From 54edf6575aabb33b06ec21a8f0ef6bf556d09a7b Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 1 May 2023 13:30:29 -0700 Subject: [PATCH 1/7] new detections --- .../endpoint/detect_rtlo_in_file_name.yml | 77 +++++++++++++++++ .../endpoint/detect_rtlo_in_process.yml | 83 +++++++++++++++++++ 2 files changed, 160 insertions(+) create mode 100644 detections/endpoint/detect_rtlo_in_file_name.yml create mode 100644 detections/endpoint/detect_rtlo_in_process.yml diff --git a/detections/endpoint/detect_rtlo_in_file_name.yml b/detections/endpoint/detect_rtlo_in_file_name.yml new file mode 100644 index 0000000000..1d7ee59660 --- /dev/null +++ b/detections/endpoint/detect_rtlo_in_file_name.yml @@ -0,0 +1,77 @@ +name: Detect RTLO In File Name +id: 468b7e11-d362-43b8-b6ec-7a2d3b246678 +version: 2 +date: '2023-04-26' +author: Steven Dick +status: production +type: TTP +description: This search is used to detect the abuse of the right-to-left override (RTLO or RLO) + character (U+202E) RTLO. This technique is used by adversaries to disguise a string and/or + file name to make it appear benign. The RTLO character is a non-printing Unicode + character that causes the text that follows it to be displayed in reverse. +data_source: +- Sysmon 11 +- Sysmon 23 +- Sysmon 26 +search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.file_create_time) as file_create_time from datamodel=Endpoint.Filesystem where Filesystem.file_name!=unknown by Filesystem.dest Filesystem.user Filesystem.process_id Filesystem.file_name Filesystem.file_path +| `drop_dm_object_name(Filesystem)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| regex file_name = '\\x{202E}' +| rex field=file_name '(?.+)(?\\x{202E})(?.+)' +| eval file_name_with_RTLO=file_name +| eval file_name=RTLO_file_1.RTLO_file_2 +| fields - RTLO* +| `detect_RTLO_in_file_filter`" +how_to_implement: To successfully implement this search you need to be ingesting information + on process that includes the full command line of the process being launched on + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Implementation in regions that use right to left in native language. +references: +- https://attack.mitre.org/techniques/T1036/002/ +- https://resources.infosecinstitute.com/topic/spoof-using-right-to-left-override-rtlo-technique-2/ +- https://www.trendmicro.com/en_us/research/17/f/following-trail-blacktech-cyber-espionage-campaigns.html +tags: + analytic_story: + - Spearphishing Attachments + asset_type: Endpoint + confidence: 80 + impact: 50 + message: Suspicious RTLO detected in $file_name$ on endpoint $dest$ by user $user$. + mitre_attack_id: + - T1036.002 + - T1036 + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Endpoint + role: + - Victim + - name: file_name + type: File Name + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.dest + - Filesystem.user + - Filesystem.file_name + - Filesystem.file_path + - Filesystem.process_id + risk_score: 40 + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.002/outlook_attachment/rtlo_events.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/endpoint/detect_rtlo_in_process.yml b/detections/endpoint/detect_rtlo_in_process.yml new file mode 100644 index 0000000000..b7acd9497e --- /dev/null +++ b/detections/endpoint/detect_rtlo_in_process.yml @@ -0,0 +1,83 @@ +name: Detect RTLO In Process +id: 22ac27b4-7189-4a4f-9375-b9017c9620d7 +version: 2 +date: '2023-04-26' +author: Steven Dick +status: production +type: TTP +description: This search is used to detect the abuse of the right-to-left override (RTLO or RLO) + character (U+202E) RTLO. This technique is used by adversaries to disguise a string and/or + file name to make it appear benign. The RTLO character is a non-printing Unicode + character that causes the text that follows it to be displayed in reverse. +data_source: +- Sysmon 1 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from +datamodel=Endpoint.Processes where Processes.process!=unknown AND Processes.action=allowed by Processes.dest +Processes.user Processes.original_file_name Processes.parent_process_name Processes.parent_process Processes.process_name +Processes.process Processes.process_id Processes.process_guid Processes.parent_process_id +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `drop_dm_object_name(Processes)` +| regex process="\\x{202E}" +| rex field=process "(?.+)(?\\x{202E})(?.+)" +| eval process_with_RTLO=process +| eval process=RTLO_command_1.RTLO_command_2 +| fields - RTLO* +| `detect_RTLO_in_process_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that includes the full command line of the process being launched on + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Implementation in regions that use right to left in native language. +references: +- https://attack.mitre.org/techniques/T1036/002/ +- https://resources.infosecinstitute.com/topic/spoof-using-right-to-left-override-rtlo-technique-2/ +- https://www.trendmicro.com/en_us/research/17/f/following-trail-blacktech-cyber-espionage-campaigns.html +tags: + analytic_story: + - Spearphishing Attachments + asset_type: Endpoint + confidence: 80 + impact: 50 + message: Suspicious RTLO detected in $process_name$ on endpoint $dest$ by user $user$. + mitre_attack_id: + - T1036.002 + - T1036 + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Endpoint + role: + - Victim + - name: process_name + type: Process Name + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.process_guid + - Processes.parent_process_id + - Processes.parent_process_name + - Processes.parent_process + risk_score: 40 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.002/outlook_attachment/rtlo_events.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From e71b78f22ca7b83e9dc4f9a7cca917f274177e1d Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Fri, 26 May 2023 14:25:21 -0700 Subject: [PATCH 2/7] macrosupdate --- detections/endpoint/detect_rtlo_in_file_name.yml | 2 +- detections/endpoint/detect_rtlo_in_process.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/detect_rtlo_in_file_name.yml b/detections/endpoint/detect_rtlo_in_file_name.yml index 1d7ee59660..bb7b0dbfcb 100644 --- a/detections/endpoint/detect_rtlo_in_file_name.yml +++ b/detections/endpoint/detect_rtlo_in_file_name.yml @@ -22,7 +22,7 @@ search: "| tstats `security_content_summariesonly` count min(_time) as firstTime | eval file_name_with_RTLO=file_name | eval file_name=RTLO_file_1.RTLO_file_2 | fields - RTLO* -| `detect_RTLO_in_file_filter`" +| `detect_rtlo_in_file_filter`" how_to_implement: To successfully implement this search you need to be ingesting information on process that includes the full command line of the process being launched on your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/detections/endpoint/detect_rtlo_in_process.yml b/detections/endpoint/detect_rtlo_in_process.yml index b7acd9497e..9bfda0d9c6 100644 --- a/detections/endpoint/detect_rtlo_in_process.yml +++ b/detections/endpoint/detect_rtlo_in_process.yml @@ -23,7 +23,7 @@ Processes.process Processes.process_id Processes.process_guid Processes.parent_p | eval process_with_RTLO=process | eval process=RTLO_command_1.RTLO_command_2 | fields - RTLO* -| `detect_RTLO_in_process_filter`' +| `detect_rtlo_in_process_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that includes the full command line of the process being launched on your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, From 2a217a7c0a4a3e3ae9d32dcbf9fbe69f2878cfdd Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 12 Jun 2023 10:55:39 -0700 Subject: [PATCH 3/7] Update detect_rtlo_in_file_name.yml --- detections/endpoint/detect_rtlo_in_file_name.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/detect_rtlo_in_file_name.yml b/detections/endpoint/detect_rtlo_in_file_name.yml index bb7b0dbfcb..29cf7930d6 100644 --- a/detections/endpoint/detect_rtlo_in_file_name.yml +++ b/detections/endpoint/detect_rtlo_in_file_name.yml @@ -22,7 +22,7 @@ search: "| tstats `security_content_summariesonly` count min(_time) as firstTime | eval file_name_with_RTLO=file_name | eval file_name=RTLO_file_1.RTLO_file_2 | fields - RTLO* -| `detect_rtlo_in_file_filter`" +| `detect_rtlo_in_file_name_filter`" how_to_implement: To successfully implement this search you need to be ingesting information on process that includes the full command line of the process being launched on your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -74,4 +74,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.002/outlook_attachment/rtlo_events.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog \ No newline at end of file + sourcetype: xmlwineventlog From af3fe52811465452c8c24d83c473a4a257c06058 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 12 Jun 2023 10:57:39 -0700 Subject: [PATCH 4/7] Update detect_rtlo_in_file_name.yml --- detections/endpoint/detect_rtlo_in_file_name.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/detect_rtlo_in_file_name.yml b/detections/endpoint/detect_rtlo_in_file_name.yml index 29cf7930d6..755a3c81f9 100644 --- a/detections/endpoint/detect_rtlo_in_file_name.yml +++ b/detections/endpoint/detect_rtlo_in_file_name.yml @@ -10,9 +10,9 @@ description: This search is used to detect the abuse of the right-to-left overri file name to make it appear benign. The RTLO character is a non-printing Unicode character that causes the text that follows it to be displayed in reverse. data_source: -- Sysmon 11 -- Sysmon 23 -- Sysmon 26 +- Sysmon Event ID 11 +- Sysmon Event ID 23 +- Sysmon Event ID 26 search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.file_create_time) as file_create_time from datamodel=Endpoint.Filesystem where Filesystem.file_name!=unknown by Filesystem.dest Filesystem.user Filesystem.process_id Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` From 4c2f54a0dc55b0f6a2ea1cf22c6ace2e7cbbb19e Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 12 Jun 2023 10:58:03 -0700 Subject: [PATCH 5/7] Update detect_rtlo_in_process.yml --- detections/endpoint/detect_rtlo_in_process.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/detect_rtlo_in_process.yml b/detections/endpoint/detect_rtlo_in_process.yml index 9bfda0d9c6..2975dade93 100644 --- a/detections/endpoint/detect_rtlo_in_process.yml +++ b/detections/endpoint/detect_rtlo_in_process.yml @@ -10,7 +10,7 @@ description: This search is used to detect the abuse of the right-to-left overri file name to make it appear benign. The RTLO character is a non-printing Unicode character that causes the text that follows it to be displayed in reverse. data_source: -- Sysmon 1 +- Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process!=unknown AND Processes.action=allowed by Processes.dest Processes.user Processes.original_file_name Processes.parent_process_name Processes.parent_process Processes.process_name @@ -80,4 +80,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.002/outlook_attachment/rtlo_events.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog \ No newline at end of file + sourcetype: xmlwineventlog From 9e31186154cbcab119e0643cbe6d91122574baad Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 12 Jun 2023 14:06:53 -0700 Subject: [PATCH 6/7] Update detect_rtlo_in_file_name.yml double quotes --- detections/endpoint/detect_rtlo_in_file_name.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/detect_rtlo_in_file_name.yml b/detections/endpoint/detect_rtlo_in_file_name.yml index 755a3c81f9..b85c4cc4b2 100644 --- a/detections/endpoint/detect_rtlo_in_file_name.yml +++ b/detections/endpoint/detect_rtlo_in_file_name.yml @@ -17,8 +17,8 @@ search: "| tstats `security_content_summariesonly` count min(_time) as firstTime | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` -| regex file_name = '\\x{202E}' -| rex field=file_name '(?.+)(?\\x{202E})(?.+)' +| regex file_name = "\\x{202E}" +| rex field=file_name "(?.+)(?\\x{202E})(?.+)" | eval file_name_with_RTLO=file_name | eval file_name=RTLO_file_1.RTLO_file_2 | fields - RTLO* From 21bd725eaa48de6d3399dcb371fd666b1cac50b6 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 12 Jun 2023 14:23:18 -0700 Subject: [PATCH 7/7] yaml fix --- detections/endpoint/detect_rtlo_in_file_name.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/detect_rtlo_in_file_name.yml b/detections/endpoint/detect_rtlo_in_file_name.yml index b85c4cc4b2..0ef981be91 100644 --- a/detections/endpoint/detect_rtlo_in_file_name.yml +++ b/detections/endpoint/detect_rtlo_in_file_name.yml @@ -13,7 +13,7 @@ data_source: - Sysmon Event ID 11 - Sysmon Event ID 23 - Sysmon Event ID 26 -search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.file_create_time) as file_create_time from datamodel=Endpoint.Filesystem where Filesystem.file_name!=unknown by Filesystem.dest Filesystem.user Filesystem.process_id Filesystem.file_name Filesystem.file_path +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.file_create_time) as file_create_time from datamodel=Endpoint.Filesystem where Filesystem.file_name!=unknown by Filesystem.dest Filesystem.user Filesystem.process_id Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -22,7 +22,7 @@ search: "| tstats `security_content_summariesonly` count min(_time) as firstTime | eval file_name_with_RTLO=file_name | eval file_name=RTLO_file_1.RTLO_file_2 | fields - RTLO* -| `detect_rtlo_in_file_name_filter`" +| `detect_rtlo_in_file_name_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that includes the full command line of the process being launched on your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,