @@ description: The following detection identifies Microsoft Word spawning `cmd.exe being executed. During triage, review parallel processes and identify any files that may have been written. It is possible that COM is utilized to trampoline the child process to `explorer.exe` or `wmiprvse.exe`. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 6fcbaedc-a37b-11eb-956b-acde48001122 -known_false_positives: False positives should be limited, but if any are present, - filter as needed. -name: Winword Spawning Cmd -references: -- https://app.any.run/tasks/73af0064-a785-4c0a-ab0d-cde593fe16ef/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="winword.exe" `process_cmd` by Processes.dest Processes.user Processes.parent_process Processes.original_file_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winword_spawning_cmd_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives should be limited, but if any are present, + filter as needed. +references: +- https://app.any.run/tasks/73af0064-a785-4c0a-ab0d-cde593fe16ef/ tags: analytic_story: - Spearphishing Attachments @@ -75,5 +77,3 @@ tags: - _time risk_score: 70 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/winword_spawning_powershell.yml b/detections/endpoint/winword_spawning_powershell.yml index 045614cf71..beabc9c8fb 100644 --- a/detections/endpoint/winword_spawning_powershell.yml +++ b/detections/endpoint/winword_spawning_powershell.yml @@ -1,7 +1,11 @@ +name: Winword Spawning PowerShell +id: b2c950b8-9be2-11eb-8658-acde48001122 +version: 2 +date: '2021-04-12' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-04-12' description: The following detection identifies Microsoft Word spawning PowerShell. Typically, this is not common behavior and not default with winword.exe. Winword.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` @@ -9,26 +13,24 @@ description: The following detection identifies Microsoft Word spawning PowerShe attachment and is actively used. Albeit, the command executed will most likely be encoded and captured via another detection. During triage, review parallel processes and identify any files that may have been written. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: b2c950b8-9be2-11eb-8658-acde48001122 -known_false_positives: False positives should be limited, but if any are present, - filter as needed. -name: Winword Spawning PowerShell -references: -- https://redcanary.com/threat-detection-report/techniques/powershell/ -- https://attack.mitre.org/techniques/T1566/001/ -- https://app.any.run/tasks/b79fa381-f35c-4b3e-8d02-507e7ee7342f/ -- https://app.any.run/tasks/181ac90b-0898-4631-8701-b778a30610ad/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="winword.exe" `process_powershell` by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `winword_spawning_powershell_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives should be limited, but if any are present, + filter as needed. +references: +- https://redcanary.com/threat-detection-report/techniques/powershell/ +- https://attack.mitre.org/techniques/T1566/001/ +- https://app.any.run/tasks/b79fa381-f35c-4b3e-8d02-507e7ee7342f/ +- https://app.any.run/tasks/181ac90b-0898-4631-8701-b778a30610ad/ tags: analytic_story: - Spearphishing Attachments @@ -77,5 +79,3 @@ tags: - _time risk_score: 70 security_domain: endpoint -type: TTP -version: 2 diff --git a/detections/endpoint/winword_spawning_windows_script_host.yml b/detections/endpoint/winword_spawning_windows_script_host.yml index 523abf33ed..afdd3ce86b 100644 --- a/detections/endpoint/winword_spawning_windows_script_host.yml +++ b/detections/endpoint/winword_spawning_windows_script_host.yml @@ -1,7 +1,11 @@ +name: Winword Spawning Windows Script Host +id: 637e1b5c-9be1-11eb-9c32-acde48001122 +version: 1 +date: '2021-04-12' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-04-12' description: The following detection identifies Microsoft Winword.exe spawning Windows Script Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior and not default with Winword.exe. Winword.exe will generally be found in the following @@ -12,21 +16,19 @@ description: The following detection identifies Microsoft Winword.exe spawning W be obfuscated and captured via another detection. During triage, review parallel processes and identify any files that may have been written. Review the reputation of the remote destination and block accordingly. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -id: 637e1b5c-9be1-11eb-9c32-acde48001122 -known_false_positives: There will be limited false positives and it will be different - for every environment. Tune by child process or command-line as needed. -name: Winword Spawning Windows Script Host -references: -- https://attack.mitre.org/techniques/T1566/001/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="winword.exe" Processes.process_name IN ("cscript.exe", "wscript.exe") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winword_spawning_windows_script_host_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: There will be limited false positives and it will be different + for every environment. Tune by child process or command-line as needed. +references: +- https://attack.mitre.org/techniques/T1566/001/ tags: analytic_story: - Spearphishing Attachment @@ -79,5 +81,3 @@ tags: - user risk_score: 70 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml index 953a5e1593..85791f4412 100644 --- a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml +++ b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml @@ -69,13 +69,13 @@ tags: - PR.IP observable: - name: host + role: + - Victim type: Endpoint - role: - - Victim - name: user - type: User role: - Victim + type: User product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/wmi_recon_running_process_or_services.yml b/detections/endpoint/wmi_recon_running_process_or_services.yml index eb2a44d7b3..cd1c22109a 100644 --- a/detections/endpoint/wmi_recon_running_process_or_services.yml +++ b/detections/endpoint/wmi_recon_running_process_or_services.yml @@ -44,13 +44,13 @@ tags: - T1592 observable: - name: ComputerName + role: + - Victim type: Endpoint - role: - - Victim - name: User - type: User role: - Victim + type: User product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/wmic_group_discovery.yml b/detections/endpoint/wmic_group_discovery.yml index 63bc01dbfd..b91db98a93 100644 --- a/detections/endpoint/wmic_group_discovery.yml +++ b/detections/endpoint/wmic_group_discovery.yml @@ -1,7 +1,11 @@ +name: Wmic Group Discovery +id: 83317b08-155b-11ec-8e00-acde48001122 +version: 1 +date: '2021-09-14' author: Michael Haag, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-09-14' description: 'The following hunting analytic identifies the use of `wmic.exe` enumerating local groups on the endpoint. \ @@ -9,23 +13,21 @@ description: 'The following hunting analytic identifies the use of `wmic.exe` en day, endpoint and username. \ During triage, review parallel processes and identify any further suspicious behavior.' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 83317b08-155b-11ec-8e00-acde48001122 -known_false_positives: Administrators or power users may use this command for troubleshooting. -name: Wmic Group Discovery -references: -- https://attack.mitre.org/techniques/T1069/001/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="wmic.exe" (Processes.process="*group get name*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `wmic_group_discovery_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/001/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md tags: analytic_story: - Active Directory Discovery @@ -69,5 +71,3 @@ tags: - _time risk_score: 15 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/wmic_noninteractive_app_uninstallation.yml b/detections/endpoint/wmic_noninteractive_app_uninstallation.yml index 61eb070960..d8b36e73b6 100644 --- a/detections/endpoint/wmic_noninteractive_app_uninstallation.yml +++ b/detections/endpoint/wmic_noninteractive_app_uninstallation.yml @@ -1,7 +1,11 @@ +name: Wmic NonInteractive App Uninstallation +id: bff0e7a0-317f-11ec-ab4e-acde48001122 +version: 1 +date: '2021-10-20' author: Teoderick Contreras, Splunk +type: Hunting datamodel: - Endpoint -date: '2021-10-20' description: This analytic is to detect a suspicious wmic commandlined that uninstall application non interactively. This technique was seen in IceID to uninstall av products to the compromised host to bypassed and evade detections. This Hunting @@ -9,16 +13,6 @@ description: This analytic is to detect a suspicious wmic commandlined that unin wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: bff0e7a0-317f-11ec-ab4e-acde48001122 -known_false_positives: third party application may use this approach to uninstall - there application -name: Wmic NonInteractive App Uninstallation -references: -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="wmic.exe" Processes.process="* product *" Processes.process="*where name*" Processes.process="*call @@ -26,6 +20,14 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.parent_process_name Processes.process_name Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmic_noninteractive_app_uninstallation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: third party application may use this approach to uninstall + there application +references: +- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ tags: analytic_story: - IceID @@ -72,5 +74,3 @@ tags: - _time risk_score: 25 security_domain: endpoint -type: Hunting -version: 1 diff --git a/detections/endpoint/wmic_xsl_execution_via_url.yml b/detections/endpoint/wmic_xsl_execution_via_url.yml index 8f8cd62c16..720f0d510d 100644 --- a/detections/endpoint/wmic_xsl_execution_via_url.yml +++ b/detections/endpoint/wmic_xsl_execution_via_url.yml @@ -1,7 +1,11 @@ +name: WMIC XSL Execution via URL +id: 787e9dd0-4328-11ec-a029-acde48001122 +version: 1 +date: '2021-11-11' author: Michael Haag, Splunk +type: TTP datamodel: - Endpoint -date: '2021-11-11' description: The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible Stylesheet Language) script. This originally was identified by Casey Smith, dubbed Squiblytwo, as an application control bypass. Many adversaries will utilize this @@ -10,25 +14,23 @@ description: The following analytic identifies `wmic.exe` loading a remote XSL ( leverages a trusted, built-in Windows tool. Adversaries may abuse any alias in Windows Management Instrumentation provided they utilize the /FORMAT switch. Upon identifying a suspicious execution, review for confirmed network connnection and script download. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -id: 787e9dd0-4328-11ec-a029-acde48001122 -known_false_positives: False positives are limited as legitimate applications typically - do not download files or xsl using WMIC. Filter as needed. -name: WMIC XSL Execution via URL -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md -- https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md#atomic-test-4---wmic-bypass-using-remote-xsl-file search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_wmic` Processes.process IN ("*http://*", "*https://*") Processes.process="*/format:*" by Processes.parent_process_name Processes.original_file_name Processes.parent_process Processes.process_name Processes.process_id Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmic_xsl_execution_via_url_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives are limited as legitimate applications typically + do not download files or xsl using WMIC. Filter as needed. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md +- https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md#atomic-test-4---wmic-bypass-using-remote-xsl-file tags: analytic_story: - Suspicious WMI Use @@ -79,5 +81,3 @@ tags: - _time risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml index 6a8726687f..3a3863f75e 100644 --- a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml @@ -1,7 +1,11 @@ +name: Wmiprsve LOLBAS Execution Process Spawn +id: 95a455f0-4c04-11ec-b8ac-3e22fbd008af +version: 1 +date: '2021-11-22' author: Mauricio Velazco, Splunk +type: TTP datamodel: - Endpoint -date: '2021-11-22' description: The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing Windows Management Instrumentation (WMI), the executed command is spawned as a child process of `wmiprvse.exe`. @@ -9,17 +13,6 @@ description: The following analytic identifies `wmiprsve.exe` spawning a LOLBAS actors to perform tasks like executing malicious code. Looking for child processes of wmiprvse.exe that are part of the LOLBAS project can help defenders identify lateral movement activity. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -id: 95a455f0-4c04-11ec-b8ac-3e22fbd008af -known_false_positives: Legitimate applications may trigger this behavior, filter as - needed. -name: Wmiprsve LOLBAS Execution Process Spawn -references: -- https://attack.mitre.org/techniques/T1047/ -- https://www.ired.team/offensive-security/lateral-movement/t1047-wmi-for-lateral-movement -- https://lolbas-project.github.io/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name="wmiprvse.exe") (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", @@ -36,6 +29,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmiprsve_lolbas_execution_process_spawn_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. +known_false_positives: Legitimate applications may trigger this behavior, filter as + needed. +references: +- https://attack.mitre.org/techniques/T1047/ +- https://www.ired.team/offensive-security/lateral-movement/t1047-wmi-for-lateral-movement +- https://lolbas-project.github.io/ tags: analytic_story: - Active Directory Lateral Movement @@ -73,5 +75,3 @@ tags: - _time risk_score: 54 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml index 8524ed9dee..01a5f6ad3a 100644 --- a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml +++ b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml @@ -1,7 +1,11 @@ +name: Wscript Or Cscript Suspicious Child Process +id: 1f35e1da-267b-11ec-90a9-acde48001122 +version: 1 +date: '2021-10-06' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-10-06' description: This analytic is to detect a suspicious spawned process by wscript or cscript process. This technique was a common technique used by adversaries and malware to execute different LOLBIN, other script like powershell or create a suspended @@ -9,16 +13,6 @@ description: This analytic is to detect a suspicious spawned process by wscript script that using several application tool that are in the list of the child process it detects but a good pivot and indicator that a script is may execute suspicious code. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: 1f35e1da-267b-11ec-90a9-acde48001122 -known_false_positives: user may create vbs or js script that use several tool as part - of its execution. -name: Wscript Or Cscript Suspicious Child Process -references: -- https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("cscript.exe", "wscript.exe") Processes.process_name IN ("regsvr32.exe", "rundll32.exe","winhlp32.exe","certutil.exe","msbuild.exe","cmd.exe","powershell*","wmic.exe","mshta.exe") @@ -26,6 +20,14 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wscript_or_cscript_suspicious_child_process_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: user may create vbs or js script that use several tool as part + of its execution. +references: +- https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 tags: analytic_story: - FIN7 @@ -72,5 +74,3 @@ tags: - _time risk_score: 49 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml index 96abc8cd5a..47a9e10483 100644 --- a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml @@ -1,7 +1,11 @@ +name: Wsmprovhost LOLBAS Execution Process Spawn +id: 2eed004c-4c0d-11ec-93e8-3e22fbd008af +version: 1 +date: '2021-11-22' author: Mauricio Velazco, Splunk +type: TTP datamodel: - Endpoint -date: '2021-11-22' description: The following analytic identifies `Wsmprovhost.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the Windows Remote Management (WinRm) protocol, the executed command is spawned as a @@ -9,17 +13,6 @@ description: The following analytic identifies `Wsmprovhost.exe` spawning a LOLB binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of Wsmprovhost.exe that are part of the LOLBAS project can help defenders identify lateral movement activity. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -id: 2eed004c-4c0d-11ec-93e8-3e22fbd008af -known_false_positives: Legitimate applications may trigger this behavior, filter as - needed. -name: Wsmprovhost LOLBAS Execution Process Spawn -references: -- https://attack.mitre.org/techniques/T1021/006/ -- https://lolbas-project.github.io/ -- https://pentestlab.blog/2018/05/15/lateral-movement-winrm/ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name="wsmprovhost.exe") (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", @@ -36,6 +29,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `wsmprovhost_lolbas_execution_process_spawn_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. +known_false_positives: Legitimate applications may trigger this behavior, filter as + needed. +references: +- https://attack.mitre.org/techniques/T1021/006/ +- https://lolbas-project.github.io/ +- https://pentestlab.blog/2018/05/15/lateral-movement-winrm/ tags: analytic_story: - Active Directory Lateral Movement @@ -74,5 +76,3 @@ tags: - _time risk_score: 54 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/wsreset_uac_bypass.yml b/detections/endpoint/wsreset_uac_bypass.yml index b5e2ed2afb..56d0680084 100644 --- a/detections/endpoint/wsreset_uac_bypass.yml +++ b/detections/endpoint/wsreset_uac_bypass.yml @@ -1,27 +1,29 @@ +name: WSReset UAC Bypass +id: 8b5901bc-da63-11eb-be43-acde48001122 +version: 1 +date: '2021-07-01' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-07-01' description: This search is to detect a suspicious modification of registry related to UAC bypass. This technique is to modify the registry in this detection, create a registry value with the path of the payload and run WSreset.exe to bypass User account Control. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -id: 8b5901bc-da63-11eb-be43-acde48001122 -known_false_positives: unknown -name: WSReset UAC Bypass -references: -- https://github.com/hfiref0x/UACME -- https://blog.morphisec.com/trickbot-uses-a-new-windows-10-uac-bypass search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command*" (Registry.registry_value_name = "(Default)" OR Registry.registry_value_name = "DelegateExecute") by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wsreset_uac_bypass_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: unknown +references: +- https://github.com/hfiref0x/UACME +- https://blog.morphisec.com/trickbot-uses-a-new-windows-10-uac-bypass tags: analytic_story: - Windows Defense Evasion Tactics @@ -59,5 +61,3 @@ tags: - _time risk_score: 63 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/xmrig_driver_loaded.yml b/detections/endpoint/xmrig_driver_loaded.yml index 78257a90d0..aa6182aa16 100644 --- a/detections/endpoint/xmrig_driver_loaded.yml +++ b/detections/endpoint/xmrig_driver_loaded.yml @@ -1,21 +1,23 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: XMRIG Driver Loaded +id: 90080fa6-a8df-11eb-91e4-acde48001122 +version: 1 date: '2021-04-29' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: [] description: This analytic identifies XMRIG coinminer driver installation on the system. The XMRIG driver name by default is `WinRing0x64.sys`. This cpu miner is an open source project that is commonly abused by adversaries to infect and mine bitcoin. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the driver loaded and Signature from your endpoints. If you are using - Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -id: 90080fa6-a8df-11eb-91e4-acde48001122 -known_false_positives: False positives should be limited. -name: XMRIG Driver Loaded -references: -- https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ search: '`sysmon` EventCode=6 Signature="Noriyuki MIYAZAKI" OR ImageLoaded= "*\\WinRing0x64.sys" | stats min(_time) as firstTime max(_time) as lastTime count by Computer ImageLoaded Hashes IMPHASH Signature Signed | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `xmrig_driver_loaded_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the driver loaded and Signature from your endpoints. If you are using + Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: False positives should be limited. +references: +- https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ tags: analytic_story: - XMRig @@ -57,5 +59,3 @@ tags: - Signed risk_score: 80 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/endpoint/xsl_script_execution_with_wmic.yml b/detections/endpoint/xsl_script_execution_with_wmic.yml index 7876983446..b7b59606b7 100644 --- a/detections/endpoint/xsl_script_execution_with_wmic.yml +++ b/detections/endpoint/xsl_script_execution_with_wmic.yml @@ -1,30 +1,32 @@ +name: XSL Script Execution With WMIC +id: 004e32e2-146d-11ec-a83f-acde48001122 +version: 1 +date: '2021-09-13' author: Teoderick Contreras, Splunk +type: TTP datamodel: - Endpoint -date: '2021-09-13' description: This search is to detect a suspicious wmic.exe process or renamed wmic process to execute malicious xsl file. This technique was seen in FIN7 to execute its malicous jscript using the .xsl as the loader with the help of wmic.exe process. This TTP is really a good indicator for you to hunt further for FIN7 or other attacker that known to used this technique. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -id: 004e32e2-146d-11ec-a83f-acde48001122 -known_false_positives: unknown -name: XSL Script Execution With WMIC -references: -- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html -- https://attack.mitre.org/groups/G0046/ -- https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md#atomic-test-3---wmic-bypass-using-local-xsl-file search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_wmic` Processes.process = "*os get*" Processes.process="*/format:*" Processes.process = "*.xsl*" by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process_id Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `xsl_script_execution_with_wmic_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html +- https://attack.mitre.org/groups/G0046/ +- https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md#atomic-test-3---wmic-bypass-using-local-xsl-file tags: analytic_story: - FIN7 @@ -75,5 +77,3 @@ tags: - _time risk_score: 49 security_domain: endpoint -type: TTP -version: 1 diff --git a/detections/network/baseline_of_dns_query_length___mltk.yml b/detections/network/baseline_of_dns_query_length___mltk.yml index a3d2d91e3c..e9d9fa2611 100644 --- a/detections/network/baseline_of_dns_query_length___mltk.yml +++ b/detections/network/baseline_of_dns_query_length___mltk.yml @@ -1,12 +1,20 @@ +name: Baseline of DNS Query Length - MLTK +id: c914844c-0ff5-4efc-8d44-c063443129ba +version: 1 +date: '2019-05-08' author: Rico Valdez, Splunk +type: Baseline datamodel: - Network_Resolution -date: '2019-05-08' description: This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which uses it to identify outliers in the length of the DNS query. +search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution.DNS + by DNS.query DNS.record_type | search DNS.record_type=* | `drop_dm_object_name("DNS")` + | eval query_length = len(query) | fit DensityFunction query_length by record_type + into dns_query_pdfmodel' how_to_implement: To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any @@ -15,14 +23,8 @@ how_to_implement: To successfully implement this search, you will need to ensure period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -id: c914844c-0ff5-4efc-8d44-c063443129ba known_false_positives: none -name: Baseline of DNS Query Length - MLTK references: [] -search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution.DNS - by DNS.query DNS.record_type | search DNS.record_type=* | `drop_dm_object_name("DNS")` - | eval query_length = len(query) | fit DensityFunction query_length by record_type - into dns_query_pdfmodel' tags: analytic_story: - Command and Control @@ -40,5 +42,3 @@ tags: - Network_Resolution.DNS.query - Network_Resolution.DNS.record_type security_domain: network -type: Baseline -version: 1 diff --git a/detections/network/baseline_of_smb_traffic___mltk.yml b/detections/network/baseline_of_smb_traffic___mltk.yml index 0f927d21b5..b0f25d4e00 100644 --- a/detections/network/baseline_of_smb_traffic___mltk.yml +++ b/detections/network/baseline_of_smb_traffic___mltk.yml @@ -1,13 +1,22 @@ +name: Baseline of SMB Traffic - MLTK +id: df98763b-0b08-4281-8ef9-08db7ac572a9 +version: 1 +date: '2019-05-08' author: Rico Valdez, Splunk +type: Baseline datamodel: - Network_Traffic -date: '2019-05-08' description: This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search to identify outliers in the number of SMB connections for that hour and day of the week. +search: '| tstats `security_content_summariesonly` count from datamodel=Network_Traffic.All_Traffic + where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb + by _time span=10m, All_Traffic.src | eval HourOfDay=strftime(_time, "%H") | eval + DayOfWeek=strftime(_time, "%A") | `drop_dm_object_name("All_Traffic")` | fit DensityFunction + count by "HourOfDay,DayOfWeek" into smb_pdfmodel' how_to_implement: You must be ingesting network traffic and populating the Network_Traffic data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. To improve your results, @@ -21,15 +30,8 @@ how_to_implement: You must be ingesting network traffic and populating the Netwo which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -id: df98763b-0b08-4281-8ef9-08db7ac572a9 known_false_positives: none -name: Baseline of SMB Traffic - MLTK references: [] -search: '| tstats `security_content_summariesonly` count from datamodel=Network_Traffic.All_Traffic - where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb - by _time span=10m, All_Traffic.src | eval HourOfDay=strftime(_time, "%H") | eval - DayOfWeek=strftime(_time, "%A") | `drop_dm_object_name("All_Traffic")` | fit DensityFunction - count by "HourOfDay,DayOfWeek" into smb_pdfmodel' tags: analytic_story: - DHS Report TA18-074A @@ -53,5 +55,3 @@ tags: - Network_Traffic.All_Traffic.src - _time security_domain: network -type: Baseline -version: 1 diff --git a/detections/network/count_of_unique_ips_connecting_to_ports.yml b/detections/network/count_of_unique_ips_connecting_to_ports.yml index da19c03317..30582f2069 100644 --- a/detections/network/count_of_unique_ips_connecting_to_ports.yml +++ b/detections/network/count_of_unique_ips_connecting_to_ports.yml @@ -1,18 +1,20 @@ +name: Count of Unique IPs Connecting to Ports +id: 9f3bae5a-9fe3-49df-8c84-5edc51d84b7f +version: 1 +date: '2017-09-13' author: David Dorsey, Splunk +type: Baseline datamodel: - Network_Traffic -date: '2017-09-13' description: The search counts the number of times a connection was observed to each destination port, and the number of unique source IPs connecting to them. -how_to_implement: To successfully implement this search, you must be ingesting network - traffic, and populating the Network_Traffic data model. -id: 9f3bae5a-9fe3-49df-8c84-5edc51d84b7f -known_false_positives: none -name: Count of Unique IPs Connecting to Ports -references: [] search: '| tstats `security_content_summariesonly` count dc(All_Traffic.src) as numberOfUniqueHosts from datamodel=Network_Traffic.All_Traffic by All_Traffic.dest_port | `drop_dm_object_name("All_Traffic")` | sort - count' +how_to_implement: To successfully implement this search, you must be ingesting network + traffic, and populating the Network_Traffic data model. +known_false_positives: none +references: [] tags: deployments: - Daily Cache Updates @@ -24,5 +26,3 @@ tags: - Network_Traffic.All_Traffic.dest_port - Network_Traffic.All_Traffic.src security_domain: network -type: Baseline -version: 1 diff --git a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml index 769b936921..a3d30f9295 100644 --- a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml +++ b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml @@ -1,13 +1,21 @@ +name: Detect hosts connecting to dynamic domain providers +id: c77162d3-f93c-45cc-80c8-22f6v5464g9f +version: 3 +date: '2021-01-14' author: Bhavin Patel, Splunk +type: TTP datamodel: - Network_Resolution -date: '2021-01-14' description: Malicious actors often abuse legitimate Dynamic DNS services to host malicious payloads or interactive command and control nodes. Attackers will automate domain resolution changes by routing dynamic domains to countless IP addresses to circumvent firewall blocks, block lists as well as frustrate a network defenders analytic and investigative processes. This search will look for DNS queries made from within your infrastructure to suspicious dynamic domains. +search: '| tstats `security_content_summariesonly` count values(DNS.answer) as answer + min(_time) as firstTime from datamodel=Network_Resolution.DNS by DNS.query host + | `drop_dm_object_name("DNS")` | `security_content_ctime(firstTime)` | `dynamic_dns_providers` + | `detect_hosts_connecting_to_dynamic_domain_providers_filter`' how_to_implement: 'First, you''ll need to ingest data from your DNS operations. This can be done by ingesting logs from your server or data, collected passively by Splunk Stream or a similar solution. Specifically, data that contains the domain that is @@ -33,16 +41,10 @@ how_to_implement: 'First, you''ll need to ingest data from your DNS operations. Detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`' -id: c77162d3-f93c-45cc-80c8-22f6v5464g9f known_false_positives: Some users and applications may leverage Dynamic DNS to reach out to some domains on the Internet since dynamic DNS by itself is not malicious, however this activity must be verified. -name: Detect hosts connecting to dynamic domain providers references: [] -search: '| tstats `security_content_summariesonly` count values(DNS.answer) as answer - min(_time) as firstTime from datamodel=Network_Resolution.DNS by DNS.query host - | `drop_dm_object_name("DNS")` | `security_content_ctime(firstTime)` | `dynamic_dns_providers` - | `detect_hosts_connecting_to_dynamic_domain_providers_filter`' tags: analytic_story: - Data Protection @@ -96,5 +98,3 @@ tags: - host risk_score: 56 security_domain: network -type: TTP -version: 3 diff --git a/detections/network/detect_outbound_ldap_traffic.yml b/detections/network/detect_outbound_ldap_traffic.yml index 4063dc6d7c..efe64b11ea 100644 --- a/detections/network/detect_outbound_ldap_traffic.yml +++ b/detections/network/detect_outbound_ldap_traffic.yml @@ -1,29 +1,31 @@ +name: Detect Outbound LDAP Traffic +id: c77162d3-f91c-45cc-80c8-22f6v546119f +version: 1 +date: '2021-12-13' author: Bhavin Patel, Johan Bjerke, Splunk +type: Hunting datamodel: - Network_Traffic -date: '2021-12-13' description: Malicious actors often abuse misconfigured LDAP servers or applications that use the LDAP servers in organizations. Outbound LDAP traffic should not be allowed outbound through your perimeter firewall. This search will help determine if you have any LDAP connections to IP addresses outside of private (RFC1918) address space. +search: '| tstats earliest(_time) as earliest_time latest(_time) as latest_time values(All_Traffic.dest_ip) + as dest_ip from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port + = 389 OR All_Traffic.dest_port = 636 AND NOT (All_Traffic.dest_ip = "10.0.0.0/8" + OR All_Traffic.dest_ip="192.168.0.0/16" OR All_Traffic.dest_ip = "172.16.0.0/12") + by All_Traffic.src_ip All_Traffic.dest_ip |`drop_dm_object_name("All_Traffic")` + | where src_ip != dest_ip | `security_content_ctime(latest_time)` | `security_content_ctime(earliest_time)` + |`detect_outbound_ldap_traffic_filter`' how_to_implement: You must be ingesting Zeek DNS and Zeek Conn data into Splunk. Zeek data should also be getting ingested in JSON format and should be mapped to the Network Traffic datamodels that are in use for this search. -id: c77162d3-f91c-45cc-80c8-22f6v546119f known_false_positives: Unknown at this moment. Outbound LDAP traffic should not be allowed outbound through your perimeter firewall. Please check those servers to verify if the activity is legitimate. -name: Detect Outbound LDAP Traffic references: - https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/ -search: '| tstats earliest(_time) as earliest_time latest(_time) as latest_time values(All_Traffic.dest_ip) - as dest_ip from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port - = 389 OR All_Traffic.dest_port = 636 AND NOT (All_Traffic.dest_ip = "10.0.0.0/8" OR - All_Traffic.dest_ip="192.168.0.0/16" OR All_Traffic.dest_ip = "172.16.0.0/12") by All_Traffic.src_ip - All_Traffic.dest_ip |`drop_dm_object_name("All_Traffic")` | where src_ip != dest_ip - | `security_content_ctime(latest_time)` | `security_content_ctime(earliest_time)` - |`detect_outbound_ldap_traffic_filter`' tags: analytic_story: - Log4Shell CVE-2021-44228 @@ -74,5 +76,3 @@ tags: - _time risk_score: 56 security_domain: network -type: Hunting -version: 1 diff --git a/detections/network/discover_dns_records.yml b/detections/network/discover_dns_records.yml index ca328e8efd..f96fe9f866 100644 --- a/detections/network/discover_dns_records.yml +++ b/detections/network/discover_dns_records.yml @@ -1,19 +1,15 @@ +name: Discover DNS records +id: c096f721-8842-42ce-bfc7-74bd8c72b7c3 +version: 1 +date: '2019-02-14' author: Jose Hernandez, Splunk +type: Baseline datamodel: - Network_Resolution -date: '2019-02-14' description: The search takes corporate and common cloud provider domains configured under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv` finds their responses across the last 30 days from data in the `Network_Resolution ` datamodel, then stores the output under the `discovered_dns_records.csv` lookup -how_to_implement: To successfully implement this search, you must be ingesting DNS - logs, and populating the Network_Resolution data model. Also make sure that the - cim_corporate_web_domains and cim_corporate_email_domains lookups are populated - with the domains owned by your corporation -id: c096f721-8842-42ce-bfc7-74bd8c72b7c3 -known_false_positives: none -name: Discover DNS records -references: [] search: '| inputlookup cim_corporate_email_domains.csv | inputlookup append=T cim_corporate_web_domains.csv | inputlookup append=T cim_cloud_domains.csv | eval domain = trim(replace(domain, "\*", "")) | join domain [|tstats `security_content_summariesonly` count values(DNS.record_type) @@ -22,6 +18,12 @@ search: '| inputlookup cim_corporate_email_domains.csv | inputlookup append=T ci DNS.query as query | where query!="unknown" | rex field=query "(?\w+\.\w+?)(?:$|/)"] | makemv delim=" " answer | makemv delim=" " type | sort -count | table count,domain,type,query,answer | outputlookup createinapp=true discovered_dns_records' +how_to_implement: To successfully implement this search, you must be ingesting DNS + logs, and populating the Network_Resolution data model. Also make sure that the + cim_corporate_web_domains and cim_corporate_email_domains lookups are populated + with the domains owned by your corporation +known_false_positives: none +references: [] tags: analytic_story: - DNS Hijacking @@ -39,5 +41,3 @@ tags: - Network_Resolution.DNS.query - Network_Resolution.DNS.record_type security_domain: network -type: Baseline -version: 1 diff --git a/detections/network/dns_query_length_with_high_standard_deviation.yml b/detections/network/dns_query_length_with_high_standard_deviation.yml index 5e2a3bb7d0..48860107e1 100644 --- a/detections/network/dns_query_length_with_high_standard_deviation.yml +++ b/detections/network/dns_query_length_with_high_standard_deviation.yml @@ -1,16 +1,14 @@ +name: DNS Query Length With High Standard Deviation +id: 1a67f15a-f4ff-4170-84e9-08cf6f75d6f5 +version: 4 +date: '2021-10-06' author: Bhavin Patel, Splunk +type: Anomaly datamodel: - Network_Resolution -date: '2021-10-06' description: This search allows you to identify DNS requests and compute the standard deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment. -how_to_implement: To successfully implement this search, you will need to ensure that - DNS data is populating the Network_Resolution data model. -id: 1a67f15a-f4ff-4170-84e9-08cf6f75d6f5 -known_false_positives: It's possible there can be long domain names that are legitimate. -name: DNS Query Length With High Standard Deviation -references: [] search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution.DNS where NOT DNS.message_type IN("Pointer","PTR") by DNS.query | `drop_dm_object_name("DNS")` | eval tlds=split(query,".") | eval tld=mvindex(tlds,-1) | eval tld_len=len(tld) @@ -18,6 +16,10 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Network_ record_type count | eventstats stdev(query_length) AS stdev avg(query_length) AS avg p50(query_length) AS p50| where query_length>(avg+stdev*2) | eval z_score=(query_length-avg)/stdev | `dns_query_length_with_high_standard_deviation_filter`' +how_to_implement: To successfully implement this search, you will need to ensure that + DNS data is populating the Network_Resolution data model. +known_false_positives: It's possible there can be long domain names that are legitimate. +references: [] tags: analytic_story: - Hidden Cobra Malware @@ -64,5 +66,3 @@ tags: - Network_Resolution.DNS.query risk_score: 56 security_domain: network -type: Anomaly -version: 4 diff --git a/detections/network/get_certificate_logs_for_a_domain.yml b/detections/network/get_certificate_logs_for_a_domain.yml index 99f8417014..35dcfea2b6 100644 --- a/detections/network/get_certificate_logs_for_a_domain.yml +++ b/detections/network/get_certificate_logs_for_a_domain.yml @@ -1,23 +1,25 @@ +name: Get Certificate logs for a domain +id: bc91a8cf-35e7-4bb2-2240-e756cc06fd73 +version: 2 +date: '2019-04-29' author: Bhavin Patel, Splunk +type: Investigation datamodel: - Certificates -date: '2019-04-29' description: This search queries the Certificates datamodel and give you all the information for a specific domain. Please note that the certificates issued by "Let's Encrypt" are widely used by attackers. -how_to_implement: You must be ingesting your certificates or SSL logs from your network - traffic into your Certificates datamodel. Please note the wildcard(*) before domain - in the search syntax, we use to match for all domain and subdomain combinations -id: bc91a8cf-35e7-4bb2-2240-e756cc06fd73 -known_false_positives: '' -name: Get Certificate logs for a domain -references: [] search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Certificates.All_Certificates where All_Certificates.SSL.ssl_subject_common_name=*$domain$ by All_Certificates.dest All_Certificates.src All_Certificates.SSL.ssl_issuer_common_name All_Certificates.SSL.ssl_subject_common_name All_Certificates.SSL.ssl_hash | `drop_dm_object_name(All_Certificates)` | `drop_dm_object_name(SSL)` | rename ssl_subject_common_name as domain | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' +how_to_implement: You must be ingesting your certificates or SSL logs from your network + traffic into your Certificates datamodel. Please note the wildcard(*) before domain + in the search syntax, we use to match for all domain and subdomain combinations +known_false_positives: '' +references: [] tags: analytic_story: - Common Phishing Frameworks @@ -28,5 +30,3 @@ tags: - Certificates.All_Certificates.src - _time security_domain: network -type: Investigation -version: 2 diff --git a/detections/network/get_dns_server_history_for_a_host.yml b/detections/network/get_dns_server_history_for_a_host.yml index 56413f0485..725dd1b7ca 100644 --- a/detections/network/get_dns_server_history_for_a_host.yml +++ b/detections/network/get_dns_server_history_for_a_host.yml @@ -1,19 +1,21 @@ -author: Bhavin Patel, Splunk -datamodel: [] +name: Get DNS Server History for a host +id: bc91a8cf-35e7-4bb2-8140-e756cc06fd72 +version: 1 date: '2017-11-09' +author: Bhavin Patel, Splunk +type: Investigation +datamodel: [] description: While investigating any detections it is important to understand which and how many DNS servers a host has connected to in the past. This search uses data that is tagged as DNS and gives you a count and list of DNS servers that a particular host has connected to the previous 24 hours. -how_to_implement: To successfully implement this search, you must be ingesting your - DNS traffic -id: bc91a8cf-35e7-4bb2-8140-e756cc06fd72 -known_false_positives: '' -name: Get DNS Server History for a host -references: [] search: '| search tag=dns src_ip=$src_ip$ dest_port=53 | streamstats time_window=1d count values(dest_ip) as dcip by src_ip | table date_mday src_ip dcip count | sort -count' +how_to_implement: To successfully implement this search, you must be ingesting your + DNS traffic +known_false_positives: '' +references: [] tags: analytic_story: - AWS Network ACL Activity @@ -33,5 +35,3 @@ tags: - dest_port - src_ip security_domain: network -type: Investigation -version: 1 diff --git a/detections/network/get_dns_traffic_ratio.yml b/detections/network/get_dns_traffic_ratio.yml index 2c74c9682f..167e5ba81a 100644 --- a/detections/network/get_dns_traffic_ratio.yml +++ b/detections/network/get_dns_traffic_ratio.yml @@ -1,23 +1,25 @@ +name: Get DNS traffic ratio +id: bc91a8cf-35e7-4bb2-8140-e756cc06fd73 +version: 1 +date: '2017-11-09' author: Bhavin Patel, Splunk +type: Investigation datamodel: - Network_Traffic -date: '2017-11-09' description: 'This search calculates the ratio of DNS traffic originating and coming from a host to a list of DNS servers over the last 24 hours. A high value of this ratio could be very useful to quickly understand if a src_ip (host) is sending a high volume of data out via port 53, could be an indicator of data exfiltration via DNS. ' -how_to_implement: You must be ingesting your network traffic -id: bc91a8cf-35e7-4bb2-8140-e756cc06fd73 -known_false_positives: '' -name: Get DNS traffic ratio -references: [] search: '| tstats allow_old_summaries=true sum(All_Traffic.bytes_out) as "bytes_out" sum(All_Traffic.bytes_in) as "bytes_in" from datamodel=Network_Traffic.All_Traffic where nodename=All_Traffic All_Traffic.dest_port=53 by All_Traffic.src All_Traffic.dest| `drop_dm_object_name(All_Traffic)` | rename src as src_ip | rename dest as dest_ip | search src_ip=$src_ip$ | search dest_ip = $dest_ip | eval ratio = (bytes_out/bytes_in) | table ratio' +how_to_implement: You must be ingesting your network traffic +known_false_positives: '' +references: [] tags: analytic_story: - AWS Network ACL Activity @@ -36,5 +38,3 @@ tags: - Network_Traffic.All_Traffic.dest_port - Network_Traffic.All_Traffic.src security_domain: network -type: Investigation -version: 1 diff --git a/detections/network/get_email_info.yml b/detections/network/get_email_info.yml index 2a07ead064..20822e2668 100644 --- a/detections/network/get_email_info.yml +++ b/detections/network/get_email_info.yml @@ -1,16 +1,18 @@ +name: Get Email Info +id: bc91a8cf-35e7-4bb2-8140-e756cc06fd75 +version: 1 +date: '2017-11-09' author: Bhavin Patel, Splunk +type: Investigation datamodel: - Email -date: '2017-11-09' description: This search returns all the information Splunk might have collected a specific email message over the last 2 hours. +search: '| from datamodel Email.All_Email | search message_id=$message_id$' how_to_implement: To successfully implement this search you must be ingesting your email logs or capturing unencrypted network traffic which contains email communications. -id: bc91a8cf-35e7-4bb2-8140-e756cc06fd75 known_false_positives: '' -name: Get Email Info references: [] -search: '| from datamodel Email.All_Email | search message_id=$message_id$' tags: analytic_story: - Brand Monitoring @@ -20,5 +22,3 @@ tags: required_fields: - message security_domain: network -type: Investigation -version: 1 diff --git a/detections/network/get_emails_from_specific_sender.yml b/detections/network/get_emails_from_specific_sender.yml index 93ecebfd51..0d6603537e 100644 --- a/detections/network/get_emails_from_specific_sender.yml +++ b/detections/network/get_emails_from_specific_sender.yml @@ -1,17 +1,19 @@ +name: Get Emails From Specific Sender +id: 5df39b3f-447d-4869-b673-8f45ad4616fe +version: 1 +date: '2017-11-09' author: David Dorsey, Splunk +type: Investigation datamodel: - Email -date: '2017-11-09' description: This search returns all the emails from a specific sender over the last 24 and next hours. +search: '| from datamodel Email.All_Email | search src_user=$src_user$' how_to_implement: To successfully implement this search you must ingest your email logs or capture unencrypted email communications within network traffic, and populate the Email data model. -id: 5df39b3f-447d-4869-b673-8f45ad4616fe known_false_positives: '' -name: Get Emails From Specific Sender references: [] -search: '| from datamodel Email.All_Email | search src_user=$src_user$' tags: analytic_story: - Brand Monitoring @@ -22,5 +24,3 @@ tags: required_fields: - src_user security_domain: networks -type: Investigation -version: 1 diff --git a/detections/network/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml b/detections/network/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml index b25a99fdb7..ecb0a7caf1 100644 --- a/detections/network/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml +++ b/detections/network/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml @@ -1,21 +1,23 @@ +name: Get First Occurrence and Last Occurrence of a MAC Address +id: bc91a8cf-35e7-4bb2-8140-e756cc06fd33 +version: 1 +date: '2017-09-13' author: Bhavin Patel, Splunk +type: Investigation datamodel: - Network_Sessions -date: '2017-09-13' description: This search allows you to gather more context around a notable which has detected a new device connecting to your network. Use this search to determine the first and last occurrences of the suspicious device attempting to connect with your network. -how_to_implement: To successfully implement this search, you must be ingesting the - logs from your DHCP server. -id: bc91a8cf-35e7-4bb2-8140-e756cc06fd33 -known_false_positives: '' -name: Get First Occurrence and Last Occurrence of a MAC Address -references: [] search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Sessions.All_Sessions where nodename=All_Sessions.DHCP All_Sessions.signature=DHCPREQUEST All_Sessions.src_mac= $src_mac$ by All_Sessions.src_ip All_Sessions.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`' +how_to_implement: To successfully implement this search, you must be ingesting the + logs from your DHCP server. +known_false_positives: '' +references: [] tags: analytic_story: - Asset Tracking @@ -28,5 +30,3 @@ tags: - Network_Sessions.All_Sessions.user - _time security_domain: network -type: Investigation -version: 1 diff --git a/detections/network/get_history_of_email_sources.yml b/detections/network/get_history_of_email_sources.yml index c33c5e22fd..f5b43e5186 100644 --- a/detections/network/get_history_of_email_sources.yml +++ b/detections/network/get_history_of_email_sources.yml @@ -1,21 +1,23 @@ +name: Get History Of Email Sources +id: ddc7af28-c34d-4392-af93-7f29a4e8806c +version: 1 +date: '2019-02-21' author: Rico Valdez, Splunk +type: Investigation datamodel: - Email -date: '2019-02-21' description: This search returns a list of all email sources seen in the 48 hours prior to the notable event to 24 hours after, and the number of emails from each source. -how_to_implement: To successfully implement this search you must ingest your email - logs or capture unencrypted email communications within network traffic, and populate - the Email data model. -id: ddc7af28-c34d-4392-af93-7f29a4e8806c -known_false_positives: '' -name: Get History Of Email Sources -references: [] search: '|tstats `security_content_summariesonly` values(All_Email.dest) as dest values(All_Email.recipient) as recepient min(_time) as firstTime max(_time) as lastTime count from datamodel=Email.All_Email by All_Email.src |`drop_dm_object_name(All_Email)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search src=$src$' +how_to_implement: To successfully implement this search you must ingest your email + logs or capture unencrypted email communications within network traffic, and populate + the Email data model. +known_false_positives: '' +references: [] tags: analytic_story: - 'Emotet Malware DHS Report TA18-201A ' @@ -34,5 +36,3 @@ tags: - Email.All_Email.src - _time security_domain: network -type: Investigation -version: 1 diff --git a/detections/network/get_web_session_information_via_session_id.yml b/detections/network/get_web_session_information_via_session_id.yml index c60b0b8fad..3d7219d12b 100644 --- a/detections/network/get_web_session_information_via_session_id.yml +++ b/detections/network/get_web_session_information_via_session_id.yml @@ -1,19 +1,21 @@ -author: Bhavin Patel, Splunk -datamodel: [] +name: Get Web Session Information via session id +id: bc91a8cf-35e7-4bb2-1120-e756cc06fd89 +version: 1 date: '2018-10-08' +author: Bhavin Patel, Splunk +type: Investigation +datamodel: [] description: This search helps an analyst investigate a notable event to find out more about a specific web session. The search looks for a specific web session ID in the HTTP web traffic and outputs the URL and user agents, grouped by source IP address and HTTP status code. +search: '`stream_http` session_id = $session_id$ | stats values(url) values(http_user_agent) + by src_ip status' how_to_implement: This search leverages data extracted from Stream:HTTP. You must configure the HTTP stream using the Splunk Stream App on your Splunk Stream deployment server. -id: bc91a8cf-35e7-4bb2-1120-e756cc06fd89 known_false_positives: '' -name: Get Web Session Information via session id references: [] -search: '`stream_http` session_id = $session_id$ | stats values(url) values(http_user_agent) - by src_ip status' tags: analytic_story: - Web Fraud Detection @@ -25,5 +27,3 @@ tags: - src_ip - status security_domain: network -type: Investigation -version: 1 diff --git a/detections/network/identify_systems_creating_remote_desktop_traffic.yml b/detections/network/identify_systems_creating_remote_desktop_traffic.yml index bb351f747b..154d814b72 100644 --- a/detections/network/identify_systems_creating_remote_desktop_traffic.yml +++ b/detections/network/identify_systems_creating_remote_desktop_traffic.yml @@ -1,18 +1,20 @@ +name: Identify Systems Creating Remote Desktop Traffic +id: 5cdda34f-4caf-4128-a713-0837fc48b67a +version: 1 +date: '2017-09-15' author: David Dorsey, Splunk +type: Baseline datamodel: - Network_Traffic -date: '2017-09-15' description: This search counts the numbers of times the system has generated remote desktop traffic. -how_to_implement: To successfully implement this search, you must ingest network traffic - and populate the Network_Traffic data model. -id: 5cdda34f-4caf-4128-a713-0837fc48b67a -known_false_positives: none -name: Identify Systems Creating Remote Desktop Traffic -references: [] search: '| tstats `security_content_summariesonly` count from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port=3389 by All_Traffic.src | `drop_dm_object_name("All_Traffic")` | sort - count' +how_to_implement: To successfully implement this search, you must ingest network traffic + and populate the Network_Traffic data model. +known_false_positives: none +references: [] tags: deployments: - Daily Cache Updates @@ -24,5 +26,3 @@ tags: - Network_Traffic.All_Traffic.dest_port - Network_Traffic.All_Traffic.src security_domain: network -type: Baseline -version: 1 diff --git a/detections/network/identify_systems_receiving_remote_desktop_traffic.yml b/detections/network/identify_systems_receiving_remote_desktop_traffic.yml index 76ca760e3c..bcd4323897 100644 --- a/detections/network/identify_systems_receiving_remote_desktop_traffic.yml +++ b/detections/network/identify_systems_receiving_remote_desktop_traffic.yml @@ -1,19 +1,21 @@ +name: Identify Systems Receiving Remote Desktop Traffic +id: baaeea15-fe8a-4090-92c2-5b60943bb608 +version: 1 +date: '2017-09-15' author: David Dorsey, Splunk +type: Baseline datamodel: - Network_Traffic -date: '2017-09-15' description: This search counts the numbers of times the system has created remote desktop traffic -how_to_implement: To successfully implement this search you must ingest network traffic - and populate the Network_Traffic data model. If a system receives a lot of remote - desktop traffic, you can apply the category common_rdp_destination to it. -id: baaeea15-fe8a-4090-92c2-5b60943bb608 -known_false_positives: none -name: Identify Systems Receiving Remote Desktop Traffic -references: [] search: '| tstats `security_content_summariesonly` count from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port=3389 by All_Traffic.dest | `drop_dm_object_name("All_Traffic")` | sort - count' +how_to_implement: To successfully implement this search you must ingest network traffic + and populate the Network_Traffic data model. If a system receives a lot of remote + desktop traffic, you can apply the category common_rdp_destination to it. +known_false_positives: none +references: [] tags: deployments: - Daily Cache Updates @@ -25,5 +27,3 @@ tags: - Network_Traffic.All_Traffic.dest - Network_Traffic.All_Traffic.dest_port security_domain: network -type: Baseline -version: 1 diff --git a/detections/network/investigate_network_traffic_from_src_ip.yml b/detections/network/investigate_network_traffic_from_src_ip.yml index 26088d69b5..99b59182a5 100644 --- a/detections/network/investigate_network_traffic_from_src_ip.yml +++ b/detections/network/investigate_network_traffic_from_src_ip.yml @@ -1,16 +1,18 @@ +name: Investigate Network Traffic From src ip +id: 9df9ca9c-a02b-4f48-9eba-0bac55179050 +version: 1 +date: '2018-06-15' author: David Dorsey, Splunk +type: Investigation datamodel: - Network_Traffic -date: '2018-06-15' description: This search allows you to find all the network traffic from a specific IP address. +search: '| from datamodel Network_Traffic.All_Traffic | search src_ip=$src_ip$' how_to_implement: To successfully implement this search, you must be ingesting your web-traffic logs and populating the web data model. -id: 9df9ca9c-a02b-4f48-9eba-0bac55179050 known_false_positives: '' -name: Investigate Network Traffic From src ip references: [] -search: '| from datamodel Network_Traffic.All_Traffic | search src_ip=$src_ip$' tags: analytic_story: - ColdRoot MacOS RAT @@ -22,5 +24,3 @@ tags: required_fields: - src_ip security_domain: network -type: Investigation -version: 1 diff --git a/detections/network/investigate_suspicious_strings_in_http_header.yml b/detections/network/investigate_suspicious_strings_in_http_header.yml index f694b8a0e1..ce60dd3658 100644 --- a/detections/network/investigate_suspicious_strings_in_http_header.yml +++ b/detections/network/investigate_suspicious_strings_in_http_header.yml @@ -1,25 +1,27 @@ -author: Bhavin Patel, Splunk -datamodel: [] +name: Investigate Suspicious Strings in HTTP Header +id: bc91a8cf-35e7-4bb2-8140-e756cc06fd89 +version: 1 date: '2017-10-20' +author: Bhavin Patel, Splunk +type: Investigation +datamodel: [] description: This search helps an analyst investigate a notable event related to a potential Apache Struts exploitation. To investigate, we will want to isolate and analyze the "payload" or the commands that were passed to the vulnerable hosts by creating a few regular expressions to carve out the commands focusing on common keywords from the payload, such as cmd.exe, /bin/bash and whois. The search returns these suspicious strings found in the HTTP logs of the system of interest. -how_to_implement: This particular search leverages data extracted from Stream:HTTP. - You must configure the http stream using the Splunk Stream App on your Splunk Stream - deployment server to extract the cs_content_type field. -id: bc91a8cf-35e7-4bb2-8140-e756cc06fd89 -known_false_positives: '' -name: Investigate Suspicious Strings in HTTP Header -references: [] search: '`stream_http` | search src_ip=$src_ip$ | search dest_ip=$dest_ip$ | eval cs_content_type_length = len(cs_content_type) | search cs_content_type_length > 100 | rex field="cs_content_type" (?cmd.exe) | eval suspicious_strings_found=if(match(cs_content_type, "application"), "True", "False") | rename suspicious_strings_found AS "Suspicious Content-Type Found" | fields "Suspicious Content-Type Found", dest_ip, src_ip, suspicious_strings, cs_content_type, cs_content_type_length, url' +how_to_implement: This particular search leverages data extracted from Stream:HTTP. + You must configure the http stream using the Splunk Stream App on your Splunk Stream + deployment server to extract the cs_content_type field. +known_false_positives: '' +references: [] tags: analytic_story: - Apache Struts Vulnerability @@ -31,5 +33,3 @@ tags: - src_ip - url security_domain: network -type: Investigation -version: 1 diff --git a/detections/network/investigate_web_posts_from_src.yml b/detections/network/investigate_web_posts_from_src.yml index 3a529189ed..c049d4e69b 100644 --- a/detections/network/investigate_web_posts_from_src.yml +++ b/detections/network/investigate_web_posts_from_src.yml @@ -1,19 +1,21 @@ +name: Investigate Web POSTs From src +id: f5c39fac-205c-4e07-9004-8fd61ea3431a +version: 1 +date: '2018-12-06' author: Jose Hernandez, Splunk +type: Investigation datamodel: - Web -date: '2018-12-06' description: 'This investigative search retrieves POST requests from a specified source IP or hostname. Identifying the POST requests, as well as their associated destination URLs and user agent(s), may help you scope and characterize the suspicious traffic. ' -how_to_implement: To successfully implement this search, you must be ingesting your - web-traffic logs and populating the web data model. -id: f5c39fac-205c-4e07-9004-8fd61ea3431a -known_false_positives: '' -name: Investigate Web POSTs From src -references: [] search: '| tstats `security_content_summariesonly` values(Web.url) as url from datamodel=Web.Web by Web.src,Web.http_user_agent,Web.http_method | `drop_dm_object_name("Web")`| search http_method, "POST" | search src=$src$' +how_to_implement: To successfully implement this search, you must be ingesting your + web-traffic logs and populating the web data model. +known_false_positives: '' +references: [] tags: analytic_story: - Apache Struts Vulnerability @@ -25,5 +27,3 @@ tags: - Web.Web.src - Web.Web.url security_domain: network -type: Investigation -version: 1 diff --git a/detections/network/multiple_archive_files_http_post_traffic.yml b/detections/network/multiple_archive_files_http_post_traffic.yml index a76301d04f..dab9118f92 100644 --- a/detections/network/multiple_archive_files_http_post_traffic.yml +++ b/detections/network/multiple_archive_files_http_post_traffic.yml @@ -1,6 +1,10 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Multiple Archive Files Http Post Traffic +id: 4477f3ea-a28f-11eb-b762-acde48001122 +version: 1 date: '2021-04-21' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: [] description: This search is designed to detect high frequency of archive files data exfiltration through HTTP POST method protocol. This are one of the common techniques used by APT or trojan spy after doing the data collection like screenshot, recording, @@ -11,23 +15,21 @@ description: This search is designed to detect high frequency of archive files d files transfer to HTTP POST since it checks the request body header. Unfortunately this detection cannot support archive that was encrypted or encoded before doing the exfiltration. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the stream HTTP logs or network logs that catch network traffic. Make - sure that the http-request-body, payload, or request field is enabled in stream - http configuration. -id: 4477f3ea-a28f-11eb-b762-acde48001122 -known_false_positives: Normal archive transfer via HTTP protocol may trip this detection. -name: Multiple Archive Files Http Post Traffic -references: -- https://attack.mitre.org/techniques/T1560/001/ -- https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html -- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ search: '`stream_http` http_method=POST |eval archive_hdr1=substr(form_data,1,2) | eval archive_hdr2 = substr(form_data,1,4) |stats values(form_data) as http_request_body min(_time) as firstTime max(_time) as lastTime count by http_method http_user_agent uri_path url bytes_in bytes_out archive_hdr1 archive_hdr2 |where count >20 AND (archive_hdr1 = "7z" OR archive_hdr1 = "PK" OR archive_hdr2="Rar!") | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `multiple_archive_files_http_post_traffic_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the stream HTTP logs or network logs that catch network traffic. Make + sure that the http-request-body, payload, or request field is enabled in stream + http configuration. +known_false_positives: Normal archive transfer via HTTP protocol may trip this detection. +references: +- https://attack.mitre.org/techniques/T1560/001/ +- https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html +- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ tags: analytic_story: - Command and Control @@ -73,5 +75,3 @@ tags: - form_data risk_score: 25 security_domain: network -type: TTP -version: 1 diff --git a/detections/network/plain_http_post_exfiltrated_data.yml b/detections/network/plain_http_post_exfiltrated_data.yml index 3e2de35c16..2446f405eb 100644 --- a/detections/network/plain_http_post_exfiltrated_data.yml +++ b/detections/network/plain_http_post_exfiltrated_data.yml @@ -1,23 +1,25 @@ -author: Teoderick Contreras, Splunk -datamodel: [] +name: Plain HTTP POST Exfiltrated Data +id: e2b36208-a364-11eb-8909-acde48001122 +version: 1 date: '2021-04-22' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: [] description: This search is to detect potential plain HTTP POST method data exfiltration. This network traffic is commonly used by trickbot, trojanspy, keylogger or APT adversary where arguments or commands are sent in plain text to the remote C2 server using HTTP POST method as part of data exfiltration. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the stream HTTP logs or network logs that catch network traffic. Make - sure that the http-request-body, payload, or request field is enabled. -id: e2b36208-a364-11eb-8909-acde48001122 -known_false_positives: unknown -name: Plain HTTP POST Exfiltrated Data -references: -- https://blog.talosintelligence.com/2020/03/trickbot-primer.html search: '`stream_http` http_method=POST form_data IN ("*wermgr.exe*","*svchost.exe*", "*name=\"proclist\"*","*ipconfig*", "*name=\"sysinfo\"*", "*net view*") |stats values(form_data) as http_request_body min(_time) as firstTime max(_time) as lastTime count by http_method http_user_agent uri_path url bytes_in bytes_out | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `plain_http_post_exfiltrated_data_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the stream HTTP logs or network logs that catch network traffic. Make + sure that the http-request-body, payload, or request field is enabled. +known_false_positives: unknown +references: +- https://blog.talosintelligence.com/2020/03/trickbot-primer.html tags: analytic_story: - Command and Control @@ -60,5 +62,3 @@ tags: - bytes_out risk_score: 63 security_domain: network -type: TTP -version: 1 diff --git a/detections/web/log4shell_jndi_payload_injection_attempt.yml b/detections/web/log4shell_jndi_payload_injection_attempt.yml index e7b549f675..a4fa84e63e 100644 --- a/detections/web/log4shell_jndi_payload_injection_attempt.yml +++ b/detections/web/log4shell_jndi_payload_injection_attempt.yml @@ -60,13 +60,13 @@ tags: - DE.CM observable: - name: user + role: + - Victim type: User - role: - - Victim - name: dest - type: Hostname role: - Victim + type: Hostname product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml b/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml index 6ad5a4789d..9c37e7fc28 100644 --- a/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml +++ b/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml @@ -1,8 +1,12 @@ +name: Log4Shell JNDI Payload Injection with Outbound Connection +id: 69afee44-5c91-11ec-bf1f-497c9a704a72 +version: 1 +date: '2021-12-13' author: Jose Hernandez +type: Anomaly datamodel: - Network_Traffic - Web -date: '2021-12-13' description: CVE-2021-44228 Log4Shell payloads can be injected via various methods, but on of the most common vectors injection is via Web calls. Many of the vulnerable java web applications that are using log4j have a web component to them are specially @@ -13,14 +17,6 @@ description: CVE-2021-44228 Log4Shell payloads can be injected via various metho Specifically it has been successfully exploited via headers like X-Forwarded-For, User-Agent, Referer, and X-Api-Version. In this detection we match the invocation function with a network connection to a malicious ip address. -how_to_implement: This detection requires the Web datamodel to be populated from a - supported Technology Add-On like Splunk for Apache or Splunk for Nginx. -id: 69afee44-5c91-11ec-bf1f-497c9a704a72 -known_false_positives: If there is a vulnerablility scannner looking for log4shells - this will trigger, otherwise likely to have low false positives. -name: Log4Shell JNDI Payload Injection with Outbound Connection -references: -- https://www.lunasec.io/docs/blog/log4j-zero-day/ search: '| from datamodel Web.Web | rex field=_raw max_match=0 "[jJnNdDiI]{4}(\:|\%3A|\/|\%2F)(?\w+)(\:\/\/|\%3A\%2F\%2F)(\$\{.*?\}(\.)?)?(?[a-zA-Z0-9\.\-\_\$]+)" | join affected_host type=inner [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic @@ -28,6 +24,12 @@ search: '| from datamodel Web.Web | rex field=_raw max_match=0 "[jJnNdDiI]{4}(\: | `security_content_ctime(lastTime)` | rename dest AS affected_host] | fillnull | stats count by action, category, dest, dest_port, http_content_type, http_method, http_referrer, http_user_agent, site, src, url, url_domain, user | `log4shell_jndi_payload_injection_with_outbound_connection_filter`' +how_to_implement: This detection requires the Web datamodel to be populated from a + supported Technology Add-On like Splunk for Apache or Splunk for Nginx. +known_false_positives: If there is a vulnerablility scannner looking for log4shells + this will trigger, otherwise likely to have low false positives. +references: +- https://www.lunasec.io/docs/blog/log4j-zero-day/ tags: analytic_story: - Log4Shell CVE-2021-44228 @@ -83,5 +85,3 @@ tags: - user risk_score: 15 security_domain: threat -type: Anomaly -version: 1