Branch was auto-updated.

detections/endpoint/powershell_creating_thread_mutex.yml

@@ -0,0 +1,43 @@
+name: Powershell Creating Thread Mutex
+id: 637557ec-ca08-11eb-bd0a-acde48001122
+version: 1
+date: '2021-06-10'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to detect suspicious powershell script that using mutex
+  function. This function is commonly seen in some obfuscated powershell script to
+  make sure that only one instance of there process is running to a compromise machine
+  which is also a good indicator to check why powershell script is using it.
+search: '`powershell` EventCode=4104 Message = "*Threading.Mutex*" | stats count min(_time)
+  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `powershell_creating_thread_mutex_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the powershell logs  from your endpoints. make sure you enable needed
+  registry to monitor this event.
+known_false_positives: powershell developer may used this function in their script
+  for instance checking too.
+references:
+- https://isc.sans.edu/forums/diary/Some+Powershell+Malicious+Code/22988/
+tags:
+  analytic_story:
+  - Malicious PowerShell
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1027.005
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log

detections/endpoint/powershell_processing_stream_of_data.yml

@@ -0,0 +1,44 @@
+name: Powershell Processing Stream Of Data
+id: 0d718b52-c9f1-11eb-bc61-acde48001122
+version: 1
+date: '2021-06-10'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: this search is to detect suspicious powershell that processing compressed
+  stream data. This technique was seen in obfuscated powershell or powershell with
+  embedded .net or binary files that are stream flated and will be deflated during
+  execution.
+search: '`powershell` EventCode=4104 Message = "*IO.Compression.*" OR Message = "*IO.StreamReader*"
+  OR Message = "*]::Decompress*" | stats count min(_time) as firstTime max(_time)
+  as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `powershell_processing_stream_of_data_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the powershell logs  from your endpoints. make sure you enable needed
+  registry to monitor this event.
+known_false_positives: powershell may used this function to process compressed data.
+references:
+- https://medium.com/@ahmedjouini99/deobfuscating-emotets-powershell-payload-e39fb116f7b9
+tags:
+  analytic_story:
+  - Malicious PowerShell
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1059.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  - Score
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log

detections/endpoint/powershell_using_memory_as_backing_store.yml

@@ -0,0 +1,44 @@
+name: Powershell Using memory As Backing Store
+id: c396a0c4-c9f2-11eb-b4f5-acde48001122
+version: 1
+date: '2021-06-10'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: this search is to detect suspicious powershell script that using memory
+  stream as new object backstore. This technique is commonly seen in malicious powershell
+  contain a stream flate data and will be decompressed in memory to run or drop the
+  actual payload to the compromise machine.
+search: '`powershell` EventCode=4104 Message = "*New-Object IO.MemoryStream*" | stats
+  count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName
+  User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `powershell_using_memory_as_backing_store_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the powershell logs  from your endpoints. make sure you enable needed
+  registry to monitor this event.
+known_false_positives: powershell may used this function to store out object into
+  memory.
+references:
+- https://www.carbonblack.com/blog/decoding-malicious-powershell-streams/
+tags:
+  analytic_story:
+  - Malicious PowerShell
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1140
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log

detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml

@@ -0,0 +1,43 @@
+name: Recon AVProduct Through Pwh or WMI
+id: 28077620-c9f6-11eb-8785-acde48001122
+version: 1
+date: '2021-06-10'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to detect a powershell script that do a recon or checking
+  to the av product install on the machine. This technique is commonly seen in APT
+  or malware like ransomware to list all security product and disable it.
+search: '`powershell` EventCode=4104 Message = "*SELECT*" AND (Message = "*AntiVirusProduct*"
+  OR Message = "*AntiSpywareProduct*") | stats count min(_time) as firstTime max(_time)
+  as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `recon_avproduct_through_pwh_or_wmi_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the powershell logs from your endpoints. make sure you enable needed registry
+  to monitor this event.
+known_false_positives: network administrator may used this command for checking purposes
+references:
+- https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/
+tags:
+  analytic_story:
+  - Ransomware
+  - Malicious PowerShell
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1592
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log

detections/endpoint/recon_using__wmi_class.yml

@@ -0,0 +1,44 @@
+name: Recon Using  WMI Class
+id: 018c1972-ca07-11eb-9473-acde48001122
+version: 1
+date: '2021-06-10'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to detect a powershell script that do a recon to the targetted
+  or compromised machine. This technique is common nowadays to know the running process,
+  services
+search: '`powershell` EventCode=4104 (Message= "*SELECT*" OR Message= "*Get-WmiObject*")
+  AND (Message= "*Win32_Bios*" OR Message= "*Win32_OperatingSystem*" OR Message= "*Win32_Processor*"
+  OR Message= "*Win32_ComputerSystem*" OR Message= "*Win32_ComputerSystemProduct*"
+  OR Message= "*Win32_ShadowCopy*") | stats count min(_time) as firstTime max(_time)
+  as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `recon_using__wmi_class_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the powershell logs from your endpoints. make sure you enable needed registry
+  to monitor this event.
+known_false_positives: network administrator may used this command for checking purposes
+references:
+- https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/
+tags:
+  analytic_story:
+  - Malicious PowerShell
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1592
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log

detections/endpoint/wmi_recon_running_process_or_services.yml

@@ -0,0 +1,43 @@
+name: WMI Recon Running Process Or Services
+id: b5cd5526-cce7-11eb-b3bd-acde48001122
+version: 1
+date: '2021-06-14'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This seearch is to detect a suspicious powershell/wmi query to recon
+  running process and running services. This technique is commonly seen in malware
+  and apt attack to mapped all running security application or services on the compromised
+  machine.
+search: '`powershell` EventCode=4104 Message= "*SELECT*" AND (Message="*Win32_Process*"
+  OR Message="*Win32_Service*") | stats count min(_time) as firstTime max(_time) as
+  lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `wmi_recon_running_process_or_services_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the powershell logs from your endpoints. make sure you enable needed registry
+  to monitor this event.
+known_false_positives: network administrator may used this command for checking purposes
+references:
+- https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/
+tags:
+  analytic_story:
+  - Malicious PowerShell
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1592
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log

tests/endpoint/powershell_creating_thread_mutex.test.yml

@@ -0,0 +1,12 @@
+name: Powershell Creating Thread Mutex Unit Test
+tests:
+- name: Powershell Creating Thread Mutex
+  file: endpoint/powershell_creating_thread_mutex.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog

tests/endpoint/powershell_processing_stream_of_data.test.yml

@@ -0,0 +1,12 @@
+name: Powershell Processing Stream Of Data Unit Test
+tests:
+- name: Powershell Processing Stream Of Data
+  file: endpoint/powershell_processing_stream_of_data.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog

tests/endpoint/powershell_using_memory_as_backing_store.test.yml

@@ -0,0 +1,12 @@
+name: Powershell Using memory As Backing Store Unit Test
+tests:
+- name: Powershell Using memory As Backing Store
+  file: endpoint/powershell_using_memory_as_backing_store.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog

tests/endpoint/recon_avproduct_through_pwh_or_wmi.test.yml

@@ -0,0 +1,12 @@
+name: Recon AVProduct Through Pwh or WMI Unit Test
+tests:
+- name: Recon AVProduct Through Pwh or WMI
+  file: endpoint/recon_avproduct_through_pwh_or_wmi.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog

tests/endpoint/recon_using__wmi_class.test.yml

@@ -0,0 +1,12 @@
+name: Recon Using  WMI Class Unit Test
+tests:
+- name: Recon Using  WMI Class
+  file: endpoint/recon_using__wmi_class.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog

tests/endpoint/wmi_recon_running_process_or_services.test.yml

@@ -0,0 +1,12 @@
+name: WMI Recon Running Process Or Services Unit Test
+tests:
+- name: WMI Recon Running Process Or Services
+  file: endpoint/wmi_recon_running_process_or_services.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog