From 60164de4e7cde1851d99f49c1874fb407844631c Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 3 Mar 2025 15:46:14 +0100 Subject: [PATCH 01/20] updates and tunings --- ...load_with_urlcache_and_split_arguments.yml | 5 +- ...oad_with_verifyctl_and_split_arguments.yml | 5 +- ...ws_certutil_download_with_url_argument.yml | 5 +- .../endpoint/chcp_command_execution.yml | 22 ++--- .../check_elevated_cmd_using_whoami.yml | 9 +- ...rocesses_run_from_unexpected_locations.yml | 20 ++--- .../windows_file_download_via_certutil.yml | 86 +++++++++++++++++++ ...ows_process_with_namedpipe_commandline.yml | 15 ++-- ...uery_registry_browser_list_application.yml | 4 +- ..._execution_malicious_url_shortcut_file.yml | 33 +++---- ...ls_passing_authentication_in_cleartext.yml | 9 +- 11 files changed, 142 insertions(+), 71 deletions(-) rename detections/{endpoint => deprecated}/certutil_download_with_urlcache_and_split_arguments.yml (96%) rename detections/{endpoint => deprecated}/certutil_download_with_verifyctl_and_split_arguments.yml (96%) rename detections/{endpoint => deprecated}/windows_certutil_download_with_url_argument.yml (96%) create mode 100644 detections/endpoint/windows_file_download_via_certutil.yml diff --git a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml b/detections/deprecated/certutil_download_with_urlcache_and_split_arguments.yml similarity index 96% rename from detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml rename to detections/deprecated/certutil_download_with_urlcache_and_split_arguments.yml index d83fd1f502..7c2519c3b0 100644 --- a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml +++ b/detections/deprecated/certutil_download_with_urlcache_and_split_arguments.yml @@ -3,9 +3,10 @@ id: 415b4306-8bfb-11eb-85c4-acde48001122 version: 12 date: '2025-04-16' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects the use of certutil.exe to download files +description: This analytic has been deprecated in favor of "Windows CertUtil Download". + The following analytic detects the use of certutil.exe to download files using the `-urlcache` and `-f` arguments. It leverages Endpoint Detection and Response (EDR) data, focusing on command-line executions that include these specific arguments. This activity is significant because certutil.exe is typically used for certificate diff --git a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml b/detections/deprecated/certutil_download_with_verifyctl_and_split_arguments.yml similarity index 96% rename from detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml rename to detections/deprecated/certutil_download_with_verifyctl_and_split_arguments.yml index d183056cf4..d93f16be39 100644 --- a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml +++ b/detections/deprecated/certutil_download_with_verifyctl_and_split_arguments.yml @@ -3,9 +3,10 @@ id: 801ad9e4-8bfb-11eb-8b31-acde48001122 version: 12 date: '2025-04-16' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects the use of `certutil.exe` to download +description: This analytic has been deprecated in favor of "Windows CertUtil Download". + The following analytic detects the use of `certutil.exe` to download files using the `-VerifyCtl` and `-f` arguments. This behavior is identified by monitoring command-line executions for these specific arguments via Endpoint Detection and Response (EDR) telemetry. This activity is significant because `certutil.exe` diff --git a/detections/endpoint/windows_certutil_download_with_url_argument.yml b/detections/deprecated/windows_certutil_download_with_url_argument.yml similarity index 96% rename from detections/endpoint/windows_certutil_download_with_url_argument.yml rename to detections/deprecated/windows_certutil_download_with_url_argument.yml index edf48a4bef..d0b2b97673 100644 --- a/detections/endpoint/windows_certutil_download_with_url_argument.yml +++ b/detections/deprecated/windows_certutil_download_with_url_argument.yml @@ -3,9 +3,10 @@ id: 4fc5ca00-4c7c-46b3-8772-c98a4b8bd944 version: 5 date: '2025-04-16' author: Nasreddine Bencherchali, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects the use of `certutil.exe` to download +description: This analytic has been deprecated in favor of "Windows CertUtil Download". + The following analytic detects the use of `certutil.exe` to download files using the `-URL` arguments. This behavior is identified by monitoring command-line executions for these specific arguments via Endpoint Detection and Response (EDR) telemetry. This activity is significant because `certutil.exe` is a legitimate tool diff --git a/detections/endpoint/chcp_command_execution.yml b/detections/endpoint/chcp_command_execution.yml index e24a0ed294..dd4ccea74b 100644 --- a/detections/endpoint/chcp_command_execution.yml +++ b/detections/endpoint/chcp_command_execution.yml @@ -1,15 +1,14 @@ name: CHCP Command Execution id: 21d236ec-eec1-11eb-b23e-acde48001122 version: 6 -date: '2025-02-19' +date: '2025-02-28' author: Teoderick Contreras, Splunk status: production -type: TTP -description: The following analytic detects the execution of the chcp.exe application, +type: Anomaly +description: The following analytic detects the execution of the chcp.com utility, which is used to change the active code page of the console. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation - events where chcp.exe is executed by cmd.exe with specific command-line arguments. - This activity is significant because it can indicate the presence of malware, such + events. This activity is significant because it can indicate the presence of malware, such as IcedID, which uses this technique to determine the locale region, language, or country of the compromised host. If confirmed malicious, this could lead to further system compromise and data exfiltration. @@ -18,13 +17,9 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=chcp.com - Processes.parent_process_name = cmd.exe (Processes.parent_process=*/c* OR Processes.parent_process=*/k*) - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process - Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id - Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec - Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + by Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process + Processes.process_id Processes.parent_process_id Processes.dest Processes.user | + `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `chcp_command_execution_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -35,8 +30,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: other tools or script may used this to change code page to - UTF-* or others +known_false_positives: other tools or script may used this to change code page to UTF-* or others references: - https://ss64.com/nt/chcp.html - https://twitter.com/tccontre18/status/1419941156633329665?s=20 diff --git a/detections/endpoint/check_elevated_cmd_using_whoami.yml b/detections/endpoint/check_elevated_cmd_using_whoami.yml index 2921928934..0ac703695c 100644 --- a/detections/endpoint/check_elevated_cmd_using_whoami.yml +++ b/detections/endpoint/check_elevated_cmd_using_whoami.yml @@ -5,8 +5,11 @@ date: '2024-11-13' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic identifies the execution of the 'whoami' command - with specific parameters to check for elevated privileges. It leverages data from +description: The following analytic identifies the execution of the "whoami" command + with the "/group" flag, where the results are passed to the "find" command in order + to look for a the string "12288". This string represents the SID of the group + "Mandatory Label\High Mandatory Level" effectively checking if the current process + is running as a "High" integrity process or with Administrator privileges. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. This activity is significant because it is commonly used by attackers, such as FIN7, to perform reconnaissance on a compromised host. If confirmed malicious, @@ -35,7 +38,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: unknown +known_false_positives: The combination of these commands is unlikely to occur in a production environment. Any matches should be investigated. references: [] drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" diff --git a/detections/endpoint/system_processes_run_from_unexpected_locations.yml b/detections/endpoint/system_processes_run_from_unexpected_locations.yml index 52ded1d414..847a6a5e8c 100644 --- a/detections/endpoint/system_processes_run_from_unexpected_locations.yml +++ b/detections/endpoint/system_processes_run_from_unexpected_locations.yml @@ -1,12 +1,12 @@ name: System Processes Run From Unexpected Locations id: a34aae96-ccf8-4aef-952c-3ea21444444d version: 11 -date: '2025-02-10' -author: David Dorsey, Michael Haag, Splunk +date: '2025-03-03' +author: David Dorsey, Michael Haag, Nasreddine Bencherchali, Splunk status: production type: Anomaly description: The following analytic identifies system processes running from unexpected - locations outside `C:\Windows\System32\` or `C:\Windows\SysWOW64`. It leverages + locations outside of paths such as `C:\Windows\System32\` or `C:\Windows\SysWOW64`. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process paths, names, and hashes. This activity is significant as it may indicate a malicious process attempting to masquerade as a legitimate system process. If confirmed malicious, @@ -17,15 +17,11 @@ data_source: - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path !="C:\\Windows\\System32*" - Processes.process_path !="C:\\Windows\\SysWOW64*" by Processes.action Processes.dest - Processes.original_file_name Processes.parent_process Processes.parent_process_exec - Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name - Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name - Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| - `is_windows_system_file_macro` | `system_processes_run_from_unexpected_locations_filter`' + as lastTime FROM datamodel=Endpoint.Processes where NOT Processes.process_path IN ("C:\\$WINDOWS.~BT\\*", "C:\\$WinREAgent\\*", "C:\\Windows\\SoftwareDistribution\\*", "C:\\Windows\\System32\\*", "C:\\Windows\\SystemTemp\\*", "C:\\Windows\\SysWOW64\\*", "C:\\Windows\\uus\\*", "C:\\Windows\\WinSxS\\*") by Processes.dest Processes.user + Processes.parent_process Processes.process_path Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id Processes.process_hash | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `is_windows_system_file_macro` + | `system_processes_run_from_unexpected_locations_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/windows_file_download_via_certutil.yml b/detections/endpoint/windows_file_download_via_certutil.yml new file mode 100644 index 0000000000..90640fc8f2 --- /dev/null +++ b/detections/endpoint/windows_file_download_via_certutil.yml @@ -0,0 +1,86 @@ +name: Windows File Download Via CertUtil +id: 7fac8d40-e370-45ea-a4a3-031bbcc18b02 +version: 1 +date: '2025-03-03' +author: Nasreddine Bencherchali, Michael Haag, Splunk +status: production +type: TTP +description: The following analytic detects the use of `certutil.exe` to download files using the `-URL`, `-urlcache` or '-verifyctl' arguments. This behavior is identified by monitoring command-line executions for these specific arguments via Endpoint Detection and Response (EDR) telemetry. This activity is significant because `certutil.exe` is a legitimate tool often abused by attackers to download and execute malicious payloads. If confirmed malicious, this could allow an attacker to download and execute arbitrary files, potentially leading to code execution, data exfiltration, or further compromise of the system. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_certutil` AND ((Processes.process IN ("*-URL *", "*/URL *")) OR (Processes.process IN ("*urlcache*", "*verifyctl*") AND Processes.process IN ("*/f *", "*-f *"))) by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_file_download_via_certutil_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Limited false positives in most environments, however tune + as needed based on parent-child relationship or network connection. +references: +- https://attack.mitre.org/techniques/T1105/ +- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/ +- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats +- https://web.archive.org/web/20210921110637/https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html +- https://lolbas-project.github.io/lolbas/Binaries/Certutil/ +- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to download a file. + risk_objects: + - field: user + type: user + score: 90 + - field: dest + type: system + score: 90 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +tags: + analytic_story: + - Living Off The Land + - Ingress Tool Transfer + - ProxyNotShell + - DarkSide Ransomware + - Forest Blizzard + - Flax Typhoon + - Compromised Windows Host + - CISA AA22-277A + asset_type: Endpoint + mitre_attack_id: + - T1105 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_process_with_namedpipe_commandline.yml b/detections/endpoint/windows_process_with_namedpipe_commandline.yml index f3e83be25f..9999d9c1d6 100644 --- a/detections/endpoint/windows_process_with_namedpipe_commandline.yml +++ b/detections/endpoint/windows_process_with_namedpipe_commandline.yml @@ -1,7 +1,7 @@ name: Windows Process With NamedPipe CommandLine id: e64399d4-94a8-11ec-a9da-acde48001122 version: 5 -date: '2024-11-13' +date: '2025-03-03' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -19,14 +19,11 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*\\\\.\\pipe\\*" - NOT (Processes.process_path IN ("*\\program files*")) by Processes.action Processes.dest - Processes.original_file_name Processes.parent_process Processes.parent_process_exec - Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name - Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name - Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_process_with_namedpipe_commandline_filter`' + NOT Processes.process_path IN ("C:\\Program Files\\*", "C:\\Program Files (x86)\\*") by Processes.parent_process_name + Processes.parent_process Processes.process_name Processes.process Processes.original_file_name + Processes.process_id Processes.parent_process_path Processes.process_guid Processes.parent_process_id + Processes.dest Processes.user Processes.process_path | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_with_namedpipe_commandline_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/windows_query_registry_browser_list_application.yml b/detections/endpoint/windows_query_registry_browser_list_application.yml index efe1db1c2d..3f5f4af6bd 100644 --- a/detections/endpoint/windows_query_registry_browser_list_application.yml +++ b/detections/endpoint/windows_query_registry_browser_list_application.yml @@ -16,8 +16,8 @@ description: The following analytic detects a suspicious process accessing the r confirmed malicious, this behavior could enable attackers to exfiltrate sensitive information and compromise user accounts. search: '`wineventlog_security` EventCode=4663 object_file_path IN ("*\\SOFTWARE\\Clients\\StartMenuInternet\\*", - "*\\SOFTWARE\\Clients\\StartMenuInternet\\*") AND NOT (process_path IN ("*:\\Windows\\System32\\*", - "*:\\Windows\\SysWow64\\*", "*:\\Program Files*", "*:\\Windows\\*")) | stats count + "*\\SOFTWARE\\Clients\\StartMenuInternet\\*") AND NOT process_path IN ("*:\\Windows\\System32\\*", + "*:\\Windows\\SysWow64\\*", *:\\Windows\\WinSxS\\*, "*:\\Program Files\\*", "*:\\Program Files (x86)\\*") | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path process_id EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_query_registry_browser_list_application_filter`' diff --git a/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml b/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml index 65a41a6789..c1f8e63216 100644 --- a/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml +++ b/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml @@ -1,27 +1,20 @@ name: Windows User Execution Malicious URL Shortcut File id: 5c7ee6ad-baf4-44fb-b2f0-0cfeddf82dbc version: 6 -date: '2025-02-10' -author: Teoderick Contreras, Splunk +date: '2025-03-03' +author: Teoderick Contreras, Nasreddine Bencherchali, Splunk status: production -type: TTP -description: The following analytic detects the creation of suspicious URL shortcut - link files, often used by malware like CHAOS ransomware. It leverages the Endpoint.Filesystem - datamodel to identify .url files created outside standard directories, such as Program - Files. This activity is significant as it may indicate an attempt to execute malicious - code upon system reboot. If confirmed malicious, this could allow an attacker to - achieve persistence and execute harmful payloads, potentially leading to further - system compromise and data loss. +type: Anomaly +description: The following analytic detects the creation URL shortcut files, often used by malware like CHAOS ransomware. + It leverages the Endpoint.Filesystem datamodel to identify ".url" files created outside common directories, such as "Program Files". + This activity can be significant as ".URL" files can be used as mean to trick the user into visiting certain websites unknowingly, or when placed in certain locations such as "\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", it may allow the execution of malicious code upon system reboot. If confirmed malicious, this could allow an attacker to achieve persistence and execute harmful payloads, potentially leading to further system compromise and data loss. data_source: - Sysmon EventID 11 search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Filesystem where NOT(Filesystem.file_path IN - ("*\\Program Files*")) Filesystem.file_name = *.url by Filesystem.action Filesystem.dest - Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time - Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size - Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product - | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_user_execution_malicious_url_shortcut_file_filter`' + as lastTime from datamodel=Endpoint.Filesystem where NOT Filesystem.file_path IN + ("*:\\Program Files\\*", "*:\\Program Files (x86)\\*", "*\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*", "*:\\Windows\\WinSxS\\*") Filesystem.file_name=*.url by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user Filesystem.file_path + Filesystem.process_guid Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_user_execution_malicious_url_shortcut_file_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. @@ -45,14 +38,14 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: a process created URL shortcut file in $file_path$ of $dest$ + message: A process created a .URL shortcut file in $file_path$ of $dest$ risk_objects: - field: user type: user - score: 64 + score: 50 - field: dest type: system - score: 64 + score: 50 threat_objects: [] tags: analytic_story: diff --git a/detections/network/protocols_passing_authentication_in_cleartext.yml b/detections/network/protocols_passing_authentication_in_cleartext.yml index ba3d3d5577..33cf2063ad 100644 --- a/detections/network/protocols_passing_authentication_in_cleartext.yml +++ b/detections/network/protocols_passing_authentication_in_cleartext.yml @@ -1,10 +1,10 @@ name: Protocols passing authentication in cleartext id: 6923cd64-17a0-453c-b945-81ac2d8c6db9 -version: 6 -date: '2024-11-15' +version: 7 +date: '2025-03-03' author: Rico Valdez, Splunk status: experimental -type: TTP +type: Anomaly description: The following analytic identifies the use of cleartext protocols that risk leaking sensitive information. It detects network traffic on legacy protocols such as Telnet (port 23), POP3 (port 110), IMAP (port 143), and non-anonymous FTP @@ -25,8 +25,7 @@ how_to_implement: This search requires you to be ingesting your network traffic, populating the Network_Traffic data model. For more accurate result it's better to limit destination to organization private and public IP range, like All_Traffic.dest IN(192.168.0.0/16,172.16.0.0/12,10.0.0.0/8, x.x.x.x/22) -known_false_positives: Some networks may use kerberized FTP or telnet servers, however, - this is rare. +known_false_positives: Some networks may use kerberos, FTP or telnet servers, however, this is rare. references: - https://www.rackaid.com/blog/secure-your-email-and-file-transfers/ - https://www.infosecmatter.com/capture-passwords-using-wireshark/ From 4aa6e92c3b3e76817eb14ed4e369473cbdf6a597 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 3 Mar 2025 20:15:54 +0100 Subject: [PATCH 02/20] Update check_elevated_cmd_using_whoami.yml --- detections/endpoint/check_elevated_cmd_using_whoami.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/check_elevated_cmd_using_whoami.yml b/detections/endpoint/check_elevated_cmd_using_whoami.yml index 0ac703695c..8270863d7e 100644 --- a/detections/endpoint/check_elevated_cmd_using_whoami.yml +++ b/detections/endpoint/check_elevated_cmd_using_whoami.yml @@ -1,7 +1,7 @@ name: Check Elevated CMD using whoami id: a9079b18-1633-11ec-859c-acde48001122 version: 6 -date: '2024-11-13' +date: '2025-03-03' author: Teoderick Contreras, Splunk status: production type: TTP From 629bc01aaed79944d349ec639c76c501964d6517 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Thu, 24 Apr 2025 18:23:55 +0200 Subject: [PATCH 03/20] update output and nirsoft tools --- .../endpoint/chcp_command_execution.yml | 13 ++- .../detection_of_tools_built_by_nirsoft.yml | 8 +- ...rocesses_run_from_unexpected_locations.yml | 18 ++-- .../windows_file_download_via_certutil.yml | 12 ++- ...ows_process_with_namedpipe_commandline.yml | 14 +-- ..._execution_malicious_url_shortcut_file.yml | 16 +++- lookups/is_nirsoft_software.csv | 95 ++++++++++++++++++- lookups/is_nirsoft_software.yml | 4 +- 8 files changed, 150 insertions(+), 30 deletions(-) diff --git a/detections/endpoint/chcp_command_execution.yml b/detections/endpoint/chcp_command_execution.yml index dd4ccea74b..1532d3e1fd 100644 --- a/detections/endpoint/chcp_command_execution.yml +++ b/detections/endpoint/chcp_command_execution.yml @@ -1,7 +1,7 @@ name: CHCP Command Execution id: 21d236ec-eec1-11eb-b23e-acde48001122 -version: 6 -date: '2025-02-28' +version: 7 +date: '2025-04-24' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -17,9 +17,12 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=chcp.com - by Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process - Processes.process_id Processes.parent_process_id Processes.dest Processes.user | - `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `chcp_command_execution_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related diff --git a/detections/endpoint/detection_of_tools_built_by_nirsoft.yml b/detections/endpoint/detection_of_tools_built_by_nirsoft.yml index 945bb2a461..ea14e18c85 100644 --- a/detections/endpoint/detection_of_tools_built_by_nirsoft.yml +++ b/detections/endpoint/detection_of_tools_built_by_nirsoft.yml @@ -1,10 +1,10 @@ name: Detection of tools built by NirSoft id: 3d8d201c-aa03-422d-b0ee-2e5ecf9718c0 version: 7 -date: '2024-11-13' +date: '2025-02-20' author: Bhavin Patel, Splunk status: experimental -type: TTP +type: Anomaly description: The following analytic identifies the execution of tools built by NirSoft by detecting specific command-line arguments such as "/stext" and "/scomma". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process @@ -37,10 +37,10 @@ how_to_implement: The detection is based on data that originates from Endpoint D data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: While legitimate, these NirSoft tools are prone to abuse. You - should verfiy that the tool was used for a legitimate purpose. + should verify that the tool was used for a legitimate purpose. references: [] rba: - message: NirSoft tools detected on $dest$ + message: NirSoft tool detected on $dest$ risk_objects: - field: user type: user diff --git a/detections/endpoint/system_processes_run_from_unexpected_locations.yml b/detections/endpoint/system_processes_run_from_unexpected_locations.yml index 847a6a5e8c..6b5ceb288a 100644 --- a/detections/endpoint/system_processes_run_from_unexpected_locations.yml +++ b/detections/endpoint/system_processes_run_from_unexpected_locations.yml @@ -1,7 +1,7 @@ name: System Processes Run From Unexpected Locations id: a34aae96-ccf8-4aef-952c-3ea21444444d -version: 11 -date: '2025-03-03' +version: 12 +date: '2025-04-24' author: David Dorsey, Michael Haag, Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -17,10 +17,16 @@ data_source: - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Processes where NOT Processes.process_path IN ("C:\\$WINDOWS.~BT\\*", "C:\\$WinREAgent\\*", "C:\\Windows\\SoftwareDistribution\\*", "C:\\Windows\\System32\\*", "C:\\Windows\\SystemTemp\\*", "C:\\Windows\\SysWOW64\\*", "C:\\Windows\\uus\\*", "C:\\Windows\\WinSxS\\*") by Processes.dest Processes.user - Processes.parent_process Processes.process_path Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id Processes.process_hash | `drop_dm_object_name("Processes")` - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `is_windows_system_file_macro` + as lastTime FROM datamodel=Endpoint.Processes where NOT Processes.process_path IN ("C:\\$WINDOWS.~BT\\*", "C:\\$WinREAgent\\*", "C:\\Windows\\SoftwareDistribution\\*", "C:\\Windows\\System32\\*", "C:\\Windows\\SystemTemp\\*", "C:\\Windows\\SysWOW64\\*", "C:\\Windows\\uus\\*", "C:\\Windows\\WinSxS\\*") by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `is_windows_system_file_macro` | `system_processes_run_from_unexpected_locations_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related diff --git a/detections/endpoint/windows_file_download_via_certutil.yml b/detections/endpoint/windows_file_download_via_certutil.yml index 90640fc8f2..3bb8b31ab1 100644 --- a/detections/endpoint/windows_file_download_via_certutil.yml +++ b/detections/endpoint/windows_file_download_via_certutil.yml @@ -11,7 +11,17 @@ data_source: - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_certutil` AND ((Processes.process IN ("*-URL *", "*/URL *")) OR (Processes.process IN ("*urlcache*", "*verifyctl*") AND Processes.process IN ("*/f *", "*-f *"))) by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_file_download_via_certutil_filter`' + as lastTime from datamodel=Endpoint.Processes where `process_certutil` AND ((Processes.process IN ("*-URL *", "*/URL *")) OR (Processes.process IN ("*urlcache*", "*verifyctl*") AND Processes.process IN ("*/f *", "*-f *"))) + by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_file_download_via_certutil_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/windows_process_with_namedpipe_commandline.yml b/detections/endpoint/windows_process_with_namedpipe_commandline.yml index 9999d9c1d6..4f2630f753 100644 --- a/detections/endpoint/windows_process_with_namedpipe_commandline.yml +++ b/detections/endpoint/windows_process_with_namedpipe_commandline.yml @@ -1,7 +1,7 @@ name: Windows Process With NamedPipe CommandLine id: e64399d4-94a8-11ec-a9da-acde48001122 -version: 5 -date: '2025-03-03' +version: 6 +date: '2025-04-24' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -19,10 +19,12 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*\\\\.\\pipe\\*" - NOT Processes.process_path IN ("C:\\Program Files\\*", "C:\\Program Files (x86)\\*") by Processes.parent_process_name - Processes.parent_process Processes.process_name Processes.process Processes.original_file_name - Processes.process_id Processes.parent_process_path Processes.process_guid Processes.parent_process_id - Processes.dest Processes.user Processes.process_path | `drop_dm_object_name(Processes)` + NOT Processes.process_path IN ("C:\\Program Files\\*", "C:\\Program Files (x86)\\*") by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_with_namedpipe_commandline_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related diff --git a/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml b/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml index c1f8e63216..d4ebca8efb 100644 --- a/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml +++ b/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml @@ -1,7 +1,7 @@ name: Windows User Execution Malicious URL Shortcut File id: 5c7ee6ad-baf4-44fb-b2f0-0cfeddf82dbc -version: 6 -date: '2025-03-03' +version: 7 +date: '2025-04-24' author: Teoderick Contreras, Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -12,9 +12,15 @@ data_source: - Sysmon EventID 11 search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where NOT Filesystem.file_path IN - ("*:\\Program Files\\*", "*:\\Program Files (x86)\\*", "*\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*", "*:\\Windows\\WinSxS\\*") Filesystem.file_name=*.url by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user Filesystem.file_path - Filesystem.process_guid Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_user_execution_malicious_url_shortcut_file_filter`' + ("*:\\Program Files\\*", "*:\\Program Files (x86)\\*", "*\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*", "*:\\Windows\\WinSxS\\*") Filesystem.file_name=*.url + by Filesystem.action Filesystem.dest + Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size + Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_user_execution_malicious_url_shortcut_file_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. diff --git a/lookups/is_nirsoft_software.csv b/lookups/is_nirsoft_software.csv index 8e2ad32430..c1bbedf957 100644 --- a/lookups/is_nirsoft_software.csv +++ b/lookups/is_nirsoft_software.csv @@ -1,15 +1,108 @@ filename,nirsoftFile AdvancedRun.exe,True +awatch.exe,True +BrowsingHistoryView.exe,True +BulletsPassView.exe,True +ChromeCacheView.exe,True +ChromeHistoryView.exe,True ChromePass.exe,True +cports.exe,True +CredentialsFileView.exe,True CredHistView.exe,True +DataProtectionDecryptor.exe,True +DeviceIOView.exe,True Dialupass.exe,True +dllexp.exe,True +DNSDataView.exe,True +DNSQuerySniffer.exe,True +DotNetResourcesExtract.exe,True +DownTester.exe,True +DriverView.exe,True +EncryptedRegView.exe,True +ESEDatabaseView.exe,True +EventLogChannelsView.exe,True +FastResolver.exe,True +faview.exe,True +FBCacheView.exe,True +FileTypesMan.exe,True +FirefoxDownloadsView.exe,True +FlashCookiesView.exe,True +FolderChangesView.exe,True +FolderTimeUpdate.exe,True +FullEventLogView.exe,True +gacview.exe,True +GDIView.exe,True +HeapMemView.exe,True +HTTPNetworkSniffer.exe,True +IECacheView.exe,True +iecv.exe,True +iehv.exe,True iepv.exe,True +ImageCacheViewer.exe,True +InstalledPackagesView.exe,True +IPNetInfo.exe,True +LastActivityView.exe,True LostMyPassword.exe,True mailpv.exe,True +MozillaCacheView.exe,True +MozillaHistoryView.exe,True mspass.exe,True +MyLastSearch.exe,True +mzcv.exe,True +NetBScanner.exe,True +NetConnectChoose.exe,True netpass.exe,True +NetResView.exe,True +NetRouteView.exe,True +NetworkLatencyView.exe,True +NetworkTrafficView.exe,True +OpenedFilesView.exe,True +OperaCacheView.exe,True PasswordFox.exe,True PasswordHashesView.exe,True +PingInfoView.exe,True +ProcessActivityView.exe,True +ProcessThreadsView.exe,True +ProduKey.exe,True PstPassword.exe,True +QuickSetDNS.exe,True +RegDllView.exe,True +RegFromApp.exe,True RegHiveBackup.exe,True -WebBrowserPassView.exe,True \ No newline at end of file +RegScanner.exe,True +ResourcesExtract.exe,True +RouterPassView.exe,True +RunAsDate.exe,True +SafariCacheView.exe,True +SafariHistoryView.exe,True +SearchMyFiles.exe,True +shexview.exe,True +shmnview.exe,True +SimpleProgramDebugger.exe,True +SiteShoter.exe,True +smsniff.exe,True +SniffPass.exe,True +SocketSniff.exe,True +SpecialFoldersView.exe,True +sysexp.exe,True +TaskSchedulerView.exe,True +TcpLogView.exe,True +TurnedOnTimesView.exe,True +UninstallView.exe,True +URLProtocolView.exe,True +USBDeview.exe,True +VaultPasswordView.exe,True +volumouse.exe,True +WebBrowserPassView.exe,True +WebCacheImageInfo.exe,True +WebCookiesSniffer.exe,True +WebSiteSniffer.exe,True +WhatIsHang.exe,True +WhoisTD.exe,True +WifiChannelMonitor.exe,True +WifiInfoView.exe,True +WinCrashReport.exe,True +WinLogOnView.exe,True +WirelessKeyView.exe,True +WirelessNetView.exe,True +WNetWatcher.exe,True \ No newline at end of file diff --git a/lookups/is_nirsoft_software.yml b/lookups/is_nirsoft_software.yml index 12337fbbca..8adb625a12 100644 --- a/lookups/is_nirsoft_software.yml +++ b/lookups/is_nirsoft_software.yml @@ -1,6 +1,6 @@ name: is_nirsoft_software -date: 2024-12-23 -version: 2 +date: 2025-04-24 +version: 3 id: 28966a08-55e4-4ccb-a20d-dc4cc154b09c author: Splunk Threat Research Team lookup_type: csv From 5676c6691c5595f07b70fa05b8d19b1473d8c1d9 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Thu, 24 Apr 2025 18:36:06 +0200 Subject: [PATCH 04/20] Update deprecation_mapping.YML --- removed/deprecation_mapping.YML | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/removed/deprecation_mapping.YML b/removed/deprecation_mapping.YML index 99e8eb5874..58fe777c18 100644 --- a/removed/deprecation_mapping.YML +++ b/removed/deprecation_mapping.YML @@ -1030,4 +1030,13 @@ stories: - Suspicious Cloud Instance Activities - content: Web Fraud Detection removed_in_version: 5.2.0 - reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity \ No newline at end of file + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + - content: CertUtil Download With URLCache and Split Arguments + removed_in_version: 5.4.0 + reason: Detection deprecated in favor of "Windows CertUtil Download", in order to provide a better experience of the alert + - content: Windows CertUtil Download With URL Argument + removed_in_version: 5.4.0 + reason: Detection deprecated in favor of "Windows CertUtil Download", in order to provide a better experience of the alert + - content: CertUtil Download With VerifyCtl and Split Arguments + removed_in_version: 5.4.0 + reason: Detection deprecated in favor of "Windows CertUtil Download", in order to provide a better experience of the alert From 194d99c6558fec17b0f9e02137d743bed705b897 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Thu, 24 Apr 2025 18:55:29 +0200 Subject: [PATCH 05/20] Update deprecation_mapping.YML --- removed/deprecation_mapping.YML | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/removed/deprecation_mapping.YML b/removed/deprecation_mapping.YML index 58fe777c18..4f83ba2393 100644 --- a/removed/deprecation_mapping.YML +++ b/removed/deprecation_mapping.YML @@ -759,6 +759,16 @@ detections: - content: Excel Spawning Windows Script Host removed_in_version: 5.2.0 reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: CertUtil Download With URLCache and Split Arguments + removed_in_version: 5.4.0 + reason: Detection deprecated in favor of "Windows CertUtil Download", in order to provide a better experience of the alert + - content: Windows CertUtil Download With URL Argument + removed_in_version: 5.4.0 + reason: Detection deprecated in favor of "Windows CertUtil Download", in order to provide a better experience of the alert + - content: CertUtil Download With VerifyCtl and Split Arguments + removed_in_version: 5.4.0 + reason: Detection deprecated in favor of "Windows CertUtil Download", in order to provide a better experience of the alert + baselines: - content: Previously Seen AWS Cross Account Activity removed_in_version: 5.4.0 @@ -1031,12 +1041,3 @@ stories: - content: Web Fraud Detection removed_in_version: 5.2.0 reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity - - content: CertUtil Download With URLCache and Split Arguments - removed_in_version: 5.4.0 - reason: Detection deprecated in favor of "Windows CertUtil Download", in order to provide a better experience of the alert - - content: Windows CertUtil Download With URL Argument - removed_in_version: 5.4.0 - reason: Detection deprecated in favor of "Windows CertUtil Download", in order to provide a better experience of the alert - - content: CertUtil Download With VerifyCtl and Split Arguments - removed_in_version: 5.4.0 - reason: Detection deprecated in favor of "Windows CertUtil Download", in order to provide a better experience of the alert From 75cb7af28dc7c8e64af3f5e4554041885241ab76 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Thu, 24 Apr 2025 19:14:31 +0200 Subject: [PATCH 06/20] Update deprecation_mapping.YML --- removed/deprecation_mapping.YML | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/removed/deprecation_mapping.YML b/removed/deprecation_mapping.YML index 4f83ba2393..4d44357540 100644 --- a/removed/deprecation_mapping.YML +++ b/removed/deprecation_mapping.YML @@ -762,12 +762,18 @@ detections: - content: CertUtil Download With URLCache and Split Arguments removed_in_version: 5.4.0 reason: Detection deprecated in favor of "Windows CertUtil Download", in order to provide a better experience of the alert + replacement_content: + - Windows CertUtil Download - content: Windows CertUtil Download With URL Argument removed_in_version: 5.4.0 reason: Detection deprecated in favor of "Windows CertUtil Download", in order to provide a better experience of the alert + replacement_content: + - Windows CertUtil Download - content: CertUtil Download With VerifyCtl and Split Arguments removed_in_version: 5.4.0 reason: Detection deprecated in favor of "Windows CertUtil Download", in order to provide a better experience of the alert + replacement_content: + - Windows CertUtil Download baselines: - content: Previously Seen AWS Cross Account Activity From ce07cb9ded8438b7ff54750174084707d6951abb Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Thu, 24 Apr 2025 19:40:31 +0200 Subject: [PATCH 07/20] Update deprecation_mapping.YML --- removed/deprecation_mapping.YML | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/removed/deprecation_mapping.YML b/removed/deprecation_mapping.YML index 4d44357540..b53518fedf 100644 --- a/removed/deprecation_mapping.YML +++ b/removed/deprecation_mapping.YML @@ -760,21 +760,20 @@ detections: removed_in_version: 5.2.0 reason: Detection deprecated as it no longer effectively identifies the intended malicious activity - content: CertUtil Download With URLCache and Split Arguments - removed_in_version: 5.4.0 + removed_in_version: 5.6.0 reason: Detection deprecated in favor of "Windows CertUtil Download", in order to provide a better experience of the alert replacement_content: - Windows CertUtil Download - content: Windows CertUtil Download With URL Argument - removed_in_version: 5.4.0 + removed_in_version: 5.6.0 reason: Detection deprecated in favor of "Windows CertUtil Download", in order to provide a better experience of the alert replacement_content: - Windows CertUtil Download - content: CertUtil Download With VerifyCtl and Split Arguments - removed_in_version: 5.4.0 + removed_in_version: 5.6.0 reason: Detection deprecated in favor of "Windows CertUtil Download", in order to provide a better experience of the alert replacement_content: - Windows CertUtil Download - baselines: - content: Previously Seen AWS Cross Account Activity removed_in_version: 5.4.0 From 44b110d9e68c5b9bfc4807089002fd955b484938 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Thu, 24 Apr 2025 19:43:37 +0200 Subject: [PATCH 08/20] update date and deprecation replacement --- .../windows_file_download_via_certutil.yml | 2 +- removed/deprecation_mapping.YML | 14 +++++++------- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/windows_file_download_via_certutil.yml b/detections/endpoint/windows_file_download_via_certutil.yml index 3bb8b31ab1..bf5000df1e 100644 --- a/detections/endpoint/windows_file_download_via_certutil.yml +++ b/detections/endpoint/windows_file_download_via_certutil.yml @@ -1,7 +1,7 @@ name: Windows File Download Via CertUtil id: 7fac8d40-e370-45ea-a4a3-031bbcc18b02 version: 1 -date: '2025-03-03' +date: '2025-04-24' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production type: TTP diff --git a/removed/deprecation_mapping.YML b/removed/deprecation_mapping.YML index b53518fedf..fbad64ef86 100644 --- a/removed/deprecation_mapping.YML +++ b/removed/deprecation_mapping.YML @@ -761,19 +761,19 @@ detections: reason: Detection deprecated as it no longer effectively identifies the intended malicious activity - content: CertUtil Download With URLCache and Split Arguments removed_in_version: 5.6.0 - reason: Detection deprecated in favor of "Windows CertUtil Download", in order to provide a better experience of the alert + reason: Detection deprecated in favor of "Windows File Download Via CertUtil", in order to provide a better experience of the alert replacement_content: - - Windows CertUtil Download - - content: Windows CertUtil Download With URL Argument + - Windows File Download Via CertUtil + - content: Windows File Download Via CertUtil With URL Argument removed_in_version: 5.6.0 - reason: Detection deprecated in favor of "Windows CertUtil Download", in order to provide a better experience of the alert + reason: Detection deprecated in favor of "Windows File Download Via CertUtil", in order to provide a better experience of the alert replacement_content: - - Windows CertUtil Download + - Windows File Download Via CertUtil - content: CertUtil Download With VerifyCtl and Split Arguments removed_in_version: 5.6.0 - reason: Detection deprecated in favor of "Windows CertUtil Download", in order to provide a better experience of the alert + reason: Detection deprecated in favor of "Windows File Download Via CertUtil", in order to provide a better experience of the alert replacement_content: - - Windows CertUtil Download + - Windows File Download Via CertUtil baselines: - content: Previously Seen AWS Cross Account Activity removed_in_version: 5.4.0 From eb99c36454f1c7c7245214b406ace9c315f95d02 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Thu, 24 Apr 2025 19:48:12 +0200 Subject: [PATCH 09/20] Update deprecation_mapping.YML --- removed/deprecation_mapping.YML | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/removed/deprecation_mapping.YML b/removed/deprecation_mapping.YML index fbad64ef86..dac753de15 100644 --- a/removed/deprecation_mapping.YML +++ b/removed/deprecation_mapping.YML @@ -764,7 +764,7 @@ detections: reason: Detection deprecated in favor of "Windows File Download Via CertUtil", in order to provide a better experience of the alert replacement_content: - Windows File Download Via CertUtil - - content: Windows File Download Via CertUtil With URL Argument + - content: Windows CertUtil Download With URL Argument removed_in_version: 5.6.0 reason: Detection deprecated in favor of "Windows File Download Via CertUtil", in order to provide a better experience of the alert replacement_content: From 1dc4f1c45a0752d61786572ec2ad9aa9dbfb7d2c Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Thu, 24 Apr 2025 19:53:19 +0200 Subject: [PATCH 10/20] bump versions --- .../certutil_download_with_urlcache_and_split_arguments.yml | 4 ++-- .../certutil_download_with_verifyctl_and_split_arguments.yml | 4 ++-- .../windows_certutil_download_with_url_argument.yml | 4 ++-- detections/endpoint/check_elevated_cmd_using_whoami.yml | 4 ++-- detections/endpoint/detection_of_tools_built_by_nirsoft.yml | 4 ++-- .../windows_query_registry_browser_list_application.yml | 4 ++-- 6 files changed, 12 insertions(+), 12 deletions(-) diff --git a/detections/deprecated/certutil_download_with_urlcache_and_split_arguments.yml b/detections/deprecated/certutil_download_with_urlcache_and_split_arguments.yml index 7c2519c3b0..5faea2cb93 100644 --- a/detections/deprecated/certutil_download_with_urlcache_and_split_arguments.yml +++ b/detections/deprecated/certutil_download_with_urlcache_and_split_arguments.yml @@ -1,7 +1,7 @@ name: CertUtil Download With URLCache and Split Arguments id: 415b4306-8bfb-11eb-85c4-acde48001122 -version: 12 -date: '2025-04-16' +version: 13 +date: '2025-04-24' author: Michael Haag, Splunk status: deprecated type: TTP diff --git a/detections/deprecated/certutil_download_with_verifyctl_and_split_arguments.yml b/detections/deprecated/certutil_download_with_verifyctl_and_split_arguments.yml index d93f16be39..aae4d4ca8b 100644 --- a/detections/deprecated/certutil_download_with_verifyctl_and_split_arguments.yml +++ b/detections/deprecated/certutil_download_with_verifyctl_and_split_arguments.yml @@ -1,7 +1,7 @@ name: CertUtil Download With VerifyCtl and Split Arguments id: 801ad9e4-8bfb-11eb-8b31-acde48001122 -version: 12 -date: '2025-04-16' +version: 13 +date: '2025-04-24' author: Michael Haag, Splunk status: deprecated type: TTP diff --git a/detections/deprecated/windows_certutil_download_with_url_argument.yml b/detections/deprecated/windows_certutil_download_with_url_argument.yml index d0b2b97673..73b11d501f 100644 --- a/detections/deprecated/windows_certutil_download_with_url_argument.yml +++ b/detections/deprecated/windows_certutil_download_with_url_argument.yml @@ -1,7 +1,7 @@ name: Windows CertUtil Download With URL Argument id: 4fc5ca00-4c7c-46b3-8772-c98a4b8bd944 -version: 5 -date: '2025-04-16' +version: 6 +date: '2025-04-24' author: Nasreddine Bencherchali, Splunk status: deprecated type: TTP diff --git a/detections/endpoint/check_elevated_cmd_using_whoami.yml b/detections/endpoint/check_elevated_cmd_using_whoami.yml index 8270863d7e..692218967c 100644 --- a/detections/endpoint/check_elevated_cmd_using_whoami.yml +++ b/detections/endpoint/check_elevated_cmd_using_whoami.yml @@ -1,7 +1,7 @@ name: Check Elevated CMD using whoami id: a9079b18-1633-11ec-859c-acde48001122 -version: 6 -date: '2025-03-03' +version: 7 +date: '2025-04-24' author: Teoderick Contreras, Splunk status: production type: TTP diff --git a/detections/endpoint/detection_of_tools_built_by_nirsoft.yml b/detections/endpoint/detection_of_tools_built_by_nirsoft.yml index ea14e18c85..2a0e7986d7 100644 --- a/detections/endpoint/detection_of_tools_built_by_nirsoft.yml +++ b/detections/endpoint/detection_of_tools_built_by_nirsoft.yml @@ -1,7 +1,7 @@ name: Detection of tools built by NirSoft id: 3d8d201c-aa03-422d-b0ee-2e5ecf9718c0 -version: 7 -date: '2025-02-20' +version: 8 +date: '2025-04-24' author: Bhavin Patel, Splunk status: experimental type: Anomaly diff --git a/detections/endpoint/windows_query_registry_browser_list_application.yml b/detections/endpoint/windows_query_registry_browser_list_application.yml index 3f5f4af6bd..77d905faa0 100644 --- a/detections/endpoint/windows_query_registry_browser_list_application.yml +++ b/detections/endpoint/windows_query_registry_browser_list_application.yml @@ -1,7 +1,7 @@ name: Windows Query Registry Browser List Application id: 45ebd21c-f4bf-4ced-bd49-d25b6526cebb -version: '6' -date: '2025-03-19' +version: 7 +date: '2025-04-24' author: Teoderick Contreras, Splunk status: production type: Anomaly From 31e2c03b8df76ba5f9c3225ee3fa975bfcab7eca Mon Sep 17 00:00:00 2001 From: ljstella Date: Fri, 25 Apr 2025 08:44:50 -0500 Subject: [PATCH 11/20] Add where clause back --- ...excessive_number_of_taskhost_processes.yml | 79 ++++++++++--------- 1 file changed, 43 insertions(+), 36 deletions(-) diff --git a/detections/endpoint/excessive_number_of_taskhost_processes.yml b/detections/endpoint/excessive_number_of_taskhost_processes.yml index 848b988bf1..475c7d71e8 100644 --- a/detections/endpoint/excessive_number_of_taskhost_processes.yml +++ b/detections/endpoint/excessive_number_of_taskhost_processes.yml @@ -5,7 +5,8 @@ date: '2024-11-13' author: Michael Hart status: production type: Anomaly -description: The following analytic identifies an excessive number of taskhost.exe +description: + The following analytic identifies an excessive number of taskhost.exe and taskhostex.exe processes running within a short time frame. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and their counts. This behavior is significant as it is commonly associated with post-exploitation @@ -14,10 +15,11 @@ description: The following analytic identifies an excessive number of taskhost.e activity could indicate an ongoing attack, allowing attackers to execute code, escalate privileges, or move laterally within the network. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.action) as action + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` values(Processes.action) as action values(Processes.original_file_name) as original_file_name values(Processes.parent_process) as parent_process values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_id) as parent_process_id @@ -41,9 +43,11 @@ search: '| tstats `security_content_summariesonly` values(Processes.action) as a values(process_hash) as process_hash values(process_id) as process_id values(process_integrity_level) as process_integrity_level values(user) as user values(process_path) as process_path values(user_id) as user_id values(vendor_product) as vendor_product values(process_name) - as process_name by _time, dest, firstTime, lastTime | `security_content_ctime(firstTime)` + as process_name by _time, dest, firstTime, lastTime | where taskhost_count > + 10 or taskhostex_count > 10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_number_of_taskhost_processes_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -52,46 +56,49 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Administrators, administrative actions or certain applications +known_false_positives: + Administrators, administrative actions or certain applications may run many instances of taskhost and taskhostex concurrently. Filter as needed. references: -- https://attack.mitre.org/software/S0250/ + - https://attack.mitre.org/software/S0250/ drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: An excessive amount of taskhost.exe and taskhostex.exe was executed on + message: + An excessive amount of taskhost.exe and taskhostex.exe was executed on $dest$ indicative of suspicious behavior. risk_objects: - - field: dest - type: system - score: 56 + - field: dest + type: system + score: 56 threat_objects: [] tags: analytic_story: - - Meterpreter + - Meterpreter asset_type: Endpoint mitre_attack_id: - - T1059 + - T1059 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/excessive_distinct_processes_from_windows_temp/windows-xml.log - source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/excessive_distinct_processes_from_windows_temp/windows-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog From 511221ba1e0663f0002e22a41659ca26a731d5ff Mon Sep 17 00:00:00 2001 From: ljstella Date: Fri, 25 Apr 2025 08:58:58 -0500 Subject: [PATCH 12/20] version bump --- .../endpoint/excessive_number_of_taskhost_processes.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/excessive_number_of_taskhost_processes.yml b/detections/endpoint/excessive_number_of_taskhost_processes.yml index 475c7d71e8..afd814f56a 100644 --- a/detections/endpoint/excessive_number_of_taskhost_processes.yml +++ b/detections/endpoint/excessive_number_of_taskhost_processes.yml @@ -1,7 +1,7 @@ name: Excessive number of taskhost processes id: f443dac2-c7cf-11eb-ab51-acde48001122 -version: 7 -date: '2024-11-13' +version: 8 +date: '2025-04-25' author: Michael Hart status: production type: Anomaly From 074d13f00121bc2d209095de828d2d5554033368 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 28 Apr 2025 10:33:17 -0600 Subject: [PATCH 13/20] BasketNetWeaving with Haag: No Shell Left Behind! --- .../endpoint/java_spawning_command_shells.yml | 69 +++++++++++++++++++ detections/endpoint/java_writing_jsp_file.yml | 1 + .../endpoint/windows_java_spawning_shells.yml | 1 + ...jection_into_commonly_abused_processes.yml | 1 + ...r_visual_composer_exploitation_attempt.yml | 52 ++++++++++++++ stories/sap_netweaver_exploitation.yml | 28 ++++++++ 6 files changed, 152 insertions(+) create mode 100644 detections/endpoint/java_spawning_command_shells.yml create mode 100644 detections/web/sap_netweaver_visual_composer_exploitation_attempt.yml create mode 100644 stories/sap_netweaver_exploitation.yml diff --git a/detections/endpoint/java_spawning_command_shells.yml b/detections/endpoint/java_spawning_command_shells.yml new file mode 100644 index 0000000000..119ec09af5 --- /dev/null +++ b/detections/endpoint/java_spawning_command_shells.yml @@ -0,0 +1,69 @@ +name: Java Spawning Command Shells +id: 425ab753-de8f-4ab3-9671-377c60b9e53c +version: 1 +date: '2025-04-28' +author: Michael Haag, Splunk +status: production +type: Anomaly +description: | + Detects instances where a Java process (such as SAP NetWeaver Java Application Server) spawns command shells or scripting utilities like cmd.exe, powershell.exe, or msbuild.exe. This behavior is highly suspicious in enterprise environments and may indicate post-exploitation activity, such as webshells or malware launched via vulnerabilities like CVE-2025-31324. Attackers exploiting SAP NetWeaver Visual Composer can upload and execute webshells, which often spawn these utilities to gain further access or execute malicious payloads. +data_source: +- Sysmon EventID 1 +search: | + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name="java.exe" OR Processes.parent_process_name="java" OR Processes.parent_process_name="jc*.exe") AND (Processes.process_name="cmd.exe" OR Processes.process_name="powershell.exe" OR Processes.process_name="msbuild.exe") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.parent_process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.parent_process_guid Processes.parent_process_exec Processes.process_exec Processes.process_path Processes.parent_process_path Processes.process_hash Processes.process_integrity_level Processes.original_file_name Processes.user_id Processes.action Processes.vendor_product + | `drop_dm_object_name(Processes)` + | rename process as CommandLine, parent_process as ParentCommandLine + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `java_spawning_command_shells_filter` +how_to_implement: | + This search requires Sysmon EventID 1 (process creation) logs to be collected from endpoints. Deploy Sysmon with a configuration that captures parent and child process relationships. Ensure that logs are ingested into Splunk and mapped to the correct fields (parent_process_name, process_name, CommandLine, etc.). +known_false_positives: | + Some legitimate Java-based applications may occasionally spawn command shells for maintenance or automation tasks, but this is rare in most enterprise environments. Any occurrence should be carefully reviewed, especially on SAP servers. +references: +- https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/ +- https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/ +- https://www.rapid7.com/blog/post/2025/04/28/etr-active-exploitation-of-sap-netweaver-visual-composer-cve-2025-31324/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Java process spawning command shell or scripting utility on $dest$. + risk_objects: + - field: dest + type: system + score: 80 + threat_objects: + - field: parent_process_name + type: parent_process_name +tags: + analytic_story: + - SAP NetWeaver Exploitation + asset_type: Endpoint + mitre_attack_id: + - T1059 + - T1190 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint + cve: + - CVE-2025-31324 +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/java_write_jsp-linux-sysmon.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/java_writing_jsp_file.yml b/detections/endpoint/java_writing_jsp_file.yml index 4476ff86f3..0130073a93 100644 --- a/detections/endpoint/java_writing_jsp_file.yml +++ b/detections/endpoint/java_writing_jsp_file.yml @@ -72,6 +72,7 @@ tags: - Spring4Shell CVE-2022-22965 - Atlassian Confluence Server and Data Center CVE-2022-26134 - SysAid On-Prem Software CVE-2023-47246 Vulnerability + - SAP NetWeaver Exploitation asset_type: Endpoint cve: - CVE-2022-22965 diff --git a/detections/endpoint/windows_java_spawning_shells.yml b/detections/endpoint/windows_java_spawning_shells.yml index d3f259a807..dfd89c6f42 100644 --- a/detections/endpoint/windows_java_spawning_shells.yml +++ b/detections/endpoint/windows_java_spawning_shells.yml @@ -61,6 +61,7 @@ tags: - Log4Shell CVE-2021-44228 - SysAid On-Prem Software CVE-2023-47246 Vulnerability - Cleo File Transfer Software + - SAP NetWeaver Exploitation asset_type: Endpoint cve: - CVE-2021-44228 diff --git a/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml b/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml index 9eff6d1067..d9e4b3cabe 100644 --- a/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml +++ b/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml @@ -70,6 +70,7 @@ tags: analytic_story: - BishopFox Sliver Adversary Emulation Framework - Earth Alux + - SAP NetWeaver Exploitation asset_type: Endpoint mitre_attack_id: - T1055.002 diff --git a/detections/web/sap_netweaver_visual_composer_exploitation_attempt.yml b/detections/web/sap_netweaver_visual_composer_exploitation_attempt.yml new file mode 100644 index 0000000000..4ced874045 --- /dev/null +++ b/detections/web/sap_netweaver_visual_composer_exploitation_attempt.yml @@ -0,0 +1,52 @@ +name: SAP NetWeaver Visual Composer Exploitation Attempt +id: a583b9f1-9c3a-4402-9441-b981654dea6c +version: 1 +date: '2025-04-28' +author: Michael Haag, Splunk +status: production +type: Hunting +description: | + Detects potential exploitation attempts targeting CVE-2025-31324, a critical unauthenticated file upload vulnerability in SAP NetWeaver Visual Composer. This flaw allows remote attackers to send specially crafted POST requests to the /developmentserver/metadatauploader endpoint, enabling arbitrary file uploads—commonly webshells—resulting in full system compromise. The detection looks for HTTP HEAD or POST requests with a 200 OK status to sensitive Visual Composer endpoints, which may indicate reconnaissance or active exploitation. Successful exploitation can lead to attackers gaining privileged access, deploying malware, and impacting business-critical SAP resources. Immediate patching and investigation of suspicious activity are strongly recommended, as this vulnerability is being actively exploited in the wild. +data_source: +- Suricata +search: '| tstats count min(_time) as firstTime max(_time) as lastTime + from datamodel=Web.Web + where (Web.url IN ("/CTCWebService/CTCWebServiceBean", "/VisualComposer/services/DesignTimeService", "/ctc/CTCWebService/CTCWebServiceBean")) + AND Web.http_method IN ("HEAD", "POST") + AND Web.status=200 + by Web.src, Web.dest, Web.http_method, Web.url, Web.http_user_agent, Web.url_length, sourcetype + | `drop_dm_object_name("Web")` + | eval action=case(http_method="HEAD", "Recon/Probe", http_method="POST", "Possible Exploitation") + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | table firstTime, lastTime, src, dest, http_method, action, url, user_agent, url_length, sourcetype + | `sap_netweaver_visual_composer_exploitation_attempt_filter`' +how_to_implement: | + Ensure that the Web data model is accelerated and populated with web server or web proxy logs capturing HTTP request and response data. + This search relies on HTTP method, status code, and URL path fields to identify suspicious access patterns against SAP NetWeaver endpoints. +known_false_positives: | + Some legitimate administrative activity may access SAP NetWeaver services. However, HEAD or POST requests directly resulting in a 200 OK + to Visual Composer endpoints are uncommon and should be investigated carefully. +references: +- https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/ +- https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/ +- https://www.rapid7.com/blog/post/2025/04/28/etr-active-exploitation-of-sap-netweaver-visual-composer-cve-2025-31324/ +tags: + analytic_story: + - SAP NetWeaver Exploitation + asset_type: Web Server + mitre_attack_id: + - T1190 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: network + cve: + - CVE-2025-31324 +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/sap/suricata_sapnetweaver.log + sourcetype: suricata + source: suricata diff --git a/stories/sap_netweaver_exploitation.yml b/stories/sap_netweaver_exploitation.yml new file mode 100644 index 0000000000..881b2a6998 --- /dev/null +++ b/stories/sap_netweaver_exploitation.yml @@ -0,0 +1,28 @@ +name: SAP NetWeaver Exploitation +id: a52f77e2-0632-46a5-b750-6c059bc7bbb4 +version: 1 +status: production +date: '2025-04-28' +author: Michael Haag, Splunk +description: | + This Analytic Story covers the detection of exploitation attempts and reconnaissance activity targeting SAP NetWeaver platforms, with a focus on the critical unauthenticated file upload vulnerability CVE-2025-31324 in Visual Composer. Attackers are actively exploiting this flaw to upload arbitrary files—often webshells—via POST requests to the /developmentserver/metadatauploader endpoint, leading to full system compromise, remote code execution, and persistent access. The story includes detections for both probing (e.g., HEAD requests) and active exploitation, and highlights the significant business risks, such as data theft, operational disruption, and potential regulatory impact. Defenders can use this story to monitor, hunt, and respond to suspicious activity across SAP NetWeaver services, helping to identify both initial access and post-exploitation behaviors. +narrative: | + Attackers are actively targeting SAP NetWeaver environments through newly disclosed vulnerabilities like CVE-2025-31324, affecting the Visual Composer service. + Successful exploitation can lead to remote code execution (RCE) and the deployment of webshells, giving adversaries persistent access to SAP systems. + This story provides detections for reconnaissance patterns (e.g., HEAD requests receiving HTTP 200 responses) and potential exploitation behavior + (e.g., POST requests leading to successful uploads), empowering defenders to quickly identify compromise attempts and mitigate them before escalation. +references: + - https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/ + - https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/ + - https://www.rapid7.com/blog/post/2025/04/28/etr-active-exploitation-of-sap-netweaver-visual-composer-cve-2025-31324/ + - https://www.splunk.com/en_us/blog/security/the-final-shell-introducing-shellsweepx.html +tags: + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection + cve: + - CVE-2025-31324 From 074c90ceb4d1522762c759934558de829d52a834 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 28 Apr 2025 10:37:57 -0600 Subject: [PATCH 14/20] ver and date --- detections/endpoint/java_writing_jsp_file.yml | 4 ++-- detections/endpoint/windows_java_spawning_shells.yml | 4 ++-- ...ndows_process_injection_into_commonly_abused_processes.yml | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/java_writing_jsp_file.yml b/detections/endpoint/java_writing_jsp_file.yml index 0130073a93..c8358070e3 100644 --- a/detections/endpoint/java_writing_jsp_file.yml +++ b/detections/endpoint/java_writing_jsp_file.yml @@ -1,7 +1,7 @@ name: Java Writing JSP File id: eb65619c-4f8d-4383-a975-d352765d344b -version: 8 -date: '2025-04-22' +version: 9 +date: '2025-04-28' author: Michael Haag, Splunk status: production type: TTP diff --git a/detections/endpoint/windows_java_spawning_shells.yml b/detections/endpoint/windows_java_spawning_shells.yml index dfd89c6f42..48c0960c80 100644 --- a/detections/endpoint/windows_java_spawning_shells.yml +++ b/detections/endpoint/windows_java_spawning_shells.yml @@ -1,7 +1,7 @@ name: Windows Java Spawning Shells id: 28c81306-5c47-11ec-bfea-acde48001122 -version: 9 -date: '2024-12-16' +version: 10 +date: '2025-04-28' author: Michael Haag, Splunk status: experimental type: TTP diff --git a/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml b/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml index d9e4b3cabe..018d13e4cb 100644 --- a/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml +++ b/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml @@ -1,7 +1,7 @@ name: Windows Process Injection into Commonly Abused Processes id: 1e1dedc6-f6f3-41a0-9dd7-a1245904fe75 -version: 2 -date: '2025-04-16' +version: 3 +date: '2025-04-28' author: 0xC0FFEEEE, Github Community type: Anomaly status: production From 0c67bd001c2437922b6d6bc5d4976eea7e78d8e2 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 28 Apr 2025 12:01:09 -0600 Subject: [PATCH 15/20] Delete java_spawning_command_shells.yml --- .../endpoint/java_spawning_command_shells.yml | 69 ------------------- 1 file changed, 69 deletions(-) delete mode 100644 detections/endpoint/java_spawning_command_shells.yml diff --git a/detections/endpoint/java_spawning_command_shells.yml b/detections/endpoint/java_spawning_command_shells.yml deleted file mode 100644 index 119ec09af5..0000000000 --- a/detections/endpoint/java_spawning_command_shells.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Java Spawning Command Shells -id: 425ab753-de8f-4ab3-9671-377c60b9e53c -version: 1 -date: '2025-04-28' -author: Michael Haag, Splunk -status: production -type: Anomaly -description: | - Detects instances where a Java process (such as SAP NetWeaver Java Application Server) spawns command shells or scripting utilities like cmd.exe, powershell.exe, or msbuild.exe. This behavior is highly suspicious in enterprise environments and may indicate post-exploitation activity, such as webshells or malware launched via vulnerabilities like CVE-2025-31324. Attackers exploiting SAP NetWeaver Visual Composer can upload and execute webshells, which often spawn these utilities to gain further access or execute malicious payloads. -data_source: -- Sysmon EventID 1 -search: | - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name="java.exe" OR Processes.parent_process_name="java" OR Processes.parent_process_name="jc*.exe") AND (Processes.process_name="cmd.exe" OR Processes.process_name="powershell.exe" OR Processes.process_name="msbuild.exe") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.parent_process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.parent_process_guid Processes.parent_process_exec Processes.process_exec Processes.process_path Processes.parent_process_path Processes.process_hash Processes.process_integrity_level Processes.original_file_name Processes.user_id Processes.action Processes.vendor_product - | `drop_dm_object_name(Processes)` - | rename process as CommandLine, parent_process as ParentCommandLine - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `java_spawning_command_shells_filter` -how_to_implement: | - This search requires Sysmon EventID 1 (process creation) logs to be collected from endpoints. Deploy Sysmon with a configuration that captures parent and child process relationships. Ensure that logs are ingested into Splunk and mapped to the correct fields (parent_process_name, process_name, CommandLine, etc.). -known_false_positives: | - Some legitimate Java-based applications may occasionally spawn command shells for maintenance or automation tasks, but this is rare in most enterprise environments. Any occurrence should be carefully reviewed, especially on SAP servers. -references: -- https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/ -- https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/ -- https://www.rapid7.com/blog/post/2025/04/28/etr-active-exploitation-of-sap-netweaver-visual-composer-cve-2025-31324/ -drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -rba: - message: Java process spawning command shell or scripting utility on $dest$. - risk_objects: - - field: dest - type: system - score: 80 - threat_objects: - - field: parent_process_name - type: parent_process_name -tags: - analytic_story: - - SAP NetWeaver Exploitation - asset_type: Endpoint - mitre_attack_id: - - T1059 - - T1190 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: endpoint - cve: - - CVE-2025-31324 -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/java_write_jsp-linux-sysmon.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux From 884eede4ce697dfd7e19252ec734ab2ce49db1f7 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 30 Apr 2025 12:14:30 -0700 Subject: [PATCH 16/20] updating search --- .../windows_remote_access_software_hunt.yml | 6 ++-- ...t_remote_access_software_usage_process.yml | 36 +++++++++++-------- removed/deprecation_mapping.YML | 5 +++ 3 files changed, 30 insertions(+), 17 deletions(-) rename detections/{endpoint => deprecated}/windows_remote_access_software_hunt.yml (98%) diff --git a/detections/endpoint/windows_remote_access_software_hunt.yml b/detections/deprecated/windows_remote_access_software_hunt.yml similarity index 98% rename from detections/endpoint/windows_remote_access_software_hunt.yml rename to detections/deprecated/windows_remote_access_software_hunt.yml index 67dbe00f02..1f2e1de847 100644 --- a/detections/endpoint/windows_remote_access_software_hunt.yml +++ b/detections/deprecated/windows_remote_access_software_hunt.yml @@ -1,9 +1,9 @@ name: Windows Remote Access Software Hunt id: 8bd22c9f-05a2-4db1-b131-29271f28cb0a -version: 7 -date: '2025-04-18' +version: 8 +date: '2025-04-30' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting description: The following analytic identifies the use of remote access software within the environment. It leverages data from Endpoint Detection and Response (EDR) agents, diff --git a/detections/endpoint/detect_remote_access_software_usage_process.yml b/detections/endpoint/detect_remote_access_software_usage_process.yml index 9d3d572175..5f2a04d5e4 100644 --- a/detections/endpoint/detect_remote_access_software_usage_process.yml +++ b/detections/endpoint/detect_remote_access_software_usage_process.yml @@ -1,7 +1,7 @@ name: Detect Remote Access Software Usage Process id: ffd5e001-2e34-48f4-97a2-26dc4bb08178 -version: 8 -date: '2025-04-18' +version: 9 +date: '2025-04-30' author: Steven Dick status: production type: Anomaly @@ -17,18 +17,23 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime values(Processes.parent_process) as parent_process from datamodel=Endpoint.Processes - where Processes.dest!=unknown Processes.process!=unknown by Processes.action Processes.dest - Processes.original_file_name Processes.parent_process Processes.parent_process_exec - Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name - Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name - Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` - | lookup remote_access_software remote_utility AS process_name OUTPUT isutility, - description as signature, comment_reference as desc, category | search isutility - = True | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_process_filter`' +search: | + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.parent_process) as parent_process + from datamodel=Endpoint.Processes + where + [| inputlookup remote_access_software where isutility=TRUE + | rename remote_utility AS Processes.process_name + | fields Processes.process_name] + AND Processes.dest!="unknown" + AND Processes.user!="unknown" + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `drop_dm_object_name(Processes)` + | lookup remote_access_software remote_utility AS process_name OUTPUT isutility description AS signature comment_reference AS desc category + | search isutility = TRUE + | `remote_access_software_usage_exceptions` + | `detect_remote_access_software_usage_process_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -107,3 +112,6 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/screenconnect/screenconnect_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/removed/deprecation_mapping.YML b/removed/deprecation_mapping.YML index 99e8eb5874..219df33168 100644 --- a/removed/deprecation_mapping.YML +++ b/removed/deprecation_mapping.YML @@ -1,4 +1,9 @@ detections: + - content: Windows Remote Access Software Hunt + removed_in_version: 5.8.0 + reason: Detection has been replaced by a new detection with a more specific name and logic + replacement_content: + - Detect Remote Access Software Usage Process - content: Detect Large Outbound ICMP Packets removed_in_version: 5.6.0 reason: Detection has been replaced by a new detection with a more specific name From 6b2f2e9636daa1288ede8e3e7e3b6bda9e4a43a3 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 30 Apr 2025 12:15:14 -0700 Subject: [PATCH 17/20] remove manual test for a CI run --- .../endpoint/detect_remote_access_software_usage_process.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/detections/endpoint/detect_remote_access_software_usage_process.yml b/detections/endpoint/detect_remote_access_software_usage_process.yml index 5f2a04d5e4..f768ab922a 100644 --- a/detections/endpoint/detect_remote_access_software_usage_process.yml +++ b/detections/endpoint/detect_remote_access_software_usage_process.yml @@ -32,7 +32,6 @@ search: | | `drop_dm_object_name(Processes)` | lookup remote_access_software remote_utility AS process_name OUTPUT isutility description AS signature comment_reference AS desc category | search isutility = TRUE - | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_process_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -105,7 +104,7 @@ tags: - Splunk Enterprise Security - Splunk Cloud security_domain: endpoint - manual_test: This detection uses A&I lookups from Enterprise Security. + # manual_test: This detection uses A&I lookups from Enterprise Security. tests: - name: True Positive Test attack_data: From 26e2f594627919760017d9e9c4c89e5c026fc777 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 30 Apr 2025 12:20:03 -0700 Subject: [PATCH 18/20] add back manual_Test --- .../detect_remote_access_software_usage_process.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/detect_remote_access_software_usage_process.yml b/detections/endpoint/detect_remote_access_software_usage_process.yml index f768ab922a..7074ab0fe1 100644 --- a/detections/endpoint/detect_remote_access_software_usage_process.yml +++ b/detections/endpoint/detect_remote_access_software_usage_process.yml @@ -2,14 +2,13 @@ name: Detect Remote Access Software Usage Process id: ffd5e001-2e34-48f4-97a2-26dc4bb08178 version: 9 date: '2025-04-30' -author: Steven Dick +author: Steven Dick, Sebastian Wurl, Splunk Community status: production type: Anomaly description: The following analytic detects the execution of known remote access software within the environment. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes mapped to the Endpoint data - model. This activity is significant as adversaries often use remote access tools - like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized access. + model. We then compare with with a list of known remote access software shipped as a lookup file - remote_access_software. This activity is significant as adversaries often use remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized access. If confirmed malicious, this could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization's security. @@ -32,6 +31,7 @@ search: | | `drop_dm_object_name(Processes)` | lookup remote_access_software remote_utility AS process_name OUTPUT isutility description AS signature comment_reference AS desc category | search isutility = TRUE + | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_process_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -104,7 +104,7 @@ tags: - Splunk Enterprise Security - Splunk Cloud security_domain: endpoint - # manual_test: This detection uses A&I lookups from Enterprise Security. + manual_test: This detection uses A&I lookups from Enterprise Security. tests: - name: True Positive Test attack_data: From 4d1ff91ee3b95a53070da1219b6c300777972a97 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 30 Apr 2025 12:24:55 -0700 Subject: [PATCH 19/20] updated messaging --- detections/deprecated/windows_remote_access_software_hunt.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/deprecated/windows_remote_access_software_hunt.yml b/detections/deprecated/windows_remote_access_software_hunt.yml index 1f2e1de847..f1ce42bcbd 100644 --- a/detections/deprecated/windows_remote_access_software_hunt.yml +++ b/detections/deprecated/windows_remote_access_software_hunt.yml @@ -5,7 +5,7 @@ date: '2025-04-30' author: Michael Haag, Splunk status: deprecated type: Hunting -description: The following analytic identifies the use of remote access software within +description: This search is deprecated in favor of the new detection - Detect Remote Access Software Usage Process. The following analytic identifies the use of remote access software within the environment. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This detection is significant as unauthorized remote access tools can be used by adversaries to maintain persistent access to From a7f0e38586e9c11282ddf3003a8f4298e272c582 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 1 May 2025 11:33:07 -0700 Subject: [PATCH 20/20] updating removed in version --- removed/deprecation_mapping.YML | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/removed/deprecation_mapping.YML b/removed/deprecation_mapping.YML index dac753de15..4d4d7f77e7 100644 --- a/removed/deprecation_mapping.YML +++ b/removed/deprecation_mapping.YML @@ -1,4 +1,19 @@ detections: + - content: CertUtil Download With URLCache and Split Arguments + removed_in_version: 5.8.0 + reason: Detection deprecated in favor of "Windows File Download Via CertUtil", in order to provide a better experience of the alert + replacement_content: + - Windows File Download Via CertUtil + - content: Windows CertUtil Download With URL Argument + removed_in_version: 5.8.0 + reason: Detection deprecated in favor of "Windows File Download Via CertUtil", in order to provide a better experience of the alert + replacement_content: + - Windows File Download Via CertUtil + - content: CertUtil Download With VerifyCtl and Split Arguments + removed_in_version: 5.8.0 + reason: Detection deprecated in favor of "Windows File Download Via CertUtil", in order to provide a better experience of the alert + replacement_content: + - Windows File Download Via CertUtil - content: Detect Large Outbound ICMP Packets removed_in_version: 5.6.0 reason: Detection has been replaced by a new detection with a more specific name @@ -759,21 +774,6 @@ detections: - content: Excel Spawning Windows Script Host removed_in_version: 5.2.0 reason: Detection deprecated as it no longer effectively identifies the intended malicious activity - - content: CertUtil Download With URLCache and Split Arguments - removed_in_version: 5.6.0 - reason: Detection deprecated in favor of "Windows File Download Via CertUtil", in order to provide a better experience of the alert - replacement_content: - - Windows File Download Via CertUtil - - content: Windows CertUtil Download With URL Argument - removed_in_version: 5.6.0 - reason: Detection deprecated in favor of "Windows File Download Via CertUtil", in order to provide a better experience of the alert - replacement_content: - - Windows File Download Via CertUtil - - content: CertUtil Download With VerifyCtl and Split Arguments - removed_in_version: 5.6.0 - reason: Detection deprecated in favor of "Windows File Download Via CertUtil", in order to provide a better experience of the alert - replacement_content: - - Windows File Download Via CertUtil baselines: - content: Previously Seen AWS Cross Account Activity removed_in_version: 5.4.0