diff --git a/detections/endpoint/detect_rtlo_in_file_name.yml b/detections/endpoint/detect_rtlo_in_file_name.yml new file mode 100644 index 0000000000..0ef981be91 --- /dev/null +++ b/detections/endpoint/detect_rtlo_in_file_name.yml @@ -0,0 +1,77 @@ +name: Detect RTLO In File Name +id: 468b7e11-d362-43b8-b6ec-7a2d3b246678 +version: 2 +date: '2023-04-26' +author: Steven Dick +status: production +type: TTP +description: This search is used to detect the abuse of the right-to-left override (RTLO or RLO) + character (U+202E) RTLO. This technique is used by adversaries to disguise a string and/or + file name to make it appear benign. The RTLO character is a non-printing Unicode + character that causes the text that follows it to be displayed in reverse. +data_source: +- Sysmon Event ID 11 +- Sysmon Event ID 23 +- Sysmon Event ID 26 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.file_create_time) as file_create_time from datamodel=Endpoint.Filesystem where Filesystem.file_name!=unknown by Filesystem.dest Filesystem.user Filesystem.process_id Filesystem.file_name Filesystem.file_path +| `drop_dm_object_name(Filesystem)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| regex file_name = "\\x{202E}" +| rex field=file_name "(?.+)(?\\x{202E})(?.+)" +| eval file_name_with_RTLO=file_name +| eval file_name=RTLO_file_1.RTLO_file_2 +| fields - RTLO* +| `detect_rtlo_in_file_name_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that includes the full command line of the process being launched on + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Implementation in regions that use right to left in native language. +references: +- https://attack.mitre.org/techniques/T1036/002/ +- https://resources.infosecinstitute.com/topic/spoof-using-right-to-left-override-rtlo-technique-2/ +- https://www.trendmicro.com/en_us/research/17/f/following-trail-blacktech-cyber-espionage-campaigns.html +tags: + analytic_story: + - Spearphishing Attachments + asset_type: Endpoint + confidence: 80 + impact: 50 + message: Suspicious RTLO detected in $file_name$ on endpoint $dest$ by user $user$. + mitre_attack_id: + - T1036.002 + - T1036 + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Endpoint + role: + - Victim + - name: file_name + type: File Name + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.dest + - Filesystem.user + - Filesystem.file_name + - Filesystem.file_path + - Filesystem.process_id + risk_score: 40 + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.002/outlook_attachment/rtlo_events.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/detect_rtlo_in_process.yml b/detections/endpoint/detect_rtlo_in_process.yml new file mode 100644 index 0000000000..2975dade93 --- /dev/null +++ b/detections/endpoint/detect_rtlo_in_process.yml @@ -0,0 +1,83 @@ +name: Detect RTLO In Process +id: 22ac27b4-7189-4a4f-9375-b9017c9620d7 +version: 2 +date: '2023-04-26' +author: Steven Dick +status: production +type: TTP +description: This search is used to detect the abuse of the right-to-left override (RTLO or RLO) + character (U+202E) RTLO. This technique is used by adversaries to disguise a string and/or + file name to make it appear benign. The RTLO character is a non-printing Unicode + character that causes the text that follows it to be displayed in reverse. +data_source: +- Sysmon Event ID 1 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from +datamodel=Endpoint.Processes where Processes.process!=unknown AND Processes.action=allowed by Processes.dest +Processes.user Processes.original_file_name Processes.parent_process_name Processes.parent_process Processes.process_name +Processes.process Processes.process_id Processes.process_guid Processes.parent_process_id +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `drop_dm_object_name(Processes)` +| regex process="\\x{202E}" +| rex field=process "(?.+)(?\\x{202E})(?.+)" +| eval process_with_RTLO=process +| eval process=RTLO_command_1.RTLO_command_2 +| fields - RTLO* +| `detect_rtlo_in_process_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that includes the full command line of the process being launched on + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Implementation in regions that use right to left in native language. +references: +- https://attack.mitre.org/techniques/T1036/002/ +- https://resources.infosecinstitute.com/topic/spoof-using-right-to-left-override-rtlo-technique-2/ +- https://www.trendmicro.com/en_us/research/17/f/following-trail-blacktech-cyber-espionage-campaigns.html +tags: + analytic_story: + - Spearphishing Attachments + asset_type: Endpoint + confidence: 80 + impact: 50 + message: Suspicious RTLO detected in $process_name$ on endpoint $dest$ by user $user$. + mitre_attack_id: + - T1036.002 + - T1036 + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Endpoint + role: + - Victim + - name: process_name + type: Process Name + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.process_guid + - Processes.parent_process_id + - Processes.parent_process_name + - Processes.parent_process + risk_score: 40 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.002/outlook_attachment/rtlo_events.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog