Branch was auto-updated.

detections/endpoint/disabling_defender_services.yml

@@ -37,6 +37,7 @@ tags:
   analytic_story:
   - IcedID
   - Windows Registry Abuse
+  - RedLine Stealer
   asset_type: Endpoint
   confidence: 70
   impact: 70

detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml

@@ -0,0 +1,60 @@
+name: Windows Credentials from Password Stores Chrome Extension Access
+id: 2e65afe0-9a75-4487-bd87-ada9a9f1b9af
+version: 1
+date: '2023-04-26'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+data_source:
+- Security Event ID 4663
+description: The following analytic identifies a non-chrome process accessing Chrome extensions file. 
+  This file stores various settings and information related to the browser's extensions on your computer. Threat actor, adversaries and malware author 
+  also abused this file to attempt to extract sensitive information from the chrome browser of the target host.
+  This anomaly detection can be a good pivot of analysis for suspicious process aside from chrome.exe and explorer.exe executable.
+search: '`wineventlog_security` EventCode=4663 object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\*" 
+  AND NOT (process_path IN ("*:\\Windows\\explorer.exe", "*\\chrome.exe"))       
+  | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path  process_id EventCode dest
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `windows_credentials_from_password_stores_chrome_extension_access_filter`'
+how_to_implement:  To successfully implement this search, you must ingest Windows Security
+  Event logs and track event code 4663. For 4663, enable "Audit Object Access" in
+  Group Policy. Then check the two boxes listed for both "Success" and "Failure."
+known_false_positives: Uninstall chrome browser extension application may access this file and folder path to removed chrome installation in the target host. Filter is needed.
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
+tags:
+  analytic_story:
+  - RedLine Stealer
+  asset_type: Endpoint
+  confidence: 50
+  impact: 50
+  message: A non-chrome process $process_name$ accessing chrome browser extension folder files on $dest$  
+  mitre_attack_id:
+  - T1012
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - object_file_name
+  - object_file_path
+  - process_name
+  - process_path
+  - process_id
+  - EventCode
+  - dest
+  risk_score: 25
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/browser_ext_access/security-ext-raw.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml

@@ -0,0 +1,60 @@
+name: Windows Credentials from Password Stores Chrome LocalState Access
+id: 3b1d09a8-a26f-473e-a510-6c6613573657
+version: 1
+date: '2023-04-26'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+data_source:
+- Security Event ID 4663
+description: The following analytic identifies a non-chrome process accessing Chrome user data "local state" file. 
+  This file stores various settings and information related to the browser's operation on your computer. Threat actor, adversaries and malware author 
+  also abused this file to attempt to extract the encrypted master key to decrypt password saved in chrome browser.
+  This anomaly detection can be a good pivot of analysis for suspicious process aside from chrome.exe and explorer.exe executable.
+search: '`wineventlog_security` EventCode=4663 object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" 
+  NOT (process_name IN ("*\\chrome.exe","*:\\Windows\\explorer.exe"))
+  | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path  process_id EventCode dest
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_credentials_from_password_stores_chrome_localstate_access_filter`'
+how_to_implement: To successfully implement this search, you must ingest Windows Security
+  Event logs and track event code 4663. For 4663, enable "Audit Object Access" in
+  Group Policy. Then check the two boxes listed for both "Success" and "Failure."
+known_false_positives: Uninstall chrome application may access this file and folder path to removed chrome installation in target host. Filter is needed.
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
+tags:
+  analytic_story:
+  - RedLine Stealer
+  asset_type: Endpoint
+  confidence: 50
+  impact: 50
+  message: A non-chrome process $process_name$ accessing "Chrome\\User Data\\Local State" file on $dest$  
+  mitre_attack_id:
+  - T1012
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - object_file_name
+  - object_file_path
+  - process_name
+  - process_path
+  - process_id
+  - EventCode
+  - dest
+  risk_score: 25
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/chrome_local_state_simulate_access/redline-local-state-security-xml.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml

@@ -0,0 +1,61 @@
+name: Windows Credentials from Password Stores Chrome Login Data Access
+id: 0d32ba37-80fc-4429-809c-0ba15801aeaf
+version: 1
+date: '2023-04-27'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+data_source:
+- Security Event ID 4663
+description: The following analytic identifies a non-chrome process accessing Chrome user data "login data" file. 
+  This sqlite db file stores various information related to the browser's operation on your computer. Threat actor, adversaries and malware author 
+  also abused this file to attempt to extract and decrypt password saved in chrome browser.
+  This anomaly detection can be a good pivot of analysis for suspicious process aside from chrome.exe and explorer.exe executable.
+search: '`wineventlog_security` EventCode=4663 object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
+  AND NOT (process_path IN ("*:\\Windows\\explorer.exe", "*:\\Windows\\System32\\dllhost.exe", "*\\chrome.exe"))       
+  | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path  process_id EventCode dest
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `windows_credentials_from_password_stores_chrome_login_data_access_filter`'
+how_to_implement: To successfully implement this search, you must ingest Windows Security
+  Event logs and track event code 4663. For 4663, enable "Audit Object Access" in
+  Group Policy. Then check the two boxes listed for both "Success" and "Failure."
+known_false_positives: Uninstall application may access this registry to remove the entry of the target application. filter is needed.
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
+tags:
+  analytic_story:
+  - RedLine Stealer
+  asset_type: Endpoint
+  confidence: 70
+  impact: 70
+  message: A non-chrome process $process_name$ accessing Chrome "Login Data" file on $dest$  
+  mitre_attack_id:
+  - T1012
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - object_file_name
+  - object_file_path
+  - process_name
+  - process_path
+  - process_id
+  - EventCode
+  - dest
+  risk_score: 49
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/chrome_login_data_simulate_access/redline-login-data-security-xml.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog
+

detections/endpoint/windows_query_registry_browser_list_application.yml

@@ -0,0 +1,61 @@
+name: Windows Query Registry Browser List Application
+id: 45ebd21c-f4bf-4ced-bd49-d25b6526cebb
+version: 1
+date: '2023-04-25'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+data_source:
+- Security Event ID 4663
+description: The following analytic identifies a suspicious process accessing default internet browsers registry entry. 
+  This registry is used by Windows to store information about default internet browsers installed on a system. 
+  Malware, adversaries or red-teamers can abuse this registry key to collect data about the installed internet browsers and their associated settings.
+  This information can be used to steal sensitive data such as login credentials, browsing history, and saved passwords.
+  We observed noise that needs to be filter out so we add several known path of Windows Application to make this detection more stable.
+search: '`wineventlog_security` EventCode=4663 object_file_path IN ("*\\SOFTWARE\\Clients\\StartMenuInternet\\*", "*\\SOFTWARE\\Clients\\StartMenuInternet\\*")
+  AND NOT (process_path IN ("*:\\Windows\\System32\\*", "*:\\Windows\\SysWow64\\*", "*:\\Program Files*", "*:\\Windows\\*"))       
+  | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path  process_id EventCode dest
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_query_registry_browser_list_application_filter`'
+how_to_implement: To successfully implement this search, you must ingest Windows Security
+  Event logs and track event code 4663. For 4663, enable "Audit Object Access" in
+  Group Policy. Then check the two boxes listed for both "Success" and "Failure."
+known_false_positives: uninstall application may access this registry to remove the entry of the target application. filter is needed.
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
+tags:
+  analytic_story:
+  - RedLine Stealer
+  asset_type: Endpoint
+  confidence: 50
+  impact: 50
+  message: A suspicious process accessing installed default browser registry on $dest$  
+  mitre_attack_id:
+  - T1012
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - object_file_name
+  - object_file_path
+  - process_name
+  - process_path
+  - process_id
+  - EventCode
+  - dest
+  risk_score: 25
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/browser_list/ar3_4663_redline_reg.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

detections/endpoint/windows_query_registry_uninstall_program_list.yml

@@ -0,0 +1,59 @@
+name: Windows Query Registry UnInstall Program List
+id: 535fd4fc-7151-4062-9d7e-e896bea77bf6
+version: 1
+date: '2023-04-25'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+data_source:
+- Security Event ID 4663
+description: The following analytic identifies a suspicious query on uninstall application list in Windows OS registry. 
+  This registry  is commonly used by legitimate software to store information about installed applications on a Windows system, such as their name, version, publisher, and installation path.
+  However, malware, adversaries or even red-teamers can abuse this registry key to retrieve information stored in the "Uninstall" key to gather data about installed applications in the target host.
+  This Anomaly detection can be a good pivot to detect a possible suspicious process accessing this registry which is not commonly accessed by a normal user.
+search: '`wineventlog_security` EventCode=4663 object_file_path="\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*" 
+  | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path  process_id EventCode dest
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `windows_query_registry_uninstall_program_list_filter`'
+how_to_implement: To successfully implement this search, you must ingest Windows Security
+  Event logs and track event code 4663. For 4663, enable "Audit Object Access" in
+  Group Policy. Then check the two boxes listed for both "Success" and "Failure."
+known_false_positives: Uninstall application may access this registry to remove the entry of the target application. Filter is needed.
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
+tags:
+  analytic_story:
+  - RedLine Stealer
+  asset_type: Endpoint
+  confidence: 50
+  impact: 50
+  message: A suspicious process $process_name$ accessing uninstall registry on $dest$  
+  mitre_attack_id:
+  - T1012
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - object_file_name
+  - object_file_path
+  - process_name
+  - process_path
+  - process_id
+  - EventCode
+  - dest
+  risk_score: 25
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/recon_registry/recon-reg-redline-security-xml.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

detections/endpoint/windows_service_stop_win_updates.yml

@@ -0,0 +1,63 @@
+name: Windows Service Stop Win Updates
+id: 0dc25c24-6fcf-456f-b08b-dd55a183e4de
+version: 1
+date: '2023-04-21'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+data_source:
+- System Event ID 7040
+description: The following analytic identifies a windows update service being disabled in Windows OS. 
+  This technique is being abused by adversaries or threat actors to add defense mechanisms to their malware implant in the targeted host. 
+  Disabling windows update will put the compromised host vulnerable in some zero day exploit or even some update features against threats. 
+  RedLine Stealer kills this service as part of its defense evasion mechanism.
+search: '`wineventlog_system` EventCode=7040 
+  (service_name IN ("Update Orchestrator Service for Windows Update", "WaaSMedicSvc", "Windows Update") OR param1 IN ("UsoSvc", "WaaSMedicSvc", "wuauserv")) AND 
+  (param3=disabled OR start_mode = disabled) 
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer Error_Code service_name start_mode param1 param2 param3 param4 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_service_stop_win_updates_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the Service name, Service File Name Service Start type, and Service Type
+  from your endpoints (like Windows system.log Event ID 7040)
+known_false_positives: Network administrator may disable this services as part of its audit process within the network. Filter is needed.
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
+tags:
+  analytic_story:
+  - RedLine Stealer
+  asset_type: Endpoint
+  confidence: 70
+  impact: 70
+  message: Windows update services $service_name$ was being disabled on $dest$
+  mitre_attack_id:
+  - T1489
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Computer
+  - EventCode
+  - Error_Code 
+  - service_name 
+  - start_mode 
+  - param1 
+  - param2 
+  - param3 
+  - param4 
+  risk_score: 49
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/win_update_services_stop/system.log
+    source: XmlWinEventLog:System
+    sourcetype: XmlWinEventLog