diff --git a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml b/detections/deprecated/certutil_download_with_urlcache_and_split_arguments.yml similarity index 95% rename from detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml rename to detections/deprecated/certutil_download_with_urlcache_and_split_arguments.yml index d83fd1f502..5faea2cb93 100644 --- a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml +++ b/detections/deprecated/certutil_download_with_urlcache_and_split_arguments.yml @@ -1,11 +1,12 @@ name: CertUtil Download With URLCache and Split Arguments id: 415b4306-8bfb-11eb-85c4-acde48001122 -version: 12 -date: '2025-04-16' +version: 13 +date: '2025-04-24' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects the use of certutil.exe to download files +description: This analytic has been deprecated in favor of "Windows CertUtil Download". + The following analytic detects the use of certutil.exe to download files using the `-urlcache` and `-f` arguments. It leverages Endpoint Detection and Response (EDR) data, focusing on command-line executions that include these specific arguments. This activity is significant because certutil.exe is typically used for certificate diff --git a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml b/detections/deprecated/certutil_download_with_verifyctl_and_split_arguments.yml similarity index 95% rename from detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml rename to detections/deprecated/certutil_download_with_verifyctl_and_split_arguments.yml index d183056cf4..aae4d4ca8b 100644 --- a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml +++ b/detections/deprecated/certutil_download_with_verifyctl_and_split_arguments.yml @@ -1,11 +1,12 @@ name: CertUtil Download With VerifyCtl and Split Arguments id: 801ad9e4-8bfb-11eb-8b31-acde48001122 -version: 12 -date: '2025-04-16' +version: 13 +date: '2025-04-24' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects the use of `certutil.exe` to download +description: This analytic has been deprecated in favor of "Windows CertUtil Download". + The following analytic detects the use of `certutil.exe` to download files using the `-VerifyCtl` and `-f` arguments. This behavior is identified by monitoring command-line executions for these specific arguments via Endpoint Detection and Response (EDR) telemetry. This activity is significant because `certutil.exe` diff --git a/detections/endpoint/windows_certutil_download_with_url_argument.yml b/detections/deprecated/windows_certutil_download_with_url_argument.yml similarity index 95% rename from detections/endpoint/windows_certutil_download_with_url_argument.yml rename to detections/deprecated/windows_certutil_download_with_url_argument.yml index edf48a4bef..73b11d501f 100644 --- a/detections/endpoint/windows_certutil_download_with_url_argument.yml +++ b/detections/deprecated/windows_certutil_download_with_url_argument.yml @@ -1,11 +1,12 @@ name: Windows CertUtil Download With URL Argument id: 4fc5ca00-4c7c-46b3-8772-c98a4b8bd944 -version: 5 -date: '2025-04-16' +version: 6 +date: '2025-04-24' author: Nasreddine Bencherchali, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects the use of `certutil.exe` to download +description: This analytic has been deprecated in favor of "Windows CertUtil Download". + The following analytic detects the use of `certutil.exe` to download files using the `-URL` arguments. This behavior is identified by monitoring command-line executions for these specific arguments via Endpoint Detection and Response (EDR) telemetry. This activity is significant because `certutil.exe` is a legitimate tool diff --git a/detections/endpoint/windows_remote_access_software_hunt.yml b/detections/deprecated/windows_remote_access_software_hunt.yml similarity index 93% rename from detections/endpoint/windows_remote_access_software_hunt.yml rename to detections/deprecated/windows_remote_access_software_hunt.yml index 67dbe00f02..f1ce42bcbd 100644 --- a/detections/endpoint/windows_remote_access_software_hunt.yml +++ b/detections/deprecated/windows_remote_access_software_hunt.yml @@ -1,11 +1,11 @@ name: Windows Remote Access Software Hunt id: 8bd22c9f-05a2-4db1-b131-29271f28cb0a -version: 7 -date: '2025-04-18' +version: 8 +date: '2025-04-30' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting -description: The following analytic identifies the use of remote access software within +description: This search is deprecated in favor of the new detection - Detect Remote Access Software Usage Process. The following analytic identifies the use of remote access software within the environment. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This detection is significant as unauthorized remote access tools can be used by adversaries to maintain persistent access to diff --git a/detections/endpoint/chcp_command_execution.yml b/detections/endpoint/chcp_command_execution.yml index e24a0ed294..1532d3e1fd 100644 --- a/detections/endpoint/chcp_command_execution.yml +++ b/detections/endpoint/chcp_command_execution.yml @@ -1,15 +1,14 @@ name: CHCP Command Execution id: 21d236ec-eec1-11eb-b23e-acde48001122 -version: 6 -date: '2025-02-19' +version: 7 +date: '2025-04-24' author: Teoderick Contreras, Splunk status: production -type: TTP -description: The following analytic detects the execution of the chcp.exe application, +type: Anomaly +description: The following analytic detects the execution of the chcp.com utility, which is used to change the active code page of the console. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation - events where chcp.exe is executed by cmd.exe with specific command-line arguments. - This activity is significant because it can indicate the presence of malware, such + events. This activity is significant because it can indicate the presence of malware, such as IcedID, which uses this technique to determine the locale region, language, or country of the compromised host. If confirmed malicious, this could lead to further system compromise and data exfiltration. @@ -18,7 +17,6 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=chcp.com - Processes.parent_process_name = cmd.exe (Processes.parent_process=*/c* OR Processes.parent_process=*/k*) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec @@ -35,8 +33,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: other tools or script may used this to change code page to - UTF-* or others +known_false_positives: other tools or script may used this to change code page to UTF-* or others references: - https://ss64.com/nt/chcp.html - https://twitter.com/tccontre18/status/1419941156633329665?s=20 diff --git a/detections/endpoint/check_elevated_cmd_using_whoami.yml b/detections/endpoint/check_elevated_cmd_using_whoami.yml index 2921928934..692218967c 100644 --- a/detections/endpoint/check_elevated_cmd_using_whoami.yml +++ b/detections/endpoint/check_elevated_cmd_using_whoami.yml @@ -1,12 +1,15 @@ name: Check Elevated CMD using whoami id: a9079b18-1633-11ec-859c-acde48001122 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-24' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic identifies the execution of the 'whoami' command - with specific parameters to check for elevated privileges. It leverages data from +description: The following analytic identifies the execution of the "whoami" command + with the "/group" flag, where the results are passed to the "find" command in order + to look for a the string "12288". This string represents the SID of the group + "Mandatory Label\High Mandatory Level" effectively checking if the current process + is running as a "High" integrity process or with Administrator privileges. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. This activity is significant because it is commonly used by attackers, such as FIN7, to perform reconnaissance on a compromised host. If confirmed malicious, @@ -35,7 +38,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: unknown +known_false_positives: The combination of these commands is unlikely to occur in a production environment. Any matches should be investigated. references: [] drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" diff --git a/detections/endpoint/detect_remote_access_software_usage_process.yml b/detections/endpoint/detect_remote_access_software_usage_process.yml index 9d3d572175..7074ab0fe1 100644 --- a/detections/endpoint/detect_remote_access_software_usage_process.yml +++ b/detections/endpoint/detect_remote_access_software_usage_process.yml @@ -1,15 +1,14 @@ name: Detect Remote Access Software Usage Process id: ffd5e001-2e34-48f4-97a2-26dc4bb08178 -version: 8 -date: '2025-04-18' -author: Steven Dick +version: 9 +date: '2025-04-30' +author: Steven Dick, Sebastian Wurl, Splunk Community status: production type: Anomaly description: The following analytic detects the execution of known remote access software within the environment. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes mapped to the Endpoint data - model. This activity is significant as adversaries often use remote access tools - like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized access. + model. We then compare with with a list of known remote access software shipped as a lookup file - remote_access_software. This activity is significant as adversaries often use remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized access. If confirmed malicious, this could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization's security. @@ -17,18 +16,23 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime values(Processes.parent_process) as parent_process from datamodel=Endpoint.Processes - where Processes.dest!=unknown Processes.process!=unknown by Processes.action Processes.dest - Processes.original_file_name Processes.parent_process Processes.parent_process_exec - Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name - Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name - Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` - | lookup remote_access_software remote_utility AS process_name OUTPUT isutility, - description as signature, comment_reference as desc, category | search isutility - = True | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_process_filter`' +search: | + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.parent_process) as parent_process + from datamodel=Endpoint.Processes + where + [| inputlookup remote_access_software where isutility=TRUE + | rename remote_utility AS Processes.process_name + | fields Processes.process_name] + AND Processes.dest!="unknown" + AND Processes.user!="unknown" + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `drop_dm_object_name(Processes)` + | lookup remote_access_software remote_utility AS process_name OUTPUT isutility description AS signature comment_reference AS desc category + | search isutility = TRUE + | `remote_access_software_usage_exceptions` + | `detect_remote_access_software_usage_process_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -107,3 +111,6 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/screenconnect/screenconnect_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/detections/endpoint/detection_of_tools_built_by_nirsoft.yml b/detections/endpoint/detection_of_tools_built_by_nirsoft.yml index 945bb2a461..2a0e7986d7 100644 --- a/detections/endpoint/detection_of_tools_built_by_nirsoft.yml +++ b/detections/endpoint/detection_of_tools_built_by_nirsoft.yml @@ -1,10 +1,10 @@ name: Detection of tools built by NirSoft id: 3d8d201c-aa03-422d-b0ee-2e5ecf9718c0 -version: 7 -date: '2024-11-13' +version: 8 +date: '2025-04-24' author: Bhavin Patel, Splunk status: experimental -type: TTP +type: Anomaly description: The following analytic identifies the execution of tools built by NirSoft by detecting specific command-line arguments such as "/stext" and "/scomma". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process @@ -37,10 +37,10 @@ how_to_implement: The detection is based on data that originates from Endpoint D data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: While legitimate, these NirSoft tools are prone to abuse. You - should verfiy that the tool was used for a legitimate purpose. + should verify that the tool was used for a legitimate purpose. references: [] rba: - message: NirSoft tools detected on $dest$ + message: NirSoft tool detected on $dest$ risk_objects: - field: user type: user diff --git a/detections/endpoint/excessive_number_of_taskhost_processes.yml b/detections/endpoint/excessive_number_of_taskhost_processes.yml index 848b988bf1..afd814f56a 100644 --- a/detections/endpoint/excessive_number_of_taskhost_processes.yml +++ b/detections/endpoint/excessive_number_of_taskhost_processes.yml @@ -1,11 +1,12 @@ name: Excessive number of taskhost processes id: f443dac2-c7cf-11eb-ab51-acde48001122 -version: 7 -date: '2024-11-13' +version: 8 +date: '2025-04-25' author: Michael Hart status: production type: Anomaly -description: The following analytic identifies an excessive number of taskhost.exe +description: + The following analytic identifies an excessive number of taskhost.exe and taskhostex.exe processes running within a short time frame. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and their counts. This behavior is significant as it is commonly associated with post-exploitation @@ -14,10 +15,11 @@ description: The following analytic identifies an excessive number of taskhost.e activity could indicate an ongoing attack, allowing attackers to execute code, escalate privileges, or move laterally within the network. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.action) as action + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` values(Processes.action) as action values(Processes.original_file_name) as original_file_name values(Processes.parent_process) as parent_process values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_id) as parent_process_id @@ -41,9 +43,11 @@ search: '| tstats `security_content_summariesonly` values(Processes.action) as a values(process_hash) as process_hash values(process_id) as process_id values(process_integrity_level) as process_integrity_level values(user) as user values(process_path) as process_path values(user_id) as user_id values(vendor_product) as vendor_product values(process_name) - as process_name by _time, dest, firstTime, lastTime | `security_content_ctime(firstTime)` + as process_name by _time, dest, firstTime, lastTime | where taskhost_count > + 10 or taskhostex_count > 10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_number_of_taskhost_processes_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -52,46 +56,49 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Administrators, administrative actions or certain applications +known_false_positives: + Administrators, administrative actions or certain applications may run many instances of taskhost and taskhostex concurrently. Filter as needed. references: -- https://attack.mitre.org/software/S0250/ + - https://attack.mitre.org/software/S0250/ drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: An excessive amount of taskhost.exe and taskhostex.exe was executed on + message: + An excessive amount of taskhost.exe and taskhostex.exe was executed on $dest$ indicative of suspicious behavior. risk_objects: - - field: dest - type: system - score: 56 + - field: dest + type: system + score: 56 threat_objects: [] tags: analytic_story: - - Meterpreter + - Meterpreter asset_type: Endpoint mitre_attack_id: - - T1059 + - T1059 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/excessive_distinct_processes_from_windows_temp/windows-xml.log - source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/excessive_distinct_processes_from_windows_temp/windows-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/java_writing_jsp_file.yml b/detections/endpoint/java_writing_jsp_file.yml index 4476ff86f3..c8358070e3 100644 --- a/detections/endpoint/java_writing_jsp_file.yml +++ b/detections/endpoint/java_writing_jsp_file.yml @@ -1,7 +1,7 @@ name: Java Writing JSP File id: eb65619c-4f8d-4383-a975-d352765d344b -version: 8 -date: '2025-04-22' +version: 9 +date: '2025-04-28' author: Michael Haag, Splunk status: production type: TTP @@ -72,6 +72,7 @@ tags: - Spring4Shell CVE-2022-22965 - Atlassian Confluence Server and Data Center CVE-2022-26134 - SysAid On-Prem Software CVE-2023-47246 Vulnerability + - SAP NetWeaver Exploitation asset_type: Endpoint cve: - CVE-2022-22965 diff --git a/detections/endpoint/system_processes_run_from_unexpected_locations.yml b/detections/endpoint/system_processes_run_from_unexpected_locations.yml index 52ded1d414..6b5ceb288a 100644 --- a/detections/endpoint/system_processes_run_from_unexpected_locations.yml +++ b/detections/endpoint/system_processes_run_from_unexpected_locations.yml @@ -1,12 +1,12 @@ name: System Processes Run From Unexpected Locations id: a34aae96-ccf8-4aef-952c-3ea21444444d -version: 11 -date: '2025-02-10' -author: David Dorsey, Michael Haag, Splunk +version: 12 +date: '2025-04-24' +author: David Dorsey, Michael Haag, Nasreddine Bencherchali, Splunk status: production type: Anomaly description: The following analytic identifies system processes running from unexpected - locations outside `C:\Windows\System32\` or `C:\Windows\SysWOW64`. It leverages + locations outside of paths such as `C:\Windows\System32\` or `C:\Windows\SysWOW64`. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process paths, names, and hashes. This activity is significant as it may indicate a malicious process attempting to masquerade as a legitimate system process. If confirmed malicious, @@ -17,15 +17,17 @@ data_source: - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path !="C:\\Windows\\System32*" - Processes.process_path !="C:\\Windows\\SysWOW64*" by Processes.action Processes.dest + as lastTime FROM datamodel=Endpoint.Processes where NOT Processes.process_path IN ("C:\\$WINDOWS.~BT\\*", "C:\\$WinREAgent\\*", "C:\\Windows\\SoftwareDistribution\\*", "C:\\Windows\\System32\\*", "C:\\Windows\\SystemTemp\\*", "C:\\Windows\\SysWOW64\\*", "C:\\Windows\\uus\\*", "C:\\Windows\\WinSxS\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| - `is_windows_system_file_macro` | `system_processes_run_from_unexpected_locations_filter`' + | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `is_windows_system_file_macro` + | `system_processes_run_from_unexpected_locations_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/windows_file_download_via_certutil.yml b/detections/endpoint/windows_file_download_via_certutil.yml new file mode 100644 index 0000000000..bf5000df1e --- /dev/null +++ b/detections/endpoint/windows_file_download_via_certutil.yml @@ -0,0 +1,96 @@ +name: Windows File Download Via CertUtil +id: 7fac8d40-e370-45ea-a4a3-031bbcc18b02 +version: 1 +date: '2025-04-24' +author: Nasreddine Bencherchali, Michael Haag, Splunk +status: production +type: TTP +description: The following analytic detects the use of `certutil.exe` to download files using the `-URL`, `-urlcache` or '-verifyctl' arguments. This behavior is identified by monitoring command-line executions for these specific arguments via Endpoint Detection and Response (EDR) telemetry. This activity is significant because `certutil.exe` is a legitimate tool often abused by attackers to download and execute malicious payloads. If confirmed malicious, this could allow an attacker to download and execute arbitrary files, potentially leading to code execution, data exfiltration, or further compromise of the system. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_certutil` AND ((Processes.process IN ("*-URL *", "*/URL *")) OR (Processes.process IN ("*urlcache*", "*verifyctl*") AND Processes.process IN ("*/f *", "*-f *"))) + by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_file_download_via_certutil_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Limited false positives in most environments, however tune + as needed based on parent-child relationship or network connection. +references: +- https://attack.mitre.org/techniques/T1105/ +- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/ +- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats +- https://web.archive.org/web/20210921110637/https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html +- https://lolbas-project.github.io/lolbas/Binaries/Certutil/ +- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to download a file. + risk_objects: + - field: user + type: user + score: 90 + - field: dest + type: system + score: 90 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +tags: + analytic_story: + - Living Off The Land + - Ingress Tool Transfer + - ProxyNotShell + - DarkSide Ransomware + - Forest Blizzard + - Flax Typhoon + - Compromised Windows Host + - CISA AA22-277A + asset_type: Endpoint + mitre_attack_id: + - T1105 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_java_spawning_shells.yml b/detections/endpoint/windows_java_spawning_shells.yml index d3f259a807..48c0960c80 100644 --- a/detections/endpoint/windows_java_spawning_shells.yml +++ b/detections/endpoint/windows_java_spawning_shells.yml @@ -1,7 +1,7 @@ name: Windows Java Spawning Shells id: 28c81306-5c47-11ec-bfea-acde48001122 -version: 9 -date: '2024-12-16' +version: 10 +date: '2025-04-28' author: Michael Haag, Splunk status: experimental type: TTP @@ -61,6 +61,7 @@ tags: - Log4Shell CVE-2021-44228 - SysAid On-Prem Software CVE-2023-47246 Vulnerability - Cleo File Transfer Software + - SAP NetWeaver Exploitation asset_type: Endpoint cve: - CVE-2021-44228 diff --git a/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml b/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml index 9eff6d1067..018d13e4cb 100644 --- a/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml +++ b/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml @@ -1,7 +1,7 @@ name: Windows Process Injection into Commonly Abused Processes id: 1e1dedc6-f6f3-41a0-9dd7-a1245904fe75 -version: 2 -date: '2025-04-16' +version: 3 +date: '2025-04-28' author: 0xC0FFEEEE, Github Community type: Anomaly status: production @@ -70,6 +70,7 @@ tags: analytic_story: - BishopFox Sliver Adversary Emulation Framework - Earth Alux + - SAP NetWeaver Exploitation asset_type: Endpoint mitre_attack_id: - T1055.002 diff --git a/detections/endpoint/windows_process_with_namedpipe_commandline.yml b/detections/endpoint/windows_process_with_namedpipe_commandline.yml index f3e83be25f..4f2630f753 100644 --- a/detections/endpoint/windows_process_with_namedpipe_commandline.yml +++ b/detections/endpoint/windows_process_with_namedpipe_commandline.yml @@ -1,7 +1,7 @@ name: Windows Process With NamedPipe CommandLine id: e64399d4-94a8-11ec-a9da-acde48001122 -version: 5 -date: '2024-11-13' +version: 6 +date: '2025-04-24' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -19,14 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*\\\\.\\pipe\\*" - NOT (Processes.process_path IN ("*\\program files*")) by Processes.action Processes.dest + NOT Processes.process_path IN ("C:\\Program Files\\*", "C:\\Program Files (x86)\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name - Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_process_with_namedpipe_commandline_filter`' + Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_with_namedpipe_commandline_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/windows_query_registry_browser_list_application.yml b/detections/endpoint/windows_query_registry_browser_list_application.yml index efe1db1c2d..77d905faa0 100644 --- a/detections/endpoint/windows_query_registry_browser_list_application.yml +++ b/detections/endpoint/windows_query_registry_browser_list_application.yml @@ -1,7 +1,7 @@ name: Windows Query Registry Browser List Application id: 45ebd21c-f4bf-4ced-bd49-d25b6526cebb -version: '6' -date: '2025-03-19' +version: 7 +date: '2025-04-24' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -16,8 +16,8 @@ description: The following analytic detects a suspicious process accessing the r confirmed malicious, this behavior could enable attackers to exfiltrate sensitive information and compromise user accounts. search: '`wineventlog_security` EventCode=4663 object_file_path IN ("*\\SOFTWARE\\Clients\\StartMenuInternet\\*", - "*\\SOFTWARE\\Clients\\StartMenuInternet\\*") AND NOT (process_path IN ("*:\\Windows\\System32\\*", - "*:\\Windows\\SysWow64\\*", "*:\\Program Files*", "*:\\Windows\\*")) | stats count + "*\\SOFTWARE\\Clients\\StartMenuInternet\\*") AND NOT process_path IN ("*:\\Windows\\System32\\*", + "*:\\Windows\\SysWow64\\*", *:\\Windows\\WinSxS\\*, "*:\\Program Files\\*", "*:\\Program Files (x86)\\*") | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path process_id EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_query_registry_browser_list_application_filter`' diff --git a/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml b/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml index 65a41a6789..d4ebca8efb 100644 --- a/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml +++ b/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml @@ -1,26 +1,25 @@ name: Windows User Execution Malicious URL Shortcut File id: 5c7ee6ad-baf4-44fb-b2f0-0cfeddf82dbc -version: 6 -date: '2025-02-10' -author: Teoderick Contreras, Splunk +version: 7 +date: '2025-04-24' +author: Teoderick Contreras, Nasreddine Bencherchali, Splunk status: production -type: TTP -description: The following analytic detects the creation of suspicious URL shortcut - link files, often used by malware like CHAOS ransomware. It leverages the Endpoint.Filesystem - datamodel to identify .url files created outside standard directories, such as Program - Files. This activity is significant as it may indicate an attempt to execute malicious - code upon system reboot. If confirmed malicious, this could allow an attacker to - achieve persistence and execute harmful payloads, potentially leading to further - system compromise and data loss. +type: Anomaly +description: The following analytic detects the creation URL shortcut files, often used by malware like CHAOS ransomware. + It leverages the Endpoint.Filesystem datamodel to identify ".url" files created outside common directories, such as "Program Files". + This activity can be significant as ".URL" files can be used as mean to trick the user into visiting certain websites unknowingly, or when placed in certain locations such as "\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", it may allow the execution of malicious code upon system reboot. If confirmed malicious, this could allow an attacker to achieve persistence and execute harmful payloads, potentially leading to further system compromise and data loss. data_source: - Sysmon EventID 11 search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Filesystem where NOT(Filesystem.file_path IN - ("*\\Program Files*")) Filesystem.file_name = *.url by Filesystem.action Filesystem.dest + as lastTime from datamodel=Endpoint.Filesystem where NOT Filesystem.file_path IN + ("*:\\Program Files\\*", "*:\\Program Files (x86)\\*", "*\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*", "*:\\Windows\\WinSxS\\*") Filesystem.file_name=*.url + by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size - Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product - | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_user_execution_malicious_url_shortcut_file_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from @@ -45,14 +44,14 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: a process created URL shortcut file in $file_path$ of $dest$ + message: A process created a .URL shortcut file in $file_path$ of $dest$ risk_objects: - field: user type: user - score: 64 + score: 50 - field: dest type: system - score: 64 + score: 50 threat_objects: [] tags: analytic_story: diff --git a/detections/network/protocols_passing_authentication_in_cleartext.yml b/detections/network/protocols_passing_authentication_in_cleartext.yml index ba3d3d5577..33cf2063ad 100644 --- a/detections/network/protocols_passing_authentication_in_cleartext.yml +++ b/detections/network/protocols_passing_authentication_in_cleartext.yml @@ -1,10 +1,10 @@ name: Protocols passing authentication in cleartext id: 6923cd64-17a0-453c-b945-81ac2d8c6db9 -version: 6 -date: '2024-11-15' +version: 7 +date: '2025-03-03' author: Rico Valdez, Splunk status: experimental -type: TTP +type: Anomaly description: The following analytic identifies the use of cleartext protocols that risk leaking sensitive information. It detects network traffic on legacy protocols such as Telnet (port 23), POP3 (port 110), IMAP (port 143), and non-anonymous FTP @@ -25,8 +25,7 @@ how_to_implement: This search requires you to be ingesting your network traffic, populating the Network_Traffic data model. For more accurate result it's better to limit destination to organization private and public IP range, like All_Traffic.dest IN(192.168.0.0/16,172.16.0.0/12,10.0.0.0/8, x.x.x.x/22) -known_false_positives: Some networks may use kerberized FTP or telnet servers, however, - this is rare. +known_false_positives: Some networks may use kerberos, FTP or telnet servers, however, this is rare. references: - https://www.rackaid.com/blog/secure-your-email-and-file-transfers/ - https://www.infosecmatter.com/capture-passwords-using-wireshark/ diff --git a/detections/web/sap_netweaver_visual_composer_exploitation_attempt.yml b/detections/web/sap_netweaver_visual_composer_exploitation_attempt.yml new file mode 100644 index 0000000000..4ced874045 --- /dev/null +++ b/detections/web/sap_netweaver_visual_composer_exploitation_attempt.yml @@ -0,0 +1,52 @@ +name: SAP NetWeaver Visual Composer Exploitation Attempt +id: a583b9f1-9c3a-4402-9441-b981654dea6c +version: 1 +date: '2025-04-28' +author: Michael Haag, Splunk +status: production +type: Hunting +description: | + Detects potential exploitation attempts targeting CVE-2025-31324, a critical unauthenticated file upload vulnerability in SAP NetWeaver Visual Composer. This flaw allows remote attackers to send specially crafted POST requests to the /developmentserver/metadatauploader endpoint, enabling arbitrary file uploads—commonly webshells—resulting in full system compromise. The detection looks for HTTP HEAD or POST requests with a 200 OK status to sensitive Visual Composer endpoints, which may indicate reconnaissance or active exploitation. Successful exploitation can lead to attackers gaining privileged access, deploying malware, and impacting business-critical SAP resources. Immediate patching and investigation of suspicious activity are strongly recommended, as this vulnerability is being actively exploited in the wild. +data_source: +- Suricata +search: '| tstats count min(_time) as firstTime max(_time) as lastTime + from datamodel=Web.Web + where (Web.url IN ("/CTCWebService/CTCWebServiceBean", "/VisualComposer/services/DesignTimeService", "/ctc/CTCWebService/CTCWebServiceBean")) + AND Web.http_method IN ("HEAD", "POST") + AND Web.status=200 + by Web.src, Web.dest, Web.http_method, Web.url, Web.http_user_agent, Web.url_length, sourcetype + | `drop_dm_object_name("Web")` + | eval action=case(http_method="HEAD", "Recon/Probe", http_method="POST", "Possible Exploitation") + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | table firstTime, lastTime, src, dest, http_method, action, url, user_agent, url_length, sourcetype + | `sap_netweaver_visual_composer_exploitation_attempt_filter`' +how_to_implement: | + Ensure that the Web data model is accelerated and populated with web server or web proxy logs capturing HTTP request and response data. + This search relies on HTTP method, status code, and URL path fields to identify suspicious access patterns against SAP NetWeaver endpoints. +known_false_positives: | + Some legitimate administrative activity may access SAP NetWeaver services. However, HEAD or POST requests directly resulting in a 200 OK + to Visual Composer endpoints are uncommon and should be investigated carefully. +references: +- https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/ +- https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/ +- https://www.rapid7.com/blog/post/2025/04/28/etr-active-exploitation-of-sap-netweaver-visual-composer-cve-2025-31324/ +tags: + analytic_story: + - SAP NetWeaver Exploitation + asset_type: Web Server + mitre_attack_id: + - T1190 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: network + cve: + - CVE-2025-31324 +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/sap/suricata_sapnetweaver.log + sourcetype: suricata + source: suricata diff --git a/lookups/is_nirsoft_software.csv b/lookups/is_nirsoft_software.csv index 8e2ad32430..c1bbedf957 100644 --- a/lookups/is_nirsoft_software.csv +++ b/lookups/is_nirsoft_software.csv @@ -1,15 +1,108 @@ filename,nirsoftFile AdvancedRun.exe,True +awatch.exe,True +BrowsingHistoryView.exe,True +BulletsPassView.exe,True +ChromeCacheView.exe,True +ChromeHistoryView.exe,True ChromePass.exe,True +cports.exe,True +CredentialsFileView.exe,True CredHistView.exe,True +DataProtectionDecryptor.exe,True +DeviceIOView.exe,True Dialupass.exe,True +dllexp.exe,True +DNSDataView.exe,True +DNSQuerySniffer.exe,True +DotNetResourcesExtract.exe,True +DownTester.exe,True +DriverView.exe,True +EncryptedRegView.exe,True +ESEDatabaseView.exe,True +EventLogChannelsView.exe,True +FastResolver.exe,True +faview.exe,True +FBCacheView.exe,True +FileTypesMan.exe,True +FirefoxDownloadsView.exe,True +FlashCookiesView.exe,True +FolderChangesView.exe,True +FolderTimeUpdate.exe,True +FullEventLogView.exe,True +gacview.exe,True +GDIView.exe,True +HeapMemView.exe,True +HTTPNetworkSniffer.exe,True +IECacheView.exe,True +iecv.exe,True +iehv.exe,True iepv.exe,True +ImageCacheViewer.exe,True +InstalledPackagesView.exe,True +IPNetInfo.exe,True +LastActivityView.exe,True LostMyPassword.exe,True mailpv.exe,True +MozillaCacheView.exe,True +MozillaHistoryView.exe,True mspass.exe,True +MyLastSearch.exe,True +mzcv.exe,True +NetBScanner.exe,True +NetConnectChoose.exe,True netpass.exe,True +NetResView.exe,True +NetRouteView.exe,True +NetworkLatencyView.exe,True +NetworkTrafficView.exe,True +OpenedFilesView.exe,True +OperaCacheView.exe,True PasswordFox.exe,True PasswordHashesView.exe,True +PingInfoView.exe,True +ProcessActivityView.exe,True +ProcessThreadsView.exe,True +ProduKey.exe,True PstPassword.exe,True +QuickSetDNS.exe,True +RegDllView.exe,True +RegFromApp.exe,True RegHiveBackup.exe,True -WebBrowserPassView.exe,True \ No newline at end of file +RegScanner.exe,True +ResourcesExtract.exe,True +RouterPassView.exe,True +RunAsDate.exe,True +SafariCacheView.exe,True +SafariHistoryView.exe,True +SearchMyFiles.exe,True +shexview.exe,True +shmnview.exe,True +SimpleProgramDebugger.exe,True +SiteShoter.exe,True +smsniff.exe,True +SniffPass.exe,True +SocketSniff.exe,True +SpecialFoldersView.exe,True +sysexp.exe,True +TaskSchedulerView.exe,True +TcpLogView.exe,True +TurnedOnTimesView.exe,True +UninstallView.exe,True +URLProtocolView.exe,True +USBDeview.exe,True +VaultPasswordView.exe,True +volumouse.exe,True +WebBrowserPassView.exe,True +WebCacheImageInfo.exe,True +WebCookiesSniffer.exe,True +WebSiteSniffer.exe,True +WhatIsHang.exe,True +WhoisTD.exe,True +WifiChannelMonitor.exe,True +WifiInfoView.exe,True +WinCrashReport.exe,True +WinLogOnView.exe,True +WirelessKeyView.exe,True +WirelessNetView.exe,True +WNetWatcher.exe,True \ No newline at end of file diff --git a/lookups/is_nirsoft_software.yml b/lookups/is_nirsoft_software.yml index 12337fbbca..8adb625a12 100644 --- a/lookups/is_nirsoft_software.yml +++ b/lookups/is_nirsoft_software.yml @@ -1,6 +1,6 @@ name: is_nirsoft_software -date: 2024-12-23 -version: 2 +date: 2025-04-24 +version: 3 id: 28966a08-55e4-4ccb-a20d-dc4cc154b09c author: Splunk Threat Research Team lookup_type: csv diff --git a/removed/deprecation_mapping.YML b/removed/deprecation_mapping.YML index 99e8eb5874..5947c9e475 100644 --- a/removed/deprecation_mapping.YML +++ b/removed/deprecation_mapping.YML @@ -1,4 +1,24 @@ detections: + - content: Windows Remote Access Software Hunt + removed_in_version: 5.8.0 + reason: Detection has been replaced by a new detection with a more specific name and logic + replacement_content: + - Detect Remote Access Software Usage Process + - content: CertUtil Download With URLCache and Split Arguments + removed_in_version: 5.8.0 + reason: Detection deprecated in favor of "Windows File Download Via CertUtil", in order to provide a better experience of the alert + replacement_content: + - Windows File Download Via CertUtil + - content: Windows CertUtil Download With URL Argument + removed_in_version: 5.8.0 + reason: Detection deprecated in favor of "Windows File Download Via CertUtil", in order to provide a better experience of the alert + replacement_content: + - Windows File Download Via CertUtil + - content: CertUtil Download With VerifyCtl and Split Arguments + removed_in_version: 5.8.0 + reason: Detection deprecated in favor of "Windows File Download Via CertUtil", in order to provide a better experience of the alert + replacement_content: + - Windows File Download Via CertUtil - content: Detect Large Outbound ICMP Packets removed_in_version: 5.6.0 reason: Detection has been replaced by a new detection with a more specific name @@ -1030,4 +1050,4 @@ stories: - Suspicious Cloud Instance Activities - content: Web Fraud Detection removed_in_version: 5.2.0 - reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity \ No newline at end of file + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity diff --git a/stories/sap_netweaver_exploitation.yml b/stories/sap_netweaver_exploitation.yml new file mode 100644 index 0000000000..881b2a6998 --- /dev/null +++ b/stories/sap_netweaver_exploitation.yml @@ -0,0 +1,28 @@ +name: SAP NetWeaver Exploitation +id: a52f77e2-0632-46a5-b750-6c059bc7bbb4 +version: 1 +status: production +date: '2025-04-28' +author: Michael Haag, Splunk +description: | + This Analytic Story covers the detection of exploitation attempts and reconnaissance activity targeting SAP NetWeaver platforms, with a focus on the critical unauthenticated file upload vulnerability CVE-2025-31324 in Visual Composer. Attackers are actively exploiting this flaw to upload arbitrary files—often webshells—via POST requests to the /developmentserver/metadatauploader endpoint, leading to full system compromise, remote code execution, and persistent access. The story includes detections for both probing (e.g., HEAD requests) and active exploitation, and highlights the significant business risks, such as data theft, operational disruption, and potential regulatory impact. Defenders can use this story to monitor, hunt, and respond to suspicious activity across SAP NetWeaver services, helping to identify both initial access and post-exploitation behaviors. +narrative: | + Attackers are actively targeting SAP NetWeaver environments through newly disclosed vulnerabilities like CVE-2025-31324, affecting the Visual Composer service. + Successful exploitation can lead to remote code execution (RCE) and the deployment of webshells, giving adversaries persistent access to SAP systems. + This story provides detections for reconnaissance patterns (e.g., HEAD requests receiving HTTP 200 responses) and potential exploitation behavior + (e.g., POST requests leading to successful uploads), empowering defenders to quickly identify compromise attempts and mitigate them before escalation. +references: + - https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/ + - https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/ + - https://www.rapid7.com/blog/post/2025/04/28/etr-active-exploitation-of-sap-netweaver-visual-composer-cve-2025-31324/ + - https://www.splunk.com/en_us/blog/security/the-final-shell-introducing-shellsweepx.html +tags: + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection + cve: + - CVE-2025-31324