diff --git a/detections/endpoint/powershell_creating_thread_mutex.yml b/detections/endpoint/powershell_creating_thread_mutex.yml new file mode 100644 index 0000000000..00657f2276 --- /dev/null +++ b/detections/endpoint/powershell_creating_thread_mutex.yml @@ -0,0 +1,43 @@ +name: Powershell Creating Thread Mutex +id: 637557ec-ca08-11eb-bd0a-acde48001122 +version: 1 +date: '2021-06-10' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect suspicious powershell script that using mutex + function. This function is commonly seen in some obfuscated powershell script to + make sure that only one instance of there process is running to a compromise machine + which is also a good indicator to check why powershell script is using it. +search: '`powershell` EventCode=4104 Message = "*Threading.Mutex*" | stats count min(_time) + as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `powershell_creating_thread_mutex_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the powershell logs from your endpoints. make sure you enable needed + registry to monitor this event. +known_false_positives: powershell developer may used this function in their script + for instance checking too. +references: +- https://isc.sans.edu/forums/diary/Some+Powershell+Malicious+Code/22988/ +tags: + analytic_story: + - Malicious PowerShell + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1027.005 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml new file mode 100644 index 0000000000..8a5d4c1f61 --- /dev/null +++ b/detections/endpoint/powershell_processing_stream_of_data.yml @@ -0,0 +1,44 @@ +name: Powershell Processing Stream Of Data +id: 0d718b52-c9f1-11eb-bc61-acde48001122 +version: 1 +date: '2021-06-10' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is to detect suspicious powershell that processing compressed + stream data. This technique was seen in obfuscated powershell or powershell with + embedded .net or binary files that are stream flated and will be deflated during + execution. +search: '`powershell` EventCode=4104 Message = "*IO.Compression.*" OR Message = "*IO.StreamReader*" + OR Message = "*]::Decompress*" | stats count min(_time) as firstTime max(_time) + as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `powershell_processing_stream_of_data_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the powershell logs from your endpoints. make sure you enable needed + registry to monitor this event. +known_false_positives: powershell may used this function to process compressed data. +references: +- https://medium.com/@ahmedjouini99/deobfuscating-emotets-powershell-payload-e39fb116f7b9 +tags: + analytic_story: + - Malicious PowerShell + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1059.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + - Score + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log diff --git a/detections/endpoint/powershell_using_memory_as_backing_store.yml b/detections/endpoint/powershell_using_memory_as_backing_store.yml new file mode 100644 index 0000000000..32678956f5 --- /dev/null +++ b/detections/endpoint/powershell_using_memory_as_backing_store.yml @@ -0,0 +1,44 @@ +name: Powershell Using memory As Backing Store +id: c396a0c4-c9f2-11eb-b4f5-acde48001122 +version: 1 +date: '2021-06-10' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is to detect suspicious powershell script that using memory + stream as new object backstore. This technique is commonly seen in malicious powershell + contain a stream flate data and will be decompressed in memory to run or drop the + actual payload to the compromise machine. +search: '`powershell` EventCode=4104 Message = "*New-Object IO.MemoryStream*" | stats + count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName + User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `powershell_using_memory_as_backing_store_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the powershell logs from your endpoints. make sure you enable needed + registry to monitor this event. +known_false_positives: powershell may used this function to store out object into + memory. +references: +- https://www.carbonblack.com/blog/decoding-malicious-powershell-streams/ +tags: + analytic_story: + - Malicious PowerShell + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1140 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml new file mode 100644 index 0000000000..843a8a7465 --- /dev/null +++ b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml @@ -0,0 +1,43 @@ +name: Recon AVProduct Through Pwh or WMI +id: 28077620-c9f6-11eb-8785-acde48001122 +version: 1 +date: '2021-06-10' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a powershell script that do a recon or checking + to the av product install on the machine. This technique is commonly seen in APT + or malware like ransomware to list all security product and disable it. +search: '`powershell` EventCode=4104 Message = "*SELECT*" AND (Message = "*AntiVirusProduct*" + OR Message = "*AntiSpywareProduct*") | stats count min(_time) as firstTime max(_time) + as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `recon_avproduct_through_pwh_or_wmi_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the powershell logs from your endpoints. make sure you enable needed registry + to monitor this event. +known_false_positives: network administrator may used this command for checking purposes +references: +- https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/ +tags: + analytic_story: + - Ransomware + - Malicious PowerShell + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1592 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log diff --git a/detections/endpoint/recon_using__wmi_class.yml b/detections/endpoint/recon_using__wmi_class.yml new file mode 100644 index 0000000000..7d46974ce0 --- /dev/null +++ b/detections/endpoint/recon_using__wmi_class.yml @@ -0,0 +1,44 @@ +name: Recon Using WMI Class +id: 018c1972-ca07-11eb-9473-acde48001122 +version: 1 +date: '2021-06-10' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a powershell script that do a recon to the targetted + or compromised machine. This technique is common nowadays to know the running process, + services +search: '`powershell` EventCode=4104 (Message= "*SELECT*" OR Message= "*Get-WmiObject*") + AND (Message= "*Win32_Bios*" OR Message= "*Win32_OperatingSystem*" OR Message= "*Win32_Processor*" + OR Message= "*Win32_ComputerSystem*" OR Message= "*Win32_ComputerSystemProduct*" + OR Message= "*Win32_ShadowCopy*") | stats count min(_time) as firstTime max(_time) + as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `recon_using__wmi_class_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the powershell logs from your endpoints. make sure you enable needed registry + to monitor this event. +known_false_positives: network administrator may used this command for checking purposes +references: +- https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/ +tags: + analytic_story: + - Malicious PowerShell + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1592 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log diff --git a/detections/endpoint/wmi_recon_running_process_or_services.yml b/detections/endpoint/wmi_recon_running_process_or_services.yml new file mode 100644 index 0000000000..6833b18e0e --- /dev/null +++ b/detections/endpoint/wmi_recon_running_process_or_services.yml @@ -0,0 +1,43 @@ +name: WMI Recon Running Process Or Services +id: b5cd5526-cce7-11eb-b3bd-acde48001122 +version: 1 +date: '2021-06-14' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This seearch is to detect a suspicious powershell/wmi query to recon + running process and running services. This technique is commonly seen in malware + and apt attack to mapped all running security application or services on the compromised + machine. +search: '`powershell` EventCode=4104 Message= "*SELECT*" AND (Message="*Win32_Process*" + OR Message="*Win32_Service*") | stats count min(_time) as firstTime max(_time) as + lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `wmi_recon_running_process_or_services_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the powershell logs from your endpoints. make sure you enable needed registry + to monitor this event. +known_false_positives: network administrator may used this command for checking purposes +references: +- https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/ +tags: + analytic_story: + - Malicious PowerShell + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1592 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log diff --git a/tests/endpoint/powershell_creating_thread_mutex.test.yml b/tests/endpoint/powershell_creating_thread_mutex.test.yml new file mode 100644 index 0000000000..c82a94f942 --- /dev/null +++ b/tests/endpoint/powershell_creating_thread_mutex.test.yml @@ -0,0 +1,12 @@ +name: Powershell Creating Thread Mutex Unit Test +tests: +- name: Powershell Creating Thread Mutex + file: endpoint/powershell_creating_thread_mutex.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/powershell_processing_stream_of_data.test.yml b/tests/endpoint/powershell_processing_stream_of_data.test.yml new file mode 100644 index 0000000000..e2450f20ba --- /dev/null +++ b/tests/endpoint/powershell_processing_stream_of_data.test.yml @@ -0,0 +1,12 @@ +name: Powershell Processing Stream Of Data Unit Test +tests: +- name: Powershell Processing Stream Of Data + file: endpoint/powershell_processing_stream_of_data.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/powershell_using_memory_as_backing_store.test.yml b/tests/endpoint/powershell_using_memory_as_backing_store.test.yml new file mode 100644 index 0000000000..ca8be846f5 --- /dev/null +++ b/tests/endpoint/powershell_using_memory_as_backing_store.test.yml @@ -0,0 +1,12 @@ +name: Powershell Using memory As Backing Store Unit Test +tests: +- name: Powershell Using memory As Backing Store + file: endpoint/powershell_using_memory_as_backing_store.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/recon_avproduct_through_pwh_or_wmi.test.yml b/tests/endpoint/recon_avproduct_through_pwh_or_wmi.test.yml new file mode 100644 index 0000000000..5a8c2518f7 --- /dev/null +++ b/tests/endpoint/recon_avproduct_through_pwh_or_wmi.test.yml @@ -0,0 +1,12 @@ +name: Recon AVProduct Through Pwh or WMI Unit Test +tests: +- name: Recon AVProduct Through Pwh or WMI + file: endpoint/recon_avproduct_through_pwh_or_wmi.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/recon_using__wmi_class.test.yml b/tests/endpoint/recon_using__wmi_class.test.yml new file mode 100644 index 0000000000..7d7aece511 --- /dev/null +++ b/tests/endpoint/recon_using__wmi_class.test.yml @@ -0,0 +1,12 @@ +name: Recon Using WMI Class Unit Test +tests: +- name: Recon Using WMI Class + file: endpoint/recon_using__wmi_class.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/wmi_recon_running_process_or_services.test.yml b/tests/endpoint/wmi_recon_running_process_or_services.test.yml new file mode 100644 index 0000000000..aa512d8ef1 --- /dev/null +++ b/tests/endpoint/wmi_recon_running_process_or_services.test.yml @@ -0,0 +1,12 @@ +name: WMI Recon Running Process Or Services Unit Test +tests: +- name: WMI Recon Running Process Or Services + file: endpoint/wmi_recon_running_process_or_services.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file