diff --git a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml new file mode 100644 index 0000000000..12b89f8652 --- /dev/null +++ b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml @@ -0,0 +1,49 @@ +name: Deny Permission using Cacls Utility +id: b76eae28-cd25-11eb-9c92-acde48001122 +version: 1 +date: '2021-06-14' +author: Teoderick Contreras, Splunk +type: streaming +datamodel: +- Endpoint +description: This analytic identifies a potential adversary that changes the security + permission of a specific file or directory. This technique is commonly seen in APT + tradecraft, ransomware or coinminer scripts. This behavior is meant to evade detection and prevent + access to their component files. +search: '| from read_ssa_enriched_events() + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), + process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), + parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) + | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)deny/)=true + AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), + ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. +known_false_positives: network administrator may use this windows utility but this is not a common practice. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - XMRig + kill_chain_phases: + - Exploitation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log + mitre_attack_id: + - T1222 + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml new file mode 100644 index 0000000000..d600f8b4fa --- /dev/null +++ b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml @@ -0,0 +1,48 @@ +name: Grant Permission Using Cacls Utility +id: c6da561a-cd29-11eb-ae65-acde48001122 +version: 1 +date: '2021-06-14' +author: Teoderick Contreras, Splunk +type: streaming +datamodel: +- Endpoint +description: This analytic identifies potential adversaries that modify the security + permission of a specific file or directory. This technique is commonly seen in APT + tradecraft, ransomware and coinminer scripts to evade detections and restrict access to their + component files. +search: '| from read_ssa_enriched_events() + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), + process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), + parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) + | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)grant/)=true + AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), + ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. +known_false_positives: network administrator may use this windows utility but this is not a common practice. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - XMRig + kill_chain_phases: + - Exploitation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log + mitre_attack_id: + - T1222 + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml new file mode 100644 index 0000000000..488ae953ff --- /dev/null +++ b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml @@ -0,0 +1,50 @@ +name: Modify ACLs Permission Of Files Or Folders +id: 9ae9a48a-cdbe-11eb-875a-acde48001122 +version: 1 +date: '2021-06-15' +author: Teoderick Contreras, Splunk +type: streaming +datamodel: +- Endpoint +description: This analytic identifies suspicious modification of ACL permission to + a files or folder to make it available to everyone or to a specific user. This technique may be used by + the adversary to evade ACLs or protected files access. This changes is commonly + configured by the file or directory owner with appropriate permission. This behavior + is a good indicator if this command seen on a machine utilized by an account with + no permission to do so. +search: '| from read_ssa_enriched_events() + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), + process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), + parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) + | where cmd_line IS NOT NULL AND like(cmd_line, "%/G%") AND (match_regex(cmd_line, /(?i)everyone:/)=true OR match_regex(cmd_line, /(?i)SYSTEM:/)=true) + AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used. +known_false_positives: network administrator may use this windows utility. filter is needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - XMRig + kill_chain_phases: + - Exploitation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log + mitre_attack_id: + - T1222 + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml new file mode 100644 index 0000000000..afc6927f78 --- /dev/null +++ b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml @@ -0,0 +1,51 @@ +name: WevtUtil Usage To Clear Logs +id: 5438113c-cdd9-11eb-93b8-acde48001122 +version: 1 +date: '2021-06-15' +author: Teoderick Contreras, Splunk +type: streaming +datamodel: +- Endpoint +description: The wevtutil.exe application is the windows event log utility. This searches + for wevtutil.exe with parameters for clearing the application, security, setup, powershell, sysmon, + or system event logs. +search: '| from read_ssa_enriched_events() + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), + process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) + | where cmd_line IS NOT NULL AND like(cmd_line, "% cl %") AND (match_regex(cmd_line, /(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true OR + match_regex(cmd_line, /(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true OR match_regex(cmd_line, /(?i)setup/)=true OR + match_regex(cmd_line, /(?i)powershell/)=true) AND process_name="wevtutil.exe" + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: You must be ingesting data that records process activity from your + hosts to populate the Endpoint data model in the Processes node. You must also be + ingesting logs with both the process name and command line from your endpoints. + The command-line arguments are mapped to the "process" field in the Endpoint data + model. +known_false_positives: The wevtutil.exe application is a legitimate Windows event + log utility. Administrators may use it to manage Windows event logs. +references: +- https://www.splunk.com/en_us/blog/security/detecting-clop-ransomware.html +tags: + analytic_story: + - Windows Log Manipulation + - Ransomware + - Clop Ransomware + kill_chain_phases: + - Exploitation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log + mitre_attack_id: + - T1070.001 + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml new file mode 100644 index 0000000000..8d8765ed13 --- /dev/null +++ b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml @@ -0,0 +1,47 @@ +name: Wevtutil Usage To Disable Logs +id: a4bdc944-cdd9-11eb-ac97-acde48001122 +version: 1 +date: '2021-06-15' +author: Teoderick Contreras, Splunk +type: streaming +datamodel: +- Endpoint +description: This search is to detect execution of wevtutil.exe to disable logs. This + technique was seen in several ransomware to disable the event logs to evade alerts + and detections in compromised host. +search: '| from read_ssa_enriched_events() + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), + process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) + | where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line, "%/e:false%") AND process_name="wevtutil.exe" + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: You must be ingesting data that records process activity from your + hosts to populate the Endpoint data model in the Processes node. You must also be + ingesting logs with both the process name and command line from your endpoints. + The command-line arguments are mapped to the "process" field in the Endpoint data + model. +known_false_positives: network operator may disable audit event logs for debugging purposes. +references: +- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/ +tags: + analytic_story: + - Windows Log Manipulation + - Ransomware + kill_chain_phases: + - Exploitation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log + mitre_attack_id: + - T1070.001 + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/ssa___deny_permission_using_cacls_utility.test.yml b/tests/endpoint/ssa___deny_permission_using_cacls_utility.test.yml new file mode 100644 index 0000000000..fec66fbbe8 --- /dev/null +++ b/tests/endpoint/ssa___deny_permission_using_cacls_utility.test.yml @@ -0,0 +1,13 @@ +name: Deny Permission using Cacls Utility Unit Test +tests: + - name: Deny Permission using Cacls Utility + file: endpoint/ssa___deny_permission_using_cacls_utility.yml + pass_condition: '@count_gt(0)' + description: Test for usage of cacls deny permission to a file(s) or folder(s) + attack_data: + - file_name: all_icalc.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log + source: WinEventLog:Security + + + \ No newline at end of file diff --git a/tests/endpoint/ssa___grant_permission_using_cacls_utility.test.yml b/tests/endpoint/ssa___grant_permission_using_cacls_utility.test.yml new file mode 100644 index 0000000000..12bb3db7cf --- /dev/null +++ b/tests/endpoint/ssa___grant_permission_using_cacls_utility.test.yml @@ -0,0 +1,10 @@ +name: Grant Permission Using Cacls Utility Unit Test +tests: + - name: Grant Permission Using Cacls Utility + file: endpoint/ssa___grant_permission_using_cacls_utility.yml + pass_condition: '@count_gt(0)' + description: Test for usage of cacls grant permission to a file(s) or folder(s) + attack_data: + - file_name: all_icalc.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log + source: WinEventLog:Security \ No newline at end of file diff --git a/tests/endpoint/ssa___modify_acls_permission_of_files_or_folders.test.yml b/tests/endpoint/ssa___modify_acls_permission_of_files_or_folders.test.yml new file mode 100644 index 0000000000..01d315285a --- /dev/null +++ b/tests/endpoint/ssa___modify_acls_permission_of_files_or_folders.test.yml @@ -0,0 +1,10 @@ +name: Modify ACLs Permission Of Files Or Folders Unit Test +tests: + - name: Modify ACLs Permission Of Files Or Folders + file: endpoint/ssa___modify_acls_permission_of_files_or_folders.yml + pass_condition: '@count_gt(0)' + description: Test for modifying permission of a file(s) or folder(s) using cacls utility. + attack_data: + - file_name: all_icalc.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log + source: WinEventLog:Security \ No newline at end of file diff --git a/tests/endpoint/ssa___wevtutil_usage_to_clear_logs.test.yml b/tests/endpoint/ssa___wevtutil_usage_to_clear_logs.test.yml new file mode 100644 index 0000000000..3d028e17a9 --- /dev/null +++ b/tests/endpoint/ssa___wevtutil_usage_to_clear_logs.test.yml @@ -0,0 +1,14 @@ +name: WevtUtil Usage To Clear Logs Unit Test +tests: + - name: WevtUtil Usage To Clear Logs + file: endpoint/ssa___wevtutil_usage_to_clear_logs.yml + pass_condition: '@count_gt(0)' + description: Test for wevtutil clear logs command + attack_data: + - file_name: clear_evt.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log + source: WinEventLog:Security + + + + diff --git a/tests/endpoint/ssa___wevtutil_usage_to_disable_logs.test.yml b/tests/endpoint/ssa___wevtutil_usage_to_disable_logs.test.yml new file mode 100644 index 0000000000..d417fd8647 --- /dev/null +++ b/tests/endpoint/ssa___wevtutil_usage_to_disable_logs.test.yml @@ -0,0 +1,10 @@ +name: Wevtutil Usage To Disable Logs Unit Test +tests: + - name: Wevtutil Usage To Disable Logs + file: endpoint/ssa___wevtutil_usage_to_disable_logs.yml + pass_condition: '@count_gt(0)' + description: Test for wevtutil disable logs command + attack_data: + - file_name: disable_evt.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log + source: WinEventLog:Security \ No newline at end of file